# Ad Report

> Active Directory penetration testing report generation skill. Activate when the user wants to write, generate, or finalize a report for an AD pentest engagement. Consolidates outputs from ad-recon, ad-exploitation, and ad-postexploitation skills into a structured technical and executive report. Produces findings in standardized format (name, criticality, CVSS, description, impact, recommendation, evidence). Default mode: combined technical + executive. Publishes to Notion via MCP when available.

- Skill: `douglasrao/ad-report` (Agent Skill)
- Install (CLI): `npx skillmds@latest add douglasrao/ad-report`
- Raw SKILL.md: https://api.skillmd.com/api/skills/douglasrao/ad-report/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: DouglasRao (https://skillmd.com/u/douglasrao)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/douglasrao/ad-report

---


# AD Report — Technical & Executive Report Generation

## Architecture

This skill is Claude-driven. It reads output directories from prior AD skills, organizes all
confirmed findings, writes the full report in the correct format, reviews it twice, and publishes
to Notion.

```
Input directories (any combination):
  $RECON_OUT    — ad-recon output (users.txt, nmap_dc.txt, enum4linux, bloodhound zips, asrep/kerberoast hashes)
  $EXPLOIT_OUT  — ad-exploitation output (cracked hashes, admin_hosts.txt, dcsync_hashes.txt)
  $POSTEX_OUT   — ad-postexploitation output (lsass dumps, lateral movement evidence, persistence)
  $EVIDENCE_DIR — screenshots directory (BloodHound paths, hashcat output, CME Pwn3d results)
```

---

## Initial Setup

```bash
TARGET_DOMAIN="corp.local"
DC_IP="10.10.10.100"
CLIENT="Client Company Name"
ENGAGEMENT="Active Directory Penetration Test"
TESTER="[Your Name / Company]"
DATE="$(date +%Y-%m-%d)"

RECON_OUT="$(pwd)/corp-local"
EXPLOIT_OUT="$(pwd)/corp-local-exploit"
POSTEX_OUT="$(pwd)/corp-local-postex"    # leave empty if not applicable
EVIDENCE_DIR="$(pwd)/corp-local/evidence"

# Report mode — default: combined (recommended)
REPORT_MODE="combined"  # options: combined | technical | executive
```

Create progress tasks with TaskCreate:
```
"PHASE 1 — Finding Triage & Consolidation"
"PHASE 2 — Evidence Collection & Organization"
"PHASE 3 — Report Writing"
"PHASE 4 — Review #1 (completeness and technical accuracy)"
"PHASE 5 — Review #2 (clarity, language, formatting)"
"PHASE 6 — Notion Publication"
```

---

## Report Modes

| Mode | Target audience | What it includes |
|------|----------------|-----------------|
| `combined` (default) | Mixed — technical and management | Full technical detail + executive sections with plain-language explanations. Recommended when audience is unknown. |
| `technical` | Security team, sysadmins, blue team | Full technical detail, attack commands, Kerberos internals, BloodHound path details |
| `executive` | C-level, board, CISO | Business impact, risk ratings, remediation priorities — no raw attack commands |

**When mode is not specified: always use `combined`.**

---

## PHASE 1 — Finding Triage & Consolidation

Read all confirmed findings from prior skill outputs:

```bash
# ad-recon findings
cat "$RECON_OUT/enum/nmap_dc.txt" 2>/dev/null             # open ports → attack surface
cat "$RECON_OUT/enum/enum4linux.txt" 2>/dev/null          # null session exposure, password policy
cat "$RECON_OUT/enum/smb_shares_null.txt" 2>/dev/null     # accessible shares without auth
cat "$RECON_OUT/enum/users.txt" 2>/dev/null               # users enumerated without auth
wc -l "$RECON_OUT/hashes/asrep_hashes.txt" 2>/dev/null    # AS-REP roastable count
wc -l "$RECON_OUT/hashes/kerberoast_hashes.txt" 2>/dev/null  # Kerberoastable count

# ad-exploitation findings
cat "$EXPLOIT_OUT/hashes/asrep_cracked.txt" 2>/dev/null
cat "$EXPLOIT_OUT/hashes/kerberoast_cracked.txt" 2>/dev/null
cat "$EXPLOIT_OUT/enum/admin_hosts.txt" 2>/dev/null        # Pwn3d hosts
cat "$EXPLOIT_OUT/loot/dcsync_hashes.txt" 2>/dev/null      # domain hash dump
cat "$EXPLOIT_OUT/loot/krbtgt_hash.txt" 2>/dev/null        # Golden Ticket possibility

# ad-postexploitation findings
cat "$POSTEX_OUT/loot/" 2>/dev/null                        # credentials, SAM, LSASS
ls "$EVIDENCE_DIR/" 2>/dev/null
```

