Map and exploit Active Directory attack paths securely

This skill specializes in mapping and attacking Active Directory trust paths once an authorized engagement already has a foothold inside a domain. Its workflow runs in three stages. First, enumeration: pull domain data with tools like NetExec (nxc smb <range> -u user -p pass) and BloodHound (bloodhound-python -d domain.local -u user -p pass -c All -ns <DC>) to build an attack-path graph before touching anything - map first, then act. Second, common attack paths, checked against the graph rather than tried blind: Kerberoasting and AS-REP roasting for offline cracking, ACL abuse (GenericAll/WriteDacl misconfigurations), delegation abuse across unconstrained, constrained, and resource-based delegation, AD CS template misconfigurations located with Certipy, and LLMNR/NBT-NS poisoning paired with ntlmrelayx for forced-authentication relay - the last explicitly gated on confirmed authorization. Third, credentials and lateral movement: secretsdump/lsassy/mimikatz under strict authorization and cleanup discipline, and pass-the-hash, pass-the-ticket, or golden-ticket techniques restricted to an authorized red-team engagement's scope, with every step logged as evidence and explicit user confirmation required before high-risk actions.

Use it once a foothold already exists inside the domain and the focus has narrowed to identity-based attacks - Kerberos abuse, AD CS certificate attacks, ACL and delegation abuse, or NTLM relay. Before any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target, the skill requires the user to state the exact target, confirm written authorization and scope, see the exact command and its expected effect, and give explicit confirmation - without that, it stays read-only and defensive-guidance-only. For a multi-stage engagement that starts from outside the network and needs to reach a domain controller, a separate attack-chain skill stays the primary driver and this one serves as the AD-specialist phase within it. It explicitly rules out unauthorized DCSync or using a golden ticket against a production environment, and it hands EDR-focused research to a separate skill rather than covering it here.

• Input: valid domain credentials and confirmed written authorization and scope; a target domain or DC range to enumerate.
• Output: a BloodHound/SharpHound attack-path graph, a prioritized list of exploitable misconditions (Kerberoastable accounts, abusable ACLs, vulnerable AD CS templates, relay-susceptible hosts), and - for confirmed, in-scope findings - reproducible, sanitized commands logged as evidence.

bloodhound-python -d domain.local -u user -p pass -c All -ns <DC>

BloodHound and SharpHound for attack-path graphing, Certipy for AD CS certificate-template attacks, Impacket and NetExec for enumeration and lateral movement, Rubeus and Mimikatz for ticket and credential operations (within authorization), and Coercer/Responder for forced-authentication and poisoning attacks. It draws on a dedicated references/ad-attack-paths.md reference plus a shared network-attack-defense reference from a companion pentest-tools skill, and cites prior case write-ups from its own field-journal (an AD CS ESC1 case, an NTLM-relay-via-Coercer case, and a Kerberoasting-via-SPN case). Downstream, findings feed a docs-generator skill for reporting, or route to a separate EDR-research skill when detection-evasion analysis is needed.

Authorized red teamers and penetration testers already inside a Windows domain who need a structured, graph-first path from enumeration to credential compromise, within written, scoped authorization.