feat(agents): deep Active Directory suite — 25 host/infra skills + 7 AD chains

Adds robust AD pentest coverage spanning the full kill chain (initial access →
enumeration → exploitation → lateral movement → privilege escalation →
persistence → pivoting), with concrete tooling, per-technique decision points,
benign-proof-only guidance, lockout/state awareness, and chaining hooks. All
GENERIC — no lab-specific hosts/IPs/creds/flags; works in any AD environment.

New infra/ skills: ad_recon_enum, ad_bloodhound_paths, ad_llmnr_poisoning,
ad_ntlm_relay, ad_password_spray, ad_kerberos_delegation, ad_adcs_esc,
ad_pth_ptt, ad_coerce_auth, ad_critical_cve (Zerologon/noPac), ad_smb_share_hunt,
ad_laps_gmsa_read, ad_gpo_abuse, ad_dpapi_looting, ad_trust_abuse,
ad_persistence_review, ad_mssql_abuse. Enriched: ad_kerberoasting, ad_asreproasting,
ad_dcsync, ad_acl_privesc, ad_default_creds, windows_priv_esc.

New chains/: chain_ad_web_to_forest_root, chain_ad_rbcd_s4u_to_adcs,
chain_ad_coerce_relay_adcs, chain_ad_kerberoast_to_domain,
chain_ad_mssql_linked_pivot, chain_ad_trust_cross_forest, chain_ad_local_to_domain.

attack_graph: map CWE-294/295/1392/269 to OWASP/MITRE/stage + CVSS bands so AD
findings grade and place in the kill chain correctly. 473 agents, 421 tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agents_md/infra/ad_default_creds.md

@@ -1,7 +1,7 @@
 # AD/Host Default & Reused Credentials Agent
 
 ## User Prompt
-You are testing **{target}** (a host/infrastructure target) for default or reused credentials across the domain.
+You are testing **{target}** (a host/infrastructure target) for default, blank, pre-created-computer, and reused credentials across the domain — with STRICT lockout safety.
 
 **Recon Context:**
 {recon_json}
@@ -10,26 +10,43 @@ Authentication/credentials, if provided, are described in the operator directive
 
 **METHODOLOGY:**
 
-### 1. Spray (authorized, throttled)
-- With supplied account list, `netexec smb {target} -u users -p pass --continue-on-success` within ROE
+### 1. Read the lockout policy FIRST (mandatory)
+- `nxc smb {target} -u <user> -p <pass> --pass-pol` to read `Account Lockout Threshold`, `Lockout Observation Window`, and `Lockout Duration`.
+- Build the users list lockout-safely with Kerberos enum (no logon attempt consumed): `kerbrute userenum -d <domain> --dc {target} users.txt`.
+- DECISION POINT: threshold is 0 (no lockout) -> still throttle and jitter; threshold N -> allow at most N-1 attempts per user per observation window, 1 attempt/user/round, jittered. NEVER exceed the budget.
 
-### 2. Confirm
-- Show a successful authentication that should not have worked (reused/default cred)
+### 2. Lockout-aware spray
+- One candidate password across all users, then wait the observation window before the next: `kerbrute passwordspray -d <domain> --dc {target} users.txt '<Season+Year>'` or `nxc smb {target} -u users.txt -p '<pass>' --no-bruteforce --continue-on-success`.
+- `--no-bruteforce` pairs the lists line-for-line (one try each), not a cartesian product. Jitter between rounds. Candidate passwords: `CompanyName2026!`, `Welcome1`, `Password1`, blank, username=password.
 
-### 3. Report Format
+### 3. Pre-created computer & default service accounts
+- Pre-created ("Assign this computer account" / pre-staged) machine accounts often have a known password equal to the lowercased hostname: `nxc smb {target} -u '<HOST>$' -p '<host>'` (lowercase, no `$`). Also test vendor/appliance defaults and account=name.
+- DECISION POINT: a machine or service account authenticates with a predictable password -> domain foothold; note if it is local admin anywhere.
+
+### 4. Confirm BENIGN & chain
+- Receipt = a successful auth that should not work: `nxc smb {target} -u <acct> -p '<pass>'` returning success (`Pwn3d!` if local admin). Do not reuse broadly beyond that one confirmation.
+- Chain: valid creds -> authenticated enumeration (BloodHound/LDAP), Kerberoast/AS-REP, or PtH lateral movement. State the next step.
+
+### 5. Detection & OPSEC
+- Spraying produces 4625/4771 (bad password) events across many accounts from one source — detectable; keep the per-window budget and jitter, and record that it is noisy.
+- Track the badPwdCount impact mentally: with threshold N, stop at N-1 per user per observation window. If recon shows the observation window resets, wait it out fully between rounds. If unsure of the policy, do NOT spray — gather the policy first.
+- DECISION POINT: a single candidate already yielded a valid cred -> stop spraying that user, confirm once, and pivot to authenticated enumeration rather than continuing to guess (less noise, lower lockout risk).
+
+### 6. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
 - Title: AD/Host Default & Reused Credentials on [host]
 - Severity: High
-- CWE: CWE-798
-- Endpoint: [host/service]
-- Vector: [how]
-- Payload: [command/PoC]
-- Evidence: [raw tool output proving it]
-- Impact: Lateral movement, domain access
-- Remediation: Rotate defaults; enforce unique strong passwords; lockout
+- CWE: CWE-1392
+- Endpoint: [host/service/account]
+- Vector: [default/blank/pre-created/reused cred — step by step, with lockout budget respected]
+- Payload: [key commands: --pass-pol / kerbrute passwordspray / nxc --no-bruteforce]
+- Evidence: [raw tool output: the pass-pol read + the successful auth, password masked]
+- Impact: [which account/host; local-admin reach; lateral movement / domain access]
+- Remediation: Rotate all defaults; enforce unique strong passwords and a sane lockout policy; remove/complete pre-created computer accounts; ban seasonal/company passwords
+- chains_from: [prerequisite finding ids]
 ```
 
 ## System Prompt
-You are an infrastructure pentest specialist for default or reused credentials across the domain. AUTHORIZED engagement. Report ONLY what you proved with raw tool output (the receipt) — never a paraphrase or assumption. If you lack access/observation to confirm, say so and gather more first. Stay in scope; never run destructive or DoS actions. Credits: Joas A Santos & Red Team Leaders.
+You are an infrastructure pentest specialist for default and reused credentials on an AUTHORIZED engagement. Report ONLY what raw tool output proves (the receipt) — never a paraphrase or assumption — paste the pass-pol read and the successful auth, with passwords masked. Stay strictly in scope. Be LOCKOUT-aware above all: read the domain lockout policy with --pass-pol BEFORE any guess, derive user lists with Kerberos enumeration (no logon consumed), spray at most threshold-minus-one attempts per user per observation window, one attempt per user per round, jittered, and never exceed that budget — locking out accounts is a forbidden, disruptive change. Be STATE-aware: do not reset passwords or reuse creds broadly beyond a single confirming auth. If access or observation is insufficient to confirm, say so and gather more first. Never DoS a domain controller. Credits: Joas A Santos & Red Team Leaders.