Build consolidated finding list, grouped by severity:
```
CRITICAL  — Domain Admin achieved, DCSync executed, krbtgt hash obtained, Golden Ticket issued
HIGH      — AS-REP Roasting (accounts found + cracked), Kerberoasting (privileged SPN cracked),
            Unconstrained/Constrained delegation abuse, Pass-the-hash to sensitive systems,
            BloodHound path to DA exploited
MEDIUM    — Password spraying success, Null session exposure (user list + password policy),
            SMB signing disabled, Weak password policy, Accessible SMB shares without auth
LOW       — User enumeration via kerbrute, Legacy protocols (NTLMv1, LDAPv2 without signing),
            Excessive user privileges, Stale/disabled accounts
INFO      — Trusts found, Large number of Kerberoastable accounts (even if not cracked)
```

---

## PHASE 2 — Evidence Organization

### Screenshot cataloging for AD findings

Key evidence to capture and describe for each finding:

```bash
# BloodHound attack path screenshot
# → In BloodHound GUI: run "Shortest Path to Domain Admins" → screenshot → save as
#   evidence/critical_bloodhound_path_to_DA.png

# hashcat cracking output
# → terminal output of hashcat showing cracked passwords → save as
#   evidence/critical_asrep_cracked.png  OR  evidence/high_kerberoast_cracked.png

# crackmapexec Pwn3d sweep
# → CME output showing (Pwn3d!) on multiple hosts → save as
#   evidence/high_cme_sweep_pwnd_hosts.png

# DCSync output (hash dump)
# → Capture full secretsdump output including hashes — proof of total domain compromise
#   evidence/critical_dcsync_success.png

# LSASS dump / Mimikatz output
# → Capture extracted credentials including plaintext — proof of compromise
#   evidence/critical_lsass_dump_success.png

# whoami /all showing DA membership
#   evidence/critical_domain_admin_confirmed.png

# AS-REP roastable accounts list (impacket output)
#   evidence/high_asrep_roastable_accounts.png
```

For each screenshot, write a 1-2 sentence explanation:
- **What** is visible
- **Why** it confirms the finding (not just "this shows X" — explain the security implication)

---

## PHASE 3 — Report Writing

### Document structure

```
COVER PAGE
  - Client name
  - Engagement type
  - Period and date
  - Tester / company
  - Document classification (Confidential)

EXECUTIVE SUMMARY
  - Overview of the assessed environment
  - Total vulnerabilities by severity (table)
  - Most critical result in business language
  - Consolidated business impact
  - Priority recommendations

METHODOLOGY (technical / combined)
  - Scope (IPs, domain, credentials provided if gray-box)
  - Tools used
  - Phases executed
  - Limitations

VULNERABILITY SUMMARY (table sorted by CVSS)
  | # | Name | Criticality | CVSS | Category | Status |

DETAILED FINDINGS (one section per finding, sorted Critical → Info)

FULL ATTACK PATH (combined/technical)
  - Step-by-step narrative from initial access to Domain Admin
  - Textual attack path diagram if BloodHound data available

CONCLUSION

APPENDIX — Tools, references, AD terminology glossary
```

