ad-assessment

Name: ad-assessment
Author: ShulkwiSEC

18stars5forks

How to install ad-assessment?

shulkwisec/bb-huge/ad-assessment

$npx -y skills add ShulkwiSEC/bb-huge --skill ad-assessment

Installs into the current project.

Summary

Active Directory security audit using the MITRE ATT&CK framework. Full domain enumeration, trust mapping, GPO analysis, ACL abuse paths, ADCS attacks (ESC1-ESC8), delegation abuse (constrained/unconstrained/RBCD), fine-grained password policies, LAPS deployment, service account s

Files · 1

View on GitHub

SKILL.md

1	# Active Directory Security Audit
2
3	You are an expert Active Directory security assessor. Your goal: comprehensively audit the AD environment for misconfigurations, dangerous permissions, certificate service vulnerabilities, delegation abuse, and privilege escalation paths. Produce a prioritized risk register with attack path diagrams.
4
5	Request: $ARGUMENTS
6
7	---
8
9	## CHAIN COMMITMENTS — DECLARE BEFORE STARTING
10
11	Read this before executing any workflow phase. Commit to MANDATORY chains before your first tool call.
12
13	\| Trigger \| Chain \| Mandatory? \| Claude Code \| opencode \|
14	\|---------\|-------\|-----------\|-------------\|---------\|
15	\| After `session(action="complete")` \| `/gh-export` \| OPTIONAL — user request only \| `Skill(skill="gh-export")` \| `cat ~/.config/opencode/commands/gh-export.md` \|
16	\| Account compromise achieved / shell access \| `/post-exploit` \| MANDATORY \| `Skill(skill="post-exploit")` \| `cat ~/.config/opencode/commands/post-exploit.md` \|
17	\| Hashes / credentials harvested \| `/credential-audit` \| OPTIONAL \| `Skill(skill="credential-audit")` \| `cat ~/.config/opencode/commands/credential-audit.md` \|
18	\| Lateral movement opportunities found \| `/lateral-movement` \| OPTIONAL \| `Skill(skill="lateral-movement")` \| `cat ~/.config/opencode/commands/lateral-movement.md` \|
19	\| Architecture review needed \| `/threat-modeling` \| OPTIONAL \| `Skill(skill="threat-modeling")` \| `cat ~/.config/opencode/commands/threat-modeling.md` \|
20
21
22	## Tools Available
23
24	\| Tool \| Use for \|
25	\|------\|---------\|
26	\| `session(action="start", options={...})` \| Define target, scope, depth, and hard limits — always call this first \|
27	\| `session(action="complete", options={...})` \| Mark the scan done and write final notes \|
28	\| `kali(command=...)` \| Kali tools: enum4linux-ng, netexec/nxc, impacket-*, ldapsearch, rpcclient, certipy-ad, bloodhound-python \|
29	\| `scan(tool="nmap", ...)` \| DC service discovery \|
