Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/ShulkwiSEC/bb-hugenpx agentmods add skills/shulkwisec/bb-huge/active-directory-full-attack-chainWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/shulkwisec/bb-huge/active-directory-full-attack-chain)<a href="https://agentmods.dev/skills/shulkwisec/bb-huge/active-directory-full-attack-chain"><img src="https://agentmods.dev/badge/skills/shulkwisec/bb-huge/active-directory-full-attack-chain.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00096 | $0.02552 |
| Opus 5 | $0.00048 | $0.01276 |
| Sonnet 5 | $0.00019 | $0.00510 |
| Haiku 4.5 | $0.00010 | $0.00255 |
Grade A, and why
active-directory-full-attack-chain scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootlowPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo neo4j start Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Copies of this mod
1 near-identical copy found in the catalogue:
- active-directory-full-attack-chain — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 260 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Active Directory — Full Attack Chain
When to Use
- When conducting internal network penetration tests against Windows/AD environments
- When you have domain user credentials and need to escalate to Domain Admin
- During red team engagements targeting corporate Active Directory infrastructure
- When assessing AD security posture and attack paths
Prerequisites
- Domain user credentials (at minimum)
- Kali Linux or Windows attack machine on the same network
- Impacket toolkit (
pip install impacket) - BloodHound + Neo4j for attack path visualization
- CrackMapExec / NetExec for lateral movement
- Mimikatz or Rubeus for credential attacks
Workflow
Phase 1: Domain Enumeration
# Enumerate domain info with domain user creds
# LDAP enumeration
ldapdomaindump -u 'DOMAIN\user' -p 'Password123' dc.domain.local -o ldap_dump/
# Domain info via CrackMapExec
crackmapexec smb dc.domain.local -u user -p 'Password123' --pass-pol
crackmapexec smb 10.10.10.0/24 -u user -p 'Password123' --shares
# Enumerate users
crackmapexec smb dc.domain.local -u user -p 'Password123' --users
# Enumerate groups
crackmapexec smb dc.domain.local -u user -p 'Password123' --groups
# Using Impacket
GetADUsers.py -all domain.local/user:Password123 -dc-ip 10.10.10.1
# PowerView (if on Windows)
Import-Module .\PowerView.ps1
Get-DomainUser -Properties samaccountname,description | fl
Get-DomainGroup -AdminCount | Select-Object name
Get-DomainComputer -Properties name,operatingsystem | fl
Find-LocalAdminAccess
Phase 2: BloodHound — Attack Path Discovery
# Collect AD data with SharpHound
# From Windows:
.\SharpHound.exe -c All -d domain.local
# From Linux (bloodhound-python):
bloodhound-python -u user -p 'Password123' -d domain.local -dc dc.domain.local -c All
# Start Neo4j and BloodHound
sudo neo4j start
bloodhound --no-sandbox
# Import the .zip data into BloodHound
# Key queries to run:
# - "Find Shortest Paths to Domain Admin"
# - "Find All Kerberoastable Accounts"
# - "Find Principals with DCSync Rights"
# - "Find Computers where Domain Users are Local Admin"
# - "Shortest Paths from Owned Principals"
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 260 lines · 96 tokens per session scan A 0e82c1c91716
active-directory-full-attack-chain is a skill published in the GitHub repository ShulkwiSEC/bb-huge (22 stars, last pushed 1mo ago), licensed MIT. It adds 96 tokens to every session and 2,552 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
active-directory-full-attack-chain
Execute a complete Active Directory penetration test from initial enumeration to domain dominance. Use this skill for AD security assessments including LDAP enumeration, Kerberos attacks (Kerberoasting, AS-REP roasting), BloodHound attack path analysis, credential dumping with Mimikatz, lateral movement via…
active-directory-golden-ticket
Forge highly privileged Kerberos Ticket Granting Tickets (TGTs) to gain persistent, undetectable, and long-term administrative access across an entire Active Directory domain. Use this skill during the final stages of a Red Team operation after Domain Admin access has been achieved, simulating an Advanced Persistent…
detecting-golden-ticket-forgery
Use when detect Kerberos Golden Ticket forgery by analyzing Windows Event ID 4769 for RC4 encryption downgrades (0x17), abnormal ticket lifetimes, and krbtgt account anomalies in Splunk and Elastic SIEM. Use when detecting kerberos golden ticket forgery by analyzing windows event id.
conducting-domain-persistence-with-dcsync
Perform DCSync attacks to replicate Active Directory credentials and establish domain persistence by extracting KRBTGT, Domain Admin, and service account hashes for Golden Ticket creation.
detecting-dcsync-attack-in-active-directory
Detect DCSync attacks where adversaries abuse Active Directory replication privileges to extract password hashes by monitoring for non-domain-controller accounts requesting directory replication via DsGetNCChanges.
ad-exploitation
Active Directory exploitation skill — credential attacks, lateral movement, privilege escalation, and domain domination. Activate when the user wants to exploit an AD environment after enumeration, or mentions: Kerberoasting, AS-REP Roasting, pass-the-hash, pass-the-ticket, lateral movement, DCSync, Golden Ticket…