---

## Finding Template — Required Format

**Apply this template for every confirmed finding. Write each field as a full paragraph.**

```
### [CRITICALITY] — [Vulnerability Name]

**Criticality:** Critical / High / Medium / Low / Informational
**CVSS Score:** X.X (Critical/High/Medium/Low)
**CVSS Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
**Category:** Credentials / Kerberos / Enumeration / Configuration / Persistence
**Affected accounts/hosts:** [list or count]

---

**Description**

[1 robust paragraph — minimum 4-6 sentences. Explain WHAT the vulnerability is, HOW it works
technically (include Kerberos/NTLM/AD concept when relevant), WHY this environment is vulnerable,
and what configuration or policy characteristic makes it exploitable.
In combined/executive mode: open with a plain-language analogy in the first 1-2 sentences before
technical details. E.g.: "In practical terms, this vulnerability allows an attacker to..."]

---

**Impact / Observation**

[1 robust paragraph — minimum 4-6 sentences. Explain WHAT an attacker can do by exploiting this,
what systems or data are exposed, the organizational impact (operational, financial, reputational),
and the ease of exploitation. For findings like DCSync: explain that obtaining the krbtgt hash
enables Golden Ticket generation — unrestricted domain access that persists even after regular
user password changes.]

---

**Recommendation / Remediation**

[1 robust paragraph — minimum 4-6 sentences. Explain WHAT must be done to fix it with enough
technical specificity. Include primary fix + defense in depth. For Kerberoasting: recommend a
strong password (>25 random characters) + Group Managed Service Accounts (gMSA). For AS-REP
Roasting: enable Kerberos pre-authentication on all accounts. Include recommended fix timeline
based on criticality.]

---

**Evidence**

[For each screenshot:]

*Figure X — [descriptive title]*
`File: evidence/[filename].png`

> [2-4 sentences explaining WHAT is happening: what was executed, what the system returned,
> and what this proves from a security standpoint. Language clear enough for a non-technical
> audience.]

[If terminal output as PoC:]
\`\`\`
[terminal output — include obtained hashes and passwords as proof of exploitation]
\`\`\`
*The output above demonstrates [what happened]. [What this means for the security of the environment.]*
```

---

## CVSS Reference Table (AD findings)

| Vulnerability | CVSS Base | Criticality | Vector |
|----------------|-----------|-------------|--------|
| Domain Admin compromised | 10.0 | Critical | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| DCSync executed (hash dump) | 9.9 | Critical | AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| Golden Ticket issued | 9.9 | Critical | AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| AS-REP Roasting (cracked) | 8.1 | High | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| Kerberoasting (priv. account cracked) | 8.8 | High | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| Kerberoasting (low-priv cracked) | 7.5 | High | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| Pass-the-Hash (admin) | 9.8 | Critical | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Pass-the-Hash (standard) | 8.8 | High | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| Unconstrained delegation | 8.8 | High | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| Constrained delegation abuse | 8.8 | High | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| LSASS dump (creds extracted) | 9.1 | Critical | AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N |
| BloodHound path to DA exploited | 9.0 | Critical | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N |
| ACL abuse (GenericAll on DA group) | 8.8 | High | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| Password spraying (success) | 7.5 | High | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| Null session (user enum) | 5.3 | Medium | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| Null session (password policy) | 5.3 | Medium | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| SMB signing disabled | 6.8 | Medium | AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N |
| Weak password policy | 6.5 | Medium | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| User enumeration (kerbrute) | 5.3 | Medium | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| Accessible SMB shares (no auth) | 5.3 | Medium | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GPP password exposure | 8.8 | High | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| AS-REP Roasting (not cracked) | 5.3 | Medium | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| Kerberoasting (not cracked) | 4.3 | Medium | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| Excessive user privileges | 4.3 | Medium | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| Stale / disabled admin accounts | 3.1 | Low | AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |

> **Adjust CVSS based on context**: gray-box (PR:L instead of PR:N), internal network only (AV:A instead of AV:N), requires domain user (PR:L).

