pentest-exploit-chain

name	pentest-exploit-chain
description	Multi-step exploit chain analysis — linking low/medium severity findings into a critical chain, stealth+impact scoring advisory. Triggers on exploit chain, attack chain, chain analysis, multi-step attack, kill chain, attack path, stealth scoring, impact analysis.
license	MIT
compatibility	Works with Claude Code
allowed-tools	Read Write Edit Grep
metadata	{"author":"badi","homepage":"https://github.com/fatihkan/badi-skills/tree/main/skills/pentest-exploit-chain","badi-version":">=1.24.0","category":"pentest","scope":"advisory","inspired-by":"0xSteph/pentest-ai-agents exploit-chainer + attack-planner"}

pentest-exploit-chain

Chaining individual low-to-medium severity findings into a full compromise chain. The highest value-add of engagement intelligence — human analysis only.

Triggers

• "can these findings be chained"
• "draw the kill chain"
• "low + medium = critical"
• "attack path simulation"
• "stealth + impact score"

Lockheed Cyber Kill Chain (7 step)

1. Reconnaissance       — OSINT, port scan
2. Weaponization        — exploit + payload combine
3. Delivery             — phishing, drive-by, USB
4. Exploitation         — vulnerability trigger
5. Installation         — persistent foothold
6. Command & Control    — beacon
7. Actions on Objectives — data exfil, destruction, ransom

MITRE ATT&CK Tactic Chain

TA0043 Reconnaissance
  -> TA0001 Initial Access
    -> TA0002 Execution
      -> TA0003 Persistence
        -> TA0004 Privilege Escalation
          -> TA0005 Defense Evasion
            -> TA0006 Credential Access
              -> TA0007 Discovery
                -> TA0008 Lateral Movement
                  -> TA0009 Collection
                    -> TA0011 Command and Control
                      -> TA0010 Exfiltration
                        -> TA0040 Impact

Chain Analysis Methodology

1. List all findings (low + medium + high)
2. For each finding: input requirement, output privilege/access
3. Match: output of finding A, input of finding B
4. Draw the path of steps (DAG)
5. Shortest path -> max impact
6. A stealth score (1-5) per step
7. Total stealth + impact -> chain rank

Stealth Scoring (1-5)

Score	Type	Detection Likelihood
1	Loud	EDR/SIEM auto block/alert
2	Noisy	Caught when a SOC analyst reviews it in 5 min
3	Moderate	Default rule insufficient, hunt query needed
4	Quiet	Only sophisticated hunt + threat intel
5	Stealth	Undetectable (zero-day, signed bin)

Impact Scoring (1-5)

Score	Type	Impact
1	Recon	Information gathering (no data disclosure)
2	Limited	Single account compromise
3	Local	Single system compromise
4	Lateral	Multiple systems / DB access
5	Catastrophic	DA, ransomware, mass exfil

Chain Example

# Chain — "User to Domain Admin"
Total: 6 step, Stealth: 18/30, Impact: 5/5 (DA)

## Step 1: Phishing (Initial Access)
- Finding: User awareness training missing (engagement OSINT)
- Action: Spear phish IT employee
- Stealth: 3 (email gateway may catch it, 20%)
- Impact: 2 (single user cred)
- Output: domain\jdoe / Spring2026!

## Step 2: Initial Foothold (Execution)
- Finding: VPN portal MFA missing
- Action: VPN login -> during domain join
- Stealth: 4 (MFA log signal is strong but missing)
- Impact: 2
- Output: Internal network access

## Step 3: Recon (Discovery)
- Finding: SMB anonymous null session on AD
- Action: enum4linux + RPC
- Stealth: 2 (event 4624 type 3 fires)
- Impact: 2
- Output: Domain user list + group list

## Step 4: Cred Access (Credential Access)
- Finding: Kerberoastable service account weak password
- Action: GetUserSPNs.py + hashcat 4 hr crack
- Stealth: 3 (event 4769 with 0x17 encryption)
- Impact: 3
- Output: svc-mssql / Mssql2024

## Step 5: Privesc (Privilege Escalation)
- Finding: svc-mssql member of "DB Admins"
- Action: Already privileged service acct
- Stealth: 5 (no abnormal event)
- Impact: 4
- Output: Local admin on DB-PROD

## Step 6: DA (Privilege Escalation)
- Finding: DB-PROD has unconstrained delegation
- Action: TGT capture via printer bug
- Stealth: 3 (anomalous service ticket request)
- Impact: 5
- Output: Domain Admin TGT

Compensating Controls

Write a two-sided check for each chain step:

step: 4 - Kerberoast
attack:
  technique: T1558.003
  noise: Event 4769 with encryption 0x17 (RC4)
controls:
  preventive:
    - Service account: long random password (30+ char)
    - Use AES-256 only (set msDS-SupportedEncryptionTypes)
    - Microsoft Managed Service Accounts (gMSA)
  detective:
    - Sigma rule: kerberoast_rc4_encryption.yml
    - Alert threshold: > 5 TGS-REQ in 1 hr from single user
  responsive:
    - Auto-disable account on alert
    - 24/7 SOC triage SLA

Output Template

## Exploit Chain Report — <engagement>

### Top 3 Chains (ranked by Impact / Stealth)

| # | Title | Steps | Stealth | Impact | Time |
|---|-------|-------|---------|--------|------|
| 1 | User -> DA via Kerberoast | 6 | 18 | 5 | 6 hours |
| 2 | Web SSRF -> Cloud Metadata -> RDS | 4 | 12 | 5 | 3 hours |
| 3 | Phish -> Lateral -> Ransom Sim | 5 | 10 | 5 | 8 hours |

### Recommended Defense Priority
1. Add Kerberoast detection (Sigma rule attached)
2. MFA on VPN (chain step 2 break)
3. Service account password complexity (chain step 4 break)
4. Disable unconstrained delegation (chain step 6 break)

Out-of-Scope

• Live chain execution (advisory + writeup only)
• 0-day discovery (n-day exploits are used)