adhammer 1.4.6

adhammer-1.4.6 is not a library.

The idea

Evidence over assumption. Collect the directory, trace the path, and validate supported findings with captured proof.

ADhammer collects the domain, graphs every control path that ends at Tier-0, then proves the interesting ones with the same protocol code the attacker would use. One continuous session from LDAP recon to a signed AS-REP on disk. Findings you can hand to a customer with the exact byte sequence that produced them.

🎯 Detect ≠ Validate

Most AD security tools stop at "potential attack path detected."

ADhammer keeps going.

Finding detected
      ↓
Attack path constructed
      ↓
Validation requested
      ↓
Live PoC executed
      ↓
Proof obtained
      ↓
Report generated

The difference matters:

Not	But
"potential path"	"supported validation captured proof"

Every finding in the report is either an audit observation, a supported validation with proof, or a path that still needs operator context. Defenders can see what was observed, what was proven, and what remains validation owed.

Release Truth

The current workspace version is 1.4.5.

Public claims for ADhammer should follow three rules:

Release-specific changes live in CHANGELOG.md.
Validation status lives in docs/VALIDATION.md.
No public copy should claim more than the validation ledger supports.

That keeps the README useful across release lines without turning the first screen into a moving archive.

👥 Who is this for?

🔴 Red team operators

One binary, no Python runtime, no sidecar services. Works from Kali or straight off a Windows jump box. Supported validation paths are exercised in an authorized lab and tracked in the validation ledger instead of being overstated in marketing copy.

🛡️ AD auditors / defenders

50+ hygiene checks across four categories, MITRE ATT&CK-tagged, low-priv collection via SD_FLAGS. Reports as JSON, HTML, or a BloodHound-CE ingest bundle. Supported findings have matching PoCs; unsupported ones stay labeled potential instead of being overstated.

🦀 Rust developers

Published icedracon protocol crates on crates.io, each cargo add-able. Compose your own DCE/RPC stack, forge PACs, decrypt LAPS blobs, or emit BloodHound JSON — pick the layer that fits, skip the rest. See the ecosystem section.

🚀 Try it in 30 seconds

cargo install --locked adhammer


adhammer scan  --url ldaps://dc.corp.local:636 \

               --user 'CORP\svc' --password ... \

               --insecure --bloodhound out.zip

Fast per-operation timings (see BENCHMARKS.md for the recorded matrix), JSON + HTML report, BloodHound-compatible graph bundle — from a low-privileged domain user account. See the full command list below or grab prebuilt binaries (musl / glibc / macOS / Windows) from Releases.

[!CAUTION] Authorized use only. ADhammer implements working offensive techniques — DCSync, golden / silver / diamond tickets, pass-the-ticket, NTLM relay, ADCS abuse, remote code execution. Use only against systems you own or are explicitly authorized to test. See SECURITY.md.

One product philosophy: detect the path, then prove it.

                     ADHAMMER
                        │
                        ▼
    ┌─────────────────────────────────────────┐
    │                 AUDIT                   │
    │   LDAP + SD_FLAGS  →  Snapshot          │
    │   50+ hygiene checks + 15/16 ADCS ESC   │
    └─────────────────────┬───────────────────┘
                          ▼
    ┌─────────────────────────────────────────┐
    │                 GRAPH                   │
    │   petgraph control-path graph           │
    │   cheapest chain to Tier-0 (Dijkstra)   │
    └─────────────────────┬───────────────────┘
                          ▼
    ┌─────────────────────────────────────────┐
    │              VALIDATE                   │
    │   Live PoC per finding — real hash,     │
    │   real cert, real replicated secret     │
    └─────────────────────┬───────────────────┘
                          ▼
    ┌─────────────────────────────────────────┐
    │               REPORT                    │
    │   JSON · HTML · BloodHound-CE bundle    │
    │   MITRE ATT&CK per finding + evidence   │
    └─────────────────────────────────────────┘

Two commands drive the whole flow. Everything else is a subcommand.

