active-directory-attack

Use when attacking a Windows Active Directory domain — Kerberos roasting/delegation, coercion + NTLM/Kerberos relay (CVE-2025-33073), ADCS ESC1-16 (EKUwu), ticket forgery & DCSync, dMSA BadSuccessor (CVE-2025-53779), BloodHound attack-path enumeration, domain dominance

Ir a la instalación

Repositorio: hypnguyen1209/offensive-claude
Última actividad en el origen: 29 de junio de 2026 a las 07:22
Idioma detectado de SKILL.md: inglés
Estrellas: 343
Forks: 59

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill active-directory-attack

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

Explorador de archivos

13 archivos

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

Active Directory Attacks

When to Activate

Attacking Windows domain environments after gaining any domain foothold (creds, hash, or unauth network position)

Kerberos exploitation: Kerberoasting, AS-REP roasting, delegation (RBCD/constrained/unconstrained), ticket forgery

Coercion + NTLM/Kerberos relay chains (PetitPotam/DFSCoerce → LDAP/ADCS, NTLM reflection CVE-2025-33073)

ADCS certificate-template abuse (ESC1-ESC16) and certificate-based domain takeover

dMSA / BadSuccessor privilege escalation on Windows Server 2025 domains

BloodHound CE attack-path discovery, lateral movement, DCSync, and domain-dominance persistence

Technique Map

Technique

ATT&CK

CWE

Reference

Script

BloodHound CE / SharpHound enumeration

T1482

CWE-732

references/bloodhound-enum-lateral.md

scripts/ad_recon.py

Password spray / PtH / PtT lateral movement

T1550.002, T1550.003

CWE-522

references/bloodhound-enum-lateral.md

scripts/ad_recon.py

LAPS / gMSA password read

T1003

CWE-522

references/bloodhound-enum-lateral.md

scripts/ad_recon.py

Kerberoasting

T1558.003

CWE-261

references/kerberos-roasting-delegation.md

scripts/kerberoast_audit.py

AS-REP roasting

T1558.004

CWE-308

references/kerberos-roasting-delegation.md

scripts/kerberoast_audit.py

Resource-Based Constrained Delegation (RBCD)

T1558, T1098

CWE-269

references/kerberos-roasting-delegation.md

scripts/rbcd_takeover.py

Constrained/Unconstrained delegation (S4U)

T1558

CWE-269

references/kerberos-roasting-delegation.md

scripts/rbcd_takeover.py

Coercion (PetitPotam/DFSCoerce/PrinterBug/WebDAV)

T1187

CWE-294

references/coercion-relay.md

scripts/coerce_relay_chain.sh

NTLM relay (SMB/LDAP/ADCS)

T1557.001

CWE-294

references/coercion-relay.md

scripts/coerce_relay_chain.sh

Active Directory Attacks

When to Activate

Attacking Windows domain environments after gaining any domain foothold (creds, hash, or unauth network position)

Kerberos exploitation: Kerberoasting, AS-REP roasting, delegation (RBCD/constrained/unconstrained), ticket forgery

Coercion + NTLM/Kerberos relay chains (PetitPotam/DFSCoerce → LDAP/ADCS, NTLM reflection CVE-2025-33073)

ADCS certificate-template abuse (ESC1-ESC16) and certificate-based domain takeover

dMSA / BadSuccessor privilege escalation on Windows Server 2025 domains

BloodHound CE attack-path discovery, lateral movement, DCSync, and domain-dominance persistence

Technique Map

Technique

ATT&CK

CWE

Reference

Script

BloodHound CE / SharpHound enumeration

T1482

CWE-732

references/bloodhound-enum-lateral.md

scripts/ad_recon.py

Password spray / PtH / PtT lateral movement

T1550.002, T1550.003

CWE-522

references/bloodhound-enum-lateral.md

scripts/ad_recon.py

LAPS / gMSA password read

T1003

CWE-522

references/bloodhound-enum-lateral.md

scripts/ad_recon.py

Kerberoasting

T1558.003

CWE-261

references/kerberos-roasting-delegation.md

scripts/kerberoast_audit.py

AS-REP roasting

T1558.004

CWE-308

references/kerberos-roasting-delegation.md

scripts/kerberoast_audit.py

Resource-Based Constrained Delegation (RBCD)

T1558, T1098

CWE-269

references/kerberos-roasting-delegation.md

scripts/rbcd_takeover.py

Constrained/Unconstrained delegation (S4U)

T1558

CWE-269

references/kerberos-roasting-delegation.md

scripts/rbcd_takeover.py

Coercion (PetitPotam/DFSCoerce/PrinterBug/WebDAV)

T1187

CWE-294

references/coercion-relay.md

scripts/coerce_relay_chain.sh

NTLM relay (SMB/LDAP/ADCS)

