active-directory-attack

Use when attacking a Windows Active Directory domain — Kerberos roasting/delegation, coercion + NTLM/Kerberos relay (CVE-2025-33073), ADCS ESC1-16 (EKUwu), ticket forgery & DCSync, dMSA BadSuccessor (CVE-2025-53779), BloodHound attack-path enumeration, domain dominance

Ir para a instalação

Repositório: hypnguyen1209/offensive-claude
Última atividade na origem: 29 de junho de 2026 às 07:22
Idioma detectado do SKILL.md: inglês
Estrelas: 343
Forks: 59

Opções de instalação

Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill active-directory-attack

O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.

Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.

Revise os arquivos de origem

Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.

Explorador de arquivos

13 arquivos

SKILL.md

Instruções da origem · Visualização somente leitura

Voltar à pesquisa Voltar à instalação

reverse-engineering

Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days

2026-07-30

privesc-windows

Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting

2026-06-30

threat-model-discipline

Use when starting an engagement, before exploitation, or whenever the attack surface changes — build/validate the threat model and detect drift (new unreviewed surface) before advancing

2026-06-30

Ver todas deste repositório

Active Directory Attacks

When to Activate

Attacking Windows domain environments after gaining any domain foothold (creds, hash, or unauth network position)

Kerberos exploitation: Kerberoasting, AS-REP roasting, delegation (RBCD/constrained/unconstrained), ticket forgery

Coercion + NTLM/Kerberos relay chains (PetitPotam/DFSCoerce → LDAP/ADCS, NTLM reflection CVE-2025-33073)

ADCS certificate-template abuse (ESC1-ESC16) and certificate-based domain takeover

dMSA / BadSuccessor privilege escalation on Windows Server 2025 domains

BloodHound CE attack-path discovery, lateral movement, DCSync, and domain-dominance persistence

Technique Map

Technique

ATT&CK

CWE

Reference

Script

BloodHound CE / SharpHound enumeration

T1482

CWE-732

references/bloodhound-enum-lateral.md

scripts/ad_recon.py

Password spray / PtH / PtT lateral movement

T1550.002, T1550.003

CWE-522

references/bloodhound-enum-lateral.md

scripts/ad_recon.py

LAPS / gMSA password read

T1003

CWE-522

references/bloodhound-enum-lateral.md

scripts/ad_recon.py

Kerberoasting

T1558.003

CWE-261

references/kerberos-roasting-delegation.md

scripts/kerberoast_audit.py

AS-REP roasting

T1558.004

CWE-308

references/kerberos-roasting-delegation.md

scripts/kerberoast_audit.py

Resource-Based Constrained Delegation (RBCD)

T1558, T1098

CWE-269

references/kerberos-roasting-delegation.md

scripts/rbcd_takeover.py

Constrained/Unconstrained delegation (S4U)

T1558

CWE-269

references/kerberos-roasting-delegation.md

scripts/rbcd_takeover.py

Coercion (PetitPotam/DFSCoerce/PrinterBug/WebDAV)

T1187

CWE-294

references/coercion-relay.md

scripts/coerce_relay_chain.sh

NTLM relay (SMB/LDAP/ADCS)

T1557.001

CWE-294

references/coercion-relay.md

scripts/coerce_relay_chain.sh

Active Directory Attacks

When to Activate

Attacking Windows domain environments after gaining any domain foothold (creds, hash, or unauth network position)

Kerberos exploitation: Kerberoasting, AS-REP roasting, delegation (RBCD/constrained/unconstrained), ticket forgery

Coercion + NTLM/Kerberos relay chains (PetitPotam/DFSCoerce → LDAP/ADCS, NTLM reflection CVE-2025-33073)

ADCS certificate-template abuse (ESC1-ESC16) and certificate-based domain takeover

dMSA / BadSuccessor privilege escalation on Windows Server 2025 domains

BloodHound CE attack-path discovery, lateral movement, DCSync, and domain-dominance persistence

Technique Map

Technique

ATT&CK

CWE

Reference

Script

BloodHound CE / SharpHound enumeration

T1482

CWE-732

references/bloodhound-enum-lateral.md

scripts/ad_recon.py

Password spray / PtH / PtT lateral movement

T1550.002, T1550.003

CWE-522

references/bloodhound-enum-lateral.md

scripts/ad_recon.py

LAPS / gMSA password read

T1003

CWE-522

references/bloodhound-enum-lateral.md

scripts/ad_recon.py

Kerberoasting

T1558.003

CWE-261

references/kerberos-roasting-delegation.md

scripts/kerberoast_audit.py

AS-REP roasting

T1558.004

CWE-308

references/kerberos-roasting-delegation.md

scripts/kerberoast_audit.py

Resource-Based Constrained Delegation (RBCD)

T1558, T1098

CWE-269

references/kerberos-roasting-delegation.md

scripts/rbcd_takeover.py

Constrained/Unconstrained delegation (S4U)

T1558

CWE-269

references/kerberos-roasting-delegation.md

scripts/rbcd_takeover.py

Coercion (PetitPotam/DFSCoerce/PrinterBug/WebDAV)

T1187

CWE-294

references/coercion-relay.md

scripts/coerce_relay_chain.sh

NTLM relay (SMB/LDAP/ADCS)

