4624: Successful logon
4625: Logon failure
4768: Kerberos Authentication (TGT Request)
4769: Kerberos Service Ticket (ST Request)
4776: NTLM Authentication
4672: Assign special privileges

A Claude Code plugin that shows what's happening - context usage, active tools, running agents, and todo progress

◐ Edit: auth.ts | ✓ Read ×3 | ✓ Grep ×2 ← Tools activity
◐ explore [haiku]: Finding auth code (2m 15s) ← Agent status
▸ Fix authentication bug (2/5) ← Todo progress

Суть уязвимости заключается в возможности повышения привилегий локального пользователя (LPE)
Проблема была сообщена Microsoft через их Центр реагирования на безопасность (MSRC), но исследователь остался недоволен (и бахнул сплоит 😂) тем, как была обработана жалоба

Initial release of adPEAS v2 a complete rewrite of adPEAS

Import-Module .\adPEAS.ps1
Invoke-adPEAS

Domain - поиск базовой информации о контроллерах домена, сайтов, трастов и стандартных парольных политиках

Rights - поиск различных прав, например LAPS, DCSync и т.д.

GPO - базовая информация о групповых политиках

ADCS - информация о центрах сертификации

Creds - ASREPRoast, Kerberoasting, GroupPolicies, Netlogon скрипты, LAPS, gMSA и т.д.

Delegation - поиск делегирования, например ограниченное делегирование, неограниченное делегирование и RBCD (Resource Based Constrained Delegation) для компьютеров и учетных записей

Accounts - информация об аккаунтах

Computer - AD DS, AD CS, Exchange серверы и т.д.

BloodHound - сборщик данных для BH

Invoke-adPEAS -Domain 'contoso.com' -Outputfile 'C:\temp\adPEAS_outputfile' -NoColor

Invoke-adPEAS -Domain 'contoso.com' -Server 'dc1.contoso.com'

$SecPassword = ConvertTo-SecureString 'Passw0rd1!' -AsPlainText -Force

$Cred = New-Object System.Management.Automation.PSCredential('contoso\johndoe', $SecPassword)

Invoke-adPEAS -Domain 'contoso.com' -Cred $Cred

Invoke-adPEAS -Module Domain
Invoke-adPEAS -Module Rights
Invoke-adPEAS -Module GPO
Invoke-adPEAS -Module ADCS
Invoke-adPEAS -Module Creds
Invoke-adPEAS -Module Delegation
Invoke-adPEAS -Module Accounts
Invoke-adPEAS -Module Computer
Invoke-adPEAS -Module Bloodhound -Scope All

CertiHound enumerates Active Directory Certificate Services (AD CS) via LDAP and exports BloodHound CE-compatible data for attack path visualization. Identify ESC1-ESC17 vulnerabilities and visualize certificate-based attack paths

certihound -d corp.local -u 'user' -p 'password' --dc 10.10.10.10 --format zip

from certihound import ADCSCollector, BloodHoundCEExporter
from certihound.ldap.connection import LDAPConnection, LDAPConfig

# Configure connection
config = LDAPConfig(
    domain="corp.local",
    username="user",
    password="password",
    dc_ip="10.10.10.10",
    use_ldaps=True,
)

# Collect and export
with LDAPConnection(config) as conn:
    collector = ADCSCollector(conn)
    data = collector.collect_all()

    exporter = BloodHoundCEExporter(data.domain, data.domain_sid)
    result = exporter.export(data)
    result.write_zip("bloodhound_adcs.zip")

nxc ldap 10.10.10.10 -u user -p pass --bloodhound -c ADCS

Backdoor.AdaptixC2.TLS.C&C
Backdoor.AdaptixC2.TCP.C&C
Backdoor.AdaptixC2.SMB.C&C
Backdoor.AdaptixC2.HTTP.C&C
Backdoor.AdaptixC2.DNS.C&C

A single-binary Kubernetes attack path engine for authorized security assessments
Drop it into a compromised pod, run it, and get a map of every realistic escalation path - from your current foothold to cluster-admin, node access, secret theft, and cloud IAM roles

KrakenHashes is a distributed password cracking system designed for security professionals and red teams. The platform coordinates GPU/CPU resources across multiple agents to perform high-speed hash cracking using tools like Hashcat through a secure web interface

