DEV Community: Puma

Building adhammer — a from-scratch AD security toolkit in Rust

Puma — Sat, 22 Aug 2026 19:09:56 +0000

adhammer is a Rust Active Directory security toolkit — one binary that scans a domain for misconfigurations, exercises the real exploitation primitives against them, and prints receipts you can hand to a customer.

The whole thing sits on a from-scratch protocol stack: DCE/RPC, NTLM, SMB2, Kerberos, DRSUAPI, MS-CRTD, MS-ICPR, and 40+ MS-* sibling crates. No wrappers around other languages' libraries, no shelling out. Ripgrep-scale dependency tree — most crates ship with five to eight direct deps.

What you can actually do with it
Five top-level verbs. Each does one thing.

scan — collects the domain over LDAP, feeds it to a rule engine with 41 checks, spits out an HTML or JSON report. Findings score by real blast radius (DcsyncPath, UnconstrainedDelegation, KerberoastableAdmin, PasswordNotRequired, PreWindows2000Compat, RbcdConfigured, ADCS ESC1/6/7/8/10/11/15/16 template rules, and more).

adhammer scan --url ldaps://dc.corp.local:636 \
--user auditor \
--password '@file:/tmp/pw' \
--out audit.html
attack — the active side. Every one is a real primitive, not a detector:

coerce — PetitPotam / PrinterBug / DFSCoerce / ShadowyCoerce (typed enum picks the pipe)
relay — SMB → LDAP (RBCD, Shadow Cred) or AD CS HTTP (ESC8) or ICPR (ESC11)
dcsync — GetNCChanges over a sealed DRSUAPI session, single target or --all
roast — Kerberoasting + AS-REP roasting, AES etype accepted
golden / silver — forge TGT/service tickets from a krbtgt/service key
ptt — pass-the-ticket via S4U2Self / S4U2Proxy → AP-REQ over SMB → exec
shadowcred — add msDS-KeyCredentialLink → PKINIT for the target account
pkinit — take a Shadow Cred key .pem, get a TGT
esc1 / esc4 / icpr-esc1 — AD CS abuse (enrol as another principal)
dcshadow --prep / --cleanup — rogue nTDSDSA registration (LDAP path, Server 2016)
abuse — LDAP writes: add-spn, add-member, set-password, write-rbcd, add-keycred
zerologon — CVE-2020-1472 (detect-only by default, --exploit is opt-in)
badsuccessor — CVE-2024-15671 dMSA takeover (Server 2025)
exec / wmiexec / atexec / winrm — post-auth command execution
poison — LLMNR / NBT-NS / mDNS name poisoning
enum — recon that doesn't require replication rights:

sessions — MS-SRVS NetrSessionEnum
wkssvc — MS-WKST NetrWkstaUserEnum
hku — remote registry HKU walk → logged-on SIDs (often works without local admin)
samr — user / group enum + local group membership on any DC or member
posture — relay-enabler surface (SMB signing, LDAP channel binding, EPA)
esc — AD CS ESC6/7/10/11/16 registry probes over MS-RRP
dns — AD-integrated DNS zone dump
net — network sweep across a /24
check — targeted rule packs (adcs, posture) that don't need a full collection pass.

dump — offline artifact extraction: laps, gmsa, secretsdump (SAM / SECURITY / SYSTEM hives).

Design principles worth stating
Nothing sensitive goes on argv. Every --password resolves through a four-tier cascade:

fn resolve_secret(argv_value: &str, env_key: &str) -> Result {
// 1. --password @file:/path/to/pw
if let Some(path) = argv_value.strip_prefix("@file:") {
let raw = std::fs::read_to_string(path)
.with_context(|| format!("read password file {path}"))?;
return Ok(raw.trim_end_matches(['\n', '\r']).to_string());
}
// 2. literal (backward compat, still leaky)
if !argv_value.is_empty() { return Ok(argv_value.to_string()); }
// 3. $ADHAMMER_PASSWORD env var
if let Ok(v) = std::env::var(env_key) {
if !v.is_empty() { return Ok(v); }
}
// 4. interactive echo-off prompt (when stdin is a TTY)
use std::io::IsTerminal;
if std::io::stdin().is_terminal() {
let pw = dialoguer::Password::new()
.with_prompt(format!("password (or set {env_key})"))
.interact()?;
return Ok(pw);
}
Ok(String::new())
}
Applies to every attack handler and every session-hunt enum. Uses dialoguer::Password — no new dep, no rpassword, no re-implementing termios.

