Active directory

ACLight is a programme created to find privileged accounts in ActiveDirectory setups using sophisticated Access Control Lists (ACLs) analysis.

A Golang programme called ADReaper was created to quickly renumber an Active Directory environment using LDAP queries. It enables a number of commands that carry out LDAP searches in relation to particular elements of the Active Directory.

ADRecon is an Active Directory enumeration and scanning tooldesigned for security researchers and penetration testers. It extracts andcombines various artifacts from an Active Directory (AD) environment and canpresent the information in a specially formatted Microsoft Excel report. Thetool covers a wide range of AD elements, including users, groups, computers,trusts, and more, facilitating security assessments and providing a holisticview of the AD environment.

A C# programme called Certify is intended for listing and taking advantage of Active Directory Certificate Services (AD CS) misconfigurations. In an Active Directory context, it especially focuses on discovering vulnerabilities linked to certificate templates and associated permissions.The application enables security administrators and experts to evaluate the security posture of their AD CS setup, spot any possible weak points, and take the necessary precautions to reduce risks.

PowerView's Invoke-ShareFinder.ps1 has an analogue in the Python script FindUncommonShares. It makes it easier to quickly find unusual shares in sizable Windows Active Directory domains. The script uses multithreaded connections to effectively find SMB shares and is made to work with low privileges using a domain user account.

The GetDomainController Python programme aims to quickly locate Windows domain controllers and Exchange servers within a given domain by leveraging DNS. It offers versatility in output formats and can be helpful in a variety of situations to learn more about domain controllers and Exchange servers.

Discovering Resource-Based Constrained Delegation (RBCD) attack pathways in Active Directory setups is the goal of the Get-RBCD-Threaded tool. This tool aids in the identification of possible targets for RBCD attacks, which take use of Kerberos limited delegation settings.

Using CVE-2021-42278 and CVE-2021-42287, the noPac tool may pretend to be a Domain Administrator (DA) from an ordinary domain user. Attackers are able to escalate privileges by taking advantage of vulnerabilities.

A security tool called PingCastle is made to swiftly evaluate the security of Active Directory installations. In order to give an effective compromise for assessing Active Directory security, it utilises a risk assessment and maturity framework approach. It seeks to provide you with a summary of your Active Directory infrastructure's security posture.

A tool for security audits and SQL Server penetration testing is called PowerUpSQL. It has features for SQL Server discovery, auditing weak configurations, scalability of privilege escalation, and post-exploitation operations like running OS commands. Administrators can utilise PowerUpSQL for activities like SQL Server inventory and common threat hunting connected to SQL Server, while internal penetration testing and red team engagements are its main use cases.

ItWasAllADream is a Python-based scanner for PrintNightmare, also known as CVE-2021-34527. When the Print Spooler service is active on Windows computers, this vulnerability enables remote code execution. The programme creates a CSV report with the findings after scanning complete subnets to find hosts vulnerable to the RCE portion of PrintNightmare, not the local privilege escalation (LPE). The MS-PAR and MS-RPRN protocols are tested for exploitability.

The tool Snaffler is made for penetration testers and red team members to find important data (credentials and more) in sizable Windows/Active Directory setups. It is designed as a tool for finding sensitive material in a data haystack rather than as a "audit" tool.

A strong Python library created for interfacing with network protocols is called Impacket. Impacket is a network protocol implementation tool that was first developed by SecureAuth and is currently maintained by Fortra's Core Security. It focuses on giving low-level programmatic access to packets and other network protocols. It allows for the creation and processing of packets and provides an object-oriented API for interacting with complex protocol hierarchies. The library also has tools as examples of what may be done practically using its features.

Mimikatz is a potent instrument made for investigating and learning about Windows security. It was created by BenjaminDELPY (gentilkiwi), and it's renowned for its capacity to recall plaintext passwords, hashes, PIN numbers, and Kerberos tickets. The tool enables a number of actions, including constructing Golden tickets, pass-the-hash and pass-the-ticket.

For hacking Windows authentication systems, Rubeus is a potent tool. Rubeus, a tool created by the GhostPack team, offers a wealth of functionality for doing security testing and launching attacks in a Windows environment. It may be exploited in a number of Kerberos ticket attacks, giving an attacker access to the network's privileges.

Graph theory is used by BloodHound, a potent Active Directory (AD) analysis tool, to reveal and visualise relationships inside an AD system. It helps security teams on the offensive and defensive by locating and removing potential attack routes.

A Microsoft-signed DLL for the ActiveDirectory PowerShell module is called the ADModule. It acts as a backup for the MicrosoftActiveDirectory PowerShell module, which is installed and available in Server 2016 using RSAT (Remote Server Administration Tools). Generally speaking, the DLL may be found in C:\Windows\Microsoft.NET\assembly\GAC 64\The remaining module files are located in C:\Windows\System32\WindowsPowerShell\v1.0\Modules\ActiveDirectory\, along with Microsoft.ActiveDirectory.Management.

