Ad Report

AD Report — Technical & Executive Report Generation

Architecture

This skill is Claude-driven. It reads output directories from prior AD skills, organizes all confirmed findings, writes the full report in the correct format, reviews it twice, and publishes to Notion.

Input directories (any combination):
  $RECON_OUT    — ad-recon output (users.txt, nmap_dc.txt, enum4linux, bloodhound zips, asrep/kerberoast hashes)
  $EXPLOIT_OUT  — ad-exploitation output (cracked hashes, admin_hosts.txt, dcsync_hashes.txt)
  $POSTEX_OUT   — ad-postexploitation output (lsass dumps, lateral movement evidence, persistence)
  $EVIDENCE_DIR — screenshots directory (BloodHound paths, hashcat output, CME Pwn3d results)

Initial Setup

TARGET_DOMAIN="corp.local"
DC_IP="10.10.10.100"
CLIENT="Client Company Name"
ENGAGEMENT="Active Directory Penetration Test"
TESTER="[Your Name / Company]"
DATE="$(date +%Y-%m-%d)"

RECON_OUT="$(pwd)/corp-local"
EXPLOIT_OUT="$(pwd)/corp-local-exploit"
POSTEX_OUT="$(pwd)/corp-local-postex"    # leave empty if not applicable
EVIDENCE_DIR="$(pwd)/corp-local/evidence"

# Report mode — default: combined (recommended)
REPORT_MODE="combined"  # options: combined | technical | executive

Create progress tasks with TaskCreate:

"PHASE 1 — Finding Triage & Consolidation"
"PHASE 2 — Evidence Collection & Organization"
"PHASE 3 — Report Writing"
"PHASE 4 — Review #1 (completeness and technical accuracy)"
"PHASE 5 — Review #2 (clarity, language, formatting)"
"PHASE 6 — Notion Publication"

Report Modes

When mode is not specified: always use combined.

PHASE 1 — Finding Triage & Consolidation

Read all confirmed findings from prior skill outputs:

# ad-recon findings
cat "$RECON_OUT/enum/nmap_dc.txt" 2>/dev/null             # open ports → attack surface
cat "$RECON_OUT/enum/enum4linux.txt" 2>/dev/null          # null session exposure, password policy
cat "$RECON_OUT/enum/smb_shares_null.txt" 2>/dev/null     # accessible shares without auth
cat "$RECON_OUT/enum/users.txt" 2>/dev/null               # users enumerated without auth
wc -l "$RECON_OUT/hashes/asrep_hashes.txt" 2>/dev/null    # AS-REP roastable count
wc -l "$RECON_OUT/hashes/kerberoast_hashes.txt" 2>/dev/null  # Kerberoastable count

# ad-exploitation findings
cat "$EXPLOIT_OUT/hashes/asrep_cracked.txt" 2>/dev/null
cat "$EXPLOIT_OUT/hashes/kerberoast_cracked.txt" 2>/dev/null
cat "$EXPLOIT_OUT/enum/admin_hosts.txt" 2>/dev/null        # Pwn3d hosts
cat "$EXPLOIT_OUT/loot/dcsync_hashes.txt" 2>/dev/null      # domain hash dump
cat "$EXPLOIT_OUT/loot/krbtgt_hash.txt" 2>/dev/null        # Golden Ticket possibility

# ad-postexploitation findings
cat "$POSTEX_OUT/loot/" 2>/dev/null                        # credentials, SAM, LSASS
ls "$EVIDENCE_DIR/" 2>/dev/null

Build consolidated finding list, grouped by severity:

CRITICAL  — Domain Admin achieved, DCSync executed, krbtgt hash obtained, Golden Ticket issued
HIGH      — AS-REP Roasting (accounts found + cracked), Kerberoasting (privileged SPN cracked),
            Unconstrained/Constrained delegation abuse, Pass-the-hash to sensitive systems,
            BloodHound path to DA exploited
MEDIUM    — Password spraying success, Null session exposure (user list + password policy),
            SMB signing disabled, Weak password policy, Accessible SMB shares without auth
LOW       — User enumeration via kerbrute, Legacy protocols (NTLMv1, LDAPv2 without signing),
            Excessive user privileges, Stale/disabled accounts
INFO      — Trusts found, Large number of Kerberoastable accounts (even if not cracked)

PHASE 2 — Evidence Organization

Screenshot cataloging for AD findings

Key evidence to capture and describe for each finding:

