Active Directory Attacks

dokhacgiakhoa/active directory attacks

This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", "Silver Ticket", "AS-REP roasting", "NTLM relay", or needs guidance on Windows domain penetration testing.

5k tokens

context cost

the whole folder, loaded on every use

files

instructions only

copies elsewhere

how many repositories repackaged it

505

stars on the repo

on the repository, not the skill itself

Install

one command, takes just this skill from the repository

npx skills add https://github.com/Dokhacgiakhoa/Agent-Skills-4-Vibe-Coding-CLI --skill Active Directory Attacks

What comes with it

17 611 bytes besides the instruction

references/advanced-attacks.md

sub-skills/as-rep-roasting.md

sub-skills/dcsync-attack.md

sub-skills/esc1-misconfigured-templates.md

sub-skills/esc8-web-enrollment-relay.md

sub-skills/example-1-domain-compromise-via-kerberoasting.md

sub-skills/example-2-ntlm-relay-to-ldap.md

sub-skills/kerberoasting.md

sub-skills/overpass-the-hash.md

sub-skills/pass-the-hash.md

sub-skills/pass-the-ticket-golden-ticket.md

sub-skills/password-spraying.md

sub-skills/printnightmare-cve-2021-1675.md

sub-skills/responder-ntlmrelayx.md

sub-skills/samaccountname-spoofing-cve-2021-4227842287.md

sub-skills/silver-ticket.md

sub-skills/smb-signing-check.md

sub-skills/step-1-kerberos-clock-sync.md

sub-skills/step-2-ad-reconnaissance-with-bloodhound.md

sub-skills/step-3-powerview-enumeration.md

sub-skills/zerologon-cve-2020-1472.md

The instruction itself

27 sections, as written by the author

Active Directory Attacks

Purpose

Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.

Inputs/Prerequisites

Kali Linux or Windows attack platform
Domain user credentials (for most attacks)
Network access to Domain Controller
Tools: Impacket, Mimikatz, BloodHound, Rubeus, CrackMapExec

Outputs/Deliverables

Domain enumeration data
Extracted credentials and hashes
Kerberos tickets for impersonation
Domain Administrator access
Persistent access mechanisms

Essential Tools

| Tool | Purpose |

|------|---------|

| BloodHound | AD attack path visualization |

| Impacket | Python AD attack tools |

| Mimikatz | Credential extraction |

| Rubeus | Kerberos attacks |

| CrackMapExec | Network exploitation |

| PowerView | AD enumeration |

| Responder | LLMNR/NBT-NS poisoning |

Core Workflow

🧠 Knowledge Modules (Fractal Skills)

1. Step 1: Kerberos Clock Sync

2. Step 2: AD Reconnaissance with BloodHound

3. Step 3: PowerView Enumeration

4. Password Spraying

5. Kerberoasting

6. AS-REP Roasting

7. DCSync Attack

8. Pass-the-Ticket (Golden Ticket)

9. Silver Ticket

10. Pass-the-Hash

11. OverPass-the-Hash

12. Responder + ntlmrelayx

13. SMB Signing Check

14. ESC1 - Misconfigured Templates

15. ESC8 - Web Enrollment Relay

16. ZeroLogon (CVE-2020-1472)

17. PrintNightmare (CVE-2021-1675)

18. samAccountName Spoofing (CVE-2021-42278/42287)

19. Example 1: Domain Compromise via Kerberoasting

20. Example 2: NTLM Relay to LDAP

How to use it

Copy the folder

Take dokhacgiakhoa/active directory attacks from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.