DEV Community: Puma

Cracking WMI-exec in Rust by turning impacket into a byte-level oracle

Puma — Mon, 03 Aug 2026 06:36:58 +0000

How I implemented wmiexec from scratch in Rust — DCOM activation, OXID resolution, and MS-WMIO object marshaling — by using impacket not as a library but as a debugging oracle, and diffing my wire bytes against it until a Windows DC accepted them byte-for-byte.

This is a build log from ADhammer, an Active Directory audit + validation toolkit I'm writing in Rust on a from-scratch DCE/RPC · NTLM · SMB2 · Kerberos stack (think "impacket for Rust"). The whole project is built with Claude Code, and this post is the single best example of what that actually looks like — not autocomplete, but a tight loop of hypothesis → capture live traffic → diff → fix against a real domain controller.

The goal: wmiexec, from scratch
wmiexec is the classic "quiet" remote-code-execution technique: instead of creating a service (psexec/SVCCTL) or a scheduled task (atexec), you talk to WMI over DCOM and call Win32_Process.Create. No service-install event, different host telemetry.

Under the hood it's three stages, each a different flavour of pain:

ADhammer: a full Active Directory pentest tool in Rust

Puma — Fri, 31 Jul 2026 08:19:37 +0000

Full AD pentest + audit tool in Rust, single static binary. Whole DCE/RPC · NTLM · SMB2 · Kerberos stack written from scratch (no impacket) — split into 4 reusable MIT crates on crates.io. Audits a domain (control-path graph, 10/16 AD CS ESC classes, MITRE-tagged) and validates findings end-to-end: DCSync, golden/silver tickets, pass-the-ticket to SYSTEM, LAPS, WinRM, ADCS. Live-validated against a fully-patched Windows Server 2025 DC. MIT, v1.1.0.

github.com/icedracon/adhammer

ECHO — a living pixel companion on your taskbar: he fights demons from your screen edge, plays guitar at midnight, and learns your rhythm

Puma — Fri, 31 Jul 2026 08:17:37 +0000

A pixel-art companion who lives on your Windows taskbar. Two heroes: Corvin the silent Warden (voiced 100-chapter story, midnight guitar, and a daily boss fight where a demon literally walks out of your screen edge) and Dante the demon hunter (Devil Trigger, flaming sword, espresso and doomscrolling). He reacts to your games, music and typing, plays big scenes on a living schedule, and a local learning "director" adapts him to you. Zero network calls, zero telemetry, one exe.

icedracon / ECHO

ECHO — живой пиксельный компаньон для твоего рабочего стола

Он живёт на панели задач Windows и сам реагирует на твою жизнь за компьютером: работаешь — он рядом, запустил игру — он дерётся, включил музыку — он играет с тобой, ушёл ночью — он засыпает. Лёгкий (~45 МБ памяти), ничего не отправляет в интернет, работает полностью локально.

Установка — один клик

Скачай своего героя со страницы загрузок:

Файл	Кто это
🦅 Echo-Corvin.exe	Корвин — молчаливый Страж с белым орлом. Рассказывает истории своим голосом, играет на гитаре в полночь, дерётся с тем, что лезет из-за Двери
🔴 Echo-Dante.exe	Данте — охотник на демонов: Devil Trigger, огненный меч, пицца и танцы
⚪ ECHO.exe	Оба в одном — переключайся когда хочешь

Запусти. Всё. Он выйдет на панель и начнёт жить.

Windows может спросить «запустить неизвестное приложение?» — жми «Подробнее → Выполнить в любом случае». Код открыт, проверить можно прямо здесь.

Управление — мышкой

…

View on GitHub

I built a full Active Directory pentest + audit tool in Rust — on a protocol stack I wrote from scratch (no impacket)

Puma — Wed, 29 Jul 2026 15:52:49 +0000

A single Rust binary that audits an Active Directory domain like PingCastle — and, for authorized red teams, proves each finding by actually running the attack. On a DCE/RPC · NTLM · SMB2 · Kerberos stack I wrote from scratch, because there's no impacket for Rust.

