Agent skill · security · yaklang
active-directory-kerberos-attacks
Kerberos attack playbook for Active Directory. Use when targeting AD authentication via AS-REP roasting, Kerberoasting, golden/silver/diamond tickets, delegation abuse, or pass-the-ticket attacks.
Why this skill is useful
Adds detailed attack scripts and methodologies for exploiting Kerberos in Active Directory environments, which are not commonly found in public documentation.
What it needs
Requires hashcat, impacket, john installed locally. About 5k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Kerberos Attack Playbook — Expert AD Attack Guide AI LOAD INSTRUCTION: Expert Kerberos attack techniques for AD environments. Covers AS-REP roasting, Kerberoasting, golden/silver/diamond/sapphire tickets, delegation attacks, pass-the-ticket, and overpass-the-hash. Base models miss ticket type distinctions, delegation chain nuances, and detection-evasion trade-offs. 0. RELATED ROUTING Before going deep, consider loading: active-directory-acl-abuse for ACL-based AD attacks often chained with Kerberos active-directory-certificate-services for ADCS-based persistence (golden certificate) ntlm-relay-coercion for NTLM relay attacks that complement Kerberos abuse windows-lateral-movement after obtaining tickets for lateral movement Advanced Reference Also load KERBEROSATTACKCHAINS.md when you need: Multi-step attack chains combining Kerberos with ACL abuse, ADCS, and relay End-to-end scenarios from foothold to domain admin Chained delegation attack flows --- 1. KERBEROS AUTHENTICATION PRIMER --- 2. AS-REP ROASTING Users with "Do not require Kerberos preauthentication" can be queried for AS-REP without knowing their password. Enumerate Vulnerable Users Crack AS-REP Hash --- 3. KERBEROASTING Any domain user can request TGS for accounts with SPNs. The TGS is encrypted with the service account's NTLM hash. Request Service Tickets Crack TGS Hash --- 4. TICKET FORGING — GOLDEN, SILVER, DIAMOND, SAPPHIRE Golden Ticket Forge TGT using the krbtgt hash → impersonate any user, including non-existent ones. Prerequisites: krbtgt NTLM hash (from DCSync or NTDS.dit) Persistence: Valid until krbtgt password is changed twice Silver Ticket Forge TGS using the service account's hash → access specific service only, no KDC interaction. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/active-directory-kerberos-attacks