active-directory-attack
Orchestrate post-compromise domain exploitation through Kerberos attacks, coercion-relay chains, certificate template abuse, and BloodHound-guided lateral movement. Covers roasting, delegation abuse, NTLM reflection, ADCS ESC variants, ticket forgery, DCSync, and dMSA BadSuccessor attacks with integrated OPSEC and detection guidance.
Active Directory Attack exploits domain environments using Kerberos roasting, coercion, relay chains, ADCS abuse, and BloodHound enumeration after foothold access.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-03
Active Directory Attack exploits domain environments using Kerberos roasting, coercion, relay chains, ADCS abuse, and BloodHound enumeration after foothold access. Orchestrate post-compromise domain exploitation through Kerberos attacks, coercion-relay chains, certificate template abuse, and BloodHound-guided lateral movement. Covers roasting, delegation abuse, NTLM reflection, ADCS ESC variants, ticket forgery, DCSync, and dMSA BadSuccessor attacks with integrated OPSEC and detection guidance.
Use it when
- active-directory-attack covers both AS-REP roasting (targeting accounts with no preauth enabled) and standard Kerberos roasting (extracting.
- Yes.
Verify before relying
Read SKILL.md below before installing (13 files). Open directory: indexed for reading, not audited.
Install
hypnguyen1209/offensive-claude/active-directory-attack · repository language: Python
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What is active-directory-attack and what does it cover?
active-directory-attack is an MIT-licensed toolkit for post-compromise Active Directory exploitation. It orchestrates domain attacks through Kerberos roasting, delegation abuse, NTLM relay chains, ADCS certificate template abuse, ticket forgery, DCSync credential dumping, and BloodHound-guided lateral movement discovery. The skill integrates OPSEC and detection guidance across all attack vectors.
How does active-directory-attack enable Kerberos roasting attacks?
active-directory-attack covers both AS-REP roasting (targeting accounts with no preauth enabled) and standard Kerberos roasting (extracting and cracking service principal names). It includes SPN enumeration techniques, ticket extraction workflows, and hash cracking strategies to compromise service accounts and escalate domain privileges.
Can active-directory-attack help with ADCS ESC1 certificate template abuse?
Yes. active-directory-attack addresses ADCS certificate template abuse including ESC1 and other ESC variants. It covers identifying vulnerable templates, requesting certificates with elevated privileges, and leveraging certificate persistence to achieve domain admin access through the certificate chain.
What coercion and relay techniques does active-directory-attack include?
active-directory-attack covers NTLM relay coercion exploit chains, including PetitPotam and other coercion methods paired with relay attacks. It addresses SMB signing bypass scenarios, LDAP relay techniques, and integration of coercion with Kerberos/NTLM reflection for domain escalation and lateral movement.
How does active-directory-attack use BloodHound for lateral movement?
active-directory-attack integrates BloodHound for domain enumeration and attack path discovery. It helps identify lateral movement routes, privilege escalation chains, and high-value targets within the domain graph, enabling operators to chain multiple exploitation techniques for efficient domain takeover.
What delegation abuse attacks are covered by active-directory-attack?
active-directory-attack covers constrained delegation S4U2 abuse, resource-based constrained delegation (RBCD) takeover, and dMSA BadSuccessor privilege escalation. It includes techniques for identifying misconfigured delegation settings and chaining them with ticket forgery for domain admin compromise.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
name: active-directory-attack description: Use when attacking a Windows Active Directory domain — Kerberos roasting/delegation, coercion + NTLM/Kerberos relay (CVE-2025-33073), ADCS ESC1-16 (EKUwu), ticket forgery & DCSync, dMSA BadSuccessor (CVE-2025-53779), BloodHound attack-path enumeration, domain dominance metadata: type: offensive phase: exploitation tools: impacket, certipy, rubeus, bloodhound-ce, netexec, krbrelayx, ntlmrelayx, bloodyAD, mimikatz, kerbrute, SharpSuccessor mitre: TA0008 kill_chain: phase: [exploit, actions] step: [4, 7] attck_tactics: [TA0006, TA0008, TA0004, TA0003] attck_techniques: [T1558, T1558.003, T1558.004, T1558.001, T1187, T1557, T1557.001, T1003.006, T1550.002, T1550.003, T1484.001, T1098, T1207] depends_on: [network-attack, privesc-windows] feeds_into: [red-team-ops, advanced-redteam] inputs: [domain_info, user_context, foothold_creds] outputs: [domain_admin_access, finding_record, credential_dump, forged_tickets] references: - references/bloodhound-enum-lateral.md - references/kerberos-roasting-delegation.md - references/coercion-relay.md - references/adcs-abuse.md - references/ticket-forgery-dcsync.md -
(truncated - see the full file via the links below)
File tree — 13 files
skills/active-directory-attack/SKILL.md
skills/active-directory-attack/references/adcs-abuse.md
skills/active-directory-attack/references/bloodhound-enum-lateral.md
skills/active-directory-attack/references/coercion-relay.md
skills/active-directory-attack/references/dmsa-badsuccessor.md
skills/active-directory-attack/references/kerberos-roasting-delegation.md
skills/active-directory-attack/references/ticket-forgery-dcsync.md
skills/active-directory-attack/scripts/Get-BadSuccessorOUPermissions.ps1
skills/active-directory-attack/scripts/ad_recon.py
skills/active-directory-attack/scripts/adcs_esc_finder.py
skills/active-directory-attack/scripts/coerce_relay_chain.sh
skills/active-directory-attack/scripts/kerberoast_audit.py
skills/active-directory-attack/scripts/rbcd_takeover.py
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Exploit Active Directory domain after gaining foothold credentials”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
This skill covers offensive techniques for compromising Active Directory environments, including reconnaissance with BloodHound, credential extraction via Kerberoasting and AS-REP roasting, ticket forgery, and lateral movement. Learn pass-the-hash, DCSync, NTLM relay, and exploitation of AD Certificate Services vulnerabilities alongside critical CVE tactics.
Auth Coercion Relay guides penetration testers through forcing authentication from remote systems via coercion techniques like PetitPotam and PrinterBug, then relaying those credentials through NTLM or Kerberos to escalate privileges or move laterally. It covers relay targets (SMB, LDAP, AD CS), feasibility checks, and both credential capture and exploitation paths.
Master NTLM relay attacks to capture and forward authentication across multiple protocols for privilege escalation. Learn relay targets, signing requirements, Responder poisoning, ntlmrelayx execution, mitm6 DNS takeover, and cross-protocol techniques including WebDAV coercion to bypass defenses.
This skill covers systematic approaches to elevate from low-privilege shells to root or administrator access on compromised systems. It addresses both local escalation paths—such as exploiting misconfigured sudo, capabilities, and scheduled tasks on Linux—and Windows-specific vectors including token impersonation and service abuse. For domain environments, it includes Active Directory attacks like Kerberoasting, golden tickets, and credential harvesting via LLMNR poisoning.
This skill provides guidance on conducting authorized security analysis of antivirus systems and threat detection mechanisms. It emphasizes proper sandboxing, legitimate tools like VirusTotal and YARA rules, and ethical research practices rather than unauthorized bypass techniques.
Network Attack covers layer-2 and layer-3 poisoning (LLMNR, ARP, DHCPv6), NTLM relay with coercion, traffic interception, and network-service exploitation for lateral movement. It includes TUN-based pivoting with tools like Ligolo-ng and Chisel, plus wireless assessment for WPA2/WPA3. Hand off AD-specific relay work and Kerberos attacks to the active-directory-attack skill.
More skills privesc-windows (MIT) · cloud-security (MIT)