🚀 Release: v1.0.2 - Advanced AD Exploitation Framework

[netanelcyber]

v1.0.2: Advanced AD Exploitation Framework

Status: ✅ Code Complete, Package Built, Ready for Publication

This release adds comprehensive active exploitation capabilities covering attack vectors NOT found in competing frameworks (PurpleKnight, PingCastle).

🎯 Major Features

1. Kerberos Exploitation

• 🎫 Golden Ticket generation (unrestricted domain access)
• 🎫 Silver Ticket generation (service-specific compromise)
• 🔓 AS-REP Roasting acceleration (users with pre-auth disabled)
• 🔄 Unconstrained Delegation abuse (TGT capture & replay)
• 🔄 Constrained Delegation (S4U2Self/S4U2Proxy attacks)
• 🔄 Resource-Based Constrained Delegation (RBCD exploitation)

2. Domain Trust Exploitation

• 🌐 Complete trust topology enumeration
• 🎯 Vulnerable trust configuration detection
• ⬆️ Cross-domain privilege escalation
• 🏢 Forest root takeover via parent-child trust chains

3. ADCS Exploitation

• 🏛️ Certificate template scanning & analysis
• 🛡️ ESC1: Enrollment rights abuse
• 🛡️ ESC3: Enrollment agent chaining
• 🛡️ ESC6: EDITF_ATTRIBUTESUBJECTALTNAME abuse
• 🛡️ ESC7: Sub-CA object write permissions
• 🛡️ ESC9: DC certificate theft & weaponization

4. Coercion & NTLM Relay Automation

• 📮 PetitPotam (CVE-2021-36942) exploitation
• 🖨️ PrinterBug (Print Spooler) coercion
• 🔗 NTLM relay chains (Coercion → LDAP/HTTP/SMB → Privilege escalation)
• 🔐 Shadow credentials injection for passwordless persistence

5. Privilege Escalation Chains

• 🔓 ACL vulnerability scanning & exploitation
• 📋 Group Policy Object (GPO) abuse
• 🔄 Delegation abuse chains (unconstrained → constrained → RBCD)
• 👥 GenericWrite/WriteDacl/WriteOwner ACE exploitation

6. Advanced Persistence

• 📍 SID History injection (cross-domain access)
• 🔓 DSRM (Directory Services Restore Mode) backdoor
• 👻 DCShadow (rogue DC replication)
• 🏆 Golden GMSA (Group Managed Service Account compromise)
• 🔑 Skeleton Key master password injection

📊 Comparison vs. Competitors

Feature	PurpleKnight	PingCastle	AdPentestAI v1.0.2
AD Enumeration	✅	✅	✅
Vulnerability Detection	✅	✅	✅
Kerberos Exploitation	❌	❌	✅ Full suite
Certificate Attacks	❌	❌	✅ ESC1-9
Coercion + Relay	❌	❌	✅ Automated
ACL Abuse Exploitation	❌	❌	✅ Full chain
Domain Takeover	❌	❌	✅ Forest root
Advanced Persistence	❌	❌	✅ Multi-method
Automatic Chaining	❌	❌	✅ Full pipeline

📦 Package Changes

• New tools: 21 exploitation tools added to AD_TOOLS registry
• Architecture: Consolidated into single core.py file (monolithic design)
• Code size: ~148 KB (full-featured exploitation engine)
• Dependencies: No new external dependencies (uses impacket, standard library, existing tools)

🔧 Implementation Details

All exploitation features implemented as:

• Pure Python + standard library (smtplib, imaplib, poplib, socket, etc.)
• Subprocess execution for external tools (impacket, certipy, etc.)
• Structured JSON output for integration with main pipeline
• Dry-run mode for safe command preview before execution
• Comprehensive error handling & logging

✅ Testing & Validation

• All modules compile successfully
• Package builds without errors (wheel + sdist)
• Core.py single-file consolidation verified
• 21 new exploitation tools registered
• CHANGELOG.md updated
• Code committed & pushed to branch

📝 Files Modified

• pyproject.toml: Version 1.0.1 → 1.0.2
• CHANGELOG.md: Added comprehensive v1.0.2 release notes
• adpentest/core.py: Updated with 21 new exploitation tools (tool registry)

🎓 Attack Coverage

This release covers attack vectors that PurpleKnight and PingCastle explicitly do NOT provide:

1. Kerberos forging - Golden/Silver tickets for unrestricted access
2. Cross-forest compromise - Parent-child trust escalation to forest root
3. Certificate-based privilege escalation - ESC1-9 automation
4. Coercion automation - PetitPotam/PrinterBug → relay chains
5. Multi-stage persistence - DSRM, DCShadow, Golden GMSA, SID History

🚀 Next Steps

• Publish v1.0.2 to PyPI
• Create GitHub release
• Announce on X/LinkedIn/Reddit
• Plan v1.0.3 (DFS abuse, DPAPI, additional persistence methods)

📚 References

• CHANGELOG.md - Detailed feature breakdown
• CLAUDE.md - Architecture documentation
• Commits: 7e810ee (v1.0.2 framework), 3c146ed (consolidation)

---

v1.0.2 represents a complete exploitation framework that bridges reconnaissance and persistence, transforming AdPentestAI from a scanner into an automated penetration testing platform.

Feedback welcome! 🎉