ad-breach

AD Breach: Active Directory Attack Path Enumeration & Exploitation

A structured, iterative methodology for enumerating, analyzing, and compromising Active Directory environments from Linux. Starts from zero credentials and escalates to full domain compromise through enumeration, vulnerability discovery, and multi-stage exploitation chains. Every phase feeds into the next; each credential unlock cascades into deeper access.

When this skill is active, follow the phases in order but iterate: Phase 0 output feeds Phase 1, Phase 3 findings unlock Phase 4 abuses, Phase 5 credentials upgrade Phase 1, etc. Run each command, collect output, and build the final Markdown report incrementally. Always operate within scope and rules of engagement: AD attack tooling is intrusive, and some techniques (password spraying, DCSync, ticket forging, coercion attacks) can lock out accounts, trigger EDR alerts, or destabilize directory replication if misconfigured.

Pre-flight: Tool Check

Before starting, verify required tools are available:

for tool in nxc netexec crackmapexec impacket-GetNPUsers impacket-GetUserSPNs impacket-secretsdump impacket-psexec impacket-addcomputer ldapsearch kerbrute bloodhound-python certipy-ad smbclient rpcclient enum4linux-ng dig; do
  command -v $tool >/dev/null 2>&1 && echo "$tool OK" || echo "$tool MISSING"
done

nxc (NetExec) has replaced CrackMapExec upstream. If nxc is missing, use crackmapexec as fallback. Install missing tools:

# Impacket suite (comprehensive)
pipx install impacket

# NetExec (unified SMB/LDAP/Kerberos enum)
pipx install netexec

# BloodHound ingestor
pipx install bloodhound

# Certipy (AD CS enumeration/abuse)
pipx install certipy-ad

# kerbrute (silent Kerberos user enum, no event logs)
go install github.com/ropnop/kerbrute@latest

# enum4linux-ng (legacy RPC/RID fallback)
git clone https://github.com/cddmp/enum4linux-ng /opt/enum4linux-ng

Inform the user of any tools that could not be installed and note which phases will be skipped or degraded. Critical for AD breach: having nxc + bloodhound-python + impacket is the minimum viable toolkit; everything else is force-multiplier bonus.