active-directory-attack

Use when attacking a Windows Active Directory domain — Kerberos roasting/delegation, coercion + NTLM/Kerberos relay (CVE-2025-33073), ADCS ESC1-16 (EKUwu), ticket forgery & DCSync, dMSA BadSuccessor (CVE-2025-53779), BloodHound attack-path enumeration, domain dominance

Jump to install

Repository: hypnguyen1209/offensive-claude
Last source activity: June 29, 2026 at 07:22
Detected SKILL.md language: English
Stars: 343
Forks: 59

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill active-directory-attack

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

13 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

Active Directory Attacks

When to Activate

Attacking Windows domain environments after gaining any domain foothold (creds, hash, or unauth network position)

Kerberos exploitation: Kerberoasting, AS-REP roasting, delegation (RBCD/constrained/unconstrained), ticket forgery

Coercion + NTLM/Kerberos relay chains (PetitPotam/DFSCoerce → LDAP/ADCS, NTLM reflection CVE-2025-33073)

ADCS certificate-template abuse (ESC1-ESC16) and certificate-based domain takeover

dMSA / BadSuccessor privilege escalation on Windows Server 2025 domains

BloodHound CE attack-path discovery, lateral movement, DCSync, and domain-dominance persistence

Technique Map

Technique

ATT&CK

CWE

Reference

Script

BloodHound CE / SharpHound enumeration

T1482

CWE-732

references/bloodhound-enum-lateral.md

scripts/ad_recon.py

Password spray / PtH / PtT lateral movement

T1550.002, T1550.003

CWE-522

references/bloodhound-enum-lateral.md

scripts/ad_recon.py

LAPS / gMSA password read

T1003

CWE-522

references/bloodhound-enum-lateral.md

scripts/ad_recon.py

Kerberoasting

T1558.003

CWE-261

references/kerberos-roasting-delegation.md

scripts/kerberoast_audit.py

AS-REP roasting

T1558.004

CWE-308

references/kerberos-roasting-delegation.md

scripts/kerberoast_audit.py

Resource-Based Constrained Delegation (RBCD)

T1558, T1098

CWE-269

references/kerberos-roasting-delegation.md

scripts/rbcd_takeover.py

Constrained/Unconstrained delegation (S4U)

T1558

CWE-269

references/kerberos-roasting-delegation.md

scripts/rbcd_takeover.py

Coercion (PetitPotam/DFSCoerce/PrinterBug/WebDAV)

T1187

CWE-294

references/coercion-relay.md

scripts/coerce_relay_chain.sh

NTLM relay (SMB/LDAP/ADCS)

T1557.001

CWE-294

references/coercion-relay.md

scripts/coerce_relay_chain.sh

Active Directory Attacks

When to Activate

Attacking Windows domain environments after gaining any domain foothold (creds, hash, or unauth network position)

Kerberos exploitation: Kerberoasting, AS-REP roasting, delegation (RBCD/constrained/unconstrained), ticket forgery

Coercion + NTLM/Kerberos relay chains (PetitPotam/DFSCoerce → LDAP/ADCS, NTLM reflection CVE-2025-33073)

ADCS certificate-template abuse (ESC1-ESC16) and certificate-based domain takeover

dMSA / BadSuccessor privilege escalation on Windows Server 2025 domains

BloodHound CE attack-path discovery, lateral movement, DCSync, and domain-dominance persistence

Technique Map

Technique

ATT&CK

CWE

Reference

Script

BloodHound CE / SharpHound enumeration

T1482

CWE-732

references/bloodhound-enum-lateral.md

scripts/ad_recon.py

Password spray / PtH / PtT lateral movement

T1550.002, T1550.003

CWE-522

references/bloodhound-enum-lateral.md

scripts/ad_recon.py

LAPS / gMSA password read

T1003

CWE-522

references/bloodhound-enum-lateral.md

scripts/ad_recon.py

Kerberoasting

T1558.003

CWE-261

references/kerberos-roasting-delegation.md

scripts/kerberoast_audit.py

AS-REP roasting

T1558.004

CWE-308

references/kerberos-roasting-delegation.md

scripts/kerberoast_audit.py

Resource-Based Constrained Delegation (RBCD)

T1558, T1098

CWE-269

references/kerberos-roasting-delegation.md

scripts/rbcd_takeover.py

Constrained/Unconstrained delegation (S4U)

T1558

CWE-269

references/kerberos-roasting-delegation.md

scripts/rbcd_takeover.py

Coercion (PetitPotam/DFSCoerce/PrinterBug/WebDAV)

T1187

CWE-294

references/coercion-relay.md

scripts/coerce_relay_chain.sh

NTLM relay (SMB/LDAP/ADCS)

