active-directory-attacks
This skill covers offensive techniques for compromising Active Directory environments, including reconnaissance with BloodHound, credential extraction via Kerberoasting and AS-REP roasting, ticket forgery, and lateral movement. Learn pass-the-hash, DCSync, NTLM relay, and exploitation of AD Certificate Services vulnerabilities alongside critical CVE tactics.
active-directory-attacks teaches red team techniques for compromising Windows domains through Kerberos, credential, and lateral movement attacks.
AI-generated summary based on this skill's SKILL.md
Install
zebbern/claude-code-guide/active-directory-attacks · repository language: Python
git clone https://github.com/zebbern/claude-code-guide
cp -r claude-code-guide/skills/active-directory-attacks ~/.claude/skills/active-directory-attacksnpx skillfed install zebbern/claude-code-guide/active-directory-attacksFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How to attack active directory in red team operations?
active-directory-attacks covers offensive techniques for compromising AD environments through reconnaissance, credential extraction, and exploitation. The skill teaches BloodHound enumeration, Kerberoasting, AS-REP roasting, pass-the-hash attacks, DCSync exploitation, NTLM relay, and lateral movement tactics. You'll learn to leverage Kerberos vulnerabilities, forge tickets, and exploit AD Certificate Services weaknesses to achieve domain compromise during authorized penetration tests.
What Kerberos attack methods does active-directory-attacks include?
active-directory-attacks covers multiple Kerberos-based attacks: Kerberoasting extracts service account credentials; AS-REP roasting targets users without pre-authentication; Golden Tickets forge domain admin credentials; Silver Tickets create forged service tickets; and Rubeus automates these attacks. The skill teaches ticket generation, manipulation, and replay techniques for lateral movement and privilege escalation within Windows domains.
How does active-directory-attacks explain DCSync and NTLM relay?
active-directory-attacks details DCSync attacks that impersonate domain controllers to extract password hashes directly from AD, and NTLM relay techniques that intercept and forward authentication requests to compromise systems. Both methods enable credential harvesting and lateral movement. The skill covers exploitation prerequisites, detection evasion, and practical implementation using tools like Mimikatz and Responder for domain controller compromise.
What credential harvesting techniques are covered?
active-directory-attacks teaches credential extraction via Kerberoasting, AS-REP roasting, pass-the-hash attacks, and Mimikatz-based harvesting. It includes LLMNR poisoning with Responder, DCSync exploitation, and NTLM relay interception. The skill demonstrates how to capture, extract, and reuse credentials for lateral movement and privilege escalation across Windows domain environments during authorized red team operations.
Can active-directory-attacks help with domain administrator access?
active-directory-attacks teaches enumeration and exploitation pathways to domain administrator access through credential extraction, ticket forgery, and lateral movement. Techniques include Kerberoasting service accounts, exploiting AD Certificate Services, DCSync attacks, and pass-the-hash methods. The skill emphasizes reconnaissance with BloodHound to identify privilege escalation paths and vulnerable accounts for authorized penetration testing scenarios.
What tools and CVEs does active-directory-attacks reference?
active-directory-attacks covers tools including BloodHound for enumeration, Mimikatz for credential extraction, Rubeus for Kerberos attacks, CrackMapExec for domain exploitation, and Responder for LLMNR poisoning. It addresses critical vulnerabilities like Zerologon (CVE-2020-1472) and AD Certificate Services exploits. The skill provides practical guidance on leveraging these tools and CVEs for authorized red team operations against Windows domains.
SKILL.md
rendered from the published skill — quoted content, verbatim
Active Directory Attacks
Purpose
Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.
Inputs/Prerequisites
- Kali Linux or Windows attack platform
- Domain user credentials (for most attacks)
- Network access to Domain Controller
- Tools: Impacket, Mimikatz, BloodHound, Rubeus, CrackMapExec
Outputs/Deliverables
- Domain enumeration data
- Extracted credentials and hashes
- Kerberos tickets for impersonation
- Domain Administrator access
- Persistent access mechanisms
Essential Tools
| Tool | Purpose |
|---|---|
| BloodHound | AD attack path visualization |
| Impacket |
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 2 files
skills/active-directory-attacks/SKILL.md
skills/active-directory-attacks/references/advanced-attacks.md