skills.rest
AndyAnh174
AndyAnh174COMMUNITY
Explore all skills by this author →
WebsiteGitHub

Active Directory Attacks

Execute Active Directory attack workflows for red team penetration testing.

Updated Jan 8, 2026
Search Tags:#penetration testing#exploitation#red team#cve#kerberos#active directory#adcs
One-click install
npx skills add https://github.com/AndyAnh174/BanThuoc-SEO --skill active-directory-attacks-andyanh174
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Active Directory Attacks
Source: https://github.com/AndyAnh174/BanThuoc-SEO/tree/main/.agent/skills/active-directory-attacks
Command: npx skills add https://github.com/AndyAnh174/BanThuoc-SEO --skill active-directory-attacks-andyanh174

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill provides comprehensive guidance and tools for attacking Microsoft Active Directory environments, enabling red team operations and penetration testing.

Core Features & Use Cases

  • Reconnaissance: Discover domain structure, users, groups, and sensitive information.
  • Credential Harvesting: Employ techniques like Kerberoasting, AS-REP roasting, and DCSync to obtain credentials.
  • Lateral Movement & Privilege Escalation: Utilize methods like Pass-the-Hash, Golden Tickets, and NTLM relay to gain higher privileges and access.
  • Vulnerability Exploitation: Exploit critical CVEs like ZeroLogon and PrintNightmare.
  • Use Case: A penetration tester needs to simulate a real-world attack on a client's Active Directory domain to identify security weaknesses before malicious actors do.

Quick Start

Use the Active Directory Attacks skill to enumerate domain controllers and find service accounts with SPNs.

Frequently Asked Questions about Active Directory Attacks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform Kerberoasting attacks in Active Directory for credential harvesting?▼

Kerberoasting in Active Directory involves extracting service account ticket-granting service tickets and cracking them offline to obtain plaintext credentials. This Skill provides specific commands and workflows using tools like Rubeus and Impacket to automate this credential harvesting process.

What is the best way to enumerate Active Directory domain structure during a red team engagement?▼

Enumerating Active Directory domain structure is best achieved through reconnaissance tools like BloodHound to map users, groups, and sensitive information. This Skill details how to identify domain controllers and discover service accounts with SPNs for vulnerability assessment.

How can I exploit ZeroLogon and PrintNightmare CVEs in an Active Directory environment?▼

Exploiting ZeroLogon and PrintNightmare CVEs in Active Directory allows attackers to gain unauthorized domain controller access or privilege escalation. This Skill provides detailed exploitation workflows and commands targeting these critical vulnerabilities for penetration testing.

Can I use Impacket and Mimikatz for lateral movement and privilege escalation in Active Directory?▼

Impacket and Mimikatz are fully supported for Active Directory lateral movement and privilege escalation. This Skill outlines specific methods like Pass-the-Hash, NTLM relay, and DCSync using these tools to achieve domain dominance during red team operations.

How does a Golden Ticket attack work for maintaining domain dominance in Active Directory?▼

A Golden Ticket attack in Active Directory works by forging a Kerberos Ticket Granting Ticket using the extracted krbtgt hash, allowing persistent and undetectable domain access. This Skill provides the necessary Mimikatz and Rubeus commands to execute this privilege escalation technique.

Related Skills

Explore More Software Engineering Skills→
blacklanternsecurityblacklanternsecurity
253

ad-discovery

Enumerate Active Directory domains and map attack surfaces for penetration testing.

Official
Advanced
blacklanternsecurityblacklanternsecurity
253

pass-the-hash

Authenticate to Active Directory services using stolen NTLM hashes, AES keys, or Kerberos tickets.

Official
Advanced
djcyphersdjcyphers

active-directory

Query and manage Active Directory users, groups, computers, OUs, and GPO status.

Community
Advanced
hardw00thardw00t
90

network-pentest

Simulate attacker techniques across internal networks and Active Directory environments.

Community
Advanced