A tool for Active Directory (AD)security analysis is called Adalanche. It makes the process of querying and visualising ADrelationships easier while also revealing any security flaws. Data from Windows computers, Active Directory, and Group Policy Objects may be analysed with this programme.

A suitable Pythonic interface to communicate with Active Directory through ADSI on the Windows platform is provided by the pyad Python package. The library makes Active Directory-related operations easier by offering classes for a variety of objects, including users and groups. Within the Active Directory context, it enables the creation, deletion, and searching of objects.

A Python library called Certipy was created to make it easier to maintain and automate digital certificates, with an emphasis on using Microsoft Certificate Services (AD CS). The library intends to make managing, installing, and generating certificates in a Windows context easier.

A PowerShell programme called adPEAS is made specifically for automating ActiveDirectory enumeration. It features some unique PowerShell code and acts as a wrapper for a number of other projects, including PowerView, PoshADCS, and Bloodhound. This application makes it easier to retrieve data from Active Directory, examine permissions, and look for any security vulnerabilities.

Resources in an Azure subscription have a "attack graph" created by Stormspotter. Red teams and pentesters can use it to help them visualise an attack surface and pivot opportunities inside a tenant. Additionally, it aids in immediately orienting and prioritising defenders' event reaction activity.

By offering practical commands for Active Directory Domain Controllers, the Active Directory Attack Tool (ADAT) is a flexible tool intended to help CTF gamers and penetration testers. It works best when applied to the targethost using a set of known valid credentials.

Spray is a password-spraying programme made specifically for ActiveDirectory logins. It was created by Jacob Wilkin (Greenwolf) and offers a versatile and effective method for conducting password spraying attacks against numerous sites.

Aws-adfs is a command-line utility with support for multi-factor authentication (MFA) that makes it easier to authenticate against Active Directory Federation Services (ADFS) using the AWS CLI. It eliminates the requirement to keep the user's real credentials by enabling re-login to AWS SecurityToken Service (STS) without inputting credentials for a protracted length of time. It interacts with several MFA providers, such as Duo Security, Symantec VIP, RSA SecurID, and Azure AD MFA, and it supports automation tools like Ansible.

For Microsoft's Active Directory, DCEPT (Domain Controller Enticing Password Tripwire) is a tripwire mechanism based on honeytokens. By employing credentials that, if used, signal prospective intruders trying privilege escalation to domain administrator, it acts as a defence mechanism.A server component, agents, and a monitor are all included in the system to look for such behaviours.

A PowerShell module called ADReportingTools is intended to make it easier to generate reports and get data from your Active Directory domain. It makes it easier to get useful information without the need for complex filters or a thorough knowledge of Active Directory property names.

The autobloody utility automates the Active Directory privilege escalation routes suggested by BloodHound. If a privilege escalation path is present in the BloodHound database, it simplifies the process of exploiting it between two AD objects, the source (owned) and the target (desired).

A programme called Talon is made for automated password guessing attempts that try to go unnoticed. It can execute password guessing attacks against Kerberos and LDAPS services, enumerate a list of users using Kerberos, and identify legitimate users. The Golang-created programme offers flexible solutions for password assaults and supports both the Kerberos and LDAP protocols.

SharpSpray is a.NET C# password-spraying programme for Windows domains. It is a modified version of DomainPasswordSpray that was ported to C#. The utility communicates with ActiveDirectory services using the LDAP protocol.

By forcing authentication from machine accounts (Petitpotam) and relaying to the certificate service, ADCSPwn is a tool created to increase privileges in an Active Directory network.

Built for the web, ADAM is a slick, user-friendly, permission-based account/group management. It enables you to administer your Active Directory system from any device that has a browser and an internet connection.

This Node.js module was created as a wrapper for ldapjs and was intended for Active Directory authentication and utilities. Please be aware that the module is no longer supported. The most recent versions of Node.js and ldapjs may not be compatible with the most recent upgrade, which was issued four years ago.

A C# utility called Whisker is intended to hijack ActiveDirectory user and machine accounts by changing the DS-KeyCredentialLink property. The target account now has "ShadowCredentials" in effect. The environment must have a Domain Controller running Windows Server 2016 or later for this tool to work properly, and the Domain Controller must have a server authentication certificate to permit PKINIT Kerberos authentication.

In order to apply "Shadow Credentials" to the target account, the gssapi-abuse tool manipulates the msDS-KeyCredentialLinkattribute of Active Directory user and computer accounts. Michael Grafnetter's (@MGrafnetter) work from DSInternals served as the foundation for this utility.

For various Active Directory enumeration techniques and assaults, Pentest User Interface (PentestUI) is an automated web interface built using Django.Additionally, you may see the results of past enumeration attempts or assaults on the Active Directory structure.