adhammer 1.4.5

adhammer-1.4.5 is not a library.

The idea

Evidence over assumption. No dashboard theatre. No vague alerts. Just the system, explained.

ADhammer collects the domain, graphs every control path that ends at Tier-0, then proves the interesting ones with the same protocol code the attacker would use. One continuous session from LDAP recon to a signed AS-REP on disk. Findings you can hand to a customer with the exact byte sequence that produced them.

🎯 Detect ≠ Validate

Most AD security tools stop at "potential attack path detected."

ADhammer keeps going.

Finding detected
      ↓
Attack path constructed
      ↓
Validation requested
      ↓
Live PoC executed
      ↓
Proof obtained
      ↓
Report generated

The difference matters:

Not	But
"probably exploitable"	"validated against this DC"

Every finding in the report is either an unvalidated audit hit or an evidence-backed proof — real $krb5tgs$ hash, real replicated krbtgt secret, real ISSUED cert. Defenders know which paths are theoretical and which have actually been walked.

✨ What's new in 1.4.4

The "read the whole picture" release — every scan report now ships a visual control-path graph and a complete coverage matrix inline, so you see what was checked and what tripped, not just the hits. Adds the last two offensive carryovers from 1.4.3 and sharpens the first-touch connection experience.

In-report control-path graph — the HTML report renders the cheapest attack paths to Tier-0 as a self-contained SVG (no external libraries, no CDN), laid out deterministically so two scans of the same domain diff cleanly.
Full coverage matrix in every report — all 58 checks appear with their status (tripped / clean) plus evidence, in JSON / HTML / Markdown / terminal — the completeness signal a report needs ("checked X, clean"), so a reviewer sees where there is and isn't a finding.
attack dns — write ADIDNS records (add-a / modify-a / tombstone / delete) over LDAP, --dry-run by default so the intended change prints before anything is written.
enum sccm / enum scom — discover Configuration Manager and Operations Manager footholds from the directory; an absent container reports not present instead of erroring.
Clearer connection failures — a failed LDAP bind now names the actual cause (TLS/cert, channel binding, reachability) instead of a generic hint, so first-touch setup from Kali / PowerShell is faster to debug.

Full changelog: CHANGELOG.md · release archive: GitHub Releases.

Previously — what 1.4.3 added

The "prove it, cover it" release — every finding now carries the ground-truth server artifact that substantiates it, the passive-detection registry grew from 41 to 58 checks, and scans can diff against a prior run. On top of the interactive-UX pass that makes the binary easier to drive from Kali, PowerShell, and cmd.

Ground-truth evidence on every finding — each finding carries the raw server/client artifact that proves it (the exact LDAP attribute value, registry key, cert-template flag, or wire status), rendered in the JSON, HTML, Markdown, and terminal reports. "You have X" becomes "the server returned Y, which is X" — a reviewer can verify each finding by hand from the evidence.
Wider passive coverage (41 → 58 checks) — new evidence-backed rules: constrained delegation targeting a DC (Critical), broad principals directly in Tier-0, Key Admins / Enterprise Key Admins, foreign and computer accounts in privileged groups, cleartext-secret attributes, weak certificate-template key sizes, expired LAPS, and privileged accounts missing from Protected Users.
Baseline diff — scan --baseline <prior.json> tags findings NEW / RESOLVED / SEVERITY-CHANGED by (rule id, affected object), across every report format — track drift between assessments.
Narrated guided flow — Auto / Guided shows a connection summary, named phases with timing, clearer clean/finding states, proof snippets, export choices, and a finish card; shell-safe numbered prompts; single-attack preflight brief and timed result frame.
JSON contract preserved — human narration on the operator path, --json stays machine-clean. Validation ledger stays honest in docs/VALIDATION.md.

Full changelog: CHANGELOG.md · release archive: GitHub Releases.

👥 Who is this for?

🔴 Red team operators

One binary, no Python runtime, no sidecar services. The reference DA kill chain (scan → DCSync → Golden → SYSTEM) runs in under a minute on the lab DC. Works from Kali or straight off a Windows jump box. Attack primitives are spec-shaped and live-validated for supported paths across Server 2022 and Server 2025, with version-specific limitations called out explicitly (e.g. LDAP-path DCShadow on 2019+).

🛡️ AD auditors / defenders

50+ hygiene checks across four categories, MITRE ATT&CK-tagged, low-priv collection via SD_FLAGS. Reports as JSON, HTML, or a BloodHound-CE ingest bundle. Supported findings have matching PoCs; unsupported ones stay labeled potential instead of being overstated.

🦀 Rust developers

61 standalone icedracon protocol crates on crates.io, each cargo add-able. Compose your own DCE/RPC stack, forge PACs, decrypt LAPS blobs, or emit BloodHound JSON — pick the layer that fits, skip the rest. See the ecosystem section.