1 — `adhammer scan` · audit a domain

Collects a domain over LDAP as a low-privileged user (via the SD_FLAGS control), builds a control-path graph in-process, and runs the check pack across four categories — privileged accounts, trusts, stale objects, anomalies — plus 15 of the 16 AD CS ESC classes, ADIDNS exposure, and SYSVOL / GPP. Every finding is scored, MITRE-tagged, and exportable in a BloodHound-compatible JSON bundle.

2 — `adhammer auto` · validate supported findings with a live PoC

A report shouldn't say a path might be exploitable when the tool can prove it. auto walks each finding, asks "validate this one?" — on yes runs the matching supported tradecraft, marks the finding validated only when real proof is present (an actual $krb5tgs$ hash, a replicated krbtgt secret, an ISSUED cert), and leaves unsupported findings explicitly marked as potential. Everything lands in a Markdown assessment report with the exact command + evidence per PoC.

⚡ Performance

Every operation on a warm cache against a fully-patched Windows Server 2025 domain controller, cold-timed at the command boundary. Compiled Rust binary — cold-start under a second, most operations under 100 ms.

Operation	Median
Zerologon safe-detect	54 ms
RBCD write (`msDS-AllowedToActOnBehalfOfOtherIdentity`)	49 ms
BadSuccessor (Server 2025 dMSA succession)	48 ms
LDAP query (name → SID)	59 ms
SAMR user enumeration	63 ms
AD CS enterprise CA enumeration	67 ms
DCSync `krbtgt` secret	73 ms
RRP secretsdump (SAM + SECURITY + SYSTEM)	74 ms
Kerberoast one SPN	79 ms
AS-REP roast one account	80 ms
Full LDAP audit + control-path graph (500-object domain)	88 ms
AD CS ESC1 enrollment end-to-end (submit → issued PEM)	315 ms

Reproduce in one command — driver (bench/run_bench.sh) · renderer (bench/render_results.py) · TSV output (bench/results.tsv) · methodology (docs/BENCHMARKS.md).

📥 Install

From crates.io — always latest:

cargo install --locked adhammer

As a library — every module importable:

cargo add adhammer-sdk

Prebuilt binaries per release:

musl (static, no glibc)
glibc (Linux)
macOS (arm64 + x64)
Windows (x64)

Grab the latest from Releases →

Requires Rust 1.87+ to build from source. Tested on Kali, Ubuntu, Debian, macOS, and native Windows.

🎯 Usage

Run adhammer with no arguments for the guided interactive menu — asks for user → password (or NT hash) → domain → DC, saves the session, walks every action with prompts. For golden / silver / pass-the-ticket it auto-fetches the krbtgt / service AES256 key (via DCSync) and the domain SID (via LSAT). Add --no-save to keep credentials off disk.

Session hunting — three complementary primitives

enum sessions (SRVSVC), enum wkssvc (WKSSVC), and enum hku (HKU registry walk) each answer the who is on this box question from a different angle — different auth requirements, different result granularity. Dedup + machine-account filtering are on by default (--include-machine shows the count marker for what was hidden).

Power-user subcommands:

scan                                        passive audit -> JSON/HTML (+ --sysvol, --bloodhound out.zip)
auto                                         guided: scan -> confirm each weakness -> validate + PoC report
enum   {samr, lsa, net, dns, adcs, esc, posture, sessions}
                                            RPC / net / ADIDNS / AD-CS / ESC-registry / DC-posture / SRVSVC
attack {roast, spray, abuse, coerce, rbcd, constrained, unconstrained, dcsync, exec, atexec, wmiexec,
        secretsdump, gmsa, laps, esc1, esc4, icpr-esc1, golden, silver, pth, asktgt, winrm, capture,
        poison, relay, zerologon, shadowcred, dcshadow, badsuccessor}

# Audit a domain (low-priv creds are enough), export a BloodHound bundle:

adhammer scan --url ldaps://dc.corp.local:636 --user 'CORP\svc' --password ... --insecure --bloodhound out.zip


# ADIDNS + AD CS recon:

adhammer enum dns  --url ldaps://dc:636 --user 'CORP\svc' --password ... --insecure

adhammer enum adcs --url ldaps://dc:636 --user 'CORP\svc' --password ... --insecure


