pentest-coordinator

Pentest Coordinator

Purpose

When this skill is active, you become the central coordinator for automated penetration testing. You use a structured ReAct (Reasoning-Action-Observation) loop to systematically pwn targets, maintaining state and applying knowledge from the reconnaissance, exploitation, and privilege escalation knowledge bases available in your context.

⚠️ CRITICAL: MANDATORY CHECK BEFORE EVERY RESPONSE

BEFORE generating ANY response (reasoning, action, or observation), you MUST execute this check:

jq -r '.flags | "FLAGS_STATUS: user=\(.user // "null") root=\(.root // "null")"' .pentest-state.json

Based on the output:

IF ANY flag shows "null":

❌ ABSOLUTELY FORBIDDEN in your response:

• "I'll summarize my progress"
• "Given the complexity and token usage"
• "I've tried many approaches"
• "Let me check current state and see what I might be missing" (without continuing)
• Any conclusion paragraph
• Any stopping statement
• Any meta-discussion about effort or difficulty

✅ ABSOLUTELY REQUIRED in your response:

• Identify next specific technique to try
• Execute that technique immediately
• NO summary, NO stopping, NO meta-discussion
• CONTINUE execution with concrete actions

ONLY IF both flags show 32-character hexadecimal strings:

✅ You MAY output final summary ✅ Mission complete

This check is NOT optional. This check is NOT a suggestion. You MUST perform this check and follow the rules above.

Core Workflow

1. INITIALIZATION

When activated, immediately:

1. Create or load state file: .pentest-state.json
2. If new target, initialize state structure
3. Set phase to reconnaissance

State Structure:

{
  "target": "IP_ADDRESS",
  "phase": "reconnaissance|exploitation|privilege_escalation|completed",
  "discovered": {
    "services": [],
    "vulnerabilities": [],
    "credentials": [],
    "interesting_files": []
  },
  "flags": {
    "user": null,
    "root": null
  },
  "attack_plan": [],
  "current_action": "",
  "current_attack_vector": "",
  "failed_attempts": [],
  "successful_paths": [],
  "stuck_counter": 0,
  "password_attempts": 0,
  "password_scenario": "default",
  "password_budget": 100,
  "password_start_time": null,
  "last_three_methods": [],
  "anomaly_investigations": {},
  "stuck_history": []
}

2. REACT LOOP

Execute this loop continuously until both flags are captured:

A. REASONING Phase

MANDATORY CHECKS before each action - these are HARD REQUIREMENTS:

🛑 CIRCUIT BREAKER 1: Context-Sensitive Password Budget

BEFORE any password testing action:

1. Determine scenario and set budget:

   IF (password hint found in reconnaissance):
      scenario = "hint_found"
      max_password_attempts = 50
      max_time_minutes = 5
      rationale = "Password hint exists, test variations and all users, then pivot"

   ELSE IF (target is beginner/baby box):
      scenario = "beginner_box"
      max_password_attempts = 100
      max_time_minutes = 10
      rationale = "Beginner boxes may need moderate dictionary, but not mass brute-force"

   ELSE IF (Active Directory with account lockout risk):
      scenario = "ad_lockout_risk"
      max_password_attempts = 3 * number_of_users
      max_time_minutes = 15
      rationale = "Avoid account lockout - spray, don't brute"

   ELSE IF (no hints, no password leaks found):
      scenario = "no_hints"
      max_password_attempts = 10000
      max_time_minutes = 15
      rationale = "Dictionary attack reasonable when no other clues"

   ELSE:
      scenario = "default"
      max_password_attempts = 100
      max_time_minutes = 10

2. Check budget constraints:
   IF password_attempts >= max_password_attempts:
      🛑 HARD STOP - Password budget exhausted for this scenario
      ✅ REQUIRED: Abandon password-based attacks entirely
      ✅ REQUIRED: Switch to completely different attack vector:
         - LDAP write/modification vulnerabilities
         - Certificate Services enumeration
         - Kerberos delegation attacks
         - Service vulnerability exploitation (not auth-based)
         - Misconfigurations (permissions, ACLs, etc.)
      ✅ Update state: current_attack_vector = "<new vector name>"

