active-directory-attack

Featured

Use when attacking a Windows Active Directory domain — Kerberos roasting/delegation, coercion + NTLM/Kerberos relay (CVE-2025-33073), ADCS ESC1-16 (EKUwu), ticket forgery & DCSync, dMSA BadSuccessor (CVE-2025-53779), BloodHound attack-path enumeration, domain dominance

AI & Automation 382 stars 66 forks Updated 5 days ago MIT

Install

View on GitHub

Quality Score: 95/100

Stars 20%
86
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
80
License 10%
100
Description 5%
100

Skill Content

# Active Directory Attacks ## When to Activate - Attacking Windows domain environments after gaining any domain foothold (creds, hash, or unauth network position) - Kerberos exploitation: Kerberoasting, AS-REP roasting, delegation (RBCD/constrained/unconstrained), ticket forgery - Coercion + NTLM/Kerberos relay chains (PetitPotam/DFSCoerce → LDAP/ADCS, NTLM reflection CVE-2025-33073) - ADCS certificate-template abuse (ESC1-ESC16) and certificate-based domain takeover - dMSA / BadSuccessor privilege escalation on Windows Server 2025 domains - BloodHound CE attack-path discovery, lateral movement, DCSync, and domain-dominance persistence ## Technique Map | Technique | ATT&CK | CWE | Reference | Script | |-----------|--------|-----|-----------|--------| | BloodHound CE / SharpHound enumeration | T1482 | CWE-732 | references/bloodhound-enum-lateral.md | scripts/ad_recon.py | | Password spray / PtH / PtT lateral movement | T1550.002, T1550.003 | CWE-522 | references/bloodhound-enum-lateral.md | scripts/ad_recon.py | | LAPS / gMSA password read | T1003 | CWE-522 | references/bloodhound-enum-lateral.md | scripts/ad_recon.py | | Kerberoasting | T1558.003 | CWE-261 | references/kerberos-roasting-delegation.md | scripts/kerberoast_audit.py | | AS-REP roasting | T1558.004 | CWE-308 | references/kerberos-roasting-delegation.md | scripts/kerberoast_audit.py | | Resource-Based Constrained Delegation (RBCD) | T1558, T1098 | CWE-269 | references/kerberos-roasting-delegation.md | scripts/...

Details

Author
hypnguyen1209
Repository
hypnguyen1209/offensive-claude
Created
4 months ago
Last Updated
5 days ago
Language
Python
License
MIT

Bundled in these plugins

offensive-claude

Similar Skills

Semantically similar based on skill content — not just same category

AI & Automation Featured

active-directory-attacks

This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", "Silver Ticket", "AS-REP roasting", "NTLM relay", or needs guidance on Windows domain penetration testing.

4,638 Updated today
zebbern
AI & Automation Featured

active-directory-attacks

Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.

288 Updated 2 months ago
lingxling
AI & Automation Listed

active-directory-attacks

Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.

2 Updated 2 days ago
Ghosteken