/engage.exploit

description: Execute Phase 4 - Exploitation and Access Establishment

/engage.exploit

Executes Phase 4 (Exploitation) of the engagement workflow.

Usage

`/engage.exploit [--target <host>] [--technique <technique-id>]`

Options:

• `--target`: Specify target host or application
• `--technique`: Specify MITRE ATT&CK technique ID

Process

1. Load Template

Loads `exploit/exploit-plan.md` template.

2. Exploitation Planning

Reviews delivery outcome and plans exploitation:

• What access was gained? (shell, web shell, credential, etc.)
• What is the current privilege level?
• What are the exploitation objectives? (per scope document)

3. Exploitation Execution

Guides through exploitation chain:

**Initial Access Verification**:

• Confirm access is functional
• Identify current user/privileges
• Identify target OS and environment
• Check for security controls (AV/EDR, logging, monitoring)

**Situational Awareness**:

• Enumerate system information
• Identify network configuration
• Locate sensitive data or credentials
• Map internal network (if applicable)

**Objective Achievement**: Based on engagement scope, execute:

• Data exfiltration (if authorized)
• Privilege escalation (if needed)
• Lateral movement (if needed)
• Persistence establishment (if needed)

**Evidence Collection**: For each successful exploitation step:

• Capture screenshot or command output
• Document exploitation technique
• Record MITRE ATT&CK technique ID
• Note any indicators of compromise (IOCs)

4. Finding Documentation

For each successful exploit, creates finding record in `exploit/findings/`:

**Finding Template** (`finding-<id>.md`):

# Finding: [Title]

**Severity**: Critical / High / Medium / Low
**CWE**: CWE-XXX
**CVE**: CVE-YYYY-NNNN (if applicable)
**MITRE ATT&CK**: T1XXX

## Description
[Detailed vulnerability description]

## Exploitation
[Step-by-step exploitation procedure]

## Impact
[Business impact and risk]

## Evidence
- Screenshot: evidence/screenshots/finding-<id>-01.png
- Output log: evidence/logs/finding-<id>.log

## Remediation
[Specific remediation guidance]

## References
[CVE links, vendor advisories, etc.]

5. Gate Check

Validates:

• At least one successful exploit documented
• Each finding has all required fields (severity, CWE, description, evidence)
• Evidence files exist at specified paths
• Exploitation techniques mapped to MITRE ATT&CK

6. Next Steps

Depending on workflow type:

• **Web-app / Bug-bounty**: Suggest `/engage.report`
• **Network / Red-team**: Suggest `/engage.install` (persistence)
• **Cloud / AD-domain**: Suggest `/engage.actions` (lateral movement)

Example Output

Starting Phase 4: Exploitation

Reviewing delivery outcome...
✓ Access established: Reverse shell on admin.acme-corp.com
✓ User: www-data (low privilege)
✓ OS: Ubuntu 20.04 LTS

Exploitation Objectives (from scope):
1. Demonstrate remote code execution
2. Access sensitive customer data (if present)
3. Escalate to root privileges (if possible)

[1/3] Initial Access Verification
→ Confirming shell access...
  Shell type: bash
  Working directory: /var/www/html
  Network: 10.0.1.42/24

→ Checking security controls...
  AV/EDR: None detected
  Logging: syslog active
  Firewall: iptables (outbound allowed)

[2/3] Situational Awareness
→ Enumerating system...
  Kernel: 5.4.0-42-generic
  Sudo version: 1.8.31
  SUID binaries: 47 found

→ Searching for sensitive data...
  Found: /var/www/html/config/database.php (DB credentials)
  Found: /var/www/html/uploads/ (customer documents)

[3/3] Objective Achievement
→ Objective 1: Remote code execution
  ✓ Achieved via CVE-2024-1234 exploitation
  Creating finding record...

→ Objective 2: Access sensitive data
  ✓ Database credentials found in config file
  ✓ Customer documents accessible in uploads directory
  Creating finding record...

→ Objective 3: Privilege escalation
  Checking for privesc vectors...
  Found: CVE-2021-3156 (sudo heap overflow)
  Exploiting...
  ✓ Escalated to root
  Creating finding record...

Evidence Collection:
→ Capturing screenshots...
  evidence/screenshots/finding-001-rce.png
  evidence/screenshots/finding-002-data-access.png
  evidence/screenshots/finding-003-privesc.png

→ Saving command outputs...
  evidence/logs/finding-001-rce.log
  evidence/logs/finding-002-data-access.log
  evidence/logs/finding-003-privesc.log

Findings Created:
1. Finding-001: Nginx Buffer Overflow RCE (Critical, CWE-120)
2. Finding-002: Sensitive Data Exposure (High, CWE-200)
3. Finding-003: Sudo Heap Overflow Privilege Escalation (High, CWE-122)

Running gate validation...

✓ Phase 4 (Exploitation) gate validation PASSED
3 findings documented with complete evidence

Ready to proceed to Phase 8 (Reporting).
Run: /engage.report

Available Skills

• `03-exploit-development` — Exploitation techniques
• `12-privesc-linux` — Linux privilege escalation
• `13-privesc-windows` — Windows privilege escalation
• `09-web-security` — Web application exploitation
• `25-active-directory-attack` — AD exploitation

Notes

Document every successful exploitation step as a finding. Findings form the basis of the final report.

Before a finding is recorded, run it through the `finding-validator` agent (PASS/KILL/DOWNGRADE) and set the structured proof signals that `validate_findings.py` checks (e.g. `internal_response_read`, `cross_identity_confirmed`, `command_output_captured`). A finding that can't be confirmed stays `[POSSIBLE]`, not `[CONFIRMED]`. Outward exploit actions are gated by `action_guard.py` — mutating requests against a live target need approval unless the ROE opts in.