T1557.001

CWE-294

references/coercion-relay.md

scripts/coerce_relay_chain.sh

name	active-directory-attack
description	Use when attacking a Windows Active Directory domain — Kerberos roasting/delegation, coercion + NTLM/Kerberos relay (CVE-2025-33073), ADCS ESC1-16 (EKUwu), ticket forgery & DCSync, dMSA BadSuccessor (CVE-2025-53779), BloodHound attack-path enumeration, domain dominance
metadata	{"type":"offensive","phase":"exploitation","tools":"impacket, certipy, rubeus, bloodhound-ce, netexec, krbrelayx, ntlmrelayx, bloodyAD, mimikatz, kerbrute, SharpSuccessor","mitre":"TA0008"}
kill_chain	{"phase":["exploit","actions"],"step":[4,7],"attck_tactics":["TA0006","TA0008","TA0004","TA0003"],"attck_techniques":["T1558","T1558.003","T1558.004","T1558.001","T1187","T1557","T1557.001","T1003.006","T1550.002","T1550.003","T1484.001","T1098","T1207"]}
depends_on	["network-attack","privesc-windows"]
feeds_into	["red-team-ops","advanced-redteam"]
inputs	["domain_info","user_context","foothold_creds"]
outputs	["domain_admin_access","finding_record","credential_dump","forged_tickets"]
references	["references/bloodhound-enum-lateral.md","references/kerberos-roasting-delegation.md","references/coercion-relay.md","references/adcs-abuse.md","references/ticket-forgery-dcsync.md","references/dmsa-badsuccessor.md"]
scripts	["scripts/ad_recon.py","scripts/kerberoast_audit.py","scripts/rbcd_takeover.py","scripts/coerce_relay_chain.sh","scripts/Get-BadSuccessorOUPermissions.ps1","scripts/adcs_esc_finder.py"]

name	active-directory-attack
description	Use when attacking a Windows Active Directory domain — Kerberos roasting/delegation, coercion + NTLM/Kerberos relay (CVE-2025-33073), ADCS ESC1-16 (EKUwu), ticket forgery & DCSync, dMSA BadSuccessor (CVE-2025-53779), BloodHound attack-path enumeration, domain dominance
metadata	{"type":"offensive","phase":"exploitation","tools":"impacket, certipy, rubeus, bloodhound-ce, netexec, krbrelayx, ntlmrelayx, bloodyAD, mimikatz, kerbrute, SharpSuccessor","mitre":"TA0008"}
kill_chain	{"phase":["exploit","actions"],"step":[4,7],"attck_tactics":["TA0006","TA0008","TA0004","TA0003"],"attck_techniques":["T1558","T1558.003","T1558.004","T1558.001","T1187","T1557","T1557.001","T1003.006","T1550.002","T1550.003","T1484.001","T1098","T1207"]}
depends_on	["network-attack","privesc-windows"]
feeds_into	["red-team-ops","advanced-redteam"]
inputs	["domain_info","user_context","foothold_creds"]
outputs	["domain_admin_access","finding_record","credential_dump","forged_tickets"]
references	["references/bloodhound-enum-lateral.md","references/kerberos-roasting-delegation.md","references/coercion-relay.md","references/adcs-abuse.md","references/ticket-forgery-dcsync.md","references/dmsa-badsuccessor.md"]
scripts	["scripts/ad_recon.py","scripts/kerberoast_audit.py","scripts/rbcd_takeover.py","scripts/coerce_relay_chain.sh","scripts/Get-BadSuccessorOUPermissions.ps1","scripts/adcs_esc_finder.py"]

Technique	Telemetry / IOC	Detection (Sigma / EDR)	OPSEC note
SharpHound/LDAP enum	Hundreds of LDAP queries from one host; 4662 directory access	SIEM rule: single source > N LDAP queries/minute; ADWS 9389 spikes	Throttle `--throttle/--jitter`; prefer ADWS (SOAPHound) to dodge LDAP heuristics
Kerberoasting	4769 TGS-REQ with RC4 (0x17) for many SPNs from one host	Sigma `win_security_susp_kerberos_manipulation`; alert on RC4 TGS bursts	Request AES-only SPNs sparingly; `/rc4opsec`; roast few accounts, slow
AS-REP roasting	4768 AS-REQ no-preauth; etype 23	Alert on AS-REQ for DONT_REQ_PREAUTH accounts	Only target accounts BloodHound flags; offline crack
Coercion	EFSRPC/DFSNM/RPRN named-pipe calls; auth from server to odd host	Sigma `coercion`/`PetitPotam`; RPC firewall (RpcFilter) logs	Coercion is "by design"; NTLM removal on 2025/24H2 forces Kerberos fallback
NTLM relay / reflection	4624/4648 NTLM logon to self; SMB→LDAP from non-server	Detect SMB-signing:False targets; CVE-2025-33073 DNS marshalled record	Needs signing:False target; patch (Jun 2025) detects marshalled DNS struct
ADCS ESC	4886/4887 cert issuance; cert with arbitrary SAN/UPN; client-auth EKU on web template	Sigma ADCS issuance anomalies; certutil monitoring; ESC15 EKU injection	Restore templates (ESC4); EPA on certsrv breaks ESC8 relay
Ticket forgery	TGT lifetime anomalies; PAC w/o validation; 4769 for krbtgt SPN	Golden: ticket lifetime > policy; Sapphire mimics real PAC (hard)	Match domain ticket policy lifetimes; use AES keys not RC4
DCSync	4662 DRSUAPI GetNCChanges from non-DC	Sigma `dcsync`; alert DRSUAPI replication from non-DC IP	Run from a host that looks like a DC; avoid `/all`, target krbtgt only
dMSA BadSuccessor	5137 dMSA create; 5136 write to msDS-ManagedAccountPrecededByLink	Sigma SharpSuccessor exec; SACL on dMSA attrs (off by default!)	Patched (Aug 2025) needs both sides controlled; still a creds-dump primitive

active-directory-attack

Opciones de instalación

Revisa los archivos de origen