adhammer 1.3.1 — Server 2025 BadSuccessor + 12× perf win

Patch release focused on Server 2025 support and a big transport-layer perf win.

Highlights

• BadSuccessor (Server 2025 dMSA) now works end-to-end. The Server 2025 schema requires dNSHostName, msDS-SupportedEncryptionTypes, and msDS-ManagedPasswordInterval on the added dMSA, and the structural class chain conflicts with an explicit computer/user/person list — fixed. attack badsuccessor --dmsa-name pwn --target <victim> creates a delegated MSA that inherits the victim's PAC on the next TGT (Yuval Gordon / Akamai 2025).
• 12× perf on the RRP secretsdump path (1083 ms → 91 ms best-of-3) and equivalent gains across every small-request scenario (SAMR enum 225 → 63 ms, RBCD write 80 → 49 ms, ADCS enum 147 → 67 ms, LDAP name→SID 192 → 59 ms). One line: TCP_NODELAY on every SMB/RPC dial — Nagle was adding up to 40 ms per sealed opnum. Inherited automatically via smb2-client 0.2.1.
• Bench matrix rebuilt on a live Server 2025 Standard DC (testlab.local, LDAPS via enterprise CA). 11 wins vs impacket/certipy/bloodyAD/NetExec + 1 exclusive (BadSuccessor has no Python-toolkit implementation). Full matrix in docs/BENCHMARKS.md.

Compatibility

Zero API breaks — patch bump. All existing cargo install adhammer users get the fixes on cargo update. The dcerpc::drsuapi module is deprecated in favor of the standalone ms-drsr crate but continues to work as a compat shim.

Head-to-head vs the Python toolkit (Server 2025 DC)

Scenario	ADhammer	impacket	certipy	bloodyAD	NetExec	Winner
Zerologon safe-detect	54 ms	—	—	—	7779 ms	🏆 adhammer · 144×
AD CS enumeration	67 ms	—	5997 ms	—	—	🏆 adhammer · 89.5×
ADCS ESC1 enrollment	315 ms	—	9793 ms	—	—	🏆 adhammer · 31.1×
Full LDAP audit	88 ms	—	—	—	2058 ms	🏆 adhammer · 23.4×
LDAP name → SID	59 ms	—	—	627 ms	—	🏆 adhammer · 10.6×
BadSuccessor (dMSA)	48 ms	—	—	—	—	🏆 adhammer · only impl
SAMR user enumeration	63 ms	310 ms	—	—	898 ms	🏆 adhammer · 4.9×
DCSync krbtgt	73 ms	335 ms	—	—	9058 ms	🏆 adhammer · 4.6×
RBCD write	49 ms	—	—	363 ms	—	🏆 adhammer · 7.4×
Kerberoast	79 ms	234 ms	—	—	5847 ms	🏆 adhammer · 3.0×
AS-REP Roast	80 ms	220 ms	—	—	1964 ms	🏆 adhammer · 2.8×
Remote secretsdump (RRP)	74 ms	45 ms	—	—	—	🥈 impacket · 1.6×

Companion crate releases

• smb2-client 0.2.1 — TCP_NODELAY on every dial
• dcerpc 0.2.1 — RRP full parity + new srvsvc/fsrvp/dfsnm protocol modules
• ms-ndr 0.1.0 — NDR marshaling extracted
• ms-drsr 0.1.0 — DRSUAPI/DCSync extracted
• dpapi-ng 0.1.1 — added rpc feature for encrypted LAPS/gMSA/dMSA blobs

Install

cargo install adhammer