pentest-exploit-chain

name	pentest-exploit-chain
description	Multi-step exploit zinciri analizi — low/medium severity bulgulari critical chain'e baglama, stealth+impact scoring advisory. Triggers on exploit chain, attack chain, chain analysis, multi-step attack, kill chain, attack path, stealth scoring, impact analysis.
license	MIT
compatibility	Works with Claude Code
allowed-tools	Read Write Edit Grep
metadata	{"author":"badi","badi-version":">=1.24.0","category":"pentest","scope":"advisory","inspired-by":"0xSteph/pentest-ai-agents exploit-chainer + attack-planner"}

pentest-exploit-chain

Tek tek dusuk-orta severity bulgulari tam compromise zincire birlestirme. Engagement zekasinin en yuksek katma degeri — yalnizca insan analizi.

Triggers

• "bulgular chain edilebilir mi"
• "kill chain ciz"
• "low + medium = critical"
• "attack path simulation"
• "stealth + impact score"

Lockheed Cyber Kill Chain (7 step)

1. Reconnaissance       — OSINT, port scan
2. Weaponization        — exploit + payload combine
3. Delivery             — phishing, drive-by, USB
4. Exploitation         — vulnerability trigger
5. Installation         — persistent foothold
6. Command & Control    — beacon
7. Actions on Objectives — data exfil, destruction, ransom

MITRE ATT&CK Tactic Chain

TA0043 Reconnaissance
  -> TA0001 Initial Access
    -> TA0002 Execution
      -> TA0003 Persistence
        -> TA0004 Privilege Escalation
          -> TA0005 Defense Evasion
            -> TA0006 Credential Access
              -> TA0007 Discovery
                -> TA0008 Lateral Movement
                  -> TA0009 Collection
                    -> TA0011 Command and Control
                      -> TA0010 Exfiltration
                        -> TA0040 Impact

Chain Analizi Methodology

1. Tum bulgulari listele (low + medium + high)
2. Her bulguya: input gereksinim, output yetki/erisim
3. Esle: bulgu A'nin output'u, bulgu B'nin input'u
4. Adimlar yolu ciz (DAG)
5. En kisa yol -> max impact
6. Her adim icin stealth puani (1-5)
7. Toplam stealth + impact -> chain rank

Stealth Scoring (1-5)

Score	Tip	Detection Likelihood
1	Loud	EDR/SIEM otomatik blok/alert
2	Noisy	SOC analist 5dk inceleyince yakalanir
3	Moderate	Default rule yetersiz, hunt query gerek
4	Quiet	Sadece sofistike hunt + threat intel
5	Stealth	Tespit edilmez (zero-day, signed bin)

Impact Scoring (1-5)

Score	Tip	Etki
1	Recon	Bilgi alma (data ifsa yok)
2	Limited	Tek hesap compromise
3	Local	Tek sistem compromise
4	Lateral	Cok sistem / DB erisim
5	Catastrophic	DA, ransomware, mass exfil

Chain Example

# Chain — "User to Domain Admin"
Total: 6 step, Stealth: 18/30, Impact: 5/5 (DA)

## Step 1: Phishing (Initial Access)
- Bulgu: User awareness training eksik (engagement OSINT)
- Action: Spear phish IT employee
- Stealth: 3 (email gateway yakalayabilir, %20)
- Impact: 2 (single user cred)
- Output: domain\jdoe / Spring2026!

## Step 2: Initial Foothold (Execution)
- Bulgu: VPN portal MFA eksik
- Action: VPN login -> domain join sirasinda
- Stealth: 4 (MFA log siginal kuvvetli ama eksik)
- Impact: 2
- Output: Internal network access

## Step 3: Recon (Discovery)
- Bulgu: SMB anonymous null session AD'de
- Action: enum4linux + RPC
- Stealth: 2 (event 4624 type 3 fires)
- Impact: 2
- Output: Domain user list + group list

## Step 4: Cred Access (Credential Access)
- Bulgu: Kerberoastable service account weak password
- Action: GetUserSPNs.py + hashcat 4 hr crack
- Stealth: 3 (event 4769 with 0x17 encryption)
- Impact: 3
- Output: svc-mssql / Mssql2024

## Step 5: Privesc (Privilege Escalation)
- Bulgu: svc-mssql member of "DB Admins"
- Action: Already privileged service acct
- Stealth: 5 (no abnormal event)
- Impact: 4
- Output: Local admin on DB-PROD

## Step 6: DA (Privilege Escalation)
- Bulgu: DB-PROD has unconstrained delegation
- Action: TGT capture via printer bug
- Stealth: 3 (anomalous service ticket request)
- Impact: 5
- Output: Domain Admin TGT

Compensating Controls

Her chain step'i icin iki tarafli kontrol yaz:

step: 4 - Kerberoast
attack:
  technique: T1558.003
  noise: Event 4769 with encryption 0x17 (RC4)
controls:
  preventive:
    - Service account: long random password (30+ char)
    - Use AES-256 only (set msDS-SupportedEncryptionTypes)
    - Microsoft Managed Service Accounts (gMSA)
  detective:
    - Sigma rule: kerberoast_rc4_encryption.yml
    - Alert threshold: > 5 TGS-REQ in 1 hr from single user
  responsive:
    - Auto-disable account on alert
    - 24   

Output Sablonu

## Exploit Chain Report — <engagement>

### Top 3 Chains (ranked by Impact / Stealth)

| # | Title | Steps | Stealth | Impact | Time |
|---|-------|-------|---------|--------|------|
| 1 | User -> DA via Kerberoast | 6 | 18 | 5 | 6 hours |
| 2 | Web SSRF -> Cloud Metadata -> RDS | 4 | 12 | 5 | 3 hours |
| 3 | Phish -> Lateral -> Ransom Sim | 5 | 10 | 5 | 8 hours |

### Recommended Defense Priority
1. Add Kerberoast detection (Sigma rule attached)
2. MFA on VPN (chain step 2 break)
3. Service account password complexity (chain step 4 break)
4. Disable unconstrained delegation (chain step 6 break)

Out-of-Scope

• Live chain execution (sadece advisory + writeup)
• 0-day discovery (n-day exploit kullanilir)