pwned

Prompt file imported from mukul975/Threatswarm (.claude/commands/pwned.md). Fill in {{arguments}} before use. Copyright stays with the author.

Run full post-exploitation workflow on: {{arguments}}

Parse {{arguments}}: first word is TARGET, second word (optional) is SESSION_ID or access level (user/www-data/root/SYSTEM).

1. Scope Check: Verify TARGET is in scope.txt. Stop if not found.

2. Document Current Access:

   ═══════════════════════════════════════════
   POST-EXPLOITATION START
   Target:       TARGET
   Session ID:   SESSION_ID (if provided)
   Timestamp:    $(date -u +%Y-%m-%dT%H:%M:%SZ)
   ═══════════════════════════════════════════
   

3. Invoke post-ex Agent for automated privilege escalation:

   • Detect OS type (Linux vs Windows)
   • Run LinPEAS/WinPEAS automated enumeration
   • Check SUID binaries, cron, sudo, capabilities (Linux)
   • Check SeImpersonatePrivilege, unquoted paths, AlwaysInstallElevated (Windows)
   • Document escalation path with ATT&CK TTPs
   • Target evidence dir: evidence/$(date +%Y%m%d)/TARGET/post_ex/

4. Credential Harvesting: After any privilege escalation:

   • Linux: read /etc/shadow if root, find config files with credentials
   • Windows: invoke impacket-secretsdump locally, or mimikatz via Meterpreter
   • Pass any discovered hashes to password-attacks agent for cracking
   • Store: location reference only (NOT plaintext passwords)

5. Domain Check: If target appears domain-joined:

   • Check for domain membership: realm list (Linux) or systeminfo | findstr /i domain (Windows)
   • If domain-joined: invoke active-directory agent for full domain compromise path
   • Run BloodHound collection from compromised host

6. Lateral Movement Mapping:

   # SMB sweep for reachable hosts (from compromised machine)
   crackmapexec smb $INTERNAL_SUBNET/24 \
     -u $COMPROMISED_USER -H $NTLM_HASH \
     --continue-on-success 2>&1 | \
     tee evidence/$(date +%Y%m%d)/$TARGET/lateral/smb_sweep.txt

7. Update Findings: Append to evidence/$(date +%Y%m%d)/TARGET/findings.md:

   ## Post-Exploitation — $(date -u +%Y-%m-%dT%H:%M:%SZ)
   
   | Step | Method | ATT&CK | Result |
   |------|--------|--------|--------|
   | Privesc | [technique] | [TTP] | [user → root/SYSTEM] |
   | Lateral | [technique] | T1021 | [hosts reached] |

8. Print Summary:

   ═══ POST-EX RESULTS ════════════════
   Privilege Level: [user → root/SYSTEM]
   Hosts Reached:   X
   Credentials:     X hashes (see evidence/)
   Domain Admin:    [YES/NO]
   ════════════════════════════════════