🚀 Try it in 30 seconds

cargo install --locked adhammer


adhammer scan  --url ldaps://dc.corp.local:636 \

               --user 'CORP\svc' --password ... \

               --insecure --bloodhound out.zip

Fast per-operation timings (see BENCHMARKS.md for the recorded matrix), JSON + HTML report, BloodHound-compatible graph bundle — from a low-privileged domain user account. See the full command list below or grab prebuilt binaries (musl / glibc / macOS / Windows) from Releases.

[!CAUTION] Authorized use only. ADhammer implements working offensive techniques — DCSync, golden / silver / diamond tickets, pass-the-ticket, NTLM relay, ADCS abuse, remote code execution. Use only against systems you own or are explicitly authorized to test. See SECURITY.md.

One product philosophy: detect the path, then prove it.

                     ADHAMMER
                        │
                        ▼
    ┌─────────────────────────────────────────┐
    │                 AUDIT                   │
    │   LDAP + SD_FLAGS  →  Snapshot          │
    │   50+ hygiene checks + 15/16 ADCS ESC   │
    └─────────────────────┬───────────────────┘
                          ▼
    ┌─────────────────────────────────────────┐
    │                 GRAPH                   │
    │   petgraph control-path graph           │
    │   cheapest chain to Tier-0 (Dijkstra)   │
    └─────────────────────┬───────────────────┘
                          ▼
    ┌─────────────────────────────────────────┐
    │              VALIDATE                   │
    │   Live PoC per finding — real hash,     │
    │   real cert, real replicated secret     │
    └─────────────────────┬───────────────────┘
                          ▼
    ┌─────────────────────────────────────────┐
    │               REPORT                    │
    │   JSON · HTML · BloodHound-CE bundle    │
    │   MITRE ATT&CK per finding + evidence   │
    └─────────────────────────────────────────┘

Two commands drive the whole flow. Everything else is a subcommand.

1 — `adhammer scan` · audit a domain

Collects a domain over LDAP as a low-privileged user (via the SD_FLAGS control), builds a control-path graph in-process, and runs the check pack across four categories — privileged accounts, trusts, stale objects, anomalies — plus 15 of the 16 AD CS ESC classes, ADIDNS exposure, and SYSVOL / GPP. Every finding is scored, MITRE-tagged, and exportable in a BloodHound-compatible JSON bundle.

2 — `adhammer auto` · validate supported findings with a live PoC

A report shouldn't say a path might be exploitable when the tool can prove it. auto walks each finding, asks "validate this one?" — on yes runs the matching supported tradecraft, marks the finding validated only when real proof is present (an actual $krb5tgs$ hash, a replicated krbtgt secret, an ISSUED cert), and leaves unsupported findings explicitly marked as potential. Everything lands in a Markdown assessment report with the exact command + evidence per PoC.

⚡ Performance

Every operation on a warm cache against a fully-patched Windows Server 2025 domain controller, cold-timed at the command boundary. Compiled Rust binary — cold-start under a second, most operations under 100 ms.

Operation	Median
Zerologon safe-detect	54 ms
RBCD write (`msDS-AllowedToActOnBehalfOfOtherIdentity`)	49 ms
BadSuccessor (Server 2025 dMSA succession)	48 ms
LDAP query (name → SID)	59 ms
SAMR user enumeration	63 ms
AD CS enterprise CA enumeration	67 ms
DCSync `krbtgt` secret	73 ms
RRP secretsdump (SAM + SECURITY + SYSTEM)	74 ms
Kerberoast one SPN	79 ms
AS-REP roast one account	80 ms
Full LDAP audit + control-path graph (500-object domain)	88 ms
AD CS ESC1 enrollment end-to-end (submit → issued PEM)	315 ms

Reproduce in one command — driver (bench/run_bench.sh) · renderer (bench/render_results.py) · TSV output (bench/results.tsv) · methodology (docs/BENCHMARKS.md).

📥 Install

From crates.io — always latest:

cargo install --locked adhammer

As a library — every module importable:

cargo add adhammer-sdk

Prebuilt binaries per release:

musl (static, no glibc)
glibc (Linux)
macOS (arm64 + x64)
Windows (x64)

Grab the latest from Releases →

Requires Rust 1.87+ to build from source. Tested on Kali, Ubuntu, Debian, macOS, and native Windows.

🎯 Usage

Run adhammer with no arguments for the guided interactive menu — asks for user → password (or NT hash) → domain → DC, saves the session, walks every action with prompts. For golden / silver / pass-the-ticket it auto-fetches the krbtgt / service AES256 key (via DCSync) and the domain SID (via LSAT). Add --no-save to keep credentials off disk.