T1557.001

CWE-294

references/coercion-relay.md

scripts/coerce_relay_chain.sh

name	active-directory-attack
description	Use when attacking a Windows Active Directory domain — Kerberos roasting/delegation, coercion + NTLM/Kerberos relay (CVE-2025-33073), ADCS ESC1-16 (EKUwu), ticket forgery & DCSync, dMSA BadSuccessor (CVE-2025-53779), BloodHound attack-path enumeration, domain dominance
metadata	{"type":"offensive","phase":"exploitation","tools":"impacket, certipy, rubeus, bloodhound-ce, netexec, krbrelayx, ntlmrelayx, bloodyAD, mimikatz, kerbrute, SharpSuccessor","mitre":"TA0008"}
kill_chain	{"phase":["exploit","actions"],"step":[4,7],"attck_tactics":["TA0006","TA0008","TA0004","TA0003"],"attck_techniques":["T1558","T1558.003","T1558.004","T1558.001","T1187","T1557","T1557.001","T1003.006","T1550.002","T1550.003","T1484.001","T1098","T1207"]}
depends_on	["network-attack","privesc-windows"]
feeds_into	["red-team-ops","advanced-redteam"]
inputs	["domain_info","user_context","foothold_creds"]
outputs	["domain_admin_access","finding_record","credential_dump","forged_tickets"]
references	["references/bloodhound-enum-lateral.md","references/kerberos-roasting-delegation.md","references/coercion-relay.md","references/adcs-abuse.md","references/ticket-forgery-dcsync.md","references/dmsa-badsuccessor.md"]
scripts	["scripts/ad_recon.py","scripts/kerberoast_audit.py","scripts/rbcd_takeover.py","scripts/coerce_relay_chain.sh","scripts/Get-BadSuccessorOUPermissions.ps1","scripts/adcs_esc_finder.py"]

name	active-directory-attack
description	Use when attacking a Windows Active Directory domain — Kerberos roasting/delegation, coercion + NTLM/Kerberos relay (CVE-2025-33073), ADCS ESC1-16 (EKUwu), ticket forgery & DCSync, dMSA BadSuccessor (CVE-2025-53779), BloodHound attack-path enumeration, domain dominance
metadata	{"type":"offensive","phase":"exploitation","tools":"impacket, certipy, rubeus, bloodhound-ce, netexec, krbrelayx, ntlmrelayx, bloodyAD, mimikatz, kerbrute, SharpSuccessor","mitre":"TA0008"}
kill_chain	{"phase":["exploit","actions"],"step":[4,7],"attck_tactics":["TA0006","TA0008","TA0004","TA0003"],"attck_techniques":["T1558","T1558.003","T1558.004","T1558.001","T1187","T1557","T1557.001","T1003.006","T1550.002","T1550.003","T1484.001","T1098","T1207"]}
depends_on	["network-attack","privesc-windows"]
feeds_into	["red-team-ops","advanced-redteam"]
inputs	["domain_info","user_context","foothold_creds"]
outputs	["domain_admin_access","finding_record","credential_dump","forged_tickets"]
references	["references/bloodhound-enum-lateral.md","references/kerberos-roasting-delegation.md","references/coercion-relay.md","references/adcs-abuse.md","references/ticket-forgery-dcsync.md","references/dmsa-badsuccessor.md"]
scripts	["scripts/ad_recon.py","scripts/kerberoast_audit.py","scripts/rbcd_takeover.py","scripts/coerce_relay_chain.sh","scripts/Get-BadSuccessorOUPermissions.ps1","scripts/adcs_esc_finder.py"]

Technique	Telemetry / IOC	Detection (Sigma / EDR)	OPSEC note
SharpHound/LDAP enum	Hundreds of LDAP queries from one host; 4662 directory access	SIEM rule: single source > N LDAP queries/minute; ADWS 9389 spikes	Throttle `--throttle/--jitter`; prefer ADWS (SOAPHound) to dodge LDAP heuristics
Kerberoasting	4769 TGS-REQ with RC4 (0x17) for many SPNs from one host	Sigma `win_security_susp_kerberos_manipulation`; alert on RC4 TGS bursts	Request AES-only SPNs sparingly; `/rc4opsec`; roast few accounts, slow
AS-REP roasting	4768 AS-REQ no-preauth; etype 23	Alert on AS-REQ for DONT_REQ_PREAUTH accounts	Only target accounts BloodHound flags; offline crack
Coercion	EFSRPC/DFSNM/RPRN named-pipe calls; auth from server to odd host	Sigma `coercion`/`PetitPotam`; RPC firewall (RpcFilter) logs	Coercion is "by design"; NTLM removal on 2025/24H2 forces Kerberos fallback
NTLM relay / reflection	4624/4648 NTLM logon to self; SMB→LDAP from non-server	Detect SMB-signing:False targets; CVE-2025-33073 DNS marshalled record	Needs signing:False target; patch (Jun 2025) detects marshalled DNS struct
ADCS ESC	4886/4887 cert issuance; cert with arbitrary SAN/UPN; client-auth EKU on web template	Sigma ADCS issuance anomalies; certutil monitoring; ESC15 EKU injection	Restore templates (ESC4); EPA on certsrv breaks ESC8 relay
Ticket forgery	TGT lifetime anomalies; PAC w/o validation; 4769 for krbtgt SPN	Golden: ticket lifetime > policy; Sapphire mimics real PAC (hard)	Match domain ticket policy lifetimes; use AES keys not RC4
DCSync	4662 DRSUAPI GetNCChanges from non-DC	Sigma `dcsync`; alert DRSUAPI replication from non-DC IP	Run from a host that looks like a DC; avoid `/all`, target krbtgt only
dMSA BadSuccessor	5137 dMSA create; 5136 write to msDS-ManagedAccountPrecededByLink	Sigma SharpSuccessor exec; SACL on dMSA attrs (off by default!)	Patched (Aug 2025) needs both sides controlled; still a creds-dump primitive

active-directory-attack

Install options

Review the source files