T1557.001

CWE-294

references/coercion-relay.md

scripts/coerce_relay_chain.sh

name	active-directory-attack
description	Use when attacking a Windows Active Directory domain — Kerberos roasting/delegation, coercion + NTLM/Kerberos relay (CVE-2025-33073), ADCS ESC1-16 (EKUwu), ticket forgery & DCSync, dMSA BadSuccessor (CVE-2025-53779), BloodHound attack-path enumeration, domain dominance
metadata	{"type":"offensive","phase":"exploitation","tools":"impacket, certipy, rubeus, bloodhound-ce, netexec, krbrelayx, ntlmrelayx, bloodyAD, mimikatz, kerbrute, SharpSuccessor","mitre":"TA0008"}
kill_chain	{"phase":["exploit","actions"],"step":[4,7],"attck_tactics":["TA0006","TA0008","TA0004","TA0003"],"attck_techniques":["T1558","T1558.003","T1558.004","T1558.001","T1187","T1557","T1557.001","T1003.006","T1550.002","T1550.003","T1484.001","T1098","T1207"]}
depends_on	["network-attack","privesc-windows"]
feeds_into	["red-team-ops","advanced-redteam"]
inputs	["domain_info","user_context","foothold_creds"]
outputs	["domain_admin_access","finding_record","credential_dump","forged_tickets"]
references	["references/bloodhound-enum-lateral.md","references/kerberos-roasting-delegation.md","references/coercion-relay.md","references/adcs-abuse.md","references/ticket-forgery-dcsync.md","references/dmsa-badsuccessor.md"]
scripts	["scripts/ad_recon.py","scripts/kerberoast_audit.py","scripts/rbcd_takeover.py","scripts/coerce_relay_chain.sh","scripts/Get-BadSuccessorOUPermissions.ps1","scripts/adcs_esc_finder.py"]

name	active-directory-attack
description	Use when attacking a Windows Active Directory domain — Kerberos roasting/delegation, coercion + NTLM/Kerberos relay (CVE-2025-33073), ADCS ESC1-16 (EKUwu), ticket forgery & DCSync, dMSA BadSuccessor (CVE-2025-53779), BloodHound attack-path enumeration, domain dominance
metadata	{"type":"offensive","phase":"exploitation","tools":"impacket, certipy, rubeus, bloodhound-ce, netexec, krbrelayx, ntlmrelayx, bloodyAD, mimikatz, kerbrute, SharpSuccessor","mitre":"TA0008"}
kill_chain	{"phase":["exploit","actions"],"step":[4,7],"attck_tactics":["TA0006","TA0008","TA0004","TA0003"],"attck_techniques":["T1558","T1558.003","T1558.004","T1558.001","T1187","T1557","T1557.001","T1003.006","T1550.002","T1550.003","T1484.001","T1098","T1207"]}
depends_on	["network-attack","privesc-windows"]
feeds_into	["red-team-ops","advanced-redteam"]
inputs	["domain_info","user_context","foothold_creds"]
outputs	["domain_admin_access","finding_record","credential_dump","forged_tickets"]
references	["references/bloodhound-enum-lateral.md","references/kerberos-roasting-delegation.md","references/coercion-relay.md","references/adcs-abuse.md","references/ticket-forgery-dcsync.md","references/dmsa-badsuccessor.md"]
scripts	["scripts/ad_recon.py","scripts/kerberoast_audit.py","scripts/rbcd_takeover.py","scripts/coerce_relay_chain.sh","scripts/Get-BadSuccessorOUPermissions.ps1","scripts/adcs_esc_finder.py"]

Technique	Telemetry / IOC	Detection (Sigma / EDR)	OPSEC note
SharpHound/LDAP enum	Hundreds of LDAP queries from one host; 4662 directory access	SIEM rule: single source > N LDAP queries/minute; ADWS 9389 spikes	Throttle `--throttle/--jitter`; prefer ADWS (SOAPHound) to dodge LDAP heuristics
Kerberoasting	4769 TGS-REQ with RC4 (0x17) for many SPNs from one host	Sigma `win_security_susp_kerberos_manipulation`; alert on RC4 TGS bursts	Request AES-only SPNs sparingly; `/rc4opsec`; roast few accounts, slow
AS-REP roasting	4768 AS-REQ no-preauth; etype 23	Alert on AS-REQ for DONT_REQ_PREAUTH accounts	Only target accounts BloodHound flags; offline crack
Coercion	EFSRPC/DFSNM/RPRN named-pipe calls; auth from server to odd host	Sigma `coercion`/`PetitPotam`; RPC firewall (RpcFilter) logs	Coercion is "by design"; NTLM removal on 2025/24H2 forces Kerberos fallback
NTLM relay / reflection	4624/4648 NTLM logon to self; SMB→LDAP from non-server	Detect SMB-signing:False targets; CVE-2025-33073 DNS marshalled record	Needs signing:False target; patch (Jun 2025) detects marshalled DNS struct
ADCS ESC	4886/4887 cert issuance; cert with arbitrary SAN/UPN; client-auth EKU on web template	Sigma ADCS issuance anomalies; certutil monitoring; ESC15 EKU injection	Restore templates (ESC4); EPA on certsrv breaks ESC8 relay
Ticket forgery	TGT lifetime anomalies; PAC w/o validation; 4769 for krbtgt SPN	Golden: ticket lifetime > policy; Sapphire mimics real PAC (hard)	Match domain ticket policy lifetimes; use AES keys not RC4
DCSync	4662 DRSUAPI GetNCChanges from non-DC	Sigma `dcsync`; alert DRSUAPI replication from non-DC IP	Run from a host that looks like a DC; avoid `/all`, target krbtgt only
dMSA BadSuccessor	5137 dMSA create; 5136 write to msDS-ManagedAccountPrecededByLink	Sigma SharpSuccessor exec; SACL on dMSA attrs (off by default!)	Patched (Aug 2025) needs both sides controlled; still a creds-dump primitive

active-directory-attack

Opções de instalação

Revise os arquivos de origem