Bulk destructive actions gate on --yes. attack dcsync --all and attack samr --dump-secrets refuse to run on a TTY without --yes, and both accept --limit N to bound blast radius during a run. Non-TTY (CI) proceeds without the gate.

Every wire decoder preflights its allocations. Any Vec::with_capacity(n) where n comes off the wire goes through:

let count = read_u32(d)? as usize;
if count.checked_mul(ENTRY_SIZE).map_or(true, |need| need > d.remaining()) {
return Err(RpcError::Protocol("count exceeds remaining buffer"));
}
let mut items = Vec::with_capacity(count);
checked_mul catches u32::MAX * 12 overflow; .map_or(true, …) treats overflow as an over-allocation and rejects. Hostile inputs never reach the allocator.

Clap rejects nonsense at parse time. Subcommands like attack coerce, attack abuse, attack relay take typed enums for their action selector, not free-form strings:

$ adhammer attack coerce --pipe totallybogus …
error: invalid value 'totallybogus' for '--pipe '
[possible values: spoolss, lsarpc, efsrpc, netdfs, fssagentrpc]
Old free-form-string versions would open an SMB connection, negotiate DCERPC, then bail on the pipe name. Wasted round trips + a confusing error you had to read past three layers of RPC noise to find.

Session file is DPAPI-encrypted on Windows. On Unix it's O_CREAT|O_EXCL + mode 0o600 in one syscall — no umask window. Where DPAPI is unavailable the tool refuses to write in cleartext unless you opt in with ADHAMMER_ALLOW_PLAIN_SESSION=1.

Global --json envelope on every attack / enum / dump subcommand. Output pipes cleanly into jq and CI. scan emits JSON by default with --out report.json, or --out report.html for human review.

MIT. No telemetry. Never phones home.

Architecture
12-crate workspace + 43 sibling protocol crates published under icedracon on crates.io.

adhammer/
├── cli/ — clap CLI, subcommands
├── crates/
│ ├── core/ — Finding, Severity, shared types
│ ├── collector/ — LDAP collection (ldap3)
│ ├── checks/ — 41 security-check rules
│ ├── graph/ — petgraph control-path chains
│ ├── kerberos/ — roasting, ticket forging
│ ├── report/ — HTML + JSON report generation
│ ├── sysvol/ — GPO / GPP / registry-pol parsing
│ ├── ldap/ — LDAP helper extensions
│ ├── bloodhound/ — BloodHound-CE JSON export
│ ├── secrets/ — SAM / SECURITY / LSA / LAPS / gMSA
│ └── sdk/ — one-import facade over all sub-crates
The 43 published sibling crates group into:

Wire foundation (5) — dcerpc, ntlmssp, smb2-client, windows-sddl, ms-ndr
MS- protocol clients (18)* — ms-drsr, ms-icpr, ms-crtd, ms-csra, ms-gkdi, ms-pkca, ms-pac-forge, ms-dnsp, ms-tsch, ms-lsat, ms-coerce, samr, ms-nrpc, ms-tds, ms-kile-fast, ms-even6, ms-fve, ms-rodc
Auth / crypto / ACL (5) — credssp, dpapi-ng, dpapi-offline, ad-acl, msldap-ext
Offensive extras (5) — gpo-forge, preg, llmnr-poison, ntlm-relay, winrm-pentest
Offline / DFIR (3) — ese-parser, ntds-parse, lsass-parse
Windows platform wrappers (6) — windows-token, windows-scm, windows-lsa, windows-wmi-com, windows-sspi-shim, windows-eventlog-native
BloodHound-CE export (1) — bloodhound-export
Every crate is cargo install-able standalone. Reuse dcerpc in your own DFIR tool without pulling in the attack primitives. Use ese-parser for offline NTDS.dit forensics without any wire code. Consume ms-icpr to build your own CSR helper.

