/ad-discovery

name: ad-discovery
description: >
  Enumerates Active Directory domains and maps attack surface for penetration
  testing.
keywords:
  - enumerate domain
  - AD recon
  - bloodhound
  - domain enumeration
  - active directory
  - find attack paths
  - domain controllers
  - kerberos
  - pre2k
  - pre-created computer accounts
  - machine account default password
  - netexec modules
tools:
  - bloodhound-python
  - rusthound-ce
  - netexec
  - certipy
  - bloodyAD
  - kerbrute
  - Impacket
  - PowerView
opsec: medium

AD Attack Discovery

You are helping a penetration tester enumerate an Active Directory domain and identify attack paths. All testing is under explicit written authorization.

This skill works at three access levels: 1. **No credentials** — network-level recon, poisoning, RID cycling 2. **Username only** — AS-REP roasting, Kerberos user validation 3. **Valid credentials** — full enumeration, BloodHound, ADCS, ACLs

Engagement Logging

Check for `./engagement/` directory. If absent, proceed without logging.

When an engagement directory exists:

• Print `[ad-discovery] Activated → <target>` to the screen on activation.
• **Evidence** → save significant output to `engagement/evidence/` with

descriptive filenames (e.g., `sqli-users-dump.txt`, `ssrf-aws-creds.json`).

Scope Boundary

This skill covers Active Directory discovery — enumerating domain objects, identifying misconfigurations, and reporting findings to the orchestrator. When you confirm an exploitable finding — **STOP**.

Do not load or execute another skill. Do not continue past your scope boundary. Instead, return to the orchestrator with:

• What was found (vulns, credentials, access gained)
• Detection details (finding type, affected objects, evidence)
• Context for technique execution (credentials, DC hostname, domain name, etc.)

The orchestrator decides what runs next. Your job is to execute this skill thoroughly and return clean findings.

**Stay in methodology.** Only use techniques documented in this skill. If you encounter a scenario not covered here, note it and return — do not improvise attacks, write custom exploit code, or apply techniques from other domains. The orchestrator will provide specific guidance or route to a different skill.

You MUST NOT:

• Perform Kerberoasting or AS-REP roasting beyond identifying targets
• Exploit delegation misconfigurations
• Exploit ACL misconfigurations
• Perform credential dumping
• Forge tickets
• Perform coercion or relay attacks
• Exploit ADCS beyond enumeration

When you find exploitable attack paths, present routing recommendations in your return summary. Do not continue past enumeration.

State Management

Call `get_state_summary()` from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

State Writes

Write actionable findings **immediately** via state so the orchestrator can react in real time (via event watcher) instead of waiting for your full return summary. Use these tools as you discover findings:

• `add_credential()` — valid credentials (pre-created computer accounts, gMSA readable, cleartext in descriptions/GPP/shares)
• `add_vuln()` — ADCS misconfigs (ESC1-ESC8), Kerberoastable accounts, coercion vectors, SMB signing disabled, LDAP signing not required
• `add_pivot()` — delegation paths, ACL abuse chains, trust relationships, new subnets from AD Sites
• `add_blocked()` — techniques attempted and failed (so orchestrator doesn't re-route)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

• Network access to the target domain (ports 88, 135, 389, 445, 636)
• For unauthenticated enumeration: just network access
• For authenticated enumeration: valid domain credentials (any privilege level)
• Tools: `netexec` (nxc), `bloodhound-python` or `rusthound-ce`, `certipy`,

`bloodyAD`, `kerbrute`, Impacket suite (`GetUserSPNs.py`, `GetNPUsers.py`, `lookupsid.py`)

**Kerberos-first authentication** (when credentials are available):

This skill may start unauthenticated. Once credentials are obtained, switch to Kerberos authentication for all subsequent enumeration:

# Get a TGT (password, hash, or AES key)
# Use getTGT.py or impacket-getTGT — both are the same tool (see Troubleshooting)
getTGT.py DOMAIN/user:'Password123'@dc.domain.local
# or with NTLM hash
getTGT.py DOMAIN/user@dc.domain.local -hashes :NTHASH

export KRB5CCNAME=user.ccache

# Then use -k -no-pass on all Impacket tools
# Use --use-kcache on NetExec
# Use -k on Certipy and bloodyAD

Step 1: Initial Reconnaissance

Identify domain controllers and assess the network posture.

Find Domain Controllers

# DNS SRV records
nslookup -type=srv _ldap._tcp.dc._msdcs.DOMAIN.LOCAL
nslookup -type=srv _kerberos._tcp.DOMAIN.LOCAL

# NetExec SMB scan — shows OS, signing, SMBv1
nxc smb 10.10.10.0/24

# NetExec generate /etc/hosts entries
nxc smb 10.10.10.0/24 --generate-hosts-file hosts

Check Signing and Relay Posture

# SMB signing — signing:False = relay target
nxc smb 10.10.10.0/24 | grep -i "signing:False"

# LDAP signing — signing:None = relay to LDAP viable
nxc ldap DC01.DOMAIN.LOCAL

# Determine if LDAPS is available
nxc ldap DC01.DOMAIN.LOCAL --port 636

**Findings:**

• SMB signing disabled on non-DCs -> note for coercion/relay
• LDAP signing not required -> note for relay to LDAP
• Domain name, DC hostnames, OS versions -> record in the engagement state

**State writes:**

• SMB signing disabled → `add_vuln(title="SMB sig