active-directory-attack

Use when attacking a Windows Active Directory domain — Kerberos roasting/delegation, coercion + NTLM/Kerberos relay (CVE-2025-33073), ADCS ESC1-16 (EKUwu), ticket forgery & DCSync, dMSA BadSuccessor (CVE-2025-53779), BloodHound attack-path enumeration, domain dominance

Zur Installation springen

Repository: hypnguyen1209/offensive-claude
Letzte Quellaktivität: 29. Juni 2026 um 07:22
Erkannte Sprache von SKILL.md: Englisch
Sterne: 343
Forks: 59

Installationsoptionen

Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.

Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.

Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill active-directory-attack

Der Befehl bleibt in einer Zeile. Scrollen Sie horizontal, um ihn vor dem Kopieren vollständig zu prüfen.

Sie bevorzugen eine lokale Kopie? Laden Sie die Dateien herunter, die SkillsMP derzeit vorliegen.

Quelldateien prüfen

Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.

Datei-Explorer

13 Dateien

SKILL.md

Quellanweisungen · Schreibgeschützte Vorschau

Zurück zur Suche Zurück zur Installation

Active Directory Attacks

When to Activate

Attacking Windows domain environments after gaining any domain foothold (creds, hash, or unauth network position)

Kerberos exploitation: Kerberoasting, AS-REP roasting, delegation (RBCD/constrained/unconstrained), ticket forgery

Coercion + NTLM/Kerberos relay chains (PetitPotam/DFSCoerce → LDAP/ADCS, NTLM reflection CVE-2025-33073)

ADCS certificate-template abuse (ESC1-ESC16) and certificate-based domain takeover

dMSA / BadSuccessor privilege escalation on Windows Server 2025 domains

BloodHound CE attack-path discovery, lateral movement, DCSync, and domain-dominance persistence

Technique Map

Technique

ATT&CK

CWE

Reference

Script

BloodHound CE / SharpHound enumeration

T1482

CWE-732

references/bloodhound-enum-lateral.md

scripts/ad_recon.py

Password spray / PtH / PtT lateral movement

T1550.002, T1550.003

CWE-522

references/bloodhound-enum-lateral.md

scripts/ad_recon.py

LAPS / gMSA password read

T1003

CWE-522

references/bloodhound-enum-lateral.md

scripts/ad_recon.py

Kerberoasting

T1558.003

CWE-261

references/kerberos-roasting-delegation.md

scripts/kerberoast_audit.py

AS-REP roasting

T1558.004

CWE-308

references/kerberos-roasting-delegation.md

scripts/kerberoast_audit.py

Resource-Based Constrained Delegation (RBCD)

T1558, T1098

CWE-269

references/kerberos-roasting-delegation.md

scripts/rbcd_takeover.py

Constrained/Unconstrained delegation (S4U)

T1558

CWE-269

references/kerberos-roasting-delegation.md

scripts/rbcd_takeover.py

Coercion (PetitPotam/DFSCoerce/PrinterBug/WebDAV)

T1187

CWE-294

references/coercion-relay.md

scripts/coerce_relay_chain.sh

NTLM relay (SMB/LDAP/ADCS)

T1557.001

CWE-294

references/coercion-relay.md

scripts/coerce_relay_chain.sh

Active Directory Attacks

When to Activate

Attacking Windows domain environments after gaining any domain foothold (creds, hash, or unauth network position)

Kerberos exploitation: Kerberoasting, AS-REP roasting, delegation (RBCD/constrained/unconstrained), ticket forgery

Coercion + NTLM/Kerberos relay chains (PetitPotam/DFSCoerce → LDAP/ADCS, NTLM reflection CVE-2025-33073)

ADCS certificate-template abuse (ESC1-ESC16) and certificate-based domain takeover

dMSA / BadSuccessor privilege escalation on Windows Server 2025 domains

BloodHound CE attack-path discovery, lateral movement, DCSync, and domain-dominance persistence

Technique Map

Technique

ATT&CK

CWE

Reference

Script

BloodHound CE / SharpHound enumeration

T1482

CWE-732

references/bloodhound-enum-lateral.md

scripts/ad_recon.py

Password spray / PtH / PtT lateral movement

T1550.002, T1550.003

CWE-522

references/bloodhound-enum-lateral.md

scripts/ad_recon.py

LAPS / gMSA password read

T1003

CWE-522

references/bloodhound-enum-lateral.md

scripts/ad_recon.py

Kerberoasting

T1558.003

CWE-261

references/kerberos-roasting-delegation.md

scripts/kerberoast_audit.py

AS-REP roasting

T1558.004

CWE-308

references/kerberos-roasting-delegation.md

scripts/kerberoast_audit.py

Resource-Based Constrained Delegation (RBCD)

T1558, T1098

CWE-269

references/kerberos-roasting-delegation.md

scripts/rbcd_takeover.py

Constrained/Unconstrained delegation (S4U)

T1558

CWE-269

references/kerberos-roasting-delegation.md

scripts/rbcd_takeover.py

Coercion (PetitPotam/DFSCoerce/PrinterBug/WebDAV)

T1187

CWE-294

references/coercion-relay.md

scripts/coerce_relay_chain.sh

NTLM relay (SMB/LDAP/ADCS)