That "dual-use" rule is enforced: a primitive gets extracted into a sibling crate only when it has genuine defensive / admin / DFIR appeal, not just offensive. Attacker-only compositions stay in the CLI.

From-scratch, meaning
DCE/RPC — bind (unauth / NTLM / Kerberos / sealed), NDR encoder + decoder, endpoint mapper client, fault-code decoder, association-group support
SMB2 client — NTLM + Kerberos auth, signing, session setup, tree connect, IOCTL, pipe transport, egress via SOCKS5
Kerberos — AS-REQ / AS-REP, TGS-REQ, S4U2Self, S4U2Proxy, PKINIT (DH exchange + AS-REP decrypt), PA-PAC-OPTIONS, ccache reader/writer, AES128 / AES256 / RC4 / DES key derivation
MS-DRSR — GetNCChanges, DsCrackNames, DsGetNCChangesW / X, bounded-alloc reply parser
MS-EFSR / MS-DFSNM / MS-RPRN / MS-FSRVP — all four coerce vectors on the same SMB session interface
MS-ICPR — ADCS certreq over HTTPS and over ncacn_ip_tcp (\PIPE\cert alternative endpoint)
MS-CRTD — certificate template parser + ESC rule pack (ESC1/4/6/7/8/10/11/15/16)
MS-RRP — remote registry, MS-EVEN6 remote event log, MS-TSCH scheduled tasks, MS-NRPC Zerologon
ADCS Web Enrollment — HTTP relay with NTLM handshake and CSR forwarding on the same TCP connection
Install
cargo install --locked adhammer
Rust 1.80+. Windows / macOS / Linux (tested on all three in CI).

Then:

audit-only scan → HTML report

adhammer scan --url ldaps://dc.corp.local:636 \
--user auditor \
--password '@file:/tmp/pw' \
--out audit.html

guided attack menu (interactive TTY prompts everything)

adhammer

CI-friendly JSON envelope on a single primitive

ADHAMMER_PASSWORD='…' \
adhammer --json attack dcsync \
--host dc.corp.local --domain CORP \
--user Administrator --target krbtgt
Development discipline
Every release runs the same gate:

cargo fmt --all
cargo clippy --workspace --all-targets -- -D warnings
cargo test --workspace
CI matrix: ubuntu + windows + macos
MSRV verify job pins the toolchain to whatever rust-version in Cargo.toml says
Wire code validated against at least one live DC before shipping
Every hostile-length wire input has a regression test that feeds 0xFFFF_FFFF and asserts RpcError::Protocol without panic or OOM. Every principal-string function has a test that feeds Cyrillic and rejects it (RFC 4120 IA5String rule).

Recent releases have been driven by outside code review — an external multi-agent reviewer runs against the diff before ship, and the findings that survive verification become the next milestone. The current release closed 33 of 37 findings from one such pass.

Roadmap
1.4.x — bulk MSSQL enumeration (via ms-tds), Exchange abuse primitives, SCCM NAA extraction, DCShadow phase-2 push (RPC path, works past the 2019+ LDAP hardening), cross-forest Kerberos (S4U2Proxy across trusts), sealed LDAP bind (Windows Server 2025 channel-binding requirement), bulk DRSUAPI (parallel GetNCChanges across DCs).

1.5.x — semi-interactive shell (post-auth REPL), cross-forest attack graph, automated coerce → relay → exploit chains.

Contribute
Issues, PRs, or a hard-critic review of your own — all welcome.

Repo: https://github.com/icedracon/adhammer
Crate: https://crates.io/crates/adhammer
Changelog: https://github.com/icedracon/adhammer/blob/main/CHANGELOG.md
MIT. Written by zevs.