# DCSync the krbtgt key, forge a golden ticket, pass-the-ticket to SYSTEM:

adhammer attack dcsync --host dc --domain CORP --user Administrator --password ... --target krbtgt

adhammer attack pth    --host dc --realm CORP.LOCAL --krbtgt-aes256 <64-hex> --domain-sid S-1-5-21-... \

                       --spn cifs/dc.corp.local --command whoami


# AD CS ESC1 / ESC3 / ESC6 / ESC15 enrollment via MS-ICPR:

adhammer attack icpr-esc1 --ca CORP-CA --template User --target-upn administrator@corp.local \

                        --host dc --domain CORP --user 'CORP\svc' --password ... \

                        --esc esc6 --san-upn administrator@corp.local


# Server 2025 dMSA succession (BadSuccessor):

adhammer attack badsuccessor --dmsa-name pwn --target <victim>

📋 Coverage

Audit checks — 4 categories, 15/16 AD CS ESC classes

Category	Coverage
Privileged accounts	AS-REP / Kerberoast exposure · unconstrained delegation · DCSync control paths (graph) · sensitive-group membership · gMSA read ACL · SID history · RBCD · LAPS coverage · `PASSWD_NOTREQD`
Trusts	SID filtering · selective auth · cross-forest TGT delegation · RC4 downgrade · transitivity
Stale objects	Inactive users / computers · old passwords · EOL OS · duplicate SPNs · stale machine passwords
Anomalies	`MachineAccountQuota` · krbtgt age · RC4 Kerberos · reversible encryption · BadSuccessor (dMSA) · password policy · anonymous LDAP · Pre-Windows 2000 · Guest · GPP `cpassword` (MS14-025) · LM / NTLMv1 · LDAP / SMB signing
AD CS (15/16 ESC)	Passive: ESC1-5, 9, 13-15 / EKUwu (CVE-2024-49019) · Active: ESC1, ESC3, ESC6, ESC8, ESC15 · Registry: ESC6-7, 10-11, 16 · Only ESC12 (hardware token) out of scope
ADIDNS	Zone + record enumeration with wildcard (mitm6 / WPAD) exposure detection

Every finding carries a MITRE ATT&CK technique (T1558.003, T1003.006, T1649, T1484, …).

LDAP audit (paged, SD_FLAGS-scoped) → JSON / HTML report
BloodHound-CE compatible bundle export
SAMR / LSAT / SRVSVC / MS-RRP enumeration
ADIDNS zone dump + wildcard record detection
AD CS enterprise CA discovery + ESC8 web-enrollment probe
DC posture: LDAP signing / channel binding / Spooler / RemoteRegistry

AS-REP roast + Kerberoast (RC4 + AES256)
Ask-TGT (--asktgt) + password spray
Pass-the-ticket over sealed SMB2 + AP-REQ
Golden ticket (RC4 + AES256, PAC KB5020805-compliant)
Silver ticket (per-service)
Diamond ticket (library only, via ms-pac-forge — no CLI subcommand yet) — identity-swap on a real TGT envelope (detection evasion)
FAST armor (RFC 6113)
PKINIT + Shadow Credentials

Unconstrained delegation
Constrained delegation (S4U2Self + S4U2Proxy)
RBCD write + exploit chain (msDS-AllowedToActOnBehalfOfOtherIdentity)

ESC1 — enrollee-supplied UPN SAN in CSR
ESC3 — CMC EnrollOnBehalfOf via caller-supplied Enrollment Agent cert
ESC6 — SAN as CA pctbAttribs request-attribute
ESC8 — Web-enrollment relay chain
ESC15 — EKUwu / CVE-2024-49019 via Microsoft Application Policies extension
ESC4 — write template attributes to make a template ESC1-vulnerable

DCSync (DRSUAPI, single-account or full domain)
RRP secretsdump (local SAM + SECURITY + SYSTEM offline decrypt)
LSASS minidump credential hunt (offline)
LAPS v1 (ms-Mcs-AdmPwd) + LAPS v2 (msLAPS-EncryptedPassword via GKDI)
gMSA msDS-ManagedPassword decrypt

