Metadata-Version: 2.4
Name: adpentest
Version: 1.1.5
Summary: Active Directory penetration testing framework with automatic Domain Controller detection
Author-email: Netanel Cyber <nsh531@gmail.com>
License: MIT
Project-URL: Homepage, https://github.com/netanelcyber/AdPentestAI-Python
Project-URL: Repository, https://github.com/netanelcyber/AdPentestAI-Python.git
Project-URL: Issues, https://github.com/netanelcyber/AdPentestAI-Python/issues
Project-URL: Documentation, https://github.com/netanelcyber/AdPentestAI-Python/blob/main/README.md
Keywords: active-directory,penetration-testing,ad-enumeration,kerberos,smb,ldap,security,offensive-security,red-team
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: Information Technology
Classifier: Intended Audience :: System Administrators
Classifier: License :: OSI Approved :: MIT License
Classifier: Natural Language :: English
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: System :: Networking
Classifier: Topic :: System :: Systems Administration
Classifier: Topic :: Security
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: httpx<1,>=0.27
Requires-Dist: dnspython<3,>=2.4
Requires-Dist: ldap3<3,>=2.9
Provides-Extra: dev
Requires-Dist: pytest>=7.0; extra == "dev"
Requires-Dist: black>=23.0; extra == "dev"
Requires-Dist: flake8>=6.0; extra == "dev"
Requires-Dist: mypy>=1.0; extra == "dev"
Dynamic: license-file

# AdPentestAI-Python

[![GitHub stars](https://img.shields.io/github/stars/netanelcyber/AdPentestAI-Python?style=flat)](https://github.com/netanelcyber/AdPentestAI-Python/stargazers)
[![GitHub issues](https://img.shields.io/github/issues/netanelcyber/AdPentestAI-Python)](https://github.com/netanelcyber/AdPentestAI-Python/issues)
[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
[![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
[![PyPI](https://img.shields.io/pypi/v/adpentest)](https://pypi.org/project/adpentest/)

**Active Directory penetration testing framework** with automatic Domain Controller detection, multi-threaded tool execution, WAF bypass engine, CVE scanning, and SQLite scan history.

> **For authorized penetration testing only.** Always get explicit written permission before testing any systems.

---

## Table of Contents

- [Quick Start](#quick-start)
- [Features](#features)
- [Installation](#installation)
- [Usage](#usage)
- [CVE Scanners](#cve-scanners)
- [WAF Detection & Bypass](#waf-detection--bypass)
- [Scan History Database](#scan-history-database)
- [DC Detection Strategies](#dc-detection-strategies)
- [Tool Registry](#tool-registry)
- [Email Protocol Enumeration](#email-protocol-enumeration)
- [DNS Configuration](#dns-configuration)
- [Architecture](#architecture)
- [Contributing](#contributing)
- [License](#license)

---

## Quick Start

```bash
pip install adpentest

# Dry-run — preview what would execute, no actual tool runs
adpentest --target 10.0.0.1 --mode dry-run --scope-confirmed

# Active scan with auto DC detection
adpentest --target corp.local --mode active --scope-confirmed

# View scan history
adpentest --history

# View all vulnerable CVE findings
adpentest --cve-report
```

## Features

### Core Capabilities

- **Auto DC Detection** — discovers Domain Controllers via DNS SRV records, LDAP RootDSE probes, port fingerprinting, and subnet sweep
- **Multi-threaded execution** — 16 parallel workers for tool execution, 32 workers for port/DNS/credential tasks (10-15x speedup)
- **35+ AD/SMB/Kerberos/ADCS/Email tools** — cross-platform binary tools + pure Python implementations
- **7 CVE scanners** — automated detection of critical AD vulnerabilities (CVSS 7.5-9.4)
- **WAF detection & bypass** — identifies WAF/CDN vendors and attempts bypass via HTTP spoofing, raw LDAP/Kerberos, TCP fragmentation
- **SQLite scan history** — persistent storage of all scan runs, tool results, and CVE findings
- **Auto-install** — missing tools installed automatically via apt/pip/git
- **Safety** — `dry-run` is the default mode; `--scope-confirmed` required for authorization

### Attack Vectors

| Category | Tools | Description |
|----------|-------|-------------|
| **Reconnaissance** | nmap, masscan, enum4linux-ng, rpcdump, bloodhound-python, ldapdomaindump | Network & AD enumeration |
| **SMB** | smbclient, smbmap, crackmapexec, impacket | Null sessions, share enum, signing detection, credential testing |
| **Kerberos** | GetUserSPNs, AS-REP roast, Kerberoast, kerbrute | SPN enum, ticket extraction, user enumeration |
| **ADCS** | certipy (find, shadow, ESC1, ESC3, ESC9) | Certificate template analysis & exploitation |
| **Email** | SMTP/POP3/IMAP enum & auth testing | User discovery, credential testing, Exchange detection |
| **Privilege Escalation** | ACL scanner, GPO abuse, delegation chain, auto privesc | Permission analysis & escalation paths |
| **Persistence** | Golden/silver ticket, DCshadow, skeleton key, DSRM, SID history | Domain persistence techniques |
| **Coercion & Relay** | PetitPotam, PrinterBug, NTLM relay | Authentication coercion attacks |
| **CVE Scanning** | 7 dedicated scanners | Certighost, ResetNightmare, NTLM bypass, RC4, RPC RCE |

