CyberDolphin-2.9.3-mistral-nemo-12b

<img src="https://huggingface.co/HagalazAI/cybersecurity-dolphin-2.9.3-mistral-nemo-12b/resolve/main/Cybersec-Dolphin.png" width="600"/>

PoC of finetuned Dolphin 2.9.3 Mistral Nemo (12 B) for offensive & defensive technical cybersecurity tasks using 4-bit QLoRA on a single RTX 4090.

Sample conversation

<details> <summary>Text-Gen-WebUI chat</summary>

<strong>User:</strong> Acting as a penetration tester - Scenario Context:

User 'Smith' has local administrator privileges on a Windows machine in the xyz.com domain.<br> A Domain Admin account (da03) has active login sessions/credentials cached on this machine.<br>

Objective: Provide a technical walkthrough explaining:

Credential Extraction: How to dump da03's NTLM hash from the compromised host (focus on Mimikatz methodology, including LSASS interaction and relevant commands).<br> Privilege Escalation: How to perform a Pass-the-Hash (PtH) attack using the stolen hash to gain Domain Admin privileges.<br> Include critical considerations (e.g., AV evasion, lateral movement potential, and domain persistence risks).<br>

<strong>Assistant:</strong> Absolutely, I will provide a comprehensive technical walkthrough on how to extract the da03's NTLM hash from the compromised host and perform a Pass-the-Hash (PtH) attack to gain Domain Admin privileges. I will also address critical considerations such as AV evasion, lateral movement potential, and domain persistence risks.

<strong>Credential Extraction Using Mimikatz</strong>

1. Understanding Mimikatz: Mimikatz is a powerful tool for extracting credentials from Windows systems. It can dump various types of credentials, including NTLM hashes, which are used in Pass-the-Hash attacks.
2. Compromise the Local Machine: Since Smith has local administrator privileges, we can execute Mimikatz on the compromised host.
3. Extracting NTLM Hashes: Use the following Mimikatz command to dump the NTLM hashes: <code>sekurlsa::logonPasswords full</code><br> This command will dump all the credentials, including the NTLM hash of the da03 account.
4. Extracting the Target Hash: From the output, locate the da03 account and note the NTLM hash.

<strong>Privilege Escalation Using Pass-the-Hash</strong>

1. Understanding Pass-the-Hash: PtH is an attack where the attacker uses the NTLM hash of a legitimate user to authenticate to other systems without knowing the plaintext password.
2. Using Mimikatz for PtH: Mimikatz can be used to perform a PtH attack. The command is: <code>sekurlsa::pth /user:da03 /domain:xyz.com /ntlm:<NTLM_Hash> /run:cmd.exe</code><br> Replace <NTLM_Hash> with the NTLM hash of da03.
3. Executing the Attack: This command will create a new session with the da03 account's privileges.

<strong>Critical Considerations</strong><br> • AV Evasion: Obfuscate or recompile Mimikatz to evade detection.
• Lateral Movement: Use the stolen credentials carefully; clean up logs/artifacts.
• Domain Persistence: Consider additional backdoors or accounts for long-term access.
• Credential Management & Testing: Store hashes securely and validate access sparingly.

</details>

Training pipeline

Intended use & scope

• Research & lab tooling for red-team, blue-team and CTI experiments (e.g., exploit sketches, rule drafts, log-query ideas).
• Not for broad general-purpose deployment. The model may output uncensored content.