ad-exploitation

AD Exploitation — Credential Attacks & Domain Domination

Architecture

scripts/
├── common_ad.sh    # Shared functions (logging, has_tool, phase_done, emit_summary)
└── ad_attacks.sh   # PHASES 1-3: credential attacks, network sweep, DCSync

---

Initial Setup — Context from ad-recon

Point to the output directory from a prior ad-recon run when available:

DC_IP="10.10.10.100"
DOMAIN="corp.local"
USERNAME=""        # leave empty to start with unauthenticated attacks (AS-REP Roasting)
PASSWORD=""
NTLM_HASH=""       # format: LM:NT or :NT

# ad-recon output directory (feeds users.txt, asrep_hashes.txt, kerberoast_hashes.txt)
RECON_OUT="$(pwd)/corp-local"

OUT="$(pwd)/corp-local-exploit"
SCRIPTS="$HOME/.claude/skills/ad-exploitation/scripts"

mkdir -p "$OUT"/{hashes,tickets,loot,enum}

# Link or copy recon files so scripts can find them
[ -d "$RECON_OUT" ] && {
  cp -n "$RECON_OUT/enum/users.txt"             "$OUT/enum/users.txt"         2>/dev/null || true
  cp -n "$RECON_OUT/hashes/asrep_hashes.txt"    "$OUT/hashes/asrep_hashes.txt" 2>/dev/null || true
  cp -n "$RECON_OUT/hashes/kerberoast_hashes.txt" "$OUT/hashes/kerberoast_hashes.txt" 2>/dev/null || true
}

If no prior ad-recon was run, ask the user for DC_IP, DOMAIN, and a users.txt before proceeding.

Create progress tasks with TaskCreate:

"PHASE 1 — Credential Attacks (AS-REP Roasting, Kerberoasting, hash cracking)"
"PHASE 2 — Credential Validation Sweep (CME across subnet)"
"PHASE 3 — Domain Domination (DCSync, Golden Ticket)"
"PHASE 4 — Lateral Movement & Persistence"
"PHASE 5 — Report"

---

Tool Priority

1. CLI — always first

impacket-GetNPUsers     — AS-REP Roasting (unauthenticated)
impacket-GetUserSPNs    — Kerberoasting (requires valid creds)
hashcat > john          — hash cracking
crackmapexec / netexec  — credential sweep, pass-the-hash validation
evil-winrm              — WinRM shell
impacket-psexec         — SMB shell (admin share)
impacket-smbexec        — SMB shell (no admin share needed)
impacket-secretsdump    — DCSync, LSA dump
impacket-ticketer       — Golden / Silver Ticket generation
kerbrute                — password spraying (warn about lockout first)
xfreerdp / rdesktop     — RDP access