---

## Installation

### From PyPI

```bash
pip install adpentest
```

### From Source

```bash
git clone https://github.com/netanelcyber/AdPentestAI-Python.git
cd AdPentestAI-Python
pip install -e .
```

### Dependencies

| Package | Version | Purpose |
|---------|---------|---------|
| `httpx` | >= 0.27 | HTTP client for EWS/web enumeration |
| `dnspython` | >= 2.4 | DNS resolution with SRV record support |
| `ldap3` | >= 2.9 | LDAP operations (RootDSE, anonymous bind) |

Standard library modules used: `smtplib`, `poplib`, `imaplib`, `socket`, `concurrent.futures`, `subprocess`, `sqlite3`, `json`.

---

## Usage

### Basic Scans

```bash
# Dry-run (check tools, detect DCs, preview commands — no actual execution)
adpentest --target 10.0.0.1 --mode dry-run --scope-confirmed

# Active scan with auto DC detection
adpentest --target corp.local --mode active --scope-confirmed

# Custom timeout and no auto-install of missing tools
adpentest --target 192.168.1.10 --mode active --scope-confirmed --timeout 600 --no-auto-install

# Custom DNS servers
adpentest --target corp.local --mode active --scope-confirmed --dns-server 1.1.1.1,8.8.8.8

# Connect via VPN before scanning
adpentest --target 10.10.10.1 --mode active --scope-confirmed --vpn lab.ovpn
```

### Scan History & Reports

```bash
# Show all past scan runs
adpentest --history

# Show last 5 runs
adpentest --history --history-limit 5

# Show all vulnerable CVE findings across all runs
adpentest --cve-report

# Show details for a specific run
adpentest --run-details run-8824073e5124-20260904055457

# Use custom database path
adpentest --history --db-path /path/to/custom.db
```

### Lab Setup

```bash
# Interactive lab setup orchestrator
adpentest --setup-labs
```

### Output Format

All scan output is JSON:

```json
{
  "status": "completed",
  "run_id": "run-abc123-20260901120000",
  "db_path": "~/.adpentest/scan_history.db",
  "dc_detection": {
    "dc_count": 2,
    "detected_domain": "corp.local",
    "domain_controllers": [...]
  },
  "execution": {
    "result_count": 35,
    "completed": 28,
    "failed": 7
  }
}
```

See [`examples/sample-dry-run-output.json`](examples/sample-dry-run-output.json) for a complete example.

---

## CVE Scanners

The framework includes 7 built-in CVE scanners that run as part of every scan. All scanners are **safe and read-only** — they use port probes, anonymous LDAP queries, and raw protocol checks only.

| CVE | Name | CVSS | Description |
|-----|------|------|-------------|
| CVE-2026-59270 | Spring LDAP | 9.4 | Hardcoded credentials in Spring Security embedded LDAP (UnboundIdContainer) |
| CVE-2026-54121 | Certighost | 8.8 | AD CS enrollment bypass — certificate enrollment for arbitrary computer accounts |
| CVE-2025-54918 | NTLM LDAP Bypass | 8.1 | NTLM authentication bypass on DC LDAP — privilege escalation to SYSTEM |
| CVE-2026-33826 | AD RPC RCE | 8.0 | Windows AD RPC remote code execution via improper input validation |
| CVE-2026-27912 | ResetNightmare | 8.0 | Kerberos kpasswd password reset bypass via UPN collision — full domain takeover |
| CVE-2026-24294 | NTLM Reflection | 7.8 | NTLM reflection via SMB port multiplexing (Server 2025 / Win 11 24H2) |
| CVE-2026-20833 | Kerberos RC4 | 7.5 | KDC accepts RC4-HMAC encryption — enables Kerberoasting attacks |

### What Each Scanner Checks

**CVE-2026-59270** — Attempts LDAP bind with known hardcoded credentials (`uid=admin,ou=system` / `secret`) on ports 389, 636, 53389, 33389, 10389, 8389. Reports exposed entry count.

**CVE-2026-54121** — Queries AD CS Enrollment Services and certificate templates via LDAP. Identifies templates with `ENROLLEE_SUPPLIES_SUBJECT` flag or risky enrollment configurations.

