adhammer 1.3.10

adhammer-1.3.10 is not a library.

🎯 Detect ≠ Validate

Most AD security tools stop at "potential attack path detected."

ADhammer keeps going.

Finding detected
      ↓
Attack path constructed
      ↓
Validation requested
      ↓
Live PoC executed
      ↓
Proof obtained
      ↓
Report generated

The difference matters:

Not	But
"probably exploitable"	"validated against this DC"

Every finding in the report is either an unvalidated audit hit or an evidence-backed proof — real $krb5tgs$ hash, real replicated krbtgt secret, real ISSUED cert. Defenders know which paths are theoretical and which have actually been walked.

✨ What's new in 1.3.9

Session hunting three ways — enum sessions (SRVSVC) · enum wkssvc (WKSSVC) · enum hku (MS-RRP). Dedup + machine-account filter on by default; --include-machine shows the count marker.
--json envelope on every subcommand — AttackResult wrapper pipes cleanly into jq and CI.
DPAPI-encrypted sessions at rest on Windows (CryptProtectData). --old reuses cached creds, --no-save keeps them off disk.
ADCS scan pack — ESC6/7/8/10/11/16 wired into scan. Registry probes over MS-RRP, HTTP probe for ESC8 web enrollment.
dcerpc 0.2.5 — bounded-alloc audit across the wire. Every attacker-controlled u32 that fed Vec::with_capacity is now preflighted. No more OOM on entries_read = 0xFFFFFFFF. Live-validated vs Server 2022 + 2025.
New wkssvc + rrp::logged_on_sids protocol modules shipped in dcerpc 0.2.5 — MS-WKST NetrWkstaUserEnum and HKU registry walk, both live-validated.

Full changelog: CHANGELOG.md · release archive: GitHub Releases.

👥 Who is this for?

🔴 Red team operators

One binary, no Python, no runtime deps. The reference DA kill chain (scan → DCSync → Golden → SYSTEM) runs in under a minute on the lab DC. Works from Kali or straight off a Windows jump box. Attack primitives are spec-shaped and live-validated across Server 2022 and Server 2025, with version-specific limitations called out explicitly (e.g. LDAP-path DCShadow on 2019+).

🛡️ AD auditors / defenders

41 hygiene checks across four categories, MITRE ATT&CK-tagged, low-priv collection via SD_FLAGS. Reports as JSON, HTML, or a BloodHound-CE ingest bundle. Every finding has a matching PoC — the audit tool ships the exploit.

🦀 Rust developers

43 standalone icedracon protocol crates on crates.io, each cargo add-able. Compose your own DCE/RPC stack, forge PACs, decrypt LAPS-v2 blobs, or emit BloodHound JSON — pick the layer that fits, skip the rest. See the ecosystem section.

🚀 Try it in 30 seconds

cargo install --locked adhammer


adhammer scan  --url ldaps://dc.corp.local:636 \

               --user 'CORP\svc' --password ... \

               --insecure --bloodhound out.zip

Fast per-operation timings (see BENCHMARKS.md for the recorded matrix), JSON + HTML report, BloodHound-compatible graph bundle — from a low-privileged domain user account. See the full command list below or grab prebuilt binaries (musl / glibc / macOS / Windows) from Releases.

[!CAUTION] Authorized use only. ADhammer implements working offensive techniques — DCSync, golden / silver / diamond tickets, pass-the-ticket, NTLM relay, ADCS abuse, remote code execution. Use only against systems you own or are explicitly authorized to test. See SECURITY.md.

One product philosophy: detect the path, then prove it.

                     ADHAMMER
                        │
                        ▼
    ┌─────────────────────────────────────────┐
    │                 AUDIT                   │
    │   LDAP + SD_FLAGS  →  Snapshot          │
    │   41 hygiene checks + 15/16 ADCS ESC    │
    └─────────────────────┬───────────────────┘
                          ▼
    ┌─────────────────────────────────────────┐
    │                 GRAPH                   │
    │   petgraph control-path graph           │
    │   cheapest chain to Tier-0 (Dijkstra)   │
    └─────────────────────┬───────────────────┘
                          ▼
    ┌─────────────────────────────────────────┐
    │              VALIDATE                   │
    │   Live PoC per finding — real hash,     │
    │   real cert, real replicated secret     │
    └─────────────────────┬───────────────────┘
                          ▼
    ┌─────────────────────────────────────────┐
    │               REPORT                    │
    │   JSON · HTML · BloodHound-CE bundle    │
    │   MITRE ATT&CK per finding + evidence   │
    └─────────────────────────────────────────┘

Two commands drive the whole flow. Everything else is a subcommand.