# BloodHound attack path screenshot
# → In BloodHound GUI: run "Shortest Path to Domain Admins" → screenshot → save as
#   evidence/critical_bloodhound_path_to_DA.png

# hashcat cracking output
# → terminal output of hashcat showing cracked passwords → save as
#   evidence/critical_asrep_cracked.png  OR  evidence/high_kerberoast_cracked.png

# crackmapexec Pwn3d sweep
# → CME output showing (Pwn3d!) on multiple hosts → save as
#   evidence/high_cme_sweep_pwnd_hosts.png

# DCSync output (hash dump)
# → Capture full secretsdump output including hashes — proof of total domain compromise
#   evidence/critical_dcsync_success.png

# LSASS dump / Mimikatz output
# → Capture extracted credentials including plaintext — proof of compromise
#   evidence/critical_lsass_dump_success.png

# whoami /all showing DA membership
#   evidence/critical_domain_admin_confirmed.png

# AS-REP roastable accounts list (impacket output)
#   evidence/high_asrep_roastable_accounts.png

For each screenshot, write a 1-2 sentence explanation:

• What is visible
• Why it confirms the finding (not just "this shows X" — explain the security implication)

PHASE 3 — Report Writing

Document structure

COVER PAGE
  - Client name
  - Engagement type
  - Period and date
  - Tester / company
  - Document classification (Confidential)

EXECUTIVE SUMMARY
  - Overview of the assessed environment
  - Total vulnerabilities by severity (table)
  - Most critical result in business language
  - Consolidated business impact
  - Priority recommendations

METHODOLOGY (technical / combined)
  - Scope (IPs, domain, credentials provided if gray-box)
  - Tools used
  - Phases executed
  - Limitations

VULNERABILITY SUMMARY (table sorted by CVSS)
  | # | Name | Criticality | CVSS | Category | Status |

DETAILED FINDINGS (one section per finding, sorted Critical → Info)

FULL ATTACK PATH (combined/technical)
  - Step-by-step narrative from initial access to Domain Admin
  - Textual attack path diagram if BloodHound data available

CONCLUSION

APPENDIX — Tools, references, AD terminology glossary

Finding Template — Required Format

Apply this template for every confirmed finding. Write each field as a full paragraph.

### [CRITICALITY] — [Vulnerability Name]

**Criticality:** Critical / High / Medium / Low / Informational
**CVSS Score:** X.X (Critical/High/Medium/Low)
**CVSS Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
**Category:** Credentials / Kerberos / Enumeration / Configuration / Persistence
**Affected accounts/hosts:** [list or count]

---

**Description**

[1 robust paragraph — minimum 4-6 sentences. Explain WHAT the vulnerability is, HOW it works
technically (include Kerberos/NTLM/AD concept when relevant), WHY this environment is vulnerable,
and what configuration or policy characteristic makes it exploitable.
In combined/executive mode: open with a plain-language analogy in the first 1-2 sentences before
technical details. E.g.: "In practical terms, this vulnerability allows an attacker to..."]

---

**Impact / Observation**

[1 robust paragraph — minimum 4-6 sentences. Explain WHAT an attacker can do by exploiting this,
what systems or data are exposed, the organizational impact (operational, financial, reputational),
and the ease of exploitation. For findings like DCSync: explain that obtaining the krbtgt hash
enables Golden Ticket generation — unrestricted domain access that persists even after regular
user password changes.]

---

**Recommendation / Remediation**

[1 robust paragraph — minimum 4-6 sentences. Explain WHAT must be done to fix it with enough
technical specificity. Include primary fix + defense in depth. For Kerberoasting: recommend a
strong password (>25 random characters) + Group Managed Service Accounts (gMSA). For AS-REP
Roasting: enable Kerberos pre-authentication on all accounts. Include recommended fix timeline
based on criticality.]

---

**Evidence**

[For each screenshot:]

*Figure X — [descriptive title]*
`File: evidence/[filename].png`

> [2-4 sentences explaining WHAT is happening: what was executed, what the system returned,
> and what this proves from a security standpoint. Language clear enough for a non-technical
> audience.]

[If terminal output as PoC:]
\`\`\`
[terminal output — include obtained hashes and passwords as proof of exploitation]
\`\`\`
*The output above demonstrates [what happened]. [What this means for the security of the environment.]*

CVSS Reference Table (AD findings)

Adjust CVSS based on context: gray-box (PR:L instead of PR:N), internal network only (AV:A instead of AV:N), requires domain user (PR:L).

