Skip to content

ADhammer v1.1.0

Choose a tag to compare

View all tags
@icedracon icedracon released this 29 Jul 12:46
v1.1.0
85998da

Audit-first Active Directory security assessment in Rust, on a from-scratch DCE/RPC · NTLM · SMB2 · Kerberos stack. This release widens both the passive audit and the validation surface, and adds a live progress UX. Every capability below is live-validated against a fully-patched Windows Server 2025 DC.

New

  • AD CS ESC coverage → 10/16. Added passive ESC5 (CA-object ACL), ESC14 (weak altSecurityIdentities mappings), and ESC15 / EKUwu (CVE-2024-49019, schema-v1 application-policy injection). Now ESC1/2/3/4/5/9/13/14/15 passive + ESC8 active.
  • enum adcs — enumerate enterprise CAs and actively probe each for ESC8 web-enrollment exposure.
  • enum dns — ADIDNS zone/record enumeration (adidnsdump-equivalent) with a from-scratch DNS_RPC_RECORD parser; flags wildcard (mitm6/WPAD) nodes.
  • attack laps — read LAPS local-admin passwords over LDAPS (legacy ms-Mcs-AdmPwd + Windows LAPS msLAPS-Password).
  • attack winrm — command execution over WS-Management (5985) with NTLM + MS-NLMP message encryption, on a from-scratch HTTP client; pass-the-hash supported.
  • Session hygiene — --no-save + a "Wipe saved session" menu item.
  • Progress UX — colored section headers, status glyphs, and a live spinner with an elapsed-time counter for network waits (auto-off when piped; CLICOLOR_FORCE/NO_COLOR respected).

Fixed

  • LDAP bind failed on real DCs with a bare username — the collector now auto-qualifies to a UPN from RootDSE.
  • Interactive network sweep now defaults to the DC's own /24 instead of a hardcoded range.

Install

cargo install adhammer

…or grab the prebuilt Windows binary below / build from source. See CHANGELOG.md for the full list.

Authorized testing / research / education only — see SECURITY.md.

Assets 3
Loading