1 — `adhammer scan` · audit a domain

Collects a domain over LDAP as a low-privileged user (via the SD_FLAGS control), builds a control-path graph in-process, and runs the check pack across four categories — privileged accounts, trusts, stale objects, anomalies — plus 15 of the 16 AD CS ESC classes, ADIDNS exposure, and SYSVOL / GPP. Every finding is scored, MITRE-tagged, and exportable in a BloodHound-compatible JSON bundle.

2 — `adhammer auto` · validate every finding with a live PoC

A report shouldn't say a path might be exploitable. auto walks each finding, asks "validate this one?" — on yes runs the matching tradecraft, marks the finding validated only when real proof is present (an actual $krb5tgs$ hash, a replicated krbtgt secret, an ISSUED cert). Everything lands in a Markdown assessment report with the exact command + evidence per PoC.

⚡ Performance

Every operation on a warm cache against a fully-patched Windows Server 2025 domain controller, cold-timed at the command boundary. Compiled Rust binary — cold-start under a second, most operations under 100 ms.

Operation	Median
Zerologon safe-detect	54 ms
RBCD write (`msDS-AllowedToActOnBehalfOfOtherIdentity`)	49 ms
BadSuccessor (Server 2025 dMSA succession)	48 ms
LDAP query (name → SID)	59 ms
SAMR user enumeration	63 ms
AD CS enterprise CA enumeration	67 ms
DCSync `krbtgt` secret	73 ms
RRP secretsdump (SAM + SECURITY + SYSTEM)	74 ms
Kerberoast one SPN	79 ms
AS-REP roast one account	80 ms
Full LDAP audit + control-path graph (500-object domain)	88 ms
AD CS ESC1 enrollment end-to-end (submit → issued PEM)	315 ms

Reproduce in one command — driver (bench/run_bench.sh) · renderer (bench/render_results.py) · TSV output (bench/results.tsv) · methodology (docs/BENCHMARKS.md).

📥 Install

From crates.io — always latest:

cargo install --locked adhammer

As a library — every module importable:

cargo add adhammer-sdk

Prebuilt binaries per release:

musl (static, no glibc)
glibc (Linux)
macOS (arm64 + x64)
Windows (x64)

Grab the latest from Releases →

Requires Rust 1.80+ to build from source. Tested on Kali, Ubuntu, Debian, macOS, and native Windows.

🎯 Usage

Run adhammer with no arguments for the guided interactive menu — asks for user → password (or NT hash) → domain → DC, saves the session, walks every action with prompts. For golden / silver / pass-the-ticket it auto-fetches the krbtgt / service AES256 key (via DCSync) and the domain SID (via LSAT). Add --no-save to keep credentials off disk.

Session hunting — three complementary primitives

enum sessions (SRVSVC), enum wkssvc (WKSSVC), and enum hku (HKU registry walk) each answer the who is on this box question from a different angle — different auth requirements, different result granularity. Dedup + machine-account filtering are on by default (--include-machine shows the count marker for what was hidden).

Power-user subcommands:

scan                                        passive audit -> JSON/HTML (+ --sysvol, --bloodhound out.zip)
auto                                         guided: scan -> confirm each weakness -> validate + PoC report
enum   {samr, lsa, net, dns, adcs, esc, posture, sessions}
                                            RPC / net / ADIDNS / AD-CS / ESC-registry / DC-posture / SRVSVC
attack {roast, spray, abuse, coerce, rbcd, constrained, unconstrained, dcsync, exec, atexec, wmiexec,
        secretsdump, gmsa, laps, esc1, esc4, icpr-esc1, golden, silver, pth, asktgt, winrm, capture,
        poison, relay, zerologon, shadowcred, dcshadow, badsuccessor}