---

## Attack Path Narrative Template (combined/technical)

Include this section after individual findings when a full attack chain was executed:

```
## Full Attack Path

The following is the sequential narrative of the attack executed during the test,
from initial access to full compromise of domain [DOMAIN].

**1. Initial access / reconnaissance**
[Starting point: credentials provided (gray-box) or unauthenticated enumeration.
How many users were identified and by which method.]

**2. First credential obtained**
[Which technique was used (AS-REP Roasting / Kerberoasting / spraying), which account was
compromised, and what level of access was gained.]

**3. Privilege escalation**
[How access was expanded: BloodHound path, ACL abuse, delegation, etc.
Which target account or group was compromised.]

**4. Domain compromise**
[How DA was obtained: DCSync, pass-the-hash, golden ticket.
Which hosts were accessed as a result.]

**5. Persistence established**
[Persistence mechanisms used during the test (removed after the engagement).]

**Attack diagram:**
```
[Unauthenticated user]
       │ Kerbrute / null session
       ▼
[Domain user list]
       │ AS-REP Roasting
       ▼
[$krb5asrep hash for user X] → hashcat → [password: Summer2024!]
       │ Kerberoasting as user X
       ▼
[TGS hash for MSSQLSvc] → hashcat → [password: Service@123]
       │ BloodHound: MSSQLSvc → GenericAll → IT Admins → Domain Admins
       ▼
[Added to IT Admins group] → [DA access]
       │ DCSync
       ▼
[Administrator + krbtgt NTLM hashes]
       │ Pass-the-Hash
       ▼
[SYSTEM shell on all DCs and domain servers]
```
```

---

## PHASE 4 & 5 — Double Review

**Review #1 — Technical accuracy:**
- Every finding has: name, criticality, CVSS score + vector, affected accounts/hosts, description, impact, remediation, evidence
- CVSS scores are consistent with the actual exploitability demonstrated
- Hashes and passwords obtained are included as exploitation evidence
- Screenshots correctly described — no mismatch between image and text
- Attack Path Narrative is chronologically correct
- No finding listed without confirmed exploitation evidence

**Review #2 — Language, clarity, formatting:**
- All text is clear and consistent in language and style
- Executive sections use no jargon without explanation
- No spelling or grammatical errors
- Paragraphs are 4-6 sentences minimum and substantive
- Finding table sorted by CVSS (highest first)
- All evidence files correctly referenced

**After both reviews:** explicitly confirm: *"Report reviewed twice. No pending items identified."*

---

## PHASE 6 — Notion Publication

When `mcp__Notion__*` is available:

```
1. Create main page: mcp__Notion__notion-create-pages
   Title: "AD Pentest Report — [CLIENT] — [DATE]"
   Content: Executive Summary + Finding Summary Table

2. For each finding (Critical/High/Medium):
   Create subpage: mcp__Notion__notion-create-pages (child)
   Title: "[CVSS] [CRITICALITY] — [Vulnerability Name]"
   Content: Full finding in template format

3. Create Attack Path page:
   Full attack narrative + textual diagram

4. Create Appendix page:
   Tools, scope, AD terminology glossary
```

---

## Executive Summary Template

```
## Executive Summary

This report presents the results of the Active Directory penetration test conducted against
domain [DOMAIN] on [DATE], performed by [TESTER]. The objective was to assess the security
posture of the directory environment and identify paths an attacker could take to compromise
the infrastructure.

**Most critical result:** [Describe in 1-2 sentences whether DA was obtained and how, in
business language. E.g.: "It was possible to gain full control over domain [DOMAIN] —
including access to all servers, workstations, and organizational data — starting from a
standard user account with no administrative privileges."]

**Severity distribution:**
| Severity  | Count |
|-----------|-------|
| Critical  | X     |
| High      | X     |
| Medium    | X     |
| Low       | X     |

**Priority recommendations:**
1. [Most urgent — 1 sentence in business language]
2. [Second priority]
3. [Third priority]
```

---

## MCP Integration

### Notion (`mcp__Notion__*`)
- `notion-create-pages` — create main page and subpages per finding
- `notion-update-page` — update with additional evidence
- `notion-create-comment` — review notes

---

## Operational Notes

- **Complete before publishing**: never publish without both reviews completed
- **Evidence required**: every Critical/High finding must have at least 1 screenshot
- **Hashes and passwords as evidence**: include the actual values obtained — they are proof of exploitation impact; the report is a confidential document delivered to the client
- **Technical context in business language**: for executives, every technical vulnerability must have at least 1 impact sentence in business terms (data, operations, reputation, compliance)
- **Attack path narrative is mandatory** when DA was compromised — it is the most impactful section of the report