v1.2.0

Static/cross-compiled binaries (pure-Rust rustls TLS — no OpenSSL).
For legacy DCs with SHA-1 LDAPS certs, build from source with
--no-default-features --features tls-native.

ADhammer v1.1.0

Audit-first Active Directory security assessment in Rust, on a from-scratch DCE/RPC · NTLM · SMB2 · Kerberos stack. This release widens both the passive audit and the validation surface, and adds a live progress UX. Every capability below is live-validated against a fully-patched Windows Server 2025 DC.

New

• AD CS ESC coverage → 10/16. Added passive ESC5 (CA-object ACL), ESC14 (weak altSecurityIdentities mappings), and ESC15 / EKUwu (CVE-2024-49019, schema-v1 application-policy injection). Now ESC1/2/3/4/5/9/13/14/15 passive + ESC8 active.
• enum adcs — enumerate enterprise CAs and actively probe each for ESC8 web-enrollment exposure.
• enum dns — ADIDNS zone/record enumeration (adidnsdump-equivalent) with a from-scratch DNS_RPC_RECORD parser; flags wildcard (mitm6/WPAD) nodes.
• attack laps — read LAPS local-admin passwords over LDAPS (legacy ms-Mcs-AdmPwd + Windows LAPS msLAPS-Password).
• attack winrm — command execution over WS-Management (5985) with NTLM + MS-NLMP message encryption, on a from-scratch HTTP client; pass-the-hash supported.
• Session hygiene — --no-save + a "Wipe saved session" menu item.
• Progress UX — colored section headers, status glyphs, and a live spinner with an elapsed-time counter for network waits (auto-off when piped; CLICOLOR_FORCE/NO_COLOR respected).

Fixed

• LDAP bind failed on real DCs with a bare username — the collector now auto-qualifies to a UPN from RootDSE.
• Interactive network sweep now defaults to the DC's own /24 instead of a hardcoded range.

Install

cargo install adhammer

…or grab the prebuilt Windows binary below / build from source. See CHANGELOG.md for the full list.

Authorized testing / research / education only — see SECURITY.md.

ADhammer v1.0.0

ADhammer v1.0.0 — a single Linux-native Rust binary that both audits Active Directory and exploits it, on a from-scratch DCE/RPC · NTLM · SMB2 · Kerberos stack. Every offensive capability is live-validated end-to-end against a fully-patched Windows Server 2025 DC.

Highlights:

• Audit — 33 PingCastle-category checks + in-process control-path graph + BloodHound export, with MITRE ATT&CK mapping.
• Kerberos — roasting, DCSync (+Kerberos keys incl. RFC 8009 AES-SHA2), golden/silver tickets (accepted by a patched KB5020805 KDC), pass-the-ticket (→ SYSTEM on the DC from Kali), overpass-the-hash, RC4 golden/silver, Shadow Credentials PKINIT (incl. the 2025 paChecksum2 fix that breaks Rubeus/PKINITtools).
• More — RBCD/constrained delegation, coercion, SVCCTL RCE, secretsdump, gMSA read, ADCS ESC1, NTLM relay, capture/poison.
• Protocol stack shipped as standalone crates: windows-sddl, ntlmssp, smb2-client, dcerpc — the "impacket for Rust" that didn't exist.

Prebuilt binaries below (Linux x86_64 + Windows x86_64), or cargo build --release. Guided interactive TUI (adhammer) or power-user subcommands.

Authorized testing / research / education only — see SECURITY.md. Full details in CHANGELOG.md.