The itch

Two tools own Active Directory security work, and neither is Rust. PingCastle audits beautifully but is Windows/.NET and read-only. impacket has the offensive protocol stack but is Python and offense-only. I wanted one Linux-native binary that does both — and I wanted to actually understand Kerberos/DCE-RPC/NTLM instead of importing someone else's library. So I wrote the stack from the wire up.

The result is ADhammer.

Show Image

What it does — audit, then prove it

Audit. Collect the domain over LDAP as a low-privileged user (via the SD_FLAGS control), build a BloodHound-style control-path graph in-process, and run 33 checks across the four PingCastle categories — including 10 of the 16 AD CS ESC classes, ADIDNS exposure, and SYSVOL/GPP. Every finding is scored, MITRE ATT&CK-tagged, and exportable to BloodHound.
Validate. A report shouldn't say a path might be exploitable. ADhammer implements the matching tradecraft — Kerberos roasting, DCSync, golden/silver tickets, pass-the-ticket, LAPS/gMSA read, WinRM & SVCCTL exec, ADCS enrollment — each live-validated against a fully-patched Windows Server 2025 DC.

The part I'm proud of: the protocol stack is from scratch
No impacket. No .NET. The whole DCE/RPC · NTLM · SMB2 · Kerberos layer is hand-rolled from the Microsoft open specs — NDR marshaling, NTLMv2 sign+seal, the MS-PAC PAC marshaler, PKINIT — each primitive unit-tested against spec vectors. It's published as four reusable MIT crates that didn't exist in Rust before:

windows-sddl — no-FFI SECURITY_DESCRIPTOR/DACL/ACE parser + Sid/Guid
ntlmssp — NTLMv2 + RC4 sign+seal (RPC packet privacy)
smb2-client — async SMB2 (negotiate → SPNEGO → pipes, signing)
dcerpc — NDR · PDUs · EPM · SAMR · LSAT · DRSUAPI · SVCCTL · ICPR · …
Interactive, so you don't juggle 20 flags
Run adhammer with no arguments: a wizard asks user → password (or NT hash) → domain → DC, then walks every action with prompts. For golden/silver/pass-the-ticket it auto-fetches the krbtgt/service AES256 key (via DCSync) and the domain SID (via LSAT) from your session — no pasting keys or SIDs.

Show Image

The money demo: a golden ticket a patched Server 2025 accepts
"Golden tickets are dead on patched DCs." Not quite — a correctly forged one is still accepted. What changed is the PAC bar: KB5020805 makes PAC_REQUESTOR / PAC_ATTRIBUTES mandatory, and most from-scratch forgers omit them. ADhammer builds the PAC from scratch with them, signs it with the AES256 checksum, and a fully-patched 2025 KDC accepts the forged Domain-Admin TGT → pass-the-ticket over SMB → NT AUTHORITY\SYSTEM, run from Kali.

I wrote up exactly how the 2025 PAC enforcement works (and the RC4-golden-accepted-but-service-ticket-refused asymmetry) here → Forging a golden ticket for a patched Server 2025 KDC.

Try it
cargo install adhammer

audit a domain (low-priv creds are enough) + export a BloodHound graph

adhammer scan --url ldaps://dc:636 --user 'CORP\svc' --password … --insecure --bloodhound out.zip
Or grab the prebuilt binary from the v1.1.0 release. Rust 1.80+, runs from Kali/Linux or Windows.

Authorized use only
The validation modules are real offensive techniques (DCSync, ticket forging, relay, RCE). ADhammer is for systems you own or are explicitly authorized to test — authorized engagements, red-team validation, and education. MIT-licensed; built as security research at ITMO, sibling to a Windows kernel 0-day I disclosed to Microsoft MSRC.

⭐ Repo: https://github.com/icedracon/adhammer — feedback and issues welcome.