Guide · Agent skill
How to use the Post-Exploitation and Cracking Playbook agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The post-exploitation skill is a reference card for an AI agent. Once the agent has access to a machine during an authorized penetration test, it can use this file to recall which post-exploitation techniques and tools exist, from privilege escalation and lateral movement to hash cracking and cryptographic attacks. It is written for security professionals, students on lab machines, and pentesters who already have written scope. By the end of this guide you will know what the skill contains, how to install it, how to phrase requests that trigger it, and where its limits are.
Post-Exploitation and Cracking PlaybookAIPentest/CyberStrikeAI · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Download the skill ZIP from this page.
- 2Unzip into a skills folder. Unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder.
- 3Or upload in the Claude apps. In the Claude apps, go to Settings → Capabilities → Skills and upload the skill.
- 4Install the required tools. Install the tools the skill references, such as hashcat, john, impacket, hydra and chisel, on the machine where the agent runs.
- 5Describe your authorized situation. Ask in plain words, naming your access, your goal and your written scope or lab.
- 6Review before running. Check each command the agent suggests before you let it run.
What does the post-exploitation skill make the agent do?
The skill is a single SKILL.md file. It is mostly a quick-lookup list, written in Chinese with English tool names, that tells the agent which methods and tools to reach for after it has gained access to a machine. It does not contain step-by-step instructions. It gives the agent a menu of known techniques to suggest from.
The content covers these areas: reverse shell and TTY tricks, Linux and Windows privilege escalation paths, lateral movement, tunnelling, evasion, C2 and persistence ideas, hash cracking modes, and cryptographic attacks such as padding oracle and hash length extension.
- Reverse shells and PTY upgrades, for example bash -i over /dev/tcp and a python3 pty.spawn line
- Linux privilege escalation ideas such as sudo -l, SUID binaries via GTFOBins, getcap, cron and writable files, with LinPEAS and pspy
- Windows privilege escalation ideas such as PrintSpoofer and GodPotato, AlwaysInstallElevated, and winPEAS
- Lateral movement with pass-the-hash tools, SSH key harvesting and common credential file locations
- Tunnelling with ssh -L/-D/-J, chisel and ligolo-ng
- Hash cracking with hashcat and john, including common mode numbers such as 1000 for NTLM and 3200 for bcrypt
- Cryptographic attacks such as padding oracle with padbuster and hash length extension with hashpump
How do you install the post-exploitation skill?
Download the ZIP for this skill from this page and unzip it. You can install the skill in one of two places. For a personal setup, unzip it into ~/.claude/skills/. For a single project, unzip it into that project's .claude/skills/ folder.
If you use the Claude apps instead, you can upload the skill under Settings → Capabilities → Skills.
- Personal install: ~/.claude/skills/ (available across your projects)
- Project install: the .claude/skills/ folder inside one project
- Claude apps: Settings → Capabilities → Skills, then upload
How do you trigger the skill with natural requests?
You do not need a special command. The skill's description says it applies when the request involves post-exploitation, privilege escalation, lateral movement, or cracking crypto. Describe the situation and the goal in plain words, and state that the work is authorized.
Good requests name the state you are in (for example, a shell on a Linux box), the goal (escalate privileges, move to another host, crack a hash) and the scope. Mention the engagement or lab so the agent works within it.
- I have an authorized pentest shell on a Linux host. Which privilege escalation checks should I run first?
- This is a HackTheBox lab. I have a password hash from a web app. What hashcat modes should I try?
- We have written scope for this red team exercise. Suggest lateral movement options from a host with SSH keys in the home folder.
- I have a CBC-encrypted token from the lab app. Which cryptographic attack from the playbook fits?
What does the skill need to work well?
The skill references a number of external tools. The skill itself does not install them, so you need them on the machine where the agent runs. The listed requirements are hashcat, john (John the Ripper), impacket, hydra, chisel, ligolo-ng, padbuster, hashpump, RsaCtfTool, LinPEAS, pspy, winPEAS and Mimikatz. Sliver, Havoc and Donut are referenced as well.
The skill also refers to two other skills: pentest-output-standards, for logging persistence, and web-attack-methods, for JWT attacks. Install those too if you want those references to be useful.
- Tools named in the requirements list must be installed separately
- Related skills referenced: pentest-output-standards and web-attack-methods
- The skill runs no scripts and uses no network access itself
What safety rules should you follow?
The file is a ready-made attack menu. It does not check authorization, scope or target ownership. Use it only on systems you own or have written permission to test, such as CTF labs and deliberately vulnerable machines like Hack The Box or TryHackMe.
The skill does not run scripts and does not use the network by itself. Any commands the agent runs come from the tools you have installed and the access you have given the agent, so review them before they execute. Keep a record of every persistence step, as the skill itself recommends logging persistence in the pentest-output-standards ledger so it can be rolled back.
- Only target systems you own or have written authorization to test
- Review every command the agent proposes before it runs
- Log every persistence mechanism so it can be reverted
- The content is offensive only and gives no detection or hardening advice
What tips help you get more from it?
Because the file is a menu rather than a course, tell the agent what you have already tried. It can then narrow the list instead of repeating basic checks. For hash cracking, the skill suggests a order: dictionary with rockyou plus rules such as best64 or dive, then mask attacks, then combination attacks, with john as a fallback and online rainbow tables such as crackstation checked first.
Expect to research the techniques yourself. The file names methods without explaining how or why they work, so ask the agent to explain a technique in detail, and verify against the tool's own documentation.
- State what access you already have and what you have already run
- For cracking, ask for the hash type first so the agent can pick the right hashcat mode
- Check online rainbow tables such as crackstation before heavy cracking
- Read the tool documentation before running anything the agent suggests
hashcat -m <mode> hash wordlist -r rules/best64.ruleWhat people use it for
- Suggesting privilege escalation checks after a shell on a Linux lab host
- Listing hashcat modes for a captured NTLM, bcrypt or Kerberoast hash in a CTF
- Proposing tunnelling options with ssh, chisel or ligolo-ng during an authorized internal network test
- Reviewing a CBC-encrypted token for padding oracle exposure in a lab app
- Recalling Windows privilege escalation paths to test on a deliberately vulnerable machine
Frequently asked questions
Is the post-exploitation skill free?
The source file is licensed under Apache-2.0. The skill's SKILL.md does not mention pricing, and the tools it references are separate projects with their own licences, which you should check individually.
What do I need to install before using it?
The skill references hashcat, john, impacket, hydra, chisel, ligolo-ng, padbuster, hashpump, RsaCtfTool, LinPEAS, pspy, winPEAS and Mimikatz. You install these yourself. The skill also refers to the pentest-output-standards and web-attack-methods skills.
How do I install the skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder. In the Claude apps, you can upload it under Settings → Capabilities → Skills.
Is this a beginner tutorial for learning hacking?
No. The file lists techniques and tool names without explaining how or why they work. Students can use it as a reference on lab machines, but should learn the underlying methods from other sources.
Does the skill run scripts or use the network?
According to its listing, the skill runs no scripts and uses no network access itself. Any commands the agent executes come from the tools you have installed, so review them before running.
Can I use it against any machine I can reach?
No. The skill has no authorization checks. Use it only on systems you own or have written permission to test, such as CTF labs and deliberately vulnerable machines.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits security professionals on authorized engagements and students on CTF labs who want a quick menu of post-exploitation and cracking methods for an agent to draw on. It is a poor fit for beginners who want a guided course, for anyone without written permission to test, and for defenders who need detection or hardening guidance.
Download the skill