AdPentestAI-Python

Active Directory penetration testing framework with automatic Domain Controller detection, multi-threaded tool execution, WAF bypass engine, CVE scanning, and SQLite scan history.

For authorized penetration testing only. Always get explicit written permission before testing any systems.

---

Table of Contents

• Quick Start
• Features
• Installation
• Usage
• CVE Scanners
• WAF Detection & Bypass
• Scan History Database
• DC Detection Strategies
• Tool Registry
• Email Protocol Enumeration
• DNS Configuration
• Architecture
• Contributing
• License

---

Quick Start

pip install adpentest

# Dry-run — preview what would execute, no actual tool runs
adpentest --target 10.0.0.1 --mode dry-run --scope-confirmed

# Active scan with auto DC detection
adpentest --target corp.local --mode active --scope-confirmed

# View scan history
adpentest --history

# View all vulnerable CVE findings
adpentest --cve-report

Features

Core Capabilities

• Auto DC Detection — discovers Domain Controllers via DNS SRV records, LDAP RootDSE probes, port fingerprinting, and subnet sweep
• Multi-threaded execution — 16 parallel workers for tool execution, 32 workers for port/DNS/credential tasks (10-15x speedup)
• 35+ AD/SMB/Kerberos/ADCS/Email tools — cross-platform binary tools + pure Python implementations
• 7 CVE scanners — automated detection of critical AD vulnerabilities (CVSS 7.5-9.4)
• WAF detection & bypass — identifies WAF/CDN vendors and attempts bypass via HTTP spoofing, raw LDAP/Kerberos, TCP fragmentation
• SQLite scan history — persistent storage of all scan runs, tool results, and CVE findings
• Auto-install — missing tools installed automatically via apt/pip/git
• Safety — dry-run is the default mode; --scope-confirmed required for authorization

Attack Vectors

Category	Tools	Description
Reconnaissance	nmap, masscan, enum4linux-ng, rpcdump, bloodhound-python, ldapdomaindump	Network & AD enumeration
SMB	smbclient, smbmap, crackmapexec, impacket	Null sessions, share enum, signing detection, credential testing
Kerberos	GetUserSPNs, AS-REP roast, Kerberoast, kerbrute	SPN enum, ticket extraction, user enumeration
ADCS	certipy (find, shadow, ESC1, ESC3, ESC9)	Certificate template analysis & exploitation
Email	SMTP/POP3/IMAP enum & auth testing	User discovery, credential testing, Exchange detection
Privilege Escalation	ACL scanner, GPO abuse, delegation chain, auto privesc	Permission analysis & escalation paths
Persistence	Golden/silver ticket, DCshadow, skeleton key, DSRM, SID history	Domain persistence techniques
Coercion & Relay	PetitPotam, PrinterBug, NTLM relay	Authentication coercion attacks
CVE Scanning	7 dedicated scanners	Certighost, ResetNightmare, NTLM bypass, RC4, RPC RCE

---

Installation

From PyPI

pip install adpentest

From Source

git clone https://github.com/netanelcyber/AdPentestAI-Python.git
cd AdPentestAI-Python
pip install -e .

Dependencies

Package	Version	Purpose
httpx	>= 0.27	HTTP client for EWS/web enumeration
dnspython	>= 2.4	DNS resolution with SRV record support
ldap3	>= 2.9	LDAP operations (RootDSE, anonymous bind)

Standard library modules used: smtplib, poplib, imaplib, socket, concurrent.futures, subprocess, sqlite3, json.

---

Usage

Basic Scans

# Dry-run (check tools, detect DCs, preview commands — no actual execution)
adpentest --target 10.0.0.1 --mode dry-run --scope-confirmed

# Active scan with auto DC detection
adpentest --target corp.local --mode active --scope-confirmed

# Custom timeout and no auto-install of missing tools
adpentest --target 192.168.1.10 --mode active --scope-confirmed --timeout 600 --no-auto-install

# Custom DNS servers
adpentest --target corp.local --mode active --scope-confirmed --dns-server 1.1.1.1,8.8.8.8

# Connect via VPN before scanning
adpentest --target 10.10.10.1 --mode active --scope-confirmed --vpn lab.ovpn

Scan History & Reports

# Show all past scan runs
adpentest --history

# Show last 5 runs
adpentest --history --history-limit 5

# Show all vulnerable CVE findings across all runs
adpentest --cve-report

# Show details for a specific run
adpentest --run-details run-8824073e5124-20260904055457

# Use custom database path
adpentest --history --db-path /path/to/custom.db

Lab Setup

# Interactive lab setup orchestrator
adpentest --setup-labs

Output Format

All scan output is JSON:

{
  "status": "completed",
  "run_id": "run-abc123-20260901120000",
  "db_path": "~/.adpentest/scan_history.db",
  "dc_detection": {
    "dc_count": 2,
    "detected_domain": "corp.local",
    "domain_controllers": [...]
  },
  "execution": {
    "result_count": 35,
    "completed": 28,
    "failed": 7
  }
}

See examples/sample-dry-run-output.json for a complete example.

