ad-recon

AD Recon — Host Discovery & Enumeration Kill Chain

Architecture

scripts/
├── common_ad.sh    # Shared functions (logging, has_tool, phase_done, emit_summary)
└── ad_enum.sh      # PHASES 1-2: host discovery + unauthenticated + authenticated enumeration

Each script:

• Accepts <DC_IP> <DOMAIN> <OUT> [USERNAME] [PASSWORD_OR_HASH] [--phase=N] as args
• Uses checkpoints (.phase_X.done) — re-run safely without repeating completed phases
• Emits a JSON summary via ---AD_SUMMARY_JSON--- markers for Claude to parse
• Handles missing tools gracefully — skips with warning, never crashes

---

Initial Setup — Gather Required Information

Before running anything, ensure you have:

DC_IP    = IP of the Domain Controller (e.g., 192.168.1.10)
DOMAIN   = FQDN of the domain (e.g., corp.local)
USERNAME = domain user (optional — Phases 1 and 2 work unauthenticated)
PASSWORD = plaintext password (optional)
NTLM_HASH = LM:NT hash (optional, alternative to password)

If any of these are unknown, ask the user before proceeding.

DC_IP="10.10.10.100"
DOMAIN="corp.local"
USERNAME=""        # leave empty for unauthenticated phases
PASSWORD=""        # leave empty if using hash
NTLM_HASH=""       # format: LM:NT or just :NT

PROJECT=$(echo "$DOMAIN" | sed 's/\./-/g' | tr '[:upper:]' '[:lower:]')
OUT="$(pwd)/$PROJECT"
SCRIPTS="$HOME/.claude/skills/ad-recon/scripts"

mkdir -p "$OUT"/{enum,hashes,bloodhound}

Create progress tasks with TaskCreate:

"PHASE 1 — Host Discovery & Service Scan"
"PHASE 2 — Unauthenticated Enumeration (null sessions, LDAP, kerbrute)"
"PHASE 2auth — Authenticated Enumeration (ldapdomaindump, BloodHound, SPN/AS-REP lists)"
"PHASE 3 — Report & Attack Surface Summary"

Mark each task in_progress when starting, completed when done.

---

Tool Priority

1. CLI — always first

nmap / rustscan          — host and port discovery
enum4linux-ng            — SMB/LDAP null session enumeration (preferred over enum4linux)
rpcclient                — null session: user/group enumeration
smbclient                — null session: share listing
ldapsearch               — anonymous LDAP bind, base DN discovery
kerbrute                 — user enumeration via Kerberos pre-auth (no account needed)
crackmapexec / netexec   — credential validation, SMB/LDAP/WinRM enumeration
ldapdomaindump           — full LDAP dump (requires valid creds)
bloodhound-python        — AD graph data collection (requires valid creds)
impacket-GetNPUsers      — identify AS-REP roastable accounts
impacket-GetUserSPNs     — identify Kerberoastable SPNs