Menú
Active Directory attack lane — BloodHound ingestion, Kerberoasting, ADCS ESC scanning, DCSync, LAPS extraction.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Basado en la clasificación ocupacional SOC
Benchmark mode marker — engagement objective is flag capture. Generic engagement rules apply unchanged.
Exploit Active Directory Certificate Services ESC1 — vulnerable template allows arbitrary SAN, enabling user impersonation up to domain admin.
BloodHound ingestion + canonical Cypher queries for AD attack-path enumeration. Run after collector dumps zip; promotes findings into the knowledge graph.
NetExec (CrackMapExec successor) — unified SMB/LDAP/MSSQL/WinRM/RDP/SSH/FTP/VNC protocol auth + post-auth modules. 200+ modules incl. BloodHound auto-ingest, ESC1-15 scanning, PrintNightmare, LDAP relay.
Red team engagement lifecycle management — initiation, phase transitions, go/no-go gates, deconfliction, emergency procedures, completion.
Mandatory first-turn startup procedure — checks for existing engagements, resume/new selection, workspace initialization.
| name | ad |
| description | Active Directory attack lane — BloodHound ingestion, Kerberoasting, ADCS ESC scanning, DCSync, LAPS extraction. |
| metadata | {"subdomain":"active-directory"} |
| Skill | Use for |
|---|---|
/skills/standard/ad/bloodhound-query/SKILL.md | Ingest + common Cypher queries |
/skills/standard/ad/kerberoasting/SKILL.md | Roast SPN users, crack with hashcat |
/skills/standard/ad/asrep-roasting/SKILL.md | dontreqpreauth users |
/skills/standard/ad/adcs-esc1/SKILL.md | ESC1 template abuse → domain admin |
/skills/standard/ad/dcsync/SKILL.md | Replication rights → krbtgt dump |
/skills/standard/ad/laps/SKILL.md | LAPS local admin password extraction |
/skills/standard/ad/netexec/SKILL.md | NetExec (formerly CrackMapExec) cheatsheet — SMB/WinRM/LDAP/MSSQL modules |
bash("bloodhound-python -u user -p pass -d DOMAIN -c all --zip")bh_ingest_zip("/workspace/bh.zip")dcsync_check — if any principal, that's instant domain compromisekg_query(kind="user") and filter for hasspn=true → Kerberoast queuekg_query(kind="user") and filter for dontreqpreauth=true → AS-REP roastbash("certipy find -u user -p pass -dc-ip X -json") then adcs_auditplan_attack_chains to see graph-computed domain compromise pathskg_add_node(kind="crown_jewel", label="Domain Admins group")
kg_add_node(kind="crown_jewel", label="krbtgt account")
kg_add_node(kind="crown_jewel", label="DC: DC01.corp.local")