mcpField
A
active-directory-attack-paths

active-directory-attack-paths

github.com/securityskillsSecurity0389 installsUpdated 9w ago
Repository

About active-directory-attack-paths

A skill for identifying Active Directory misconfigurations and privilege-escalation paths during authorized internal assessments. It covers enumeration, credential attacks, delegation and ACL abuse, with guidance on evidence capture and cleanup.

Key features

  1. 01Enumerate trusts, groups, and account settings
  2. 02Assess Kerberoasting and AS-REP Roasting
  3. 03Check delegation and ACL escalation paths
  4. 04Record commands, outputs, and affected accounts
  5. 05Clean up assessment changes and tools

Use cases

  1. 01Assess an authorized internal network foothold
  2. 02Trace paths to Domain Admin privileges
  3. 03Verify delegation or ACL risks

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/securityskills/skills --skill active-directory-attack-paths

After installing, type/active-directory-attack-pathsin Claude Code to confirm it loaded.

Details

From the project README

Active Directory Attack Paths

Identify and demonstrate Active Directory misconfigurations during authorized internal assessments.

When to Use

  • You have a foothold (or credentials) inside an authorized internal network
  • You need to map privilege-escalation paths to Domain Admin or Enterprise Admin

Methodology

1. Initial Enumeration
  • whoami /all, domain trusts, nested groups
  • BloodHound / SharpHound collection (small collection first: --collectionmethod All --exclude-dc if stealth matters)
  • Look for: Kerberoastable SPNs, AS-REP roastable accounts (no preauth), unconstrained delegation, DCSync rights, GPO abuse
2. Credential Attacks
  • Kerberoasting: request TGS for SPN accounts, crack offline (hashcat -m 13100)
  • AS-REP Roasting: accounts with DONT_REQ_PREAUTH, crack offline (hashcat -m 18200)
  • Password spraying only within RoE — respect lockout policies
3. Delegation Abuse
  • Unconstrained delegation: capture TGTs via printer bug (SpoolSample) with Rubeus
  • Constrained delegation: S4U2Proxy abuse to impersonate users
  • Resource-based constrained delegation (RBCD): requires write rights over msDS-AllowedToActOnBehalfOfOtherIdentity
4. ACL Attacks
  • GenericAll / GenericWrite / WriteDacl / WriteOwner on users, groups, or GPOs
  • Force a password reset or ACL change, then re-run collection to confirm the new path
5. Domain Dominance
  • DCSync (mimikatz lsadump::dcsync or secretsdump.py) — only with explicit authorization
  • AD CS abuse: ESC1–ESC8 templates (Certipy), Golden/Silver certificates

Evidence to Capture

For each step: the command run, the output showing the escalation, and the accounts affected.

Cleanup

Remove created accounts, changed ACLs, and dropped tools; note every modification in the cleanup log.

Comments

Markdown supported