ExchangeHound is built primarily for blue teams, detection engineers, and AD/Exchange defenders. It maps mailbox delegation and Exchange control-plane relationships into a graph you can query in BloodHound. It focuses on high-value relationships such as FullAccess, SendAs, SendOnBehalf, folder permissions, public folder ACLs, transport rules, and Exchange RBAC assignments

A collector for adding MSSQL attack paths to BloodHound

git clone https://github.com/SpecterOps/MSSQLHound.git
cd MSSQLHound

# Build the binary (Go 1.25+)
go build -o mssqlhound ./cmd/mssqlhound

curl -L https://ghst.ly/getbhce | docker compose -f - up

http://localhost:8080/ui/login

docker compose pull && docker compose up

python3 bloodhound-python -u domain_user -p 'P@ss' -ns 10.0.0.1 -d contoso.com -c all --dns-tcp

# Domain Admins и время установки пароля
MATCH (g:Group) WHERE g.name =~ "(?i).*DOMAIN ADMINS.*" WITH g MATCH (g)<-
[r:MemberOf*1..]-(u) RETURN u.name AS User,
datetime({epochSeconds:toInteger(u.pwdlastset)}) as passwordLastSet, datetime({epochSeconds: toInteger(u.whencreated)}) AS dateCreated ORDER BY u.pwdlastset

# Сервисные УЗ, время установки пароля, дата создания
MATCH (u:User) WHERE u.hasspn=true AND (NOT u.name STARTS WITH 'KRBTGT') RETURN u.name
AS accountName, datetime({epochSeconds: toInteger(u.pwdlastset)}) AS passwordLastSet,
datetime({epochSeconds: toInteger(u.whencreated)}) AS dateCreated ORDER BY u.pwdlastset

# Пользователи и описание
MATCH (u:User) RETURN u.name as username, u.description as description

# Domain Admins или Administrators с сессией исключая DC
MATCH (c1:Computer)-[:MemberOf*1..]->(g:Group) WHERE g.objectid ENDS WITH '-516' WITH
COLLECT(c1.name) AS domainControllers
MATCH (n:User)-[:MemberOf*1..]->(g:Group) WHERE g.objectid ENDS WITH '-512' OR
g.objectid ENDS WITH '-544'
MATCH p = (c:Computer)-[:HasSession]->(n) WHERE NOT c.name in domainControllers return
p

# Неограниченное делегирование исключая DC
MATCH (c1:Computer)-[:MemberOf*1..]->(g:Group) WHERE g.objectid ENDS WITH '-516' WITH
COLLECT(c1.name) AS domainControllers
MATCH (c:Computer {unconstraineddelegation:true}) WHERE NOT c.name IN domainControllers
RETURN c

# Пользователи с ограниченным делегированием
MATCH p = ((u:User)-[r:AllowedToDelegate]->(c:Computer)) RETURN p

Automated DLL Hijacking Discovery, Validation, and Confirmation. Turning local misconfigurations into weaponized, confirmed attack paths

IPAHound is a specialized LDAP collector designed for FreeIPA domain controllers, enabling comprehensive domain analysis through graph-based visualization. It bridges the gap between FreeIPA's complex structure and BloodHound's powerful analysis capabilities

uv tool install git+https://github.com/IPAHound/IPAHound.git

kinit admin
ipahound -k -s dc01.ipa.local -a out.json

Gain insights into MS-RPC implementations that may be vulnerable using an automated approach and make it easy to visualize the data

Import-Module .\MS-RPC-Fuzzer.psm1
Get-RpcServerData -target "C:\Windows\System32\efssvc.dll" -OutPath .\output

#Fuzzing
'.\output\rpcServerData.json' | Invoke-RpcFuzzer -outpath .\output\ -minStrLen 100 -maxStrLen 1000 -minIntSize 9999 -maxIntSize 99999

#Analysis
'.\output\Allowed.json' | Import-DatatoNeo4j -Neo4jHost 192.168.178.89:7474 -Neo4jUsername neo4j

The technique of EntryPoint Hijacking introduces a stealthier approach to code injection, as it doesn’t rely on API calls that create a new thread within the process context, and it is independent of the attack chain