Active Directory exploitation after domain credentials exist: Kerberos (AS-REP/Kerberoast including cracking the ticket then using the account), delegation, NTLM coercion/relay, lateral movement, ACL abuse, ADCS ESC1-ESC17 and CVE paths, dMSA/BadSuccessor, Kerberos reflection, identity confusion, management-plane, domain trust, and domain persistence. Own the current AD chain through crack-and-use to DA, equivalent domain control, or the targeted host SYSTEM. Do not stop after requesting TGS. Host C2 belongs to /post. Operator chooses next modules.
The English summary is being prepared. Showing the original description.
See how to installReview the instructions the agent will receive before you install.
scope： 已有域凭据，把 当前这条 AD 链 打到 DA / 等价域控制 / 目标主机 SYSTEM。要到的 TGS/AS-REP 当场按 etype 砸，爆了立刻用，不要切
/creds。不做主机 C2、数据外带、LSASS 配方。▸ 整条链打完后候选只认~/.claude/skills/shared/modules.yaml（modules.py tail）。
工具：../shared/tools.md。CVE 有 DC build 才读 ../shared/cve-enrichment.md。LAPS 读取不在本模块（../ad-recon/references/windows-laps.md，仅当你在做 LAPS 卡片）。Kerberoast 砸票查 -m 才读 ../creds/references/hash-types.md（不换模块）。
走到哪条链再 Read 哪一份，禁止开局全读：
references/kerberos-attacks.mdreferences/lateral-movement.mdreferences/acl-abuse.mdreferences/adcs.mdreferences/dmsa.mdreferences/auth-reflection.mdreferences/identity-confusion.mdreferences/management-plane.mdreferences/authentication-coercion-relay.md开局第一件事：Read ./notes.md。没有则 python ~/.claude/skills/bin/notes.py init。只按已拿下/凭据继续。
走到哪条链，才 Read 一份 references/<file>.md。禁止开局全读、禁止凭记忆写 payload。
监听 / sudo / 输密码 / Permission denied：立刻停，说明等操作者做什么，等回报。不要假装已成功。
收尾：
./notes.mdpython ~/.claude/skills/bin/modules.py tail <本模块名>
Read 备用：~/.claude/skills/shared/modules.yaml
禁止 ./modules.yaml 和 python ../bin/...default_next；never_default 不得当作默认（操作者点名除外）/模块 或 /clear
/edr-bypass 半条链未完：打通后回本模块，不要 /clear。当前选中的 AD 链打到目标身份或 DA/主机 SYSTEM。DCSync、Golden、RBCD、Shadow、ESC8/11、Certighost 都是攻击原语。会改密的标 IMPACT/RESTORE。
不算： 只列出 SPN、只把 TGS 写到磁盘、只 Coercer scan、只 certipy find。
要票 → 看 etype → hashcat 砸出明文/NT → PTH/PTT/WinRM/ACL
↑______________ 全部留在 /ad-attack ______________↑
砸不出来 → 记 notes，换本模块下一条路径。不要因此去 /creds。
独立「我手上有一堆无关 hash 要当凭据作业」才由操作者另选 /creds。
SMB/LDAP signing、Kerberos 策略、EPA、ACL = 本模块。
PTH/WinRM/PsExec 已经在目标 OS 执行 被 AV 杀 → /edr-bypass → 回本模块把这条 AD 链打完。
只有用户列表 → AS-REP 要票+当场砸 → 用爆出的口令继续
任意域用户 → Kerberoast 要票+看 etype+当场砸 → 用服务账继续
委派 → references/kerberos-attacks.md
可 coerce / 入站 NTLM → references/authentication-coercion-relay.md
LDAP/ADCS sink 在这里打完（RBCD/Shadow/ESC8）
票/NT 可登录 → references/lateral-movement.md
ACL 可写 → references/acl-abuse.md
ADCS 模板/CA → references/adcs.md
2025 DC / dMSA → references/dmsa.md
Ghost SPN / 反射 → references/auth-reflection.md
可写 UPN + 未补 DC → references/identity-confusion.md
WAC → references/management-plane.md
要域持久化 → DCSync/Golden/Shadow
跨域 → extra-sid
impacket-GetNPUsers corp.com/ -usersfile users.txt -dc-ip DC -format hashcat -outputfile asrep.hash
hashcat -m 18200 asrep.hash /usr/share/wordlists/rockyou.txt
impacket-GetUserSPNs corp.com/jen:'pass' -dc-ip DC -request -outputfile tgs.hash
grep -o '\$krb5tgs\$[0-9]*\$' tgs.hash
# etype 23
hashcat -m 13100 tgs.hash /usr/share/wordlists/rockyou.txt
# etype 17
hashcat -m 19600 tgs.hash /usr/share/wordlists/rockyou.txt
# etype 18
hashcat -m 19700 tgs.hash /usr/share/wordlists/rockyou.txt
不要默认所有 TGS 都是 RC4。完整委派链、失败换路 → references/kerberos-attacks.md。字典/规则细节可 Read ../creds/references/offline-crack.md，继续在本模块跑 hashcat。
爆了立刻：
nxc smb DC -u svc_sql -p 'CrackedPass!'
