ad-delegation-attack

该技能是面向 AI 代理的进攻性 AD/Kerberos 攻击指南，核心能力包括票据窃取、委派滥用、ACL 修改、远程执行和 DCSync。其能力与“委派攻击”描述一致，但这类能力本身属于高风险攻击工具范畴，不适合赋予通用代理自动执行。安装来源大多是已知公开项目，但技能未固定版本或验证发布物；更重要的是，它直接推动凭据使用、票据滥用和对真实基础设施的未授权操作。综合看，不像伪装成别的用途的窃密技能，但属于高风险 offensive-security skill。

This is readable offensive security documentation for Kerberos constrained-delegation and S4U abuse. It can facilitate impersonation and unauthorized access when used with valid or stolen credentials, but the shown fragment is not itself malware and contains no executable malicious payload. The example credentials should be treated as unsafe if they correspond to real accounts.

该内容是关于非约束委派攻击的高可操作性攻防文档，而非恶意软件代码。它明确展示了 LSASS 票据窃取、强制认证、pass-the-ticket 和 DCSync 等可能导致域接管的步骤。未发现自身会自动执行、回连、持久化或窃取数据的程序逻辑，但其中命令在未经授权的环境中具有极高安全危害，应仅用于获授权的测试和防御研究。

This fragment is an actionable Active Directory exploitation and lateral-movement guide. It enables RBCD and Shadow Credential abuse, Kerberos impersonation, credential dumping, remote execution, and detection evasion. It is not itself an executable malware payload, but the documented commands are high-risk offensive tooling and could facilitate unauthorized compromise. The hardcoded password appears illustrative rather than a confirmed secret.