Session hunting — three complementary primitives

enum sessions (SRVSVC), enum wkssvc (WKSSVC), and enum hku (HKU registry walk) each answer the who is on this box question from a different angle — different auth requirements, different result granularity. Dedup + machine-account filtering are on by default (--include-machine shows the count marker for what was hidden).

Power-user subcommands:

scan                                        passive audit -> JSON/HTML (+ --sysvol, --bloodhound out.zip)
auto                                         guided: scan -> confirm each weakness -> validate + PoC report
enum   {samr, lsa, net, dns, adcs, esc, posture, sessions}
                                            RPC / net / ADIDNS / AD-CS / ESC-registry / DC-posture / SRVSVC
attack {roast, spray, abuse, coerce, rbcd, constrained, unconstrained, dcsync, exec, atexec, wmiexec,
        secretsdump, gmsa, laps, esc1, esc4, icpr-esc1, golden, silver, pth, asktgt, winrm, capture,
        poison, relay, zerologon, shadowcred, dcshadow, badsuccessor}

# Audit a domain (low-priv creds are enough), export a BloodHound bundle:

adhammer scan --url ldaps://dc.corp.local:636 --user 'CORP\svc' --password ... --insecure --bloodhound out.zip


# ADIDNS + AD CS recon:

adhammer enum dns  --url ldaps://dc:636 --user 'CORP\svc' --password ... --insecure

adhammer enum adcs --url ldaps://dc:636 --user 'CORP\svc' --password ... --insecure


# DCSync the krbtgt key, forge a golden ticket, pass-the-ticket to SYSTEM:

adhammer attack dcsync --host dc --domain CORP --user Administrator --password ... --target krbtgt

adhammer attack pth    --host dc --realm CORP.LOCAL --krbtgt-aes256 <64-hex> --domain-sid S-1-5-21-... \

                       --spn cifs/dc.corp.local --command whoami


# AD CS ESC1 / ESC3 / ESC6 / ESC15 enrollment via MS-ICPR:

adhammer attack icpr-esc1 --ca CORP-CA --template User --target-upn administrator@corp.local \

                        --host dc --domain CORP --user 'CORP\svc' --password ... \

                        --esc esc6 --san-upn administrator@corp.local


# Server 2025 dMSA succession (BadSuccessor):

adhammer attack badsuccessor --dmsa-name pwn --target <victim>

📋 Coverage

Audit checks — 4 categories, 15/16 AD CS ESC classes

Category	Coverage
Privileged accounts	AS-REP / Kerberoast exposure · unconstrained delegation · DCSync control paths (graph) · sensitive-group membership · gMSA read ACL · SID history · RBCD · LAPS coverage · `PASSWD_NOTREQD`
Trusts	SID filtering · selective auth · cross-forest TGT delegation · RC4 downgrade · transitivity
Stale objects	Inactive users / computers · old passwords · EOL OS · duplicate SPNs · stale machine passwords
Anomalies	`MachineAccountQuota` · krbtgt age · RC4 Kerberos · reversible encryption · BadSuccessor (dMSA) · password policy · anonymous LDAP · Pre-Windows 2000 · Guest · GPP `cpassword` (MS14-025) · LM / NTLMv1 · LDAP / SMB signing
AD CS (15/16 ESC)	Passive: ESC1-5, 9, 13-15 / EKUwu (CVE-2024-49019) · Active: ESC1, ESC3, ESC6, ESC8, ESC15 · Registry: ESC6-7, 10-11, 16 · Only ESC12 (hardware token) out of scope
ADIDNS	Zone + record enumeration with wildcard (mitm6 / WPAD) exposure detection

Every finding carries a MITRE ATT&CK technique (T1558.003, T1003.006, T1649, T1484, …).

LDAP audit (paged, SD_FLAGS-scoped) → JSON / HTML report
BloodHound-CE compatible bundle export
SAMR / LSAT / SRVSVC / MS-RRP enumeration
ADIDNS zone dump + wildcard record detection
AD CS enterprise CA discovery + ESC8 web-enrollment probe
DC posture: LDAP signing / channel binding / Spooler / RemoteRegistry

AS-REP roast + Kerberoast (RC4 + AES256)
Ask-TGT (--asktgt) + password spray
Pass-the-ticket over sealed SMB2 + AP-REQ
Golden ticket (RC4 + AES256, PAC KB5020805-compliant)
Silver ticket (per-service)
Diamond ticket (library only, via ms-pac-forge — no CLI subcommand yet) — identity-swap on a real TGT envelope (detection evasion)
FAST armor (RFC 6113)
PKINIT + Shadow Credentials

Unconstrained delegation
Constrained delegation (S4U2Self + S4U2Proxy)
RBCD write + exploit chain (msDS-AllowedToActOnBehalfOfOtherIdentity)

