active-directory-attack
Orchestrate post-compromise domain exploitation through Kerberos attacks, coercion-relay chains, certificate template abuse, and BloodHound-guided lateral movement. Covers roasting, delegation abuse, NTLM reflection, ADCS ESC variants, ticket forgery, DCSync, and dMSA BadSuccessor attacks with integrated OPSEC and detection guidance.
Active Directory Attack exploits domain environments using Kerberos roasting, coercion, relay chains, ADCS abuse, and BloodHound enumeration after foothold access.
AI-generated summary based on this skill's SKILL.md
Install
hypnguyen1209/offensive-claude/active-directory-attack · repository language: Python
git clone https://github.com/hypnguyen1209/offensive-claude
cp -r offensive-claude/skills/active-directory-attack ~/.claude/skills/active-directory-attacknpx skillfed install hypnguyen1209/offensive-claude/active-directory-attackFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What is active-directory-attack and what does it cover?
active-directory-attack is an MIT-licensed toolkit for post-compromise Active Directory exploitation. It orchestrates domain attacks through Kerberos roasting, delegation abuse, NTLM relay chains, ADCS certificate template abuse, ticket forgery, DCSync credential dumping, and BloodHound-guided lateral movement discovery. The skill integrates OPSEC and detection guidance across all attack vectors.
How does active-directory-attack enable Kerberos roasting attacks?
active-directory-attack covers both AS-REP roasting (targeting accounts with no preauth enabled) and standard Kerberos roasting (extracting and cracking service principal names). It includes SPN enumeration techniques, ticket extraction workflows, and hash cracking strategies to compromise service accounts and escalate domain privileges.
Can active-directory-attack help with ADCS ESC1 certificate template abuse?
Yes. active-directory-attack addresses ADCS certificate template abuse including ESC1 and other ESC variants. It covers identifying vulnerable templates, requesting certificates with elevated privileges, and leveraging certificate persistence to achieve domain admin access through the certificate chain.
What coercion and relay techniques does active-directory-attack include?
active-directory-attack covers NTLM relay coercion exploit chains, including PetitPotam and other coercion methods paired with relay attacks. It addresses SMB signing bypass scenarios, LDAP relay techniques, and integration of coercion with Kerberos/NTLM reflection for domain escalation and lateral movement.
How does active-directory-attack use BloodHound for lateral movement?
active-directory-attack integrates BloodHound for domain enumeration and attack path discovery. It helps identify lateral movement routes, privilege escalation chains, and high-value targets within the domain graph, enabling operators to chain multiple exploitation techniques for efficient domain takeover.
What delegation abuse attacks are covered by active-directory-attack?
active-directory-attack covers constrained delegation S4U2 abuse, resource-based constrained delegation (RBCD) takeover, and dMSA BadSuccessor privilege escalation. It includes techniques for identifying misconfigured delegation settings and chaining them with ticket forgery for domain admin compromise.
SKILL.md
rendered from the published skill — quoted content, verbatim
name: active-directory-attack description: Use when attacking a Windows Active Directory domain — Kerberos roasting/delegation, coercion + NTLM/Kerberos relay (CVE-2025-33073), ADCS ESC1-16 (EKUwu), ticket forgery & DCSync, dMSA BadSuccessor (CVE-2025-53779), BloodHound attack-path enumeration, domain dominance metadata: type: offensive phase: exploitation tools: impacket, certipy, rubeus, bloodhound-ce, netexec, krbrelayx, ntlmrelayx, bloodyAD, mimikatz, kerbrute, SharpSuccessor mitre: TA0008 kill_chain: phase: [exploit, actions] step: [4, 7] attck_tactics: [TA0006, TA0008, TA0004, TA0003] attck_techniques: [T1558, T1558.003, T1558.004, T1558.001, T1187, T1557, T1557.001, T1003.006, T1550.002, T1550.003, T1484.001, T1098, T1207] depends_on: [network-attack, privesc-windows] feeds_into: [red-team-ops, advanced-redteam] inputs: [domain_info, user_context, foothold_creds] outputs: [domain_admin_access, finding_record, credential_dump, forged_tickets] references: - references/bloodhound-enum-lateral.md - references/kerberos-roasting-delegation.md - references/coercion-relay.md - references/adcs-abuse.md - references/ticket-forgery-dcsync.md -
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 13 files
skills/active-directory-attack/SKILL.md
skills/active-directory-attack/references/adcs-abuse.md
skills/active-directory-attack/references/bloodhound-enum-lateral.md
skills/active-directory-attack/references/coercion-relay.md
skills/active-directory-attack/references/dmsa-badsuccessor.md
skills/active-directory-attack/references/kerberos-roasting-delegation.md
skills/active-directory-attack/references/ticket-forgery-dcsync.md
skills/active-directory-attack/scripts/Get-BadSuccessorOUPermissions.ps1
skills/active-directory-attack/scripts/ad_recon.py
skills/active-directory-attack/scripts/adcs_esc_finder.py
skills/active-directory-attack/scripts/coerce_relay_chain.sh
skills/active-directory-attack/scripts/kerberoast_audit.py
skills/active-directory-attack/scripts/rbcd_takeover.py