T1557.001

CWE-294

references/coercion-relay.md

scripts/coerce_relay_chain.sh

name	active-directory-attack
description	Use when attacking a Windows Active Directory domain — Kerberos roasting/delegation, coercion + NTLM/Kerberos relay (CVE-2025-33073), ADCS ESC1-16 (EKUwu), ticket forgery & DCSync, dMSA BadSuccessor (CVE-2025-53779), BloodHound attack-path enumeration, domain dominance
metadata	{"type":"offensive","phase":"exploitation","tools":"impacket, certipy, rubeus, bloodhound-ce, netexec, krbrelayx, ntlmrelayx, bloodyAD, mimikatz, kerbrute, SharpSuccessor","mitre":"TA0008"}
kill_chain	{"phase":["exploit","actions"],"step":[4,7],"attck_tactics":["TA0006","TA0008","TA0004","TA0003"],"attck_techniques":["T1558","T1558.003","T1558.004","T1558.001","T1187","T1557","T1557.001","T1003.006","T1550.002","T1550.003","T1484.001","T1098","T1207"]}
depends_on	["network-attack","privesc-windows"]
feeds_into	["red-team-ops","advanced-redteam"]
inputs	["domain_info","user_context","foothold_creds"]
outputs	["domain_admin_access","finding_record","credential_dump","forged_tickets"]
references	["references/bloodhound-enum-lateral.md","references/kerberos-roasting-delegation.md","references/coercion-relay.md","references/adcs-abuse.md","references/ticket-forgery-dcsync.md","references/dmsa-badsuccessor.md"]
scripts	["scripts/ad_recon.py","scripts/kerberoast_audit.py","scripts/rbcd_takeover.py","scripts/coerce_relay_chain.sh","scripts/Get-BadSuccessorOUPermissions.ps1","scripts/adcs_esc_finder.py"]

name	active-directory-attack
description	Use when attacking a Windows Active Directory domain — Kerberos roasting/delegation, coercion + NTLM/Kerberos relay (CVE-2025-33073), ADCS ESC1-16 (EKUwu), ticket forgery & DCSync, dMSA BadSuccessor (CVE-2025-53779), BloodHound attack-path enumeration, domain dominance
metadata	{"type":"offensive","phase":"exploitation","tools":"impacket, certipy, rubeus, bloodhound-ce, netexec, krbrelayx, ntlmrelayx, bloodyAD, mimikatz, kerbrute, SharpSuccessor","mitre":"TA0008"}
kill_chain	{"phase":["exploit","actions"],"step":[4,7],"attck_tactics":["TA0006","TA0008","TA0004","TA0003"],"attck_techniques":["T1558","T1558.003","T1558.004","T1558.001","T1187","T1557","T1557.001","T1003.006","T1550.002","T1550.003","T1484.001","T1098","T1207"]}
depends_on	["network-attack","privesc-windows"]
feeds_into	["red-team-ops","advanced-redteam"]
inputs	["domain_info","user_context","foothold_creds"]
outputs	["domain_admin_access","finding_record","credential_dump","forged_tickets"]
references	["references/bloodhound-enum-lateral.md","references/kerberos-roasting-delegation.md","references/coercion-relay.md","references/adcs-abuse.md","references/ticket-forgery-dcsync.md","references/dmsa-badsuccessor.md"]
scripts	["scripts/ad_recon.py","scripts/kerberoast_audit.py","scripts/rbcd_takeover.py","scripts/coerce_relay_chain.sh","scripts/Get-BadSuccessorOUPermissions.ps1","scripts/adcs_esc_finder.py"]

Technique	Telemetry / IOC	Detection (Sigma / EDR)	OPSEC note
SharpHound/LDAP enum	Hundreds of LDAP queries from one host; 4662 directory access	SIEM rule: single source > N LDAP queries/minute; ADWS 9389 spikes	Throttle `--throttle/--jitter`; prefer ADWS (SOAPHound) to dodge LDAP heuristics
Kerberoasting	4769 TGS-REQ with RC4 (0x17) for many SPNs from one host	Sigma `win_security_susp_kerberos_manipulation`; alert on RC4 TGS bursts	Request AES-only SPNs sparingly; `/rc4opsec`; roast few accounts, slow
AS-REP roasting	4768 AS-REQ no-preauth; etype 23	Alert on AS-REQ for DONT_REQ_PREAUTH accounts	Only target accounts BloodHound flags; offline crack
Coercion	EFSRPC/DFSNM/RPRN named-pipe calls; auth from server to odd host	Sigma `coercion`/`PetitPotam`; RPC firewall (RpcFilter) logs	Coercion is "by design"; NTLM removal on 2025/24H2 forces Kerberos fallback
NTLM relay / reflection	4624/4648 NTLM logon to self; SMB→LDAP from non-server	Detect SMB-signing:False targets; CVE-2025-33073 DNS marshalled record	Needs signing:False target; patch (Jun 2025) detects marshalled DNS struct
ADCS ESC	4886/4887 cert issuance; cert with arbitrary SAN/UPN; client-auth EKU on web template	Sigma ADCS issuance anomalies; certutil monitoring; ESC15 EKU injection	Restore templates (ESC4); EPA on certsrv breaks ESC8 relay
Ticket forgery	TGT lifetime anomalies; PAC w/o validation; 4769 for krbtgt SPN	Golden: ticket lifetime > policy; Sapphire mimics real PAC (hard)	Match domain ticket policy lifetimes; use AES keys not RC4
DCSync	4662 DRSUAPI GetNCChanges from non-DC	Sigma `dcsync`; alert DRSUAPI replication from non-DC IP	Run from a host that looks like a DC; avoid `/all`, target krbtgt only
dMSA BadSuccessor	5137 dMSA create; 5136 write to msDS-ManagedAccountPrecededByLink	Sigma SharpSuccessor exec; SACL on dMSA attrs (off by default!)	Patched (Aug 2025) needs both sides controlled; still a creds-dump primitive

active-directory-attack

Installationsoptionen

Quelldateien prüfen