ESC1 — enrollee-supplied UPN SAN in CSR
ESC3 — CMC EnrollOnBehalfOf via caller-supplied Enrollment Agent cert
ESC6 — SAN as CA pctbAttribs request-attribute
ESC8 — Web-enrollment relay chain
ESC15 — EKUwu / CVE-2024-49019 via Microsoft Application Policies extension
ESC4 — write template attributes to make a template ESC1-vulnerable

DCSync (DRSUAPI, single-account or full domain)
RRP secretsdump (local SAM + SECURITY + SYSTEM offline decrypt)
LSASS minidump credential hunt (offline)
LAPS v1 (ms-Mcs-AdmPwd) + LAPS v2 (msLAPS-EncryptedPassword via GKDI)
gMSA msDS-ManagedPassword decrypt

Coerce (RPRN / EFSR / DFSNM / FSRVP)
NTLM relay → LDAP / SMB / AD CS Web (ESC8)
LLMNR + NBT-NS poison → NetNTLMv2 capture
Remote exec: SVCCTL · TSCH (atexec) · WMI (DCOM) · WinRM
Zerologon safe-detect by default (attack zerologon runs read-only detection); a destructive --exploit path exists and requires explicit runtime confirmation
DCShadow (rights enumeration + prep/cleanup shipped; DRSUAPI push path present, live validation owed)
Server 2025 BadSuccessor (dMSA)

🧱 Built on a from-scratch Rust ecosystem

ADhammer is one binary on top of 61 standalone icedracon crates, each doing one job well and each cargo add-able on its own. Every crate ships an explicit "what this does NOT do" section, MIT-licensed, works standalone. Combined ecosystem downloads: 20k+.

Two brands, one project:

ADhammer — the application. AD security assessment + live attack-path validation.
icedracon — the ecosystem. Pure-Rust implementations of Microsoft security protocols. Adopt one crate (cargo add dcerpc) without adopting the whole toolkit.

Layer	Crates
Transport	`dcerpc` · `smb2-client` · `ms-ndr`
Auth / crypto	`ntlmssp` · `credssp` · `dpapi-ng` · `dpapi-offline` · `ms-gkdi`
Kerberos	`ms-pac` · `ms-pac-forge` · `ms-kile-fast` · `ms-pkca`
DCE/RPC protocols	`ms-drsr` · `ms-nrpc` · `ms-samr` · `ms-lsat` · `ms-tsch` · `ms-even6` · `ms-tds` · `ms-coerce`
AD CS	`ms-crtd` · `ms-icpr` · `ms-csra`
NTDS / secrets	`ese-parser` · `ntds-parse` · `lsass-parse`
AD / GPO / audit	`ad-acl` · `msldap-ext` · `gpo` · `gpo-forge` · `preg` · `ms-dnsp` · `ms-fve` · `ms-rodc`
Relay / lateral	`ntlm-relay` · `llmnr-poison` · `winrm-pentest`
Windows-local (host-side)	`windows-sddl` · `windows-lsa` · `windows-scm` · `windows-token` · `windows-wmi-com` · `windows-sspi-shim` · `windows-eventlog-native`
BloodHound export	`bloodhound-export`

Full crate list on crates.io/users/zevs.

📚 Deep dives

Featured on dev.to — a detailed write-up of how the from-scratch Rust protocol stack came together.

Write-up — I built a full Active Directory pentest + audit tool in Rust on a from-scratch protocol stack (dev.to)
Changelog — per-release notes live in GitHub Releases and CHANGELOG.md
Benchmarks — full methodology + raw log in docs/BENCHMARKS.md
Ecosystem tour — crates.io/users/zevs

🧪 Test

CI runs the full workspace test suite on every push (100+ unit + integration tests across the CLI and 11 sub-crates). Green means ship. Reproduce locally:

cargo test --workspace

🤝 Contributing

PRs welcome — especially for new AD CS ESC variants, additional coerce endpoints, and cross-forest trust auditing. Open an issue first for anything larger than a bug fix.

☕ Support

ADhammer is MIT-licensed and independently developed. Every contribution funds another wire primitive, another live-validation session against a real DC, another release.

USDT (TRC20 / Tron) — instant, low-fee, no gatekeepers:

TDKrs1rjiUaB1JnvWRDaoxM7o1jjVuDTDW

Scan from any wallet, or copy-paste the address. Tron network, minimum ~1 USDT to cover network fee.

GitHub Sponsors + Ko-fi channels coming as Stripe onboarding clears. Until then, the address above is the fastest path.

🛡️ Security

Vulnerabilities: report privately per SECURITY.md. ADhammer contains working offensive techniques — use only against systems you own or are explicitly authorized to test.