pentest-active-directory

What This Skill Does

The pentest-active-directory skill is a sophisticated autonomous agent module designed to map, analyze, and validate attack paths within Microsoft Active Directory environments. It focuses on identifying critical misconfigurations and vulnerabilities that commonly lead to privilege escalation or lateral movement. By automating the assessment of complex AD relationships, this skill identifies risks such as Kerberoasting, AS-REP roasting, NTLM relay vulnerabilities, and various forms of dangerous delegation. The skill operates under strict ethical guidelines, ensuring that all reconnaissance and validation actions are mapped against recognized frameworks including PTES, NIST SP 800-115, and MITRE ATT&CK techniques (notably TA0006 and TA0008).

Installation

To integrate this skill into your OpenClaw ecosystem, execute the following command in your terminal:

clawhub install openclaw/skills/skills/0x-professor/pentest-active-directory

Ensure that your environment meets the dependency requirements specified in the references/tools.md file within the source repository at openclaw/skills.

Use Cases

• Security Auditing: Automating the periodic review of domain controller security postures.
• Breach & Attack Simulation: Testing defensive controls by simulating real-world escalation paths against authorized targets.
• Compliance Reporting: Generating canonical findings that align with regulatory requirements, providing clear evidence for remediation efforts.
• Red Team Operations: Efficiently mapping potential movement paths in large, complex enterprise forest topologies.

Example Prompts

1. "Perform a dry-run assessment of the domain identified in scope.json to map potential delegation abuse paths."
2. "Execute the pentest-active-directory skill against the target DC-01.company.local using --i-have-authorization and output the results to the root folder."
3. "Analyze the current network environment and identify any accounts susceptible to Kerberoasting, ensuring all findings are saved in the standard finding_schema format."

Tips & Limitations

• Authorization First: Never attempt to execute this skill against a target without verified, written consent. The skill includes a --dry-run flag which should be used for initial discovery before performing live validation.
• Scope Management: Always maintain a strict scope.json file. The agent is programmed to reject any target that falls outside the defined scope to prevent accidental environmental impact.
• Contextual Awareness: While the skill provides autonomous analysis, the output should always be reviewed by a human professional to ensure the findings are contextually relevant to the specific business environment and to prioritize remediation based on risk appetite.