Skip to content
cccskills
FreePublished on GitHub

cloud-recon

Cloud control-plane reconnaissance for AWS, Azure/Entra, GCP, and Alibaba Cloud: identity, IAM/RAM, trust, resources, metadata, and managed-Kubernetes cloud-side boundary. Recon only — no policy changes, no privilege escalation. Operator may select /cloud-attack or /k8s.

The English summary is being prepared. Showing the original description.

pale-knight/redteam-skill
Works withAWSGoogle CloudAzureKubernetes
See how to install

Files included (8)

  • SKILL.md4.1 KB
  • references/alibaba-enum-commands.md4.4 KB
  • references/aws-enum-commands.md3.9 KB
  • references/aws-iam-graph.md1.9 KB
  • references/azure-enum-commands.md1.9 KB
  • references/cloud-k8s-identity.md1.7 KB
  • references/gcp-enum-commands.md1.9 KB
  • references/vulnerability-intelligence.md534 B

SKILL.md (original)

Review the instructions the agent will receive before you install.

/cloud-recon — 云控制面信息收集

scope： 已有云凭据或云环境线索后，只读枚举身份、权限、信任、资源。不改策略、不建用户、不更新函数。▸ 高价值路径交给操作者选 /cloud-attack 或 /k8s。

命令全书在 reference，不要在 SKILL 复制四朵云 CLI。

  • AWS：references/aws-enum-commands.md + references/aws-iam-graph.md
  • Azure：references/azure-enum-commands.md
  • GCP：references/gcp-enum-commands.md
  • 阿里云：references/alibaba-enum-commands.md
  • 云↔K8s：references/cloud-k8s-identity.md
  • versioned 软件 CVE：../shared/cve-enrichment.md

开局与收尾

开局第一件事：Read ./notes.md。没有则 python ~/.claude/skills/bin/notes.py init。只按已拿下/凭据继续。 走到哪条链，才 Read 一份 references/<file>.md。禁止开局全读、禁止凭记忆写 payload。 监听 / sudo / 输密码 / Permission denied：立刻停，说明等操作者做什么，等回报。不要假装已成功。 收尾：

  1. 追加 ./notes.md
  2. python ~/.claude/skills/bin/modules.py tail <本模块名> Read 备用：~/.claude/skills/shared/modules.yaml 禁止 ./modules.yaml 和 python ../bin/...
  3. 优先 default_next；never_default 不得当作默认（操作者点名除外）
  4. 名册外的名字不许建议
  5. 停。等操作者选 /模块 或 /clear /edr-bypass 半条链未完：打通后回本模块，不要 /clear。

0. 成功条件

平台 / Account / Tenant / Project
当前 principal 与凭据类型（长期 / STS / MI / SA / OIDC）
有效权限与高价值 trust（AssumeRole / actAs / Owner）
资源面摘要（计算 / 存储 / serverless / 密钥）
托管 K8s 是否可拿 kubeconfig（只报告，不进集群）

禁止： 建 AccessKey、改 Trust、更新 Lambda、写 Bucket Policy。

IAM 误配 不是 CVE。只有自管 appliance/DB 引擎/镜像才走 enrichment。

1. 决策树（按手上材料，不按厂商课表）

还不知道哪朵云     → DNS/ASN/泄露变量识别平台
AWS 密钥/STS       → references/aws-enum-commands.md + pmapper
Azure token/SP/MI  → references/azure-enum-commands.md + ROADtools
GCP SA JSON/ADC    → references/gcp-enum-commands.md
阿里 AK/STS/RRSA   → references/alibaba-enum-commands.md
只有 VM 内         → 元数据（§4）再当新身份重新枚举
能 get 集群凭证    → 停，候选 /k8s

一次做完当前身份的图，不要 AWS 命令抄完再无脑把 Azure 全书跑一遍。

2. 平台识别

amazonaws.com / azurewebsites.net / run.app / aliyuncs.com
AWS_ACCESS_KEY_ID / AZURE_CLIENT_SECRET / GOOGLE_APPLICATION_CREDENTIALS
ALIBABA_CLOUD_ACCESS_KEY_ID

3. 每朵云（指针）

AWS： sts get-caller-identity → IAM/trust/resource policy → pmapper/cloudsplaining → EC2/S3/Lambda/Secrets。EKS 只 list/describe-cluster，能拿 API 就候选 /k8s。