**CVE-2025-54918** — Checks if LDAP accepts NTLM/GSS-SPNEGO authentication without enforced signing. Extracts DC functional level and domain context.

**CVE-2026-33826** — Probes RPC endpoint mapper (port 135), confirms AD DC via LDAP, checks for exposed RPC-related ports (135, 593, 445, 139).

**CVE-2026-27912** — Checks if kpasswd (port 464) and Kerberos (port 88) are open. Queries `ms-DS-MachineAccountQuota` to assess exploitation feasibility.

**CVE-2026-24294** — Sends SMB2 Negotiate to detect protocol version and signing mode. Checks for alternative SMB ports (8445, 9445, etc.) indicating port multiplexing.

**CVE-2026-20833** — Sends raw Kerberos AS-REQ with RC4 (etype 23), AES256 (etype 18), and AES128 (etype 17) to detect which encryption types the KDC accepts.

---

## WAF Detection & Bypass

When scanning targets behind WAF/CDN services, the framework automatically:

1. **Detects WAF vendor** — checks HTTP headers and body content for signatures of 17+ WAF vendors (Incapsula/Imperva, Cloudflare, Akamai, AWS WAF, Azure Front Door, Sucuri, etc.)
2. **Attempts bypass** via 5 technique layers:
   - **HTTP bypass** — header spoofing (X-Forwarded-For, X-Real-IP, CF-Connecting-IP), User-Agent rotation, path obfuscation, verb tampering
   - **Raw LDAP** — BER-encoded LDAPv3 anonymous bind directly to port 389
   - **Raw Kerberos** — AS-REQ with TCP framing to port 88
   - **TCP fragmentation** — 1 byte per TCP segment with TCP_NODELAY
   - **Email/HTTP** — OWA, EWS NTLM handshake, Autodiscover, ActiveSync, MAPI probing

If raw LDAP or Kerberos bypasses the WAF, the framework extracts domain info and adjusts DC detection confidence accordingly.

---

## Scan History Database

All scan data is automatically stored in SQLite at `~/.adpentest/scan_history.db`.

### Database Schema

**`scan_runs`** — One row per scan execution:
- `run_id`, `target`, `mode`, `started_at`, `finished_at`, `status`
- `dc_count`, `live_hosts`, `tools_executed`, `tools_succeeded`, `tools_failed`
- `cves_checked`, `cves_vulnerable`

**`tool_results`** — One row per tool execution:
- `tool`, `host`, `is_dc`, `fqdn`, `status`, `duration_sec`, `output`, `error`

**`cve_findings`** — One row per CVE check:
- `cve_id`, `target`, `cvss`, `severity`, `vulnerable`, `impact`, `details_json`

### Querying Directly

```bash
# Open the database
sqlite3 ~/.adpentest/scan_history.db

# All vulnerable findings
SELECT cve_id, target, cvss, severity, impact FROM cve_findings WHERE vulnerable=1 ORDER BY cvss DESC;

# Scan history summary
SELECT run_id, target, mode, status, tools_executed, cves_vulnerable, started_at FROM scan_runs ORDER BY started_at DESC;

# Tool success rate
SELECT tool, COUNT(*) as runs, SUM(CASE WHEN status='completed' THEN 1 ELSE 0 END) as ok FROM tool_results GROUP BY tool ORDER BY runs DESC;
```

---

## DC Detection Strategies

The framework uses a multi-strategy pipeline to discover Domain Controllers:

| Strategy | Method | Confidence |
|----------|--------|------------|
| DNS SRV | Queries `_ldap._tcp.dc._msdcs.<domain>` | High (0.9) |
| LDAP RootDSE | Anonymous bind to extract domain/forest info | High (0.9) |
| Port fingerprint | Checks Kerberos (88), LDAP (389/636), GC (3268/3269) | Medium (0.7) |
| Subnet sweep | Kerberos port 88 scan on /24 → /23 → /22 | Medium (0.6) |

When WAF is detected blocking ports, the bypass engine runs automatically. If raw LDAP/Kerberos bypasses succeed, confidence is adjusted to 0.7 ("waf-bypassed"); otherwise 0.1 ("waf-blocked").

