---
name: pentest-exploit-chain-ce90529d86e3
description: Multi-step exploit zinciri analizi — low/medium severity bulgulari critical chain'e baglama, stealth+impact scoring advisory. Triggers on exploit chain, attack chain, chain analysis, multi-step attack, kill chain, attack path, stealth scoring, impact analysis.
license: MIT
compatibility: Works with Claude Code
allowed-tools: Read Write Edit Grep
metadata:
  author: badi
  badi-version: ">=1.24.0"
  category: pentest
  scope: advisory
  inspired-by: 0xSteph/pentest-ai-agents exploit-chainer + attack-planner
---

# pentest-exploit-chain

Tek tek dusuk-orta severity bulgulari **tam compromise zincire** birlestirme. Engagement zekasinin en yuksek katma degeri — yalnizca insan analizi.

## Triggers

- "bulgular chain edilebilir mi"
- "kill chain ciz"
- "low + medium = critical"
- "attack path simulation"
- "stealth + impact score"

## Lockheed Cyber Kill Chain (7 step)

```
1. Reconnaissance       — OSINT, port scan
2. Weaponization        — exploit + payload combine
3. Delivery             — phishing, drive-by, USB
4. Exploitation         — vulnerability trigger
5. Installation         — persistent foothold
6. Command & Control    — beacon
7. Actions on Objectives — data exfil, destruction, ransom
```

## MITRE ATT&CK Tactic Chain

```
TA0043 Reconnaissance
  -> TA0001 Initial Access
    -> TA0002 Execution
      -> TA0003 Persistence
        -> TA0004 Privilege Escalation
          -> TA0005 Defense Evasion
            -> TA0006 Credential Access
              -> TA0007 Discovery
                -> TA0008 Lateral Movement
                  -> TA0009 Collection
                    -> TA0011 Command and Control
                      -> TA0010 Exfiltration
                        -> TA0040 Impact
```

## Chain Analizi Methodology

```
1. Tum bulgulari listele (low + medium + high)
2. Her bulguya: input gereksinim, output yetki/erisim
3. Esle: bulgu A'nin output'u, bulgu B'nin input'u
4. Adimlar yolu ciz (DAG)
5. En kisa yol -> max impact
6. Her adim icin stealth puani (1-5)
7. Toplam stealth + impact -> chain rank
```

## Stealth Scoring (1-5)

| Score | Tip | Detection Likelihood |
|-------|-----|---------------------|
| 1 | Loud | EDR/SIEM otomatik blok/alert |
| 2 | Noisy | SOC analist 5dk inceleyince yakalanir |
| 3 | Moderate | Default rule yetersiz, hunt query gerek |
| 4 | Quiet | Sadece sofistike hunt + threat intel |
| 5 | Stealth | Tespit edilmez (zero-day, signed bin) |

## Impact Scoring (1-5)

| Score | Tip | Etki |
|-------|-----|------|
| 1 | Recon | Bilgi alma (data ifsa yok) |
| 2 | Limited | Tek hesap compromise |
| 3 | Local | Tek sistem compromise |
| 4 | Lateral | Cok sistem / DB erisim |
| 5 | Catastrophic | DA, ransomware, mass exfil |

## Chain Example

```markdown
# Chain — "User to Domain Admin"
Total: 6 step, Stealth: 18/30, Impact: 5/5 (DA)

## Step 1: Phishing (Initial Access)
- Bulgu: User awareness training eksik (engagement OSINT)
- Action: Spear phish IT employee
- Stealth: 3 (email gateway yakalayabilir, %20)
- Impact: 2 (single user cred)
- Output: domain\jdoe / Spring2026!

## Step 2: Initial Foothold (Execution)
- Bulgu: VPN portal MFA eksik
- Action: VPN login -> domain join sirasinda
- Stealth: 4 (MFA log siginal kuvvetli ama eksik)
- Impact: 2
- Output: Internal network access

## Step 3: Recon (Discovery)
- Bulgu: SMB anonymous null session AD'de
- Action: enum4linux + RPC
- Stealth: 2 (event 4624 type 3 fires)
- Impact: 2
- Output: Domain user list + group list

## Step 4: Cred Access (Credential Access)
- Bulgu: Kerberoastable service account weak password
- Action: GetUserSPNs.py + hashcat 4 hr crack
- Stealth: 3 (event 4769 with 0x17 encryption)
- Impact: 3
- Output: svc-mssql / Mssql2024

## Step 5: Privesc (Privilege Escalation)
- Bulgu: svc-mssql member of "DB Admins"
- Action: Already privileged service acct
- Stealth: 5 (no abnormal event)
- Impact: 4
- Output: Local admin on DB-PROD

## Step 6: DA (Privilege Escalation)
- Bulgu: DB-PROD has unconstrained delegation
- Action: TGT capture via printer bug
- Stealth: 3 (anomalous service ticket request)
- Impact: 5
- Output: Domain Admin TGT
```

## Compensating Controls

Her chain step'i icin **iki tarafli** kontrol yaz:

```yaml
step: 4 - Kerberoast
attack:
  technique: T1558.003
  noise: Event 4769 with encryption 0x17 (RC4)
controls:
  preventive:
    - Service account: long random password (30+ char)
    - Use AES-256 only (set msDS-SupportedEncryptionTypes)
    - Microsoft Managed Service Accounts (gMSA)
  detective:
    - Sigma rule: kerberoast_rc4_encryption.yml
    - Alert threshold: > 5 TGS-REQ in 1 hr from single user
  responsive:
    - Auto-disable account on alert
    - 24/7 SOC triage SLA
```

## Output Sablonu

```markdown
## Exploit Chain Report — <engagement>

### Top 3 Chains (ranked by Impact / Stealth)

| # | Title | Steps | Stealth | Impact | Time |
|---|-------|-------|---------|--------|------|
| 1 | User -> DA via Kerberoast | 6 | 18 | 5 | 6 hours |
| 2 | Web SSRF -> Cloud Metadata -> RDS | 4 | 12 | 5 | 3 hours |
| 3 | Phish -> Lateral -> Ransom Sim | 5 | 10 | 5 | 8 hours |

### Recommended Defense Priority
1. Add Kerberoast detection (Sigma rule attached)
2. MFA on VPN (chain step 2 break)
3. Service account password complexity (chain step 4 break)
4. Disable unconstrained delegation (chain step 6 break)
```

## Out-of-Scope

- Live chain execution (sadece advisory + writeup)
- 0-day discovery (n-day exploit kullanilir)


---
Source attribution: badi
Original project: https://github.com/aibot88/sec_skill_store/blob/608120788167d56f99e31449e411e603ed250dc6/skills/claudskills/pentest-exploit-chain/SKILL.md
License: MIT
License information: https://opensource.org/license/mit
Original upstream instructions; downloaded from Mega AI Hub.

## Upstream license notice

MIT License

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.



# Mega AI Hub resource metadata

Creator / publisher: badi
Original project: https://github.com/aibot88/sec_skill_store/blob/608120788167d56f99e31449e411e603ed250dc6/skills/claudskills/pentest-exploit-chain/SKILL.md
Attribution basis: Source repository record

Fields of work: Development & Engineering
Roles: Security Engineer, ML / AI Engineer
Specialties: API
Tools: Grep
Country applicability: Country not specified
Classification basis: Source category, role and specialization labels
Instruction SHA-256: 07dcfb99ba509c3d07fa49dff09667f187d3c1243fa41159bc18e1a242e0c848