Skip to content

adPEAS v2.0.0

Choose a tag to compare

View all tags
@61106960 61106960 released this 01 Apr 22:24
· 215 commits to main since this release
v2.0.0
8dd19a2

Changelog

All notable changes to adPEAS will be documented in this file.

The format is based on Keep a Changelog.

[2.0.0] - 2026-04-02

Initial release of adPEAS v2 — a complete rewrite of adPEAS v1.

Added

  • Unified LdapConnection architecture replacing legacy DirectoryEntry/DirectorySearcher
  • Native Kerberos stack — AS-REQ/AS-REP, TGS-REQ/TGS-REP, Pass-the-Ticket, all in pure PowerShell
  • Authentication methods — Password, NT-Hash (OPtH), AES keys (PtK), PKINIT, Pass-the-Cert/Schannel, Windows integrated auth
  • Kerberos-first authentication with automatic fallback to NTLM Impersonation and SimpleBind
  • UnPAC-the-Hash — automatic NT-Hash recovery after PKINIT authentication
  • 41+ security checks across 9 categories (Domain, Creds, Rights, Delegation, ADCS, Accounts, GPO, Computer, Application)
  • ADCS vulnerability detection — ESC1 through ESC15
  • Severity scoring system with Critical/High/Medium/Low/Info levels and risk scores
  • Interactive HTML reports with search, filtering, sorting, dark/light theme, and tooltips
  • JSON export for machine-readable output, offline report conversion, and scan comparison
  • Report comparison (Compare-adPEASReport) — diff two scans to track remediation progress
  • Offline report conversion (Convert-adPEASReport) — regenerate reports from JSON without LDAP connection
  • Incremental scanning with -OutputAppend to merge findings across multiple runs
  • BloodHound CE collector — built-in data collection for attack path analysis
  • Offensive operations — Kerberoasting, AS-REP Roasting, Golden/Silver/Diamond Tickets, RBCD abuse, Shadow Credentials, GPO abuse
  • Session-based workflow — connect once, run multiple checks interactively
  • Tab-completion for AD object names (-BuildCompletionCache)
  • OPSEC mode — skip active testing (Kerberoast, ASREPRoast, BloodHound)
  • Verbose logging to file for troubleshooting (-VerboseLogging)
  • LDAP timeout configuration (-TimeoutSeconds) for slow connections (SOCKS, VPN)
  • RSA-SHA256 license system with build-time embedding and runtime override
  • Four release variants — readable, minimized, ultra-compressed, and obfuscated

Changed

  • Zero external dependencies — no RSAT, no ActiveDirectory module, no PowerView
  • All LDAP operations use System.DirectoryServices.Protocols.LdapConnection
  • Modular source structure (src/modules/) compiled into single standalone .ps1 file
  • SID-based identity checks for language-independent operation

Removed

  • PowerView dependency
  • DirectoryEntry/DirectorySearcher usage
Assets 2
Loading