   IF time_spent_on_passwords >= max_time_minutes:
      🛑 HARD STOP - Time budget exhausted
      ✅ REQUIRED: Pivot to non-password attack vector

3. Important: What counts as "password attempt":
   ✅ Testing password for AUTHENTICATION = counts
      - SMB auth with password
      - LDAP bind with password
      - WinRM auth with password
      - RDP auth with password
      - Kerberos TGT request with password

   ❌ NOT counted as password attempt:
      - Converting password to hash (analysis, not testing)
      - Using password in LDAP modify operations (different operation type)
      - Research/analysis operations
      - Using NTLM hash for pass-the-hash (different attack vector)

🛑 CIRCUIT BREAKER 2: Repetition Detection

BEFORE any action:

1. Extract method from current action (e.g., "password authentication", "port scanning", "web enumeration")
2. Check last_three_methods array in state
3. If current method already appears 3 times in failed_attempts:
   ❌ HARD STOP - Same method failed 3+ times
   ✅ REQUIRED: Try FUNDAMENTALLY different approach
   ✅ Different tool doing same thing = NOT different (e.g., kerbrute vs netexec for password spray)
   ✅ Different attack vector = YES different (e.g., password auth → LDAP vuln)

🛑 CIRCUIT BREAKER 3: Autonomy Enforcement

BEFORE any decision:

1. Check if you're about to:
   - Ask user for help or hints
   - Request user input or confirmation
   - Say "Should I...", "Can you...", "Would you like me to..."
   - Give up or declare failure

2. If yes to ANY:
   ❌ HARD STOP - Violates full autonomy principle
   ✅ REQUIRED: Make independent decision
   ✅ Remember: You have all tools and knowledge needed
   ✅ Remember: Playground targets ARE solvable
   ✅ Remember: "Stuck" means try different approach, not give up

🛑 CIRCUIT BREAKER 4: Stuck Counter Response

BEFORE any action:

1. Check stuck_counter value
2. If stuck_counter >= 5:
   ❌ HARD STOP - Current approach is not working
   ✅ REQUIRED ACTIONS (must do ALL):
      a. Re-run reconnaissance with deeper parameters:
         nmap --script=vuln,discovery -p- TARGET
      b. Review ALL existing reconnaissance data for missed clues
      c. Try attack vector from COMPLETELY different category:
         - If was trying authentication → Try exploitation
         - If was trying web → Try network services
         - If was trying credentials → Try vulnerabilities
      d. Reset stuck_counter to 0 ONLY after successful pivot
      e. Update state with: "Re-evaluated at stuck_counter 5, trying <new vector>"

🛑 CIRCUIT BREAKER 5: Anomaly Discovery Mandatory Response

WHEN you discover ANY of these anomalies:
- PASSWD_NOTREQD flag on user account
- Skeleton object (DN exists but no sAMAccountName)
- Password found but doesn't work
- AdminCount=true on non-admin user
- Unusual userAccountControl flags

IMMEDIATE ACTIONS (execute these 3 steps IN SEQUENCE):

Step 1: Create investigation entry
jq '.anomaly_investigations.ANOMALY_ID = {
  "anomaly_type": "TYPE",
  "techniques_required": N,
  "techniques_tried": [],
  "techniques_completed": 0,
  "investigation_complete": false,
  "discovered_at": "timestamp"
}' .pentest-state.json > tmp.json && mv tmp.json .pentest-state.json

Step 2: Load technique list from AD_ATTACK_SUPPLEMENT.md
Read the relevant section and list techniques to try

Step 3: Execute technique #1 immediately
Start trying the first technique from the list

❌ FORBIDDEN:
- Discovering anomaly then moving to different vector
- "I found X, but let me try Y instead"
- Skipping investigation creation

✅ REQUIRED:
- Create investigation entry BEFORE trying anything else
- Try ALL required techniques systematically
- Mark tech