Agent skill · security · yaklang
unauthorized-access-common-services
Unauthorized access playbook for common exposed services. Use when Redis, Rsync, PHP-FPM, AJP/Ghostcat, Hadoop YARN, H2 Console, or similar management interfaces are exposed without authentication.
Why this skill is useful
Adds detailed exploitation techniques and scripts for unauthorized access to various management interfaces that are not widely documented.
What it needs
Requires nmap, redis, rsync installed locally. About 5k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Unauthorized Access to Common Services — Expert Attack Playbook AI LOAD INSTRUCTION: Expert techniques for exploiting unauthenticated or weakly authenticated management services. Covers Redis write-to-RCE, Rsync data theft, PHP-FPM code execution, Ghostcat AJP file read, Hadoop YARN job submission, and H2 Console JNDI. These are infrastructure-level findings distinct from web application vulnerabilities. 0. RELATED ROUTING ssrf-server-side-request-forgery when these services are reachable via SSRF (e.g., SSRF → Redis) jndi-injection when H2 Console or similar accepts JNDI connection strings deserialization-insecure when RMI Registry or T3 protocol is exposed network-protocol-attacks for layer 2/3 attacks during service enumeration reverse-shell-techniques for shell payloads after gaining command execution Comprehensive Port Reference Also load PORTSERVICEMATRIX.md when you need: Full exploitation matrix organized by port number (20+ services) Enumeration, brute force, and post-exploitation per service Quick triage during nmap/masscan output analysis --- 1. DISCOVERY — PORT SCANNING --- 2. REDIS (PORT 6379) Detection Write SSH Authorized Keys Write Crontab (Reverse Shell) Write Webshell Master-Slave Replication RCE Use redis-rogue-server to exploit master-slave replication for loading malicious .so module: Hardening --- 3. RSYNC (PORT 873) Detection Exploitation — Write Crontab Hardening --- 4. PHP-FPM / FASTCGI (PORT 9000) Mechanism PHP-FPM listens for FastCGI requests. If exposed to the network (instead of Unix socket), an attacker can send crafted FastCGI packets to execute arbitrary PHP code. Exploitation Key FastCGI Environment Variables for Exploitation Via SSRF (gopher) Hardening --- 5. GHOSTCAT — AJP (PORT 8009) — CVE-2020-1938 Mechanism Apache JServ Protocol (AJP) is used between reverse proxy and Tomcat. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/unauthorized-access-common-services