---

CVE Scanners

The framework includes 7 built-in CVE scanners that run as part of every scan. All scanners are safe and read-only — they use port probes, anonymous LDAP queries, and raw protocol checks only.

CVE	Name	CVSS	Description
CVE-2026-59270	Spring LDAP	9.4	Hardcoded credentials in Spring Security embedded LDAP (UnboundIdContainer)
CVE-2026-54121	Certighost	8.8	AD CS enrollment bypass — certificate enrollment for arbitrary computer accounts
CVE-2025-54918	NTLM LDAP Bypass	8.1	NTLM authentication bypass on DC LDAP — privilege escalation to SYSTEM
CVE-2026-33826	AD RPC RCE	8.0	Windows AD RPC remote code execution via improper input validation
CVE-2026-27912	ResetNightmare	8.0	Kerberos kpasswd password reset bypass via UPN collision — full domain takeover
CVE-2026-24294	NTLM Reflection	7.8	NTLM reflection via SMB port multiplexing (Server 2025 / Win 11 24H2)
CVE-2026-20833	Kerberos RC4	7.5	KDC accepts RC4-HMAC encryption — enables Kerberoasting attacks

What Each Scanner Checks

CVE-2026-59270 — Attempts LDAP bind with known hardcoded credentials (uid=admin,ou=system / secret) on ports 389, 636, 53389, 33389, 10389, 8389. Reports exposed entry count.

CVE-2026-54121 — Queries AD CS Enrollment Services and certificate templates via LDAP. Identifies templates with ENROLLEE_SUPPLIES_SUBJECT flag or risky enrollment configurations.

CVE-2025-54918 — Checks if LDAP accepts NTLM/GSS-SPNEGO authentication without enforced signing. Extracts DC functional level and domain context.

CVE-2026-33826 — Probes RPC endpoint mapper (port 135), confirms AD DC via LDAP, checks for exposed RPC-related ports (135, 593, 445, 139).

CVE-2026-27912 — Checks if kpasswd (port 464) and Kerberos (port 88) are open. Queries ms-DS-MachineAccountQuota to assess exploitation feasibility.

CVE-2026-24294 — Sends SMB2 Negotiate to detect protocol version and signing mode. Checks for alternative SMB ports (8445, 9445, etc.) indicating port multiplexing.

CVE-2026-20833 — Sends raw Kerberos AS-REQ with RC4 (etype 23), AES256 (etype 18), and AES128 (etype 17) to detect which encryption types the KDC accepts.

---

WAF Detection & Bypass

When scanning targets behind WAF/CDN services, the framework automatically:

1. Detects WAF vendor — checks HTTP headers and body content for signatures of 17+ WAF vendors (Incapsula/Imperva, Cloudflare, Akamai, AWS WAF, Azure Front Door, Sucuri, etc.)
2. Attempts bypass via 5 technique layers:
   • HTTP bypass — header spoofing (X-Forwarded-For, X-Real-IP, CF-Connecting-IP), User-Agent rotation, path obfuscation, verb tampering
   • Raw LDAP — BER-encoded LDAPv3 anonymous bind directly to port 389
   • Raw Kerberos — AS-REQ with TCP framing to port 88
   • TCP fragmentation — 1 byte per TCP segment with TCP_NODELAY
   • Email/HTTP — OWA, EWS NTLM handshake, Autodiscover, ActiveSync, MAPI probing

If raw LDAP or Kerberos bypasses the WAF, the framework extracts domain info and adjusts DC detection confidence accordingly.

---

Scan History Database

All scan data is automatically stored in SQLite at ~/.adpentest/scan_history.db.

Database Schema

scan_runs — One row per scan execution:

• run_id, target, mode, started_at, finished_at, status
• dc_count, live_hosts, tools_executed, tools_succeeded, tools_failed
• cves_checked, cves_vulnerable

tool_results — One row per tool execution:

• tool, host, is_dc, fqdn, status, duration_sec, output, error

cve_findings — One row per CVE check:

• cve_id, target, cvss, severity, vulnerable, impact, details_json

Querying Directly

# Open the database
sqlite3 ~/.adpentest/scan_history.db

# All vulnerable findings
SELECT cve_id, target, cvss, severity, impact FROM cve_findings WHERE vulnerable=1 ORDER BY cvss DESC;

# Scan history summary
SELECT run_id, target, mode, status, tools_executed, cves_vulnerable, started_at FROM scan_runs ORDER BY started_at DESC;

# Tool success rate
SELECT tool, COUNT(*) as runs, SUM(CASE WHEN status='completed' THEN 1 ELSE 0 END) as ok FROM tool_results GROUP BY tool ORDER BY runs DESC;

---

DC Detection Strategies

The framework uses a multi-strategy pipeline to discover Domain Controllers:

Strategy	Method	Confidence
DNS SRV	Queries _ldap._tcp.dc._msdcs.<domain>	High (0.9)
LDAP RootDSE	Anonymous bind to extract domain/forest info	High (0.9)
Port fingerprint	Checks Kerberos (88), LDAP (389/636), GC (3268/3269)	Medium (0.7)
Subnet sweep	Kerberos port 88 scan on /24 → /23 → /22	Medium (0.6)

When WAF is detected blocking ports, the bypass engine runs automatically. If raw LDAP/Kerberos bypasses succeed, confidence is adjusted to 0.7 ("waf-bypassed"); otherwise 0.1 ("waf-blocked").