# Audit a domain (low-priv creds are enough), export a BloodHound bundle:

adhammer scan --url ldaps://dc.corp.local:636 --user 'CORP\svc' --password ... --insecure --bloodhound out.zip


# ADIDNS + AD CS recon:

adhammer enum dns  --url ldaps://dc:636 --user 'CORP\svc' --password ... --insecure

adhammer enum adcs --url ldaps://dc:636 --user 'CORP\svc' --password ... --insecure


# DCSync the krbtgt key, forge a golden ticket, pass-the-ticket to SYSTEM:

adhammer attack dcsync --host dc --domain CORP --user Administrator --password ... --target krbtgt

adhammer attack pth    --host dc --realm CORP.LOCAL --krbtgt-aes256 <64-hex> --domain-sid S-1-5-21-... \

                       --spn cifs/dc.corp.local --command whoami


# AD CS ESC1 / ESC3 / ESC6 / ESC15 enrollment via MS-ICPR:

adhammer attack icpr-esc1 --ca CORP-CA --template User --target-upn administrator@corp.local \

                        --host dc --domain CORP --user 'CORP\svc' --password ... \

                        --esc esc6 --san-upn administrator@corp.local


# Server 2025 dMSA succession (BadSuccessor):

adhammer attack badsuccessor --dmsa-name pwn --target <victim>

📋 Coverage

Audit checks — 4 categories, 15/16 AD CS ESC classes

Category	Coverage
Privileged accounts	AS-REP / Kerberoast exposure · unconstrained delegation · DCSync control paths (graph) · sensitive-group membership · gMSA read ACL · SID history · RBCD · LAPS coverage · `PASSWD_NOTREQD`
Trusts	SID filtering · selective auth · cross-forest TGT delegation · RC4 downgrade · transitivity
Stale objects	Inactive users / computers · old passwords · EOL OS · duplicate SPNs · stale machine passwords
Anomalies	`MachineAccountQuota` · krbtgt age · RC4 Kerberos · reversible encryption · BadSuccessor (dMSA) · password policy · anonymous LDAP · Pre-Windows 2000 · Guest · GPP `cpassword` (MS14-025) · LM / NTLMv1 · LDAP / SMB signing
AD CS (15/16 ESC)	Passive: ESC1-5, 9, 13-15 / EKUwu (CVE-2024-49019) · Active: ESC1, ESC3, ESC6, ESC8, ESC15 · Registry: ESC6-7, 10-11, 16 · Only ESC12 (hardware token) out of scope
ADIDNS	Zone + record enumeration with wildcard (mitm6 / WPAD) exposure detection

Every finding carries a MITRE ATT&CK technique (T1558.003, T1003.006, T1649, T1484, …).

LDAP audit (paged, SD_FLAGS-scoped) → JSON / HTML report
BloodHound-CE compatible bundle export
SAMR / LSAT / SRVSVC / MS-RRP enumeration
ADIDNS zone dump + wildcard record detection
AD CS enterprise CA discovery + ESC8 web-enrollment probe
DC posture: LDAP signing / channel binding / Spooler / RemoteRegistry

AS-REP roast + Kerberoast (RC4 + AES256)
Ask-TGT (--asktgt) + password spray
Pass-the-ticket over sealed SMB2 + AP-REQ
Golden ticket (RC4 + AES256, PAC KB5020805-compliant)
Silver ticket (per-service)
Diamond ticket (library only, via ms-pac-forge — no CLI subcommand yet) — identity-swap on a real TGT envelope (detection evasion)
FAST armor (RFC 6113)
PKINIT + Shadow Credentials

Unconstrained delegation
Constrained delegation (S4U2Self + S4U2Proxy)
RBCD write + exploit chain (msDS-AllowedToActOnBehalfOfOtherIdentity)

ESC1 — enrollee-supplied UPN SAN in CSR
ESC3 — CMC EnrollOnBehalfOf via caller-supplied Enrollment Agent cert
ESC6 — SAN as CA pctbAttribs request-attribute
ESC8 — Web-enrollment relay chain
ESC15 — EKUwu / CVE-2024-49019 via Microsoft Application Policies extension
ESC4 — write template attributes to make a template ESC1-vulnerable

