blacklanternsecurity/red-run

AD Persistence documents post-compromise techniques for maintaining access in Active Directory after domain admin access. It covers methods like DCShadow, Golden SAML, SID history, certificate persistence, and security descriptor backdoors.

ADCS Persistence establishes long-lived access through AD CS certificate abuse and weak certificate mapping. It is used for Golden Certificates, ESC9/10, altSecIdentities, certificate theft, and related persistence techniques.

ADCS Template Abuse exploits misconfigured AD CS certificate templates and CA flags to impersonate domain users with certificates. Use it during authorized assessments to enumerate ESC1, ESC2, ESC3, and ESC6 paths.

AV EDR Evasion covers payload compilation and runtime bypass methods when antivirus or endpoint protection blocks execution. Use it to build alternate DLL, EXE, script, AMSI, or ETW-based payloads for an authorized engagement.

Acl Abuse exploits misconfigured Active Directory ACLs for privilege escalation. It is used to abuse rights like GenericAll, WriteDACL, shadow credentials, SPN manipulation, and password reset paths.

Ad Discovery enumerates Active Directory domains to map hosts, signing settings, and attack paths during authorized testing. It supports unauthenticated and credentialed reconnaissance and records findings for orchestration.

Adcs Access And Relay covers ADCS template and CA ACL abuse plus NTLM relay to enrollment endpoints. Use it when enumerating or exploiting ESC4, ESC5, ESC7, ESC8, or ESC11 paths.

Authentication Coercion And Relay forces systems to authenticate to attacker-controlled listeners and relays those logons for privilege escalation or lateral movement. Use it when testing NTLM, Kerberos, or name-resolution poisoning paths such as PetitPotam, Responder, ntlmrelayx, or krbrelayx.

Container Escapes helps enumerate container and Kubernetes environments, then pursue breakout paths such as exposed Docker sockets, privileged mounts, or cluster access. Use it during authorized penetration tests of containerized hosts and pods.

Credential Dumping extracts secrets from Active Directory and related stores such as DCSync, NTDS.dit, SAM, LAPS, gMSA, ADSync, DSRM, and EFS-encrypted files. Use it during authorized penetration tests when you need hashes, passwords, or directory recovery credentials.

Database Enumeration checks common database services for default credentials, unauthenticated access, and command execution paths. Use it after network recon finds MSSQL, MySQL, PostgreSQL, Oracle, MongoDB, or Redis ports.

GPO Abuse helps test writable Group Policy Objects for code execution, privilege escalation, and lateral movement in Active Directory. It covers GPO enumeration, immediate tasks, logon script poisoning, registry changes, and GPP password extraction.

Infrastructure Enumeration checks exposed DNS, SMTP, RPC/MSRPC, LDAP, NFS, SNMP, IPMI, TFTP, and HTTP/HTTPS services for common misconfigurations and information leaks. Use it after network recon identifies open infrastructure ports.

Kerberos Delegation Exploitation guides exploitation of Kerberos delegation misconfigurations in Active Directory for privilege escalation and lateral movement. It covers unconstrained delegation, constrained delegation, and RBCD workflows using Kerberos authentication.

Kerberos Roasting extracts Kerberoastable TGS tickets and AS-REP hashes for offline password cracking. Use it during authorized Active Directory assessments when you have domain credentials or username lists.

Kerberos Ticket Forging for forging Golden, Silver, Diamond, Sapphire, and pass-the-ticket Kerberos tickets during authorized red team testing. Use it when you have domain or service key material and need Kerberos-based persistence or privilege escalation.

Network Reconnaissance scans authorized targets to discover hosts, open ports, services, and OS fingerprints. Use it to build a port/service map and route deeper enumeration to the right follow-on skills.

Pass The Hash authenticates to Active Directory services with NTLM hashes, AES keys, or Kerberos tickets without cracking passwords. Use it for Pass-the-Hash, Over-Pass-the-Hash, Pass-the-Key, and Pass-the-Ticket during authorized lateral movement.

Password Spraying performs lockout-safe credential spraying against authentication services like AD, SSH, web forms, and OWA. Use it when you have authorized usernames and need to test likely passwords without triggering account lockouts.

Red Run guides authorized penetration testing work within a defined technique scope. It helps track engagement state, evidence, and findings while staying within the documented methodology.

Red Run CTF orchestrates multi-phase penetration test workflows with agent teams. It routes recon, assessment mapping, and vulnerability chaining tasks to specialist skills during an authorized engagement.

Red Run Legacy orchestrates a penetration test by routing reconnaissance and technique work to the right skills and agents under operator approval. Use it manually for legacy subagent-based workflows; it does not auto-trigger.

Retrospective analyzes a completed engagement’s state, timeline, and skill-routing decisions to produce an improvement report. Use it after an engagement to review outcomes, identify missed skills, and capture knowledge gaps.

SCCM Exploitation enumerates Microsoft SCCM/MECM infrastructure and extracts credentials for lateral movement and escalation. Use it when you have authorized access to assess NAA secrets, relays, PXE boot flows, and SCCM deployments.

Trust Attacks enumerates Active Directory trust relationships and uses them for cross-domain and cross-forest privilege escalation. Use it to assess trust settings, SID history, trust tickets, delegation, and PAM trust abuse.