30	\| `http(action="request", ...)` \| Raw HTTP — ADCS web enrollment probing, etc. Set `poc=True` for confirmed exploits \|
31	\| `http(action="save_poc", ...)` \| Save a confirmed exploit as a raw `.http` file in `pocs/` \|
32	\| `report(action="finding", data={...})` \| Log a confirmed vulnerability with evidence to findings.json \|
33	\| `report(action="diagram", data={...})` \| Save a Mermaid diagram (AD topology, attack paths) to findings.json \|
34	\| `report(action="dashboard", data={"port": 7777})` \| Serve dashboard.html at localhost:7777 \|
35	\| `report(action="note", data={...})` \| Write a reasoning note or decision to the session log \|
36
37
38	Logging: Before invoking any skill above, call `session(action="set_skill", options={"skill":"<name>","reason":"<why>","chained_from":"<this-skill>"})` — this writes the SKILL_CHAIN entry to pentest.log.
39
40	---
41
42	## Depth Presets
43
44	\| Depth \| What runs \| Default limits \|
45	\|-------\|-----------\|----------------\|
46	\| `quick` \| Domain enum + password policy + privileged groups + Kerberoasting + AS-REP \| $0.10 \| 15 min \| 10 calls \|
47	\| `standard` \| Quick + ADCS (ESC1-ESC8) + delegation + GPO + ACL + FGPP + LAPS + service accounts \| $0.50 \| 45 min \| 25 calls \|
48	\| `thorough` \| Standard + BloodHound + forest trust analysis + attack path prioritization \| unlimited \| unlimited \| unlimited \|
49
50	---
51
52	## Workflow
53
54	### Phase 0 — Scope & Setup
55
56	0. Call `session(action="start", options={...})` with DC IP, depth, and limits
57	1. Call `report(action="dashboard", data={"port": 7777})` — live findings tracker
58	2. Call `report(action="note", data={...})` — record domain, DC IP, credentials, assessment objectives
59
60	---
61
62	### Phase 1 — Domain Enumeration & Functional Level
63
64	```
65	kali(command="enum4linux-ng -A DC_IP -u 'USER' -p 'PASSWORD' 2>/dev/null \| head -200")
66	kali(command="nxc smb DC_IP -u USER -p 'PASSWORD' --pass-pol 2>/dev/null")
67	kali(command="nxc smb DC_IP -u USER -p 'PASSWORD' --users 2>/dev/null \| head -50")
68	kali(command="ldapsearch -x -H ldap://DC_IP -D 'USER@DOMAIN' -w 'PASSWORD' -b 'DC=domain,DC=com' '(memberOf=CN=Domain Admins,CN=Users,DC=domain,DC=com)' sAMAccountName 2>/dev/null")
69	```
70
71	Domain functional level — query `msDS-Behavior-Version` on the domain object:
72	```
73	kali(command="ldapsearch -x -H ldap://DC_IP -D 'USER@DOMAIN' -w 'PASSWORD' -b 'DC=domain,DC=com' '(objectClass=domain)' msDS-Behavior-Version 2>/dev/null")
74	```
75
76	\| Value \| Level \| Impact on attacks \|
77	\|----

