ntlm-relay

Active Directory pentest methodology for Claude Code: skills, agents and slash commands for internal AD red-team work (Kerberoasting, ADCS ESC1-17, DCSync, ACL abuse, NTLM relay, delegation), with per-technique OPSEC/telemetry notes. Drives netexec, impacket, certipy, bloodyAD, BloodHound CE.

Checks for signature requirements over LDAP

POCs for CVE-2025-50154 and CVE-2025-59214, zero day vulnerabilities on windows file explorer disclosing NTLMv2-SSP without user interaction. It is a bypass for the CVE-2025-24054 Security Patch

ACL Pentesting frameworks

Impacket-based Python client for Microsoft SQL Server (MS SQL / MSSQL) traversing linked-server chains of any depth with cascading login impersonation at every hop.

Windows Local Privilege Escalation Tool. Exploits COM server hijacking to elevate privileges from local service to SYSTEM.

CVE-2025-1868: Advanced IP Scanner & Advanced Port Scanner NTLM Leakage HTTP Tester

This write-up documents my penetration testing methodology and red team approach to compromising the ghostlink machine

Windows 10 Penetration Testing — Home Lab | LLMNR Poisoning, NTLM Relay, Hash Cracking

Check HTTP servers for NTLM relay protection

Mi documentación sobre algunos de los ataques más básico en entornos de Active Directory.

Labs Active Directory offensifs en environnement GNS3 — LLMNR/NBT-NS, relais NTLM, pass-the-hash, Kerberoasting, BloodHound · contre-mesures documentées

Advanced NTLM Relay exploitation lab with complete documentation

CVE-2020-13941: Abusing UNC Paths in Windows Environments in Apache Solr

Full walkthrough of HackTheBox Pirate (Hard, Windows). A pure Active Directory chain from a pre-Windows-2000 machine account to Domain Admin, no CVEs, finishing with a constrained-delegation SPN injection.

Hands-on write-up on Responder for LLMNR/NBT-NS/mDNS poisoning & credential harvesting in Active Directory pentests — attack theory, lab setup, captured output analysis, and blue-team detection/mitigation.

CVE-2020-5148 - Forced Authentication in the SonicWall UTM SSO Agent. The agent probes unvalidated workstations as Domain Admin, so one outbound web request yields a privileged NTLMv2 hash. Advisory SNWLID-2021-0003.

Ludus MSSQL coercion lab and scripts.

Demonstrating the real-world uses of crackmapexec, ntlmrelayx, Metasploit's psexec module, and Metasploit's Incognito for Token Impersonation