Attack Path Narrative Template (combined/technical)

Include this section after individual findings when a full attack chain was executed:

## Full Attack Path

The following is the sequential narrative of the attack executed during the test,
from initial access to full compromise of domain [DOMAIN].

**1. Initial access / reconnaissance**
[Starting point: credentials provided (gray-box) or unauthenticated enumeration.
How many users were identified and by which method.]

**2. First credential obtained**
[Which technique was used (AS-REP Roasting / Kerberoasting / spraying), which account was
compromised, and what level of access was gained.]

**3. Privilege escalation**
[How access was expanded: BloodHound path, ACL abuse, delegation, etc.
Which target account or group was compromised.]

**4. Domain compromise**
[How DA was obtained: DCSync, pass-the-hash, golden ticket.
Which hosts were accessed as a result.]

**5. Persistence established**
[Persistence mechanisms used during the test (removed after the engagement).]

**Attack diagram:**

[Unauthenticated user] │ Kerbrute / null session ▼ [Domain user list] │ AS-REP Roasting ▼ [$krb5asrep hash for user X] → hashcat → [password: Summer2024!] │ Kerberoasting as user X ▼ [TGS hash for MSSQLSvc] → hashcat → [password: Service@123] │ BloodHound: MSSQLSvc → GenericAll → IT Admins → Domain Admins ▼ [Added to IT Admins group] → [DA access] │ DCSync ▼ [Administrator + krbtgt NTLM hashes] │ Pass-the-Hash ▼ [SYSTEM shell on all DCs and domain servers]

PHASE 4 & 5 — Double Review

Review #1 — Technical accuracy:

• Every finding has: name, criticality, CVSS score + vector, affected accounts/hosts, description, impact, remediation, evidence
• CVSS scores are consistent with the actual exploitability demonstrated
• Hashes and passwords obtained are included as exploitation evidence
• Screenshots correctly described — no mismatch between image and text
• Attack Path Narrative is chronologically correct
• No finding listed without confirmed exploitation evidence

Review #2 — Language, clarity, formatting:

• All text is clear and consistent in language and style
• Executive sections use no jargon without explanation
• No spelling or grammatical errors
• Paragraphs are 4-6 sentences minimum and substantive
• Finding table sorted by CVSS (highest first)
• All evidence files correctly referenced

After both reviews: explicitly confirm: "Report reviewed twice. No pending items identified."

PHASE 6 — Notion Publication

When mcp__Notion__* is available:

1. Create main page: mcp__Notion__notion-create-pages
   Title: "AD Pentest Report — [CLIENT] — [DATE]"
   Content: Executive Summary + Finding Summary Table

2. For each finding (Critical/High/Medium):
   Create subpage: mcp__Notion__notion-create-pages (child)
   Title: "[CVSS] [CRITICALITY] — [Vulnerability Name]"
   Content: Full finding in template format

3. Create Attack Path page:
   Full attack narrative + textual diagram

4. Create Appendix page:
   Tools, scope, AD terminology glossary

Executive Summary Template

## Executive Summary

This report presents the results of the Active Directory penetration test conducted against
domain [DOMAIN] on [DATE], performed by [TESTER]. The objective was to assess the security
posture of the directory environment and identify paths an attacker could take to compromise
the infrastructure.

**Most critical result:** [Describe in 1-2 sentences whether DA was obtained and how, in
business language. E.g.: "It was possible to gain full control over domain [DOMAIN] —
including access to all servers, workstations, and organizational data — starting from a
standard user account with no administrative privileges."]

**Severity distribution:**
| Severity  | Count |
|-----------|-------|
| Critical  | X     |
| High      | X     |
| Medium    | X     |
| Low       | X     |

**Priority recommendations:**
1. [Most urgent — 1 sentence in business language]
2. [Second priority]
3. [Third priority]

MCP Integration

Notion (mcp__Notion__*)

• notion-create-pages — create main page and subpages per finding
• notion-update-page — update with additional evidence
• notion-create-comment — review notes

Operational Notes

• Complete before publishing: never publish without both reviews completed
• Evidence required: every Critical/High finding must have at least 1 screenshot
• Hashes and passwords as evidence: include the actual values obtained — they are proof of exploitation impact; the report is a confidential document delivered to the client
• Technical context in business language: for executives, every technical vulnerability must have at least 1 impact sentence in business terms (data, operations, reputation, compliance)
• Attack path narrative is mandatory when DA was compromised — it is the most impactful section of the report