Cracking WMI-exec in Rust by turning impacket into a byte-level oracle

Puma — Mon, 03 Aug 2026 06:36:58 +0000

How I implemented wmiexec from scratch in Rust — DCOM activation, OXID resolution, and MS-WMIO object marshaling — by using impacket not as a library but as a debugging oracle, and diffing my wire bytes against it until a Windows DC accepted them byte-for-byte.

This is a build log from ADhammer, an Active Directory audit + validation toolkit I'm writing in Rust on a from-scratch DCE/RPC · NTLM · SMB2 · Kerberos stack (think "impacket for Rust"). The whole project is built with Claude Code, and this post is the single best example of what that actually looks like — not autocomplete, but a tight loop of hypothesis → capture live traffic → diff → fix against a real domain controller.

The goal: wmiexec, from scratch
wmiexec is the classic "quiet" remote-code-execution technique: instead of creating a service (psexec/SVCCTL) or a scheduled task (atexec), you talk to WMI over DCOM and call Win32_Process.Create. No service-install event, different host telemetry.

Under the hood it's three stages, each a different flavour of pain:

ADhammer: a full Active Directory pentest tool in Rust

Puma — Fri, 31 Jul 2026 08:19:37 +0000

Full AD pentest + audit tool in Rust, single static binary. Whole DCE/RPC · NTLM · SMB2 · Kerberos stack written from scratch (no impacket) — split into 4 reusable MIT crates on crates.io. Audits a domain (control-path graph, 10/16 AD CS ESC classes, MITRE-tagged) and validates findings end-to-end: DCSync, golden/silver tickets, pass-the-ticket to SYSTEM, LAPS, WinRM, ADCS. Live-validated against a fully-patched Windows Server 2025 DC. MIT, v1.1.0.

github.com/icedracon/adhammer

ECHO — a living pixel companion on your taskbar: he fights demons from your screen edge, plays guitar at midnight, and learns your rhythm

Puma — Fri, 31 Jul 2026 08:17:37 +0000

A pixel-art companion who lives on your Windows taskbar. Two heroes: Corvin the silent Warden (voiced 100-chapter story, midnight guitar, and a daily boss fight where a demon literally walks out of your screen edge) and Dante the demon hunter (Devil Trigger, flaming sword, espresso and doomscrolling). He reacts to your games, music and typing, plays big scenes on a living schedule, and a local learning "director" adapts him to you. Zero network calls, zero telemetry, one exe.

icedracon / ECHO

ECHO — живой пиксельный компаньон для твоего рабочего стола

Он живёт на панели задач Windows и сам реагирует на твою жизнь за компьютером: работаешь — он рядом, запустил игру — он дерётся, включил музыку — он играет с тобой, ушёл ночью — он засыпает. Лёгкий (~45 МБ памяти), ничего не отправляет в интернет, работает полностью локально.

Установка — один клик

Скачай своего героя со страницы загрузок:

Файл	Кто это
🦅 Echo-Corvin.exe	Корвин — молчаливый Страж с белым орлом. Рассказывает истории своим голосом, играет на гитаре в полночь, дерётся с тем, что лезет из-за Двери
🔴 Echo-Dante.exe	Данте — охотник на демонов: Devil Trigger, огненный меч, пицца и танцы
⚪ ECHO.exe	Оба в одном — переключайся когда хочешь

Запусти. Всё. Он выйдет на панель и начнёт жить.

Windows может спросить «запустить неизвестное приложение?» — жми «Подробнее → Выполнить в любом случае». Код открыт, проверить можно прямо здесь.

Управление — мышкой

…

View on GitHub

I built a full Active Directory pentest + audit tool in Rust — on a protocol stack I wrote from scratch (no impacket)

Puma — Wed, 29 Jul 2026 15:52:49 +0000

A single Rust binary that audits an Active Directory domain like PingCastle — and, for authorized red teams, proves each finding by actually running the attack. On a DCE/RPC · NTLM · SMB2 · Kerberos stack I wrote from scratch, because there's no impacket for Rust.