Azure： az account show / roadrecon / AzureHound。MFA 用户不要默认 az login -u -p。AKS 能出 kubeconfig → /k8s。

GCP： gcloud auth list + IAM policy + SA impersonation 探测（能 print-token 只记可达身份，不在 recon 里提权利用）。GKE 同上。

阿里云： RAM/STS/ECS/OSS/FC/ActionTrail/ACK。元数据 100.100.100.200（含 token 模式）。ACK RRSA → 记 RAM 身份，候选 /k8s 或继续本模块枚举该 Role。

4. 元数据

AWS 169.254.169.254     Azure 169.254.169.254
GCE metadata.google.internal
阿里 100.100.100.200
EKS IRSA / AKS WI / GKE WI / ACK RRSA

token ≠ admin。记下 principal 再枚举。

5. 完成后

写入 ./notes.md。候选只按「开局与收尾」跑 python ~/.claude/skills/bin/modules.py tail。只建议，不自动跳。

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

ad-attack

Free

Active Directory exploitation after domain credentials exist: Kerberos (AS-REP/Kerberoast including cracking the ticket then using the account), delegation, NTLM coercion/relay, lateral movement, ACL abuse, ADCS ESC1-ESC17 and CVE paths, dMSA/BadSuccessor, Kerberos reflection, identity confusion, management-plane, domain trust, and domain persistence. Own the current AD chain through crack-and-use to DA, equivalent domain control, or the targeted host SYSTEM. Do not stop after requesting TGS. Host C2 belongs to /post. Operator chooses next modules.

The English summary is being prepared. Showing the original description.

pale-knight/redteam-skill51Updated Aug 23, 2026

ad-recon

Free

Active Directory reconnaissance with or without credentials: user/group/computer enumeration, ACL/delegation, ADCS, modern Windows LAPS, BloodHound, Server 2025/dMSA/Ghost SPN candidates, and trust mapping. Recon only — do not exploit Kerberoast-to-DA, DCSync, or change passwords. Operator may select /ad-attack after cards are ready.

The English summary is being prepared. Showing the original description.

pale-knight/redteam-skill51Updated Aug 23, 2026

cicd

Free

CI/CD pipeline and software-supply-chain exploitation: Jenkins, GitHub Actions, GitLab CI/CD, Azure DevOps, Gitea/Forgejo, self-hosted runners/agents, poisoned pipeline execution, artifact/cache abuse, dependency confusion, third-party Action trust, GitOps/registry poisoning, workload identity/OIDC, and emerging agentic CI/CD. Use this skill when the operator has access to a CI/CD system, source repository, build/deploy configuration, runner/agent, artifact/package/registry path, or software delivery trust chain.

The English summary is being prepared. Showing the original description.

pale-knight/redteam-skill51Updated Aug 23, 2026

cloud-attack

Free

Cloud control-plane exploitation for AWS, Azure/Entra, GCP, and Alibaba Cloud: IAM/RAM privilege escalation, impersonation, cross-account trust, serverless/compute control, and cloud-native persistence. Host OS persistence/C2 after root/SYSTEM belongs to /post. K8s RBAC belongs to /k8s. Operator chooses next modules; new identities default to /cloud-recon first.

The English summary is being prepared. Showing the original description.

pale-knight/redteam-skill51Updated Aug 23, 2026

creds

Free

Credential operations: secret discovery, classification, extraction, conversion, offline cracking of hashes the operator already has as a credential job, policy-aware spraying, NetNTLM capture, generic SMB relay, and Windows/Linux harvest. Do not hijack an in-progress /ad-attack Kerberoast/AS-REP chain (that module cracks and uses the ticket itself). Do not DCSync, read LAPS LDAP, or escalate cloud IAM. Usable credentials are recorded; the operator chooses the next module.

The English summary is being prepared. Showing the original description.

pale-knight/redteam-skill51Updated Aug 23, 2026

edr-bypass

Free

Endpoint defense evasion after an operator-selected chain already has a valid execution path but AV/EDR/AMSI/WDAC/PPL/memory/kernel telemetry blocks the intended action. Originating modules include /web-attack /ad-attack /cloud-attack /k8s /cicd /service-attack /phishing /privesc-win /privesc-linux /creds /post /shell. Success is the blocked action becoming executable, then resume the originating module — not obtaining a shell here.

The English summary is being prepared. Showing the original description.

pale-knight/redteam-skill51Updated Aug 23, 2026

See all skills by pale-knight

Report a problem with this skill