exploiting-active-directory-with-bloodhound

SUSPICIOUS/HIGH RISK. The skill is internally coherent as a red-team AD exploitation guide, but its purpose is explicitly offensive and includes reconnaissance on compromised hosts, data exfiltration, and attack-chain execution planning. Official SpecterOps tooling reduces pure supply-chain concern, yet the overall skill remains high risk because it equips an AI agent with active offensive security capabilities.

This document is an offensive playbook for Active Directory enumeration and exploitation using BloodHound/SharpHound and related tooling. The content itself is not obfuscated malware inside a package, but it contains explicit instructions and examples that, if executed in a production environment without authorization, will enable credential theft, lateral movement, privilege escalation, and domain compromise. Treat this as high-risk operational guidance: do not run these commands against systems you do not own or have explicit permission to test; validate downloads before execution; avoid embedding plaintext secrets in command lines; secure Neo4j/BloodHound endpoints.

This module is a dual-use AD assessment orchestration script. The code itself does not contain hidden backdoors or dynamic obfuscation, but it intentionally invokes offensive collectors and sends user-supplied Cypher to Neo4j. Key risks: credentials passed on the command line (exposure via ps), insecure default Neo4j credentials, potential reading/writing of arbitrary JSON files if analyze_dir/output are attacker-controlled, and inclusion of potentially sensitive collector output in saved/printed reports. Use only in authorized test environments; remove or override insecure defaults and avoid passing secrets on CLI in production.