---

## Tool Registry

### Available Tools (35+)

**Binary tools:** nmap, masscan, enum4linux-ng, rpcdump, smbclient, bloodhound-python, certipy, ldapdomaindump, kerbrute, crackmapexec, smbmap, impacket (secretsdump, psexec)

**Windows-native:** powershell_ldap_enum, powershell_smb_enum, powershell_ad_recon

**Kerberos:** GetUserSPNs, AS_REP_roast, kerberoast

**ADCS:** certipy_shadow, certipy_esc1, certipy_esc3, certipy_esc9

**Email:** smtp_enum, smtp_auth_test, pop3_auth_test, imap_auth_test, email_server_discovery

**Exploitation:** ntlm_null_session, auto_privesc, golden_ticket, silver_ticket, delegation_abuse, trust_enumeration, trust_abuse, petitpotam, printerbug, ntlm_relay, acl_scanner, acl_exploit, gpo_abuse, delegation_chain, sid_history, dsrm_backdoor, dcshadow, golden_gmsa, skeleton_key

**CVE scanners:** cve_2026_59270, cve_2026_54121, cve_2025_54918, cve_2026_33826, cve_2026_27912, cve_2026_24294, cve_2026_20833

---

## Email Protocol Enumeration

Pure Python email enumeration using standard library (no external dependencies):

- **SMTP VRFY** — discover valid usernames via VRFY command
- **SMTP RCPT TO** — validate recipients via RCPT TO
- **Credential testing** — automatic fallback chain: SMTP → POP3 → IMAP
- **Exchange detection** — OWA, EWS NTLM handshake (extracts domain/DC/forest from NTLM challenge), Autodiscover, ActiveSync, MAPI
- **Parallel testing** — 32 concurrent workers for credential testing

Ports scanned: 25, 465, 587 (SMTP), 110, 995 (POP3), 143, 993 (IMAP).

---

## DNS Configuration

### Priority Order

1. **CLI arguments** (`--dns-server`, `--dns-timeout`) — highest priority
2. **Environment variables** (`DNS_SERVERS`, `DNS_TIMEOUT`)
3. **System default DNS** — auto-detected
4. **Public DNS fallback** — Google (8.8.8.8, 8.8.4.4), Cloudflare (1.1.1.1, 1.0.0.1)

```bash
# CLI
adpentest --target corp.local --mode active --scope-confirmed --dns-server 192.168.1.1,8.8.8.8 --dns-timeout 5.0

# Environment
export DNS_SERVERS=192.168.1.1,1.1.1.1
export DNS_TIMEOUT=5.0
adpentest --target corp.local --mode active --scope-confirmed
```

---

## Architecture

### Single-File Design

All framework logic is in `adpentest/core.py`. This monolithic approach provides clear dependency flow, centralized tool registry, unified error handling, and easy deployment.

### Execution Pipeline

```
Input: --target 10.0.0.1 --mode active --scope-confirmed
  │
  ├── Scope validation (dry-run vs active)
  ├── Tool discovery (scan $PATH)
  ├── SQLite run initialization
  │
  ├── DC Detection (multi-strategy)
  │   ├── DNS SRV queries
  │   ├── LDAP RootDSE probe
  │   ├── Port fingerprint (+ WAF detect/bypass)
  │   └── Subnet sweep (/24 → /23 → /22)
  │
  ├── Domain discovery + FQDN resolution
  ├── Email server discovery (MX + port scan)
  │
  ├── Parallel Tool Execution (ThreadPoolExecutor, 16 workers)
  │   ├── AD tools against DCs (prioritized)
  │   ├── CVE scanners against all targets
  │   └── Results → SQLite (tool_results + cve_findings)
  │
  └── Output: JSON + SQLite database
```

### Threading Model

| Pool | Workers | Purpose |
|------|---------|---------|
| Tool execution | 16 | AD diagnostic tools in parallel |
| Port scanning | 32 | Concurrent TCP port checks |
| DNS resolution | 32 | Concurrent DNS queries |
| Credential testing | 32 | SMTP/POP3/IMAP auth testing |

---

## Contributing

Contributions are welcome! See [CONTRIBUTING.md](CONTRIBUTING.md) for setup instructions and [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) for community guidelines.

Check the [open issues](https://github.com/netanelcyber/AdPentestAI-Python/issues) for tasks labeled `good-first-issue` or `help-wanted`.

### Adding a New CVE Scanner

1. Add scanner function `scan_cve_YYYY_NNNNN(target, timeout)` returning a dict with `cve`, `cvss`, `severity`, `vulnerable`, `impact`, `remediation`
2. Add tool name `cve_YYYY_NNNNN_short_name` to `AD_TOOLS` set
3. Add to `PIP_PACKAGES` (empty list for pure Python)
4. Add to `EXECUTABLES` (python3/python/python.exe)
5. Add `build_ad_command` handler

### Adding a New Tool

1. Add tool name to `AD_TOOLS` set
2. Add package mapping to `PIP_PACKAGES`/`APT_PACKAGES`/`WINGET_PACKAGES`
3. Add executable names to `EXECUTABLES` dict
4. Implement command building in `build_ad_command()`

---

## License

[MIT](LICENSE)

---

**Disclaimer:** This tool is designed for authorized penetration testing and security research only. Users are responsible for obtaining proper authorization before testing any systems. The authors assume no liability for misuse.
