Individual skill
intranet-pentest-advanced
内网渗透高级 — 横向移动、凭据窃取、提权、持久化、隧道代理、AD攻击、ADCS滥用、Exchange/SharePoint攻击
deepsec/spear/skills/specialized/intranet-pentest-advanced/SKILL.md
Source commit fff031fc01fb36b95348214c8ee359f6ede8aa8b
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- Yes
- Observed behavior
- Not checked yet
- Last checked
- Nov 4, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 510
- Repository last updated
- Aug 24, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- agent Repository topic
- ai Repository topic
- ai-agents Repository topic
- aisecurity Repository topic
- cybersecurity Repository topic
- plugin Repository topic
- security Repository topic
- vscode Repository topic
- vulnerability Repository topic
- hacker Repository topic
- security Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 3,016 bytesreferences/06-intranet-and-host-operations-integrated.mddoc · 64,180 bytesreferences/intranet-pentest-playbook-openai.yamlasset · 306 bytesreferences/intranet-pentest-playbook-skill.mddoc · 2,794 bytesreferences/intranet-playbook-01-lateral-movement.mddoc · 7,270 bytesreferences/intranet-playbook-02-evasion-and-anti-detection.mddoc · 5,759 bytesreferences/intranet-playbook-03-credential-theft.mddoc · 10,676 bytesreferences/intranet-playbook-04-privilege-escalation.mddoc · 7,153 bytesreferences/intranet-playbook-05-persistence.mddoc · 5,244 bytesreferences/intranet-playbook-06-tunneling-and-proxy.mddoc · 5,207 bytesreferences/intranet-playbook-07-information-gathering.mddoc · 7,301 bytesreferences/intranet-playbook-08-active-directory-attacks.mddoc · 6,215 bytesreferences/intranet-playbook-09-adcs-attacks.mddoc · 2,150 bytesreferences/intranet-playbook-10-exchange-attacks.mddoc · 2,097 bytesreferences/intranet-playbook-11-sharepoint-attacks.mddoc · 996 bytesreferences/intranet-playbook-index.mddoc · 740 bytes
Read excerpt
# 内网渗透高级 Skill
当任务从互联网评估转入主机、域或内网操作时使用本 Skill。需要已获得初始访问权限或立足点。
**前置条件**：如果尚未获得初始访问，先完成外网渗透获取立足点。
## 场景路由
| 目标类型 | 首选参考 |
|---------|---------|
| 横向移动（PsExec/WMI/WinRM/DCOM/SSH/RDP/PTH/PTT） | `references/intranet-playbook-01-lateral-movement.md` |
| 规避与反检测（AMSI绕过/ETW/注入/伪装/签名二进制滥用） | `references/intranet-playbook-02-evasion-and-anti-detection.md` |
| 凭据窃取（Mimikatz/Kerberoasting/DCSync/浏览器Vault） | `references/intranet-playbook-03-credential-theft.md` |
| 提权与持久化（Token/Service/Potato/Cron/Registry/WMI） | `references/intranet-playbook-04-privilege-escalation.md` + `05-persistence.md` |