engage.exploit

/engage.exploit

Executes Phase 4 (Exploitation) of the engagement workflow.

Usage

/engage.exploit [--target <host>] [--technique <technique-id>]

Options:

• --target: Specify target host or application
• --technique: Specify MITRE ATT&CK technique ID

Process

1. Load Template

Loads exploit/exploit-plan.md template.

2. Exploitation Planning

Reviews delivery outcome and plans exploitation:

• What access was gained? (shell, web shell, credential, etc.)
• What is the current privilege level?
• What are the exploitation objectives? (per scope document)

3. Exploitation Execution

Guides through exploitation chain:

Initial Access Verification:

• Confirm access is functional
• Identify current user/privileges
• Identify target OS and environment
• Check for security controls (AV/EDR, logging, monitoring)

Situational Awareness:

• Enumerate system information
• Identify network configuration
• Locate sensitive data or credentials
• Map internal network (if applicable)

Objective Achievement: Based on engagement scope, execute:

• Data exfiltration (if authorized)
• Privilege escalation (if needed)
• Lateral movement (if needed)
• Persistence establishment (if needed)

Evidence Collection: For each successful exploitation step:

• Capture screenshot or command output
• Document exploitation technique
• Record MITRE ATT&CK technique ID
• Note any indicators of compromise (IOCs)

4. Finding Documentation

For each successful exploit, creates finding record in exploit/findings/:

Finding Template (finding-<id>.md):

# Finding: [Title]

**Severity**: Critical / High / Medium / Low
**CWE**: CWE-XXX
**CVE**: CVE-YYYY-NNNN (if applicable)
**MITRE ATT&CK**: T1XXX

## Description
[Detailed vulnerability description]

## Exploitation
[Step-by-step exploitation procedure]

## Impact
[Business impact and risk]

## Evidence
- Screenshot: evidence/screenshots/finding-<id>-01.png
- Output log: evidence/logs/finding-<id>.log

## Remediation
[Specific remediation guidance]

## References
[CVE links, vendor advisories, etc.]