impacket-psexec corp.com/svc_sql:'CrackedPass!'@TARGET
或 NT 已出 → PTH，见 references/lateral-movement.md。不要停下来等人选 /creds。
PetitPotam / PrinterBug / DFSCoerce / Coercer → LDAP/SMB/ADCS sink：本模块打完 到 SYSTEM/RBCD/证书。不要交回 /creds。
→ references/authentication-coercion-relay.md。2025 新建域默认 LDAP signing，先做 policy gate。
→ references/lateral-movement.md。落地被杀 → EDR 后回来。
ACL → references/acl-abuse.md，改密要 RESTORE。
DCSync / NTDS 有复制权限时打（不是 /creds 收割）
Golden / Silver 有 krbtgt 或服务 NT 之后
Shadow Credentials GenericWrite
Skeleton Key DC 内存，重启失效，高 IMPACT
ADCS ESC1–17 / Certighost → references/adcs.md
dMSA / BadSuccessor → references/dmsa.md
反射 / CVE-2026-26128 → references/auth-reflection.md
ResetNightmare 会真改密 → references/identity-confusion.md
WAC 无稳定端到端 PoC → references/management-plane.md，不编命令。
写入 ./notes.md。候选只按「开局与收尾」跑 python ~/.claude/skills/bin/modules.py tail。
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Active Directory reconnaissance with or without credentials: user/group/computer enumeration, ACL/delegation, ADCS, modern Windows LAPS, BloodHound, Server 2025/dMSA/Ghost SPN candidates, and trust mapping. Recon only — do not exploit Kerberoast-to-DA, DCSync, or change passwords. Operator may select /ad-attack after cards are ready.
The English summary is being prepared. Showing the original description.
CI/CD pipeline and software-supply-chain exploitation: Jenkins, GitHub Actions, GitLab CI/CD, Azure DevOps, Gitea/Forgejo, self-hosted runners/agents, poisoned pipeline execution, artifact/cache abuse, dependency confusion, third-party Action trust, GitOps/registry poisoning, workload identity/OIDC, and emerging agentic CI/CD. Use this skill when the operator has access to a CI/CD system, source repository, build/deploy configuration, runner/agent, artifact/package/registry path, or software delivery trust chain.
The English summary is being prepared. Showing the original description.
Cloud control-plane exploitation for AWS, Azure/Entra, GCP, and Alibaba Cloud: IAM/RAM privilege escalation, impersonation, cross-account trust, serverless/compute control, and cloud-native persistence. Host OS persistence/C2 after root/SYSTEM belongs to /post. K8s RBAC belongs to /k8s. Operator chooses next modules; new identities default to /cloud-recon first.
The English summary is being prepared. Showing the original description.
Cloud control-plane reconnaissance for AWS, Azure/Entra, GCP, and Alibaba Cloud: identity, IAM/RAM, trust, resources, metadata, and managed-Kubernetes cloud-side boundary. Recon only — no policy changes, no privilege escalation. Operator may select /cloud-attack or /k8s.
The English summary is being prepared. Showing the original description.
Credential operations: secret discovery, classification, extraction, conversion, offline cracking of hashes the operator already has as a credential job, policy-aware spraying, NetNTLM capture, generic SMB relay, and Windows/Linux harvest. Do not hijack an in-progress /ad-attack Kerberoast/AS-REP chain (that module cracks and uses the ticket itself). Do not DCSync, read LAPS LDAP, or escalate cloud IAM. Usable credentials are recorded; the operator chooses the next module.
The English summary is being prepared. Showing the original description.
Endpoint defense evasion after an operator-selected chain already has a valid execution path but AV/EDR/AMSI/WDAC/PPL/memory/kernel telemetry blocks the intended action. Originating modules include /web-attack /ad-attack /cloud-attack /k8s /cicd /service-attack /phishing /privesc-win /privesc-linux /creds /post /shell. Success is the blocked action becoming executable, then resume the originating module — not obtaining a shell here.
The English summary is being prepared. Showing the original description.