Name: active-directory-attack-paths
Author: securityskills

Imported from securityskills/skills (pentest/active-directory/active-directory-attack-paths/SKILL.md). Install upstream with npx skills add securityskills/skills --skill active-directory-attack-paths. Copyright stays with the author.

Active Directory Attack Paths

Identify and demonstrate Active Directory misconfigurations during authorized internal assessments.

When to Use

You have a foothold (or credentials) inside an authorized internal network
You need to map privilege-escalation paths to Domain Admin or Enterprise Admin

Methodology

1. Initial Enumeration

whoami /all, domain trusts, nested groups
BloodHound / SharpHound collection (small collection first: --collectionmethod All --exclude-dc if stealth matters)
Look for: Kerberoastable SPNs, AS-REP roastable accounts (no preauth), unconstrained delegation, DCSync rights, GPO abuse

2. Credential Attacks

Kerberoasting: request TGS for SPN accounts, crack offline (hashcat -m 13100)
AS-REP Roasting: accounts with DONT_REQ_PREAUTH, crack offline (hashcat -m 18200)
Password spraying only within RoE — respect lockout policies

3. Delegation Abuse

Unconstrained delegation: capture TGTs via printer bug (SpoolSample) with Rubeus
Constrained delegation: S4U2Proxy abuse to impersonate users
Resource-based constrained delegation (RBCD): requires write rights over msDS-AllowedToActOnBehalfOfOtherIdentity

4. ACL Attacks

GenericAll / GenericWrite / WriteDacl / WriteOwner on users, groups, or GPOs
Force a password reset or ACL change, then re-run collection to confirm the new path

5. Domain Dominance

DCSync (mimikatz lsadump::dcsync or secretsdump.py) — only with explicit authorization
AD CS abuse: ESC1–ESC8 templates (Certipy), Golden/Silver certificates

Evidence to Capture

For each step: the command run, the output showing the escalation, and the accounts affected.

Cleanup

Remove created accounts, changed ACLs, and dropped tools; note every modification in the cleanup log.

{ "ocm": "1", "id": "securityskills-skills-active-directory-attack-paths", "kind": "skill", "name": "active-directory-attack-paths", "description": "Enumerate and exploit common Active Directory misconfigurations such as Kerberoasting, AS-REP roasting, delegation abuse, and ACL attacks. Use during authorized internal network assessments.", "publisher": "securityskills", "version": "1.0.0", "capabilities": { "domains": [ "general" ], "tags": [ "skill-md", "skills-sh" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Enumerate and exploit common Active Directory misconfigurations such as Kerberoasting, AS-REP roasting, delegation abuse, and ACL attacks. Use during authorized internal network assessments." ], "primary": false, "metadata": { "source": { "provider": "skills.sh", "repository": "https://github.com/securityskills/skills", "path": "pentest/active-directory/active-directory-attack-paths/SKILL.md", "ref": "HEAD", "url": "https://github.com/securityskills/skills/blob/HEAD/pentest/active-directory/active-directory-attack-paths/SKILL.md", "key": "securityskills/skills/pentest/active-directory/active-directory-attack-paths/SKILL.md" } }, "instructions": "# Active Directory Attack Paths\n\nIdentify and demonstrate Active Directory misconfigurations during authorized internal assessments.\n\n## When to Use\n\n- You have a foothold (or credentials) inside an authorized internal network\n- You need to map privilege-escalation paths to Domain Admin or Enterprise Admin\n\n## Methodology\n\n### 1. Initial Enumeration\n\n- `whoami /all`, domain trusts, nested groups\n- BloodHound / SharpHound collection (small collection first: `--collectionmethod All --exclude-dc` if stealth matters)\n- Look for: Kerberoastable SPNs, AS-REP roastable accounts (no preauth), unconstr", "cost": { "context_tokens": 453 } }

active-directory-attack-paths

About