Active Directory Attack

This is your AD attack automation once you're inside a Windows domain. It handles the full offensive toolkit: BloodHound enumeration to map attack paths, Kerberoasting and AS-REP roasting for credential cracking, NTLM relay attacks when SMB signing is off, and Golden/Silver ticket generation once you've got the KRBTGT hash. The workflow is thorough, covering everything from clock sync issues (Kerberos is picky) to DCSync for dumping domain credentials. It's built around Impacket, Rubeus, Mimikatz, and CrackMapExec, so you're not reinventing the wheel. The OPSEC section is worth reading before you lock out half the domain with password spraying. If you're doing internal pentests or red team engagements against Active Directory, this consolidates the playbook you'd otherwise be pulling from six different blog posts.

GitHub stars: 280
last updated: May 28, 2026

View on GitHub

Install

$ npx -y skills add hypnguyen1209/offensive-claude --skill active-directory-attack --agent claude-code

Installs into .claude/skills of the current project.

Files

Active Directory Attacks

When to Activate

Attacking Windows domain environments after gaining any domain foothold (creds, hash, or unauth network position)
Kerberos exploitation: Kerberoasting, AS-REP roasting, delegation (RBCD/constrained/unconstrained), ticket forgery
Coercion + NTLM/Kerberos relay chains (PetitPotam/DFSCoerce → LDAP/ADCS, NTLM reflection CVE-2025-33073)
ADCS certificate-template abuse (ESC1-ESC16) and certificate-based domain takeover
dMSA / BadSuccessor privilege escalation on Windows Server 2025 domains
BloodHound CE attack-path discovery, lateral movement, DCSync, and domain-dominance persistence