The itch

Two tools own Active Directory security work, and neither is Rust. PingCastle audits beautifully but is Windows/.NET and read-only. impacket has the offensive protocol stack but is Python and offense-only. I wanted one Linux-native binary that does both — and I wanted to actually understand Kerberos/DCE-RPC/NTLM instead of importing someone else's library. So I wrote the stack from the wire up.

The result is ADhammer.

Show Image

What it does — audit, then prove it

Audit. Collect the domain over LDAP as a low-privileged user (via the SD_FLAGS control), build a BloodHound-style control-path graph in-process, and run 33 checks across the four PingCastle categories — including 10 of the 16 AD CS ESC classes, ADIDNS exposure, and SYSVOL/GPP. Every finding is scored, MITRE ATT&CK-tagged, and exportable to BloodHound.
Validate. A report shouldn't say a path might be exploitable. ADhammer implements the matching tradecraft — Kerberos roasting, DCSync, golden/silver tickets, pass-the-ticket, LAPS/gMSA read, WinRM & SVCCTL exec, ADCS enrollment — each live-validated against a fully-patched Windows Server 2025 DC.

The part I'm proud of: the protocol stack is from scratch
No impacket. No .NET. The whole DCE/RPC · NTLM · SMB2 · Kerberos layer is hand-rolled from the Microsoft open specs — NDR marshaling, NTLMv2 sign+seal, the MS-PAC PAC marshaler, PKINIT — each primitive unit-tested against spec vectors. It's published as four reusable MIT crates that didn't exist in Rust before:

windows-sddl — no-FFI SECURITY_DESCRIPTOR/DACL/ACE parser + Sid/Guid
ntlmssp — NTLMv2 + RC4 sign+seal (RPC packet privacy)
smb2-client — async SMB2 (negotiate → SPNEGO → pipes, signing)
dcerpc — NDR · PDUs · EPM · SAMR · LSAT · DRSUAPI · SVCCTL · ICPR · …
Interactive, so you don't juggle 20 flags
Run adhammer with no arguments: a wizard asks user → password (or NT hash) → domain → DC, then walks every action with prompts. For golden/silver/pass-the-ticket it auto-fetches the krbtgt/service AES256 key (via DCSync) and the domain SID (via LSAT) from your session — no pasting keys or SIDs.

Show Image

The money demo: a golden ticket a patched Server 2025 accepts
"Golden tickets are dead on patched DCs." Not quite — a correctly forged one is still accepted. What changed is the PAC bar: KB5020805 makes PAC_REQUESTOR / PAC_ATTRIBUTES mandatory, and most from-scratch forgers omit them. ADhammer builds the PAC from scratch with them, signs it with the AES256 checksum, and a fully-patched 2025 KDC accepts the forged Domain-Admin TGT → pass-the-ticket over SMB → NT AUTHORITY\SYSTEM, run from Kali.

I wrote up exactly how the 2025 PAC enforcement works (and the RC4-golden-accepted-but-service-ticket-refused asymmetry) here → Forging a golden ticket for a patched Server 2025 KDC.

Try it
cargo install adhammer

audit a domain (low-priv creds are enough) + export a BloodHound graph

adhammer scan --url ldaps://dc:636 --user 'CORP\svc' --password … --insecure --bloodhound out.zip
Or grab the prebuilt binary from the v1.1.0 release. Rust 1.80+, runs from Kali/Linux or Windows.

Authorized use only
The validation modules are real offensive techniques (DCSync, ticket forging, relay, RCE). ADhammer is for systems you own or are explicitly authorized to test — authorized engagements, red-team validation, and education. MIT-licensed; built as security research at ITMO, sibling to a Windows kernel 0-day I disclosed to Microsoft MSRC.

⭐ Repo: https://github.com/icedracon/adhammer — feedback and issues welcome.