Coerce (RPRN / EFSR / DFSNM / FSRVP)
NTLM relay → LDAP / SMB / AD CS Web (ESC8)
LLMNR + NBT-NS poison → NetNTLMv2 capture
Remote exec: SVCCTL · TSCH (atexec) · WMI (DCOM) · WinRM
Zerologon safe-detect by default (attack zerologon runs read-only detection); a destructive --exploit path exists and requires explicit runtime confirmation
DCShadow (rights enumeration + prep/cleanup shipped; DRSUAPI push path present, live validation owed)
Server 2025 BadSuccessor (dMSA)

🧱 Built on a from-scratch Rust ecosystem

ADhammer is one binary on top of published standalone icedracon crates, each doing one job well and each cargo add-able on its own. Every crate ships an explicit "what this does NOT do" section, is MIT-licensed, and works standalone. Exact crate counts and download totals change over time; the important constant is that the protocol stack is reusable outside the binary.

Two brands, one project:

ADhammer — the application. AD security assessment + live attack-path validation.
icedracon — the ecosystem. Pure-Rust implementations of Microsoft security protocols. Adopt one crate (cargo add dcerpc) without adopting the whole toolkit.

Layer	Crates
Transport	`dcerpc` · `smb2-client` · `ms-ndr`
Auth / crypto	`ntlmssp` · `credssp` · `dpapi-ng` · `dpapi-offline` · `ms-gkdi`
Kerberos	`ms-pac` · `ms-pac-forge` · `ms-kile-fast` · `ms-pkca` · `ccache-io` (new — MIT ccache + .kirbi codec)
DCE/RPC protocols	`ms-drsr` · `ms-nrpc` · `ms-samr` · `ms-lsat` · `ms-tsch` · `ms-even6` · `ms-tds` · `ms-coerce` · `ms-scmr` (new) · `ms-bkrp` (new)
AD CS	`ms-crtd` · `ms-icpr` · `ms-csra`
NTDS / secrets	`ese-parser` · `ntds-parse` · `lsass-parse`
AD / GPO / audit	`ad-acl` · `msldap-ext` · `gpo` · `gpo-forge` · `preg` · `ms-dnsp` · `ms-fve` · `ms-rodc`
Relay / lateral	`ntlm-relay` · `llmnr-poison` · `winrm-pentest`
Windows-local (host-side)	`windows-sddl` · `windows-lsa` · `windows-scm` · `windows-token` · `windows-wmi-com` · `windows-sspi-shim` · `windows-eventlog-native`
BloodHound export	`bloodhound-export`

Full crate list on crates.io/users/zevs.

📚 Deep dives

Featured on dev.to — a detailed write-up of how the from-scratch Rust protocol stack came together.

Write-up — I built a full Active Directory pentest + audit tool in Rust on a from-scratch protocol stack (dev.to)
Changelog — per-release notes live in GitHub Releases and CHANGELOG.md
Benchmarks — full methodology + raw log in docs/BENCHMARKS.md
Ecosystem tour — crates.io/users/zevs

🧪 Test

CI runs the full workspace test suite on every push (100+ unit + integration tests across the CLI and 11 sub-crates). Green means ship. Reproduce locally:

cargo test --workspace

🤝 Contributing

PRs welcome — especially for new AD CS ESC variants, additional coerce endpoints, and cross-forest trust auditing. Open an issue first for anything larger than a bug fix.

☕ Support

ADhammer is MIT-licensed and independently developed. Every contribution funds another wire primitive, another live-validation session against a real DC, another release.

USDT (TRC20 / Tron) — instant, low-fee, no gatekeepers:

TDKrs1rjiUaB1JnvWRDaoxM7o1jjVuDTDW

Scan from any wallet, or copy-paste the address. Tron network, minimum ~1 USDT to cover network fee.

GitHub Sponsors + Ko-fi channels coming as Stripe onboarding clears. Until then, the address above is the fastest path.

🛡️ Security

Vulnerabilities: report privately per SECURITY.md. ADhammer contains working offensive techniques — use only against systems you own or are explicitly authorized to test.