DCSync (DRSUAPI, single-account or full domain)
RRP secretsdump (local SAM + SECURITY + SYSTEM offline decrypt)
LSASS minidump credential hunt (offline)
LAPS v1 (ms-Mcs-AdmPwd) + LAPS v2 (msLAPS-EncryptedPassword via GKDI)
gMSA msDS-ManagedPassword decrypt

Coerce (RPRN / EFSR / DFSNM / FSRVP)
NTLM relay → LDAP / SMB / AD CS Web (ESC8)
LLMNR + NBT-NS poison → NetNTLMv2 capture
Remote exec: SVCCTL · TSCH (atexec) · WMI (DCOM) · WinRM
Zerologon safe-detect by default (attack zerologon runs read-only detection); a destructive --exploit path exists and requires explicit runtime confirmation
DCShadow (rights enumeration; push not implemented)
Server 2025 BadSuccessor (dMSA)

🧱 Built on a from-scratch Rust ecosystem

ADhammer is one binary on top of 61 standalone icedracon crates, each doing one job well and each cargo add-able on its own. Every crate ships an explicit "what this does NOT do" section, MIT-licensed, works standalone. Combined ecosystem downloads: 18k+ and climbing.

Two brands, one project:

ADhammer — the application. AD security assessment + live attack-path validation.
icedracon — the ecosystem. Pure-Rust implementations of Microsoft security protocols. Adopt one crate (cargo add dcerpc) without adopting the whole toolkit.

Layer	Crates
Transport	`dcerpc` · `smb2-client` · `ms-ndr`
Auth / crypto	`ntlmssp` · `credssp` · `dpapi-ng` · `dpapi-offline` · `ms-gkdi`
Kerberos	`ms-pac` · `ms-pac-forge` · `ms-kile-fast` · `ms-pkca`
DCE/RPC protocols	`ms-drsr` · `ms-nrpc` · `ms-samr` · `ms-lsat` · `ms-tsch` · `ms-even6` · `ms-tds` · `ms-coerce`
AD CS	`ms-crtd` · `ms-icpr` · `ms-csra`
NTDS / secrets	`ese-parser` · `ntds-parse` · `lsass-parse`
AD / GPO / audit	`ad-acl` · `msldap-ext` · `gpo` · `gpo-forge` · `preg` · `ms-dnsp` · `ms-fve` · `ms-rodc`
Relay / lateral	`ntlm-relay` · `llmnr-poison` · `winrm-pentest`
Windows-local (host-side)	`windows-sddl` · `windows-lsa` · `windows-scm` · `windows-token` · `windows-wmi-com` · `windows-sspi-shim` · `windows-eventlog-native`
BloodHound export	`bloodhound-export`

Full crate list on crates.io/users/zevs.

📚 Deep dives

Featured on dev.to — a detailed write-up of how the from-scratch Rust protocol stack came together.

Write-up — I built a full Active Directory pentest + audit tool in Rust on a from-scratch protocol stack (dev.to)
Changelog — per-release notes live in GitHub Releases and CHANGELOG.md
Benchmarks — full methodology + raw log in docs/BENCHMARKS.md
Ecosystem tour — crates.io/users/zevs

🧪 Test

CI runs the full workspace test suite on every push (100+ unit + integration tests across the CLI and 11 sub-crates). Green means ship. Reproduce locally:

cargo test --workspace

🤝 Contributing

PRs welcome — especially for new AD CS ESC variants, additional coerce endpoints, and cross-forest trust auditing. Open an issue first for anything larger than a bug fix.

☕ Support

ADhammer is MIT-licensed and independently developed. Every contribution funds another wire primitive, another live-validation session against a real DC, another release.

USDT (TRC20 / Tron) — instant, low-fee, no gatekeepers:

TDKrs1rjiUaB1JnvWRDaoxM7o1jjVuDTDW

Scan from any wallet, or copy-paste the address. Tron network, minimum ~1 USDT to cover network fee.

GitHub Sponsors + Ko-fi channels coming as Stripe onboarding clears. Until then, the address above is the fastest path.

🛡️ Security

Vulnerabilities: report privately per SECURITY.md. ADhammer contains working offensive techniques — use only against systems you own or are explicitly authorized to test.