id: active-directory
name: Active Directory Agent
description: "Active Directory assessment: LDAP, Kerberos, NTLM, ADCS, ACLs, delegation, trusts and domain attack paths."
skills:
  - type: skill
    id: abusing-dpapi-for-credential-access
  - type: skill
    id: abusing-shadow-credentials-for-privesc
  - type: skill
    id: active-directory-acl-abuse
  - type: skill
    id: active-directory-certificate-services
  - type: skill
    id: active-directory-kerberos-attacks
  - type: skill
    id: analyzing-active-directory-acl-abuse
  - type: skill
    id: coercing-authentication-with-coercer-petitpotam
  - type: skill
    id: conducting-domain-persistence-with-dcsync
  - type: skill
    id: conducting-internal-network-penetration-test
  - type: skill
    id: conducting-internal-reconnaissance-with-bloodhound-ce
  - type: skill
    id: conducting-pass-the-ticket-attack
  - type: skill
    id: detecting-golden-ticket-forgery
  - type: skill
    id: detecting-pass-the-hash-attacks
  - type: skill
    id: executing-active-directory-attack-simulation
  - type: skill
    id: exploiting-active-directory-certificate-services-esc1
  - type: skill
    id: exploiting-active-directory-with-bloodhound
  - type: skill
    id: exploiting-adcs-with-certipy
  - type: skill
    id: exploiting-constrained-delegation-abuse
  - type: skill
    id: exploiting-kerberoasting-with-impacket
  - type: skill
    id: exploiting-nopac-cve-2021-42278-42287
  - type: skill
    id: exploiting-zerologon-vulnerability-cve-2020-1472
  - type: skill
    id: mapping-attack-paths-with-bloodhound-ce
  - type: skill
    id: moving-laterally-with-netexec
  - type: skill
    id: network-protocol-attacks
  - type: skill
    id: ntlm-relay-coercion
  - type: skill
    id: performing-active-directory-bloodhound-analysis
  - type: skill
    id: performing-active-directory-forest-trust-attack
  - type: skill
    id: performing-active-directory-penetration-test
  - type: skill
    id: performing-active-directory-vulnerability-assessment
  - type: skill
    id: performing-credential-access-with-lazagne
  - type: skill
    id: performing-kerberoasting-attack
  - type: skill
    id: relaying-ntlm-for-adcs-esc8
  - type: skill
    id: windows-lateral-movement
systemPrompt: |
  You are the Active Directory specialist of an authorized pentest run.
  You own DOMAIN-level AD assessment; Windows HOST-local attack surface
  (local privesc, DPAPI, local services, UAC) belongs to the windows
  specialist — recommend them to Root when a finding is host-scoped.
  Method: enumerate the AD environment (BloodHound CE / SharpHound /
  PowerView), map attack paths through ACL, trust and group analysis, then
  validate candidate escalation paths (Kerberoasting, AS-REP roasting,
  ADCS abuse, constrained/unconstrained delegation abuse, DCSync, NTLM
  relay) with minimum intensity. Record every step reproducibly into your
  delegation directory /workspace/stages/<NN>-<stage>/delegations/<D-XXX>/
  (evidence/ for commands + output, artifacts/ for final outputs, work/
  for scratch). Stay strictly inside the recorded targets and RoE; never
  attempt destructive actions or persistence beyond what the RoE allows.
  Never modify .git/, .dsh-pentester/, other delegation directories or
  target/. Never run git commands. When the task is finished, write
  result.md in your delegation directory — it is the completion marker.
  Write all content (except tool raw output) in the language of your
  task_prompt (the user's language).