active-directory-attack

Use when attacking a Windows Active Directory domain — Kerberos roasting/delegation, coercion + NTLM/Kerberos relay (CVE-2025-33073), ADCS ESC1-16 (EKUwu), ticket forgery & DCSync, dMSA BadSuccessor (CVE-2025-53779), BloodHound attack-path enumeration, domain dominance

Aller à l'installation

Dépôt: hypnguyen1209/offensive-claude
Dernière activité de la source: 29 juin 2026 à 07:22
Langue détectée de SKILL.md: anglais
Étoiles: 343
Forks: 59

Options d'installation

Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill active-directory-attack

La commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.

Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.

Vérifiez les fichiers source

Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.

Explorateur de fichiers

13 fichiers

SKILL.md

Instructions source · Aperçu en lecture seule

Retour à la recherche Retour à l’installation

Active Directory Attacks

When to Activate

Attacking Windows domain environments after gaining any domain foothold (creds, hash, or unauth network position)

Kerberos exploitation: Kerberoasting, AS-REP roasting, delegation (RBCD/constrained/unconstrained), ticket forgery

Coercion + NTLM/Kerberos relay chains (PetitPotam/DFSCoerce → LDAP/ADCS, NTLM reflection CVE-2025-33073)

ADCS certificate-template abuse (ESC1-ESC16) and certificate-based domain takeover

dMSA / BadSuccessor privilege escalation on Windows Server 2025 domains

BloodHound CE attack-path discovery, lateral movement, DCSync, and domain-dominance persistence

Technique Map

Technique

ATT&CK

CWE

Reference

Script

BloodHound CE / SharpHound enumeration

T1482

CWE-732

references/bloodhound-enum-lateral.md

scripts/ad_recon.py

Password spray / PtH / PtT lateral movement

T1550.002, T1550.003

CWE-522

references/bloodhound-enum-lateral.md

scripts/ad_recon.py

LAPS / gMSA password read

T1003

CWE-522

references/bloodhound-enum-lateral.md

scripts/ad_recon.py

Kerberoasting

T1558.003

CWE-261

references/kerberos-roasting-delegation.md

scripts/kerberoast_audit.py

AS-REP roasting

T1558.004

CWE-308

references/kerberos-roasting-delegation.md

scripts/kerberoast_audit.py

Resource-Based Constrained Delegation (RBCD)

T1558, T1098

CWE-269

references/kerberos-roasting-delegation.md

scripts/rbcd_takeover.py

Constrained/Unconstrained delegation (S4U)

T1558

CWE-269

references/kerberos-roasting-delegation.md

scripts/rbcd_takeover.py

Coercion (PetitPotam/DFSCoerce/PrinterBug/WebDAV)

T1187

CWE-294

references/coercion-relay.md

scripts/coerce_relay_chain.sh

NTLM relay (SMB/LDAP/ADCS)

T1557.001

CWE-294

references/coercion-relay.md

scripts/coerce_relay_chain.sh

Active Directory Attacks

When to Activate

Attacking Windows domain environments after gaining any domain foothold (creds, hash, or unauth network position)

Kerberos exploitation: Kerberoasting, AS-REP roasting, delegation (RBCD/constrained/unconstrained), ticket forgery

Coercion + NTLM/Kerberos relay chains (PetitPotam/DFSCoerce → LDAP/ADCS, NTLM reflection CVE-2025-33073)

ADCS certificate-template abuse (ESC1-ESC16) and certificate-based domain takeover

dMSA / BadSuccessor privilege escalation on Windows Server 2025 domains

BloodHound CE attack-path discovery, lateral movement, DCSync, and domain-dominance persistence

Technique Map

Technique

ATT&CK

CWE

Reference

Script

BloodHound CE / SharpHound enumeration

T1482

CWE-732

references/bloodhound-enum-lateral.md

scripts/ad_recon.py

Password spray / PtH / PtT lateral movement

T1550.002, T1550.003

CWE-522

references/bloodhound-enum-lateral.md

scripts/ad_recon.py

LAPS / gMSA password read

T1003

CWE-522

references/bloodhound-enum-lateral.md

scripts/ad_recon.py

Kerberoasting

T1558.003

CWE-261

references/kerberos-roasting-delegation.md

scripts/kerberoast_audit.py

AS-REP roasting

T1558.004

CWE-308

references/kerberos-roasting-delegation.md

scripts/kerberoast_audit.py

Resource-Based Constrained Delegation (RBCD)

T1558, T1098

CWE-269

references/kerberos-roasting-delegation.md

scripts/rbcd_takeover.py

Constrained/Unconstrained delegation (S4U)

T1558

CWE-269

references/kerberos-roasting-delegation.md

scripts/rbcd_takeover.py

Coercion (PetitPotam/DFSCoerce/PrinterBug/WebDAV)

T1187

CWE-294

references/coercion-relay.md

scripts/coerce_relay_chain.sh

NTLM relay (SMB/LDAP/ADCS)

