Add Pre-Windows 2000 Compatible Access section to offensive-active-directory

[0x5chltz]

Summary

Adds comprehensive Pre-Windows 2000 Compatible Access (Pre2k) section to offensive-active-directory skill, covering legacy computer account password exploitation commonly found in lab/CTF environments and aged enterprise networks.

Motivation

Pre2k computer accounts with default passwords (lowercase hostname without $) are a common initial foothold vector in AD pentesting, but were not covered in the existing skill. This gap left operators without guidance on:

• How to identify pre2k candidates during enumeration
• Exploitation workflow (getTGT → post-compromise paths)
• Post-exploitation escalation (ReadGMSAPassword → gMSA → ACL abuse)

Changes

Added Content (75 lines)

• What & Why: Legacy backward-compatibility configuration, still found in CTF/labs and enterprise migration artifacts
• Detection Indicators (5 signals):
  • userAccountControl=4128 + logonCount=0
  • No SPNs registered (strong signal — real Windows hosts always have HOST/, RestrictedKrbHost/)
  • Absent from BloodHound attack-path edges
  • pwdLastSet unchanged since whenCreated
  • Group membership in "Pre-Windows 2000 Compatible Access"
• Enumeration & Exploitation:
  • LDAP queries for candidate identification
  • Password wordlist generation (lowercase sAMAccountName without $)
  • NetExec line-by-line testing
  • getTGT workflow with time sync requirement
• Post-Compromise Escalation:
  • Group membership enumeration
  • ReadGMSAPassword → gMSA NTLM extraction via bloodyAD
  • Common attack chains (gMSA → WinRM/SMB → ACL abuse)
• Real Attack Chain: HTB Vintage (FS01$ → gMSA01$ → ServiceManagers → RBCD → DA)
• 4 Credible References:
  • HTB Vintage writeup (0xBEN) — Full pre2k → gMSA → DA chain
  • HTB Vintage writeup (InfoSec) — Step-by-step with bloodyAD
  • The Hacker Recipes: Pre-Windows 2000 computers
  • Semperis: Pre-Windows 2000 Compatibility Risks

Documentation Updates

• SKILL.md frontmatter: Updated description to include "Pre-Windows 2000 computer accounts" in credential abuse section
• README.md: Added "Pre-Windows 2000 computers" to offensive-active-directory skill description
• CHANGELOG.md: Documented addition under Unreleased section
• claude-skills.json: Regenerated manifest with updated skill description

Testing

Validated against HackTheBox Pirate machine:

1. Detection: MS01$ identified via serviceprincipalnames: [] indicator
2. Exploitation: getTGT.py 'pirate.htb/MS01$:ms01' successful
3. Post-compromise: bloodyAD -k get object gMSA_ADFS_prod$ --attr msDS-ManagedPassword extracted NTLM hash bb510d80e8ed89f4cc81a1f1d37*****
4. Full chain validated: MS01$ → ReadGMSAPassword → gMSA → Domain Admin

All commands copy-paste ready and work on real target.

CONTRIBUTING.md Compliance

• ✅ YAML frontmatter updated
• ✅ Code blocks with language tags (bash)
• ✅ Sources cited (4 references)
• ✅ README.md updated
• ✅ CHANGELOG.md updated
• ✅ claude-skills.json regenerated
• ✅ No lint tool available (skipped)

Notes

• This is the first pre2k contribution to claude-red (verified via GitHub search — no open/closed PRs on this topic)
• Content added to monolithic offensive-active-directory skill, which is planned for Phase 1 split into 16 focused skills per roadmap
• Pre2k not explicitly mentioned in current split plan — maintainers can extract this section during split or keep integrated

Checklist

• Skill tested on real target (HTB Pirate)
• Commands verified to work
• References validated (all 4 links accessible)
• Frontmatter description updated
• README.md updated
• CHANGELOG.md updated
• claude-skills.json regenerated
• No hardcoded victim domains/credentials
• Technical accuracy verified via successful exploitation