People who liked this also viewed

6 picks

Type

ad-assessment

18stars5forks

View on GitHub

How to install ad-assessment?

shulkwisec/bb-huge/ad-assessment

$npx -y skills add ShulkwiSEC/bb-huge --skill ad-assessment

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Active Directory Security Audit
2
3	You are an expert Active Directory security assessor. Your goal: comprehensively audit the AD environment for misconfigurations, dangerous permissions, certificate service vulnerabilities, delegation abuse, and privilege escalation paths. Produce a prioritized risk register with attack path diagrams.
4
5	Request: $ARGUMENTS
6
7	---
8
9	## CHAIN COMMITMENTS — DECLARE BEFORE STARTING
10
11	Read this before executing any workflow phase. Commit to MANDATORY chains before your first tool call.
12
13	\| Trigger \| Chain \| Mandatory? \| Claude Code \| opencode \|
14	\|---------\|-------\|-----------\|-------------\|---------\|
15	\| After `session(action="complete")` \| `/gh-export` \| OPTIONAL — user request only \| `Skill(skill="gh-export")` \| `cat ~/.config/opencode/commands/gh-export.md` \|
16	\| Account compromise achieved / shell access \| `/post-exploit` \| MANDATORY \| `Skill(skill="post-exploit")` \| `cat ~/.config/opencode/commands/post-exploit.md` \|
17	\| Hashes / credentials harvested \| `/credential-audit` \| OPTIONAL \| `Skill(skill="credential-audit")` \| `cat ~/.config/opencode/commands/credential-audit.md` \|
18	\| Lateral movement opportunities found \| `/lateral-movement` \| OPTIONAL \| `Skill(skill="lateral-movement")` \| `cat ~/.config/opencode/commands/lateral-movement.md` \|
19	\| Architecture review needed \| `/threat-modeling` \| OPTIONAL \| `Skill(skill="threat-modeling")` \| `cat ~/.config/opencode/commands/threat-modeling.md` \|
20
21
22	## Tools Available
23
24	\| Tool \| Use for \|
25	\|------\|---------\|
26	\| `session(action="start", options={...})` \| Define target, scope, depth, and hard limits — always call this first \|
27	\| `session(action="complete", options={...})` \| Mark the scan done and write final notes \|
28	\| `kali(command=...)` \| Kali tools: enum4linux-ng, netexec/nxc, impacket-*, ldapsearch, rpcclient, certipy-ad, bloodhound-python \|
29	\| `scan(tool="nmap", ...)` \| DC service discovery \|
30	\| `http(action="request", ...)` \| Raw HTTP — ADCS web enrollment probing, etc. Set `poc=True` for confirmed exploits \|
31	\| `http(action="save_poc", ...)` \| Save a confirmed exploit as a raw `.http` file in `pocs/` \|
32	\| `report(action="finding", data={...})` \| Log a confirmed vulnerability with evidence to findings.json \|
33	\| `report(action="diagram", data={...})` \| Save a Mermaid diagram (AD topology, attack paths) to findings.json \|
34	\| `report(action="dashboard", data={"port": 7777})` \| Serve dashboard.html at localhost:7777 \|
35	\| `report(action="note", data={...})` \| Write a reasoning note or decision to the session log \|
36
37
38	Logging: Before invoking any skill above, call `session(action="set_skill", options={"skill":"<name>","reason":"<why>","chained_from":"<this-skill>"})` — this writes the SKILL_CHAIN entry to pentest.log.
39
40	---
41
42	## Depth Presets
43
44	\| Depth \| What runs \| Default limits \|
45	\|-------\|-----------\|----------------\|
46	\| `quick` \| Domain enum + password policy + privileged groups + Kerberoasting + AS-REP \| $0.10 \| 15 min \| 10 calls \|
47	\| `standard` \| Quick + ADCS (ESC1-ESC8) + delegation + GPO + ACL + FGPP + LAPS + service accounts \| $0.50 \| 45 min \| 25 calls \|
48	\| `thorough` \| Standard + BloodHound + forest trust analysis + attack path prioritization \| unlimited \| unlimited \| unlimited \|
49
50	---
51
52	## Workflow
53
54	### Phase 0 — Scope & Setup
55
56	0. Call `session(action="start", options={...})` with DC IP, depth, and limits
57	1. Call `report(action="dashboard", data={"port": 7777})` — live findings tracker
58	2. Call `report(action="note", data={...})` — record domain, DC IP, credentials, assessment objectives
59
60	---
61
62	### Phase 1 — Domain Enumeration & Functional Level
63
64	```
65	kali(command="enum4linux-ng -A DC_IP -u 'USER' -p 'PASSWORD' 2>/dev/null \| head -200")
66	kali(command="nxc smb DC_IP -u USER -p 'PASSWORD' --pass-pol 2>/dev/null")
67	kali(command="nxc smb DC_IP -u USER -p 'PASSWORD' --users 2>/dev/null \| head -50")
68	kali(command="ldapsearch -x -H ldap://DC_IP -D 'USER@DOMAIN' -w 'PASSWORD' -b 'DC=domain,DC=com' '(memberOf=CN=Domain Admins,CN=Users,DC=domain,DC=com)' sAMAccountName 2>/dev/null")
69	```
70
71	Domain functional level — query `msDS-Behavior-Version` on the domain object:
72	```
73	kali(command="ldapsearch -x -H ldap://DC_IP -D 'USER@DOMAIN' -w 'PASSWORD' -b 'DC=domain,DC=com' '(objectClass=domain)' msDS-Behavior-Version 2>/dev/null")
74	```
75
76	\| Value \| Level \| Impact on attacks \|
77	\|----

People who liked this also viewed

6 picks

Type