Enumerate Active Directory with standard vectors
Project description
ADE - ActiveDirectoryEnum
usage: activeDirectoryEnum [-h] [-o OUT_FILE] [-u USER] [-s] [-smb] [-kp]
[-bh] [-spn] [--all] [--no-creds]
dc
___ __ _ ____ _ __ ______
/ | _____/ /_(_) _____ / __ \(_)_______ _____/ /_____ _______ __/ ____/___ __ ______ ___
/ /| |/ ___/ __/ / | / / _ \/ / / / / ___/ _ \/ ___/ __/ __ \/ ___/ / / / __/ / __ \/ / / / __ `__ \
/ ___ / /__/ /_/ /| |/ / __/ /_/ / / / / __/ /__/ /_/ /_/ / / / /_/ / /___/ / / / /_/ / / / / / /
/_/ |_\___/\__/_/ |___/\___/_____/_/_/ \___/\___/\__/\____/_/ \__, /_____/_/ /_/\__,_/_/ /_/ /_/
/____/
|*----------------------------------------------------------------------------------------------------------*|
positional arguments:
dc Hostname of the Domain Controller
optional arguments:
-h, --help show this help message and exit
-o OUT_FILE, --out-file OUT_FILE
Path to output file. If no path, CWD is assumed
(default: None)
-u USER, --user USER Username of the domain user to query with. The
username has to be domain name as `user@domain.org`
-s, --secure Try to estalish connection through LDAPS
-smb, --smb Force enumeration of SMB shares on all computer
objects fetched
-kp, --kerberos_preauth
Attempt to gather users that does not require Kerberos
preauthentication
-bh, --bloodhound Output data in the format expected by BloodHound
-spn Attempt to get all SPNs and perform Kerberoasting
-sysvol Search sysvol for GPOs with cpassword and decrypt it
--all Run all checks
--no-creds Start without credentials
Install
Run installation through pip3:
pip3 install ActiveDirectoryEnum
python -m ade
If you run BlackArch, ActiveDirectoryEnum is available through pacman
as such:
pacman -S activedirectoryenum
Included attacks/vectors
- ASREPRoasting
- Kerberoasting
- Dump AD as BloodHound JSON files
- Searching GPOs in SYSVOL for cpassword and decrypting
- Run without creds and attempt to gather for further enumeration during the run
Collaboration
While this project is developed to fit my need, any collaboration is appriciated. Please feel free to fork the project, make changes according to the License agreements and make a Pull Request. I only ask that:
- Keep equivilent naming standard as the base project
- Keep equivilent syntaxing
- Test your code
- Error handling is incorporated
- Document the feature - both in code but also for potential Wiki page
Thanks & Acknowledgements
Big thanks to the creators of:
Impacket
BloodHound
BloodHound.py
Without the above this wrapper was not possible.
License
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
ActiveDirectoryEnum-0.4.8.tar.gz
(61.9 kB
view hashes)
Built Distribution
Close
Hashes for ActiveDirectoryEnum-0.4.8.tar.gz
Algorithm | Hash digest | |
---|---|---|
SHA256 | fc0a031dc61fa0275d2de3e140666bf96f2c300091eb0359b43c17317b90d322 |
|
MD5 | bef982b81229d33a6309e7f3f13a74c1 |
|
BLAKE2b-256 | b4f0556a3279483d9fac57bff5e4c78a12945f9d8123e23f2e3e692e161af40f |
Close
Hashes for ActiveDirectoryEnum-0.4.8-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | c1b91d1cc3f26dae78ded49be319c8be0439eca4e7ccb6afbc848f5bf7a17695 |
|
MD5 | 28eac080c3ca54f782af2b17c9a4ea2d |
|
BLAKE2b-256 | f49337a52859d18120f730a463cfcbad6c8ea0032a0273868a519ab741045ef4 |