Agent skill · security · aiskillstore
active-directory-attacks
Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.
Why this skill is useful
Provides executable scripts and detailed techniques for exploiting Active Directory environments that are not commonly known or documented.
What it needs
Requires bloodhound, crackmapexec, impacket, kali-linux, mimikatz, powerview, responder, rubeus installed locally. About 5k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments. <!-- security-allowlist: credential-extraction, kerberos-attacks --> Active Directory Attacks Purpose Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing. Inputs/Prerequisites Kali Linux or Windows attack platform Domain user credentials (for most attacks) Network access to Domain Controller Tools: Impacket, Mimikatz, BloodHound, Rubeus, CrackMapExec Outputs/Deliverables Domain enumeration data Extracted credentials and hashes Kerberos tickets for impersonation Domain Administrator access Persistent access mechanisms --- Essential Tools Tool Purpose ------ --------- BloodHound AD attack path visualization Impacket Python AD attack tools Mimikatz Credential extraction Rubeus Kerberos attacks CrackMapExec Network exploitation PowerView AD enumeration Responder LLMNR/NBT-NS poisoning --- Core Workflow Step 1: Kerberos Clock Sync Kerberos requires clock synchronization (±5 minutes): Step 2: AD Reconnaissance with BloodHound Step 3: PowerView Enumeration --- Credential Attacks Password Spraying Kerberoasting Extract service account TGS tickets and crack offline: AS-REP Roasting Target accounts with "Do not require Kerberos preauthentication": DCSync Attack Extract credentials directly from DC (requires Replicating Directory Changes rights): --- Kerberos Ticket Attacks Pass-the-Ticket (Golden Ticket) Forge TGT with krbtgt hash for any user: Silver Ticket Forge TGS for specific service: Pass-the-Hash OverPass-the-Hash Convert NTLM hash to Kerberos ticket: --- NTLM Relay Attacks Responder + ntlmrelayx SMB Signing Check --- Certificate Services Attacks (AD CS) ESC1 - Misconfigured Templates ESC8 - Web Enrollment Relay --- Critical C …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/active-directory-attacks