Yeray Martín Domínguez

[Yeray Martín Domínguez @yeraymd44]

I've been pwning AD labs for months with a private toolkit I built. Worked every time.
Today I'm opening it: Claude-AD. The AD engagement playbook as Claude Code skills. Kerberos, ADCS ESC1-17, ACL abuse, coercion. Drives your standard tools.

https://t.co/ZMxGOVfl1u

[Yeray Martín Domínguez @yeraymd44]

Full blog article:

https://t.co/y8z9ctwocl

[Yeray Martín Domínguez @yeraymd44]

CrowdStrike and SentinelOne flagged my ligolo tunnel every time.
So I stopped tunneling out. The Linux tools run inside the Windows box now, in a QEMU VM, no admin, a layer below the EDR.
nxc, certipy, ADscan. Nothing fires.

Full blog article on fist comment!

[Yeray Martín Domínguez @yeraymd44]

@7h3h4ckv157 Here the founder of the repo. Thanks for the support!

[Yeray Martín Domínguez @yeraymd44]

@tom_doerr Here the founder. Thanks for the support!

[Yeray Martín Domínguez @yeraymd44]

@c3rberu5_ @7h3h4ckv157 Thanks :)

[Yeray Martín Domínguez @yeraymd44]

@_aircorridor @three_cube @DI0256 @IamSmouk @co11ateral Here the founder! Thanks for the support 😁

[Yeray Martín Domínguez @yeraymd44]

@co11ateral Here the founder! Thanks for the support 😁

[Yeray Martín Domínguez @yeraymd44]

@FosoTweets @7h3h4ckv157 Appreciate the support 😌

[Yeray Martín Domínguez @yeraymd44]

@co11ateral @7h3h4ckv157 Thanks for the good feedback 😁

[Yeray Martín Domínguez @yeraymd44]

Open source: https://t.co/SWDEnIs3kJ

[Yeray Martín Domínguez @yeraymd44]

1/ Before I run a password spray, I ask Active Directory when each user last changed their password. It tells me. And that alone means far fewer misses and zero lockouts.

[Yeray Martín Domínguez @yeraymd44]

5/ No trick. The domain hands you the very data to attack it with, and almost nobody looks.
If your only defense here is forcing a monthly password change, think about it: that policy is exactly what's handing me the date to try. What stops this is MFA, not rotating every 30 days

[Yeray Martín Domínguez @yeraymd44]

ADscan flags this automatically. Open source: https://t.co/SWDEnIs3kJ

[Yeray Martín Domínguez @yeraymd44]

1/ Any user in your domain can read an admin password stored inside Active Directory itself.
Encrypted with a key Microsoft published on the internet.

[Yeray Martín Domínguez @yeraymd44]

7/ Check yours: grep for the string cpassword in SYSVOL. If it's in any XML, that password stopped being a secret years ago. Rotate the account and delete the file.