Menu
内网渗透高级 — 横向移动、凭据窃取、提权、持久化、隧道代理、AD攻击、ADCS滥用、Exchange/SharePoint攻击
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/Netw0rkNoob/VulnClaw --skill intranet-pentest-advancedThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Showing SKILL.md
| name | intranet-pentest-advanced |
| description | 内网渗透高级 — 横向移动、凭据窃取、提权、持久化、隧道代理、AD攻击、ADCS滥用、Exchange/SharePoint攻击 |
| routing | {"target_types":["intranet","network","host"],"phases":["post_exploitation","exploitation"],"task_types":["pentest"],"vulnerability_classes":["lateral_movement","privilege_escalation","credential_theft"],"protocols":["smb","ldap","kerberos","rdp"],"tooling":["bloodhound","impacket","crackmapexec","mimikatz","chisel","ligolo","frp"]} |
当任务从互联网评估转入主机、域或内网操作时使用本 Skill。需要已获得初始访问权限或立足点。
前置条件：如果尚未获得初始访问，先完成外网渗透获取立足点。
| 目标类型 | 首选参考 |
|---|---|
| 横向移动（PsExec/WMI/WinRM/DCOM/SSH/RDP/PTH/PTT） | references/intranet-playbook-01-lateral-movement.md |
| 规避与反检测（AMSI绕过/ETW/注入/伪装/签名二进制滥用） | references/intranet-playbook-02-evasion-and-anti-detection.md |
| 凭据窃取（Mimikatz/Kerberoasting/DCSync/浏览器Vault） | references/intranet-playbook-03-credential-theft.md |
| 提权与持久化（Token/Service/Potato/Cron/Registry/WMI） | references/intranet-playbook-04-privilege-escalation.md + 05-persistence.md |
| 隧道与代理（FRP/Chisel/Ligolo/SOCKS/SSH/DNS/ICMP） | references/intranet-playbook-06-tunneling-and-proxy.md |
| 信息收集 | references/intranet-playbook-07-information-gathering.md |
| AD 攻击（BloodHound/AS-REP/Kerberoasting/Golden/Silver） | references/intranet-playbook-08-active-directory-attacks.md |
| ADCS 攻击（ESC1-8/Certipy/Certreq） | references/intranet-playbook-09-adcs-attacks.md |
| Exchange 攻击 | references/intranet-playbook-10-exchange-attacks.md |
| SharePoint 攻击 | references/intranet-playbook-11-sharepoint-attacks.md |
references/06-intranet-and-host-operations-integrated.md — 内网操作整合参考references/intranet-playbook-01~11-*.md — 各专项 Playbook（11 个）references/intranet-pentest-playbook-skill.md — Playbook 入口OSINT 开源情报收集知识库 — 四维信息收集模型（服务器→网站→域名→人员），维度四（人员信息）条件触发
Domain routing and boundary guidance for authorized Active Directory red-team security testing, including Kerberos attacks, domain privilege escalation, lateral movement, and GPO abuse. Use when a task belongs to the AD testing domain and needs scope, evidence, pivot, or exit criteria.
Domain routing and boundary guidance for authorized API security testing, including BOLA/IDOR, authentication bypass, mass assignment, missing rate limits, and GraphQL issues. Use when a task belongs to the API testing domain and needs scope, evidence, pivot, or exit criteria.
Based on SOC occupation classification