Skip to content

ADhammer v1.0.0

Choose a tag to compare

View all tags
@icedracon icedracon released this 28 Jul 18:31
v1.0.0
b2bb64f

ADhammer v1.0.0 — a single Linux-native Rust binary that both audits Active Directory and exploits it, on a from-scratch DCE/RPC · NTLM · SMB2 · Kerberos stack. Every offensive capability is live-validated end-to-end against a fully-patched Windows Server 2025 DC.

Highlights:

  • Audit — 33 PingCastle-category checks + in-process control-path graph + BloodHound export, with MITRE ATT&CK mapping.
  • Kerberos — roasting, DCSync (+Kerberos keys incl. RFC 8009 AES-SHA2), golden/silver tickets (accepted by a patched KB5020805 KDC), pass-the-ticket (→ SYSTEM on the DC from Kali), overpass-the-hash, RC4 golden/silver, Shadow Credentials PKINIT (incl. the 2025 paChecksum2 fix that breaks Rubeus/PKINITtools).
  • More — RBCD/constrained delegation, coercion, SVCCTL RCE, secretsdump, gMSA read, ADCS ESC1, NTLM relay, capture/poison.
  • Protocol stack shipped as standalone crates: windows-sddl, ntlmssp, smb2-client, dcerpc — the "impacket for Rust" that didn't exist.

Prebuilt binaries below (Linux x86_64 + Windows x86_64), or cargo build --release. Guided interactive TUI (adhammer) or power-user subcommands.

Authorized testing / research / education only — see SECURITY.md. Full details in CHANGELOG.md.

Assets 4
Loading