T1557.001

CWE-294

references/coercion-relay.md

scripts/coerce_relay_chain.sh

name	active-directory-attack
description	Use when attacking a Windows Active Directory domain — Kerberos roasting/delegation, coercion + NTLM/Kerberos relay (CVE-2025-33073), ADCS ESC1-16 (EKUwu), ticket forgery & DCSync, dMSA BadSuccessor (CVE-2025-53779), BloodHound attack-path enumeration, domain dominance
metadata	{"type":"offensive","phase":"exploitation","tools":"impacket, certipy, rubeus, bloodhound-ce, netexec, krbrelayx, ntlmrelayx, bloodyAD, mimikatz, kerbrute, SharpSuccessor","mitre":"TA0008"}
kill_chain	{"phase":["exploit","actions"],"step":[4,7],"attck_tactics":["TA0006","TA0008","TA0004","TA0003"],"attck_techniques":["T1558","T1558.003","T1558.004","T1558.001","T1187","T1557","T1557.001","T1003.006","T1550.002","T1550.003","T1484.001","T1098","T1207"]}
depends_on	["network-attack","privesc-windows"]
feeds_into	["red-team-ops","advanced-redteam"]
inputs	["domain_info","user_context","foothold_creds"]
outputs	["domain_admin_access","finding_record","credential_dump","forged_tickets"]
references	["references/bloodhound-enum-lateral.md","references/kerberos-roasting-delegation.md","references/coercion-relay.md","references/adcs-abuse.md","references/ticket-forgery-dcsync.md","references/dmsa-badsuccessor.md"]
scripts	["scripts/ad_recon.py","scripts/kerberoast_audit.py","scripts/rbcd_takeover.py","scripts/coerce_relay_chain.sh","scripts/Get-BadSuccessorOUPermissions.ps1","scripts/adcs_esc_finder.py"]

name	active-directory-attack
description	Use when attacking a Windows Active Directory domain — Kerberos roasting/delegation, coercion + NTLM/Kerberos relay (CVE-2025-33073), ADCS ESC1-16 (EKUwu), ticket forgery & DCSync, dMSA BadSuccessor (CVE-2025-53779), BloodHound attack-path enumeration, domain dominance
metadata	{"type":"offensive","phase":"exploitation","tools":"impacket, certipy, rubeus, bloodhound-ce, netexec, krbrelayx, ntlmrelayx, bloodyAD, mimikatz, kerbrute, SharpSuccessor","mitre":"TA0008"}
kill_chain	{"phase":["exploit","actions"],"step":[4,7],"attck_tactics":["TA0006","TA0008","TA0004","TA0003"],"attck_techniques":["T1558","T1558.003","T1558.004","T1558.001","T1187","T1557","T1557.001","T1003.006","T1550.002","T1550.003","T1484.001","T1098","T1207"]}
depends_on	["network-attack","privesc-windows"]
feeds_into	["red-team-ops","advanced-redteam"]
inputs	["domain_info","user_context","foothold_creds"]
outputs	["domain_admin_access","finding_record","credential_dump","forged_tickets"]
references	["references/bloodhound-enum-lateral.md","references/kerberos-roasting-delegation.md","references/coercion-relay.md","references/adcs-abuse.md","references/ticket-forgery-dcsync.md","references/dmsa-badsuccessor.md"]
scripts	["scripts/ad_recon.py","scripts/kerberoast_audit.py","scripts/rbcd_takeover.py","scripts/coerce_relay_chain.sh","scripts/Get-BadSuccessorOUPermissions.ps1","scripts/adcs_esc_finder.py"]

Technique	Telemetry / IOC	Detection (Sigma / EDR)	OPSEC note
SharpHound/LDAP enum	Hundreds of LDAP queries from one host; 4662 directory access	SIEM rule: single source > N LDAP queries/minute; ADWS 9389 spikes	Throttle `--throttle/--jitter`; prefer ADWS (SOAPHound) to dodge LDAP heuristics
Kerberoasting	4769 TGS-REQ with RC4 (0x17) for many SPNs from one host	Sigma `win_security_susp_kerberos_manipulation`; alert on RC4 TGS bursts	Request AES-only SPNs sparingly; `/rc4opsec`; roast few accounts, slow
AS-REP roasting	4768 AS-REQ no-preauth; etype 23	Alert on AS-REQ for DONT_REQ_PREAUTH accounts	Only target accounts BloodHound flags; offline crack
Coercion	EFSRPC/DFSNM/RPRN named-pipe calls; auth from server to odd host	Sigma `coercion`/`PetitPotam`; RPC firewall (RpcFilter) logs	Coercion is "by design"; NTLM removal on 2025/24H2 forces Kerberos fallback
NTLM relay / reflection	4624/4648 NTLM logon to self; SMB→LDAP from non-server	Detect SMB-signing:False targets; CVE-2025-33073 DNS marshalled record	Needs signing:False target; patch (Jun 2025) detects marshalled DNS struct
ADCS ESC	4886/4887 cert issuance; cert with arbitrary SAN/UPN; client-auth EKU on web template	Sigma ADCS issuance anomalies; certutil monitoring; ESC15 EKU injection	Restore templates (ESC4); EPA on certsrv breaks ESC8 relay
Ticket forgery	TGT lifetime anomalies; PAC w/o validation; 4769 for krbtgt SPN	Golden: ticket lifetime > policy; Sapphire mimics real PAC (hard)	Match domain ticket policy lifetimes; use AES keys not RC4
DCSync	4662 DRSUAPI GetNCChanges from non-DC	Sigma `dcsync`; alert DRSUAPI replication from non-DC IP	Run from a host that looks like a DC; avoid `/all`, target krbtgt only
dMSA BadSuccessor	5137 dMSA create; 5136 write to msDS-ManagedAccountPrecededByLink	Sigma SharpSuccessor exec; SACL on dMSA attrs (off by default!)	Patched (Aug 2025) needs both sides controlled; still a creds-dump primitive

active-directory-attack

Options d'installation

Vérifiez les fichiers source