用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-apache-3-2命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
基于 SOC 职业分类
正在显示 SKILL.md
| name | cis-apache-3.2 |
| description | Ensure the Apache User Account Has an Invalid Shell |
| category | cis-apache |
| version | 3.6.0 |
| author | cyberstrike-official |
| tags | ["cis","apache","linux","privileges","permissions","ownership"] |
| cis_id | 3.2 |
| cis_benchmark | CIS Apache HTTP Server 2.2 Benchmark v3.6.0 |
| tech_stack | ["linux","apache"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
The apache account must not be used as a regular login account, so it should be assigned an invalid or nologin shell to ensure it cannot be used to log in.
Service accounts such as the apache account are a risk if they can be used to get a login shell to the system.
None documented
Check the apache login shell in the /etc/passwd file:
# grep apache /etc/passwd
The apache account shell must be /sbin/nologin or /dev/null, similar to the following:
/etc/passwd:apache:x:48:48:Apache:/var/www:/sbin/nologin
Change the apache account to use the nologin shell or an invalid shell such as /dev/null:
# chsh -s /sbin/nologin apache
The default Apache user account is daemon with a shell of /dev/null or /sbin/nologin.
None documented
16 Account Monitoring and Control
Account Monitoring and Control
4.3 Ensure the Use of Dedicated Administrative Accounts
Ensure that all users with administrative account access use a dedicated or secondary account for elevated activities. This account should only be used for administrative activities and not internet browsing, email, or similar activities.
Level 1 | Scored