---

Tool Registry

Available Tools (35+)

Binary tools: nmap, masscan, enum4linux-ng, rpcdump, smbclient, bloodhound-python, certipy, ldapdomaindump, kerbrute, crackmapexec, smbmap, impacket (secretsdump, psexec)

Windows-native: powershell_ldap_enum, powershell_smb_enum, powershell_ad_recon

Kerberos: GetUserSPNs, AS_REP_roast, kerberoast

ADCS: certipy_shadow, certipy_esc1, certipy_esc3, certipy_esc9

Email: smtp_enum, smtp_auth_test, pop3_auth_test, imap_auth_test, email_server_discovery

Exploitation: ntlm_null_session, auto_privesc, golden_ticket, silver_ticket, delegation_abuse, trust_enumeration, trust_abuse, petitpotam, printerbug, ntlm_relay, acl_scanner, acl_exploit, gpo_abuse, delegation_chain, sid_history, dsrm_backdoor, dcshadow, golden_gmsa, skeleton_key

CVE scanners: cve_2026_59270, cve_2026_54121, cve_2025_54918, cve_2026_33826, cve_2026_27912, cve_2026_24294, cve_2026_20833

---

Email Protocol Enumeration

Pure Python email enumeration using standard library (no external dependencies):

• SMTP VRFY — discover valid usernames via VRFY command
• SMTP RCPT TO — validate recipients via RCPT TO
• Credential testing — automatic fallback chain: SMTP → POP3 → IMAP
• Exchange detection — OWA, EWS NTLM handshake (extracts domain/DC/forest from NTLM challenge), Autodiscover, ActiveSync, MAPI
• Parallel testing — 32 concurrent workers for credential testing

Ports scanned: 25, 465, 587 (SMTP), 110, 995 (POP3), 143, 993 (IMAP).

---

DNS Configuration

Priority Order

1. CLI arguments (--dns-server, --dns-timeout) — highest priority
2. Environment variables (DNS_SERVERS, DNS_TIMEOUT)
3. System default DNS — auto-detected
4. Public DNS fallback — Google (8.8.8.8, 8.8.4.4), Cloudflare (1.1.1.1, 1.0.0.1)

# CLI
adpentest --target corp.local --mode active --scope-confirmed --dns-server 192.168.1.1,8.8.8.8 --dns-timeout 5.0

# Environment
export DNS_SERVERS=192.168.1.1,1.1.1.1
export DNS_TIMEOUT=5.0
adpentest --target corp.local --mode active --scope-confirmed

---

Architecture

Single-File Design

All framework logic is in adpentest/core.py. This monolithic approach provides clear dependency flow, centralized tool registry, unified error handling, and easy deployment.

Execution Pipeline

Input: --target 10.0.0.1 --mode active --scope-confirmed
  │
  ├── Scope validation (dry-run vs active)
  ├── Tool discovery (scan $PATH)
  ├── SQLite run initialization
  │
  ├── DC Detection (multi-strategy)
  │   ├── DNS SRV queries
  │   ├── LDAP RootDSE probe
  │   ├── Port fingerprint (+ WAF detect/bypass)
  │   └── Subnet sweep (/24 → /23 → /22)
  │
  ├── Domain discovery + FQDN resolution
  ├── Email server discovery (MX + port scan)
  │
  ├── Parallel Tool Execution (ThreadPoolExecutor, 16 workers)
  │   ├── AD tools against DCs (prioritized)
  │   ├── CVE scanners against all targets
  │   └── Results → SQLite (tool_results + cve_findings)
  │
  └── Output: JSON + SQLite database

Threading Model

Pool	Workers	Purpose
Tool execution	16	AD diagnostic tools in parallel
Port scanning	32	Concurrent TCP port checks
DNS resolution	32	Concurrent DNS queries
Credential testing	32	SMTP/POP3/IMAP auth testing

---

Contributing

Contributions are welcome! See CONTRIBUTING.md for setup instructions and CODE_OF_CONDUCT.md for community guidelines.

Check the open issues for tasks labeled good-first-issue or help-wanted.

Adding a New CVE Scanner

1. Add scanner function scan_cve_YYYY_NNNNN(target, timeout) returning a dict with cve, cvss, severity, vulnerable, impact, remediation
2. Add tool name cve_YYYY_NNNNN_short_name to AD_TOOLS set
3. Add to PIP_PACKAGES (empty list for pure Python)
4. Add to EXECUTABLES (python3/python/python.exe)
5. Add build_ad_command handler

Adding a New Tool

1. Add tool name to AD_TOOLS set
2. Add package mapping to PIP_PACKAGES/APT_PACKAGES/WINGET_PACKAGES
3. Add executable names to EXECUTABLES dict
4. Implement command building in build_ad_command()

---

License

MIT

---

Disclaimer: This tool is designed for authorized penetration testing and security research only. Users are responsible for obtaining proper authorization before testing any systems. The authors assume no liability for misuse.