A single Rust binary that audits an Active Directory domain like PingCastle — and, for authorized red teams, proves each finding by actually running the attack. On a DCE/RPC · NTLM · SMB2 · Kerberos stack I wrote from scratch, because there's no impacket for Rust.
The itch
Two tools own Active Directory security work, and neither is Rust. PingCastle audits beautifully but is Windows/.NET and read-only. impacket has the offensive protocol stack but is Python and offense-only. I wanted one Linux-native binary that does both — and I wanted to actually understand Kerberos/DCE-RPC/NTLM instead of importing someone else's library. So I wrote the stack from the wire up.
The result is ADhammer.
Show Image
What it does — audit, then prove it
Audit. Collect the domain over LDAP as a low-privileged user (via the SD_FLAGS control), build a BloodHound-style control-path graph in-process, and run 33 checks across the four PingCastle categories — including 10 of the 16 AD CS ESC classes, ADIDNS exposure, and SYSVOL/GPP. Every finding is scored, MITRE ATT&CK-tagged, and exportable to BloodHound.
Validate. A report shouldn't say a path might be exploitable. ADhammer implements the matching tradecraft — Kerberos roasting, DCSync, golden/silver tickets, pass-the-ticket, LAPS/gMSA read, WinRM & SVCCTL exec, ADCS enrollment — each live-validated against a fully-patched Windows Server 2025 DC.
The part I'm proud of: the protocol stack is from scratch
No impacket. No .NET. The whole DCE/RPC · NTLM · SMB2 · Kerberos layer is hand-rolled from the Microsoft open specs — NDR marshaling, NTLMv2 sign+seal, the MS-PAC PAC marshaler, PKINIT — each primitive unit-tested against spec vectors. It's published as four reusable MIT crates that didn't exist in Rust before:
windows-sddl — no-FFI SECURITY_DESCRIPTOR/DACL/ACE parser + Sid/Guid
ntlmssp — NTLMv2 + RC4 sign+seal (RPC packet privacy)
smb2-client — async SMB2 (negotiate → SPNEGO → pipes, signing)
dcerpc — NDR · PDUs · EPM · SAMR · LSAT · DRSUAPI · SVCCTL · ICPR · …
Interactive, so you don't juggle 20 flags
Run adhammer with no arguments: a wizard asks user → password (or NT hash) → domain → DC, then walks every action with prompts. For golden/silver/pass-the-ticket it auto-fetches the krbtgt/service AES256 key (via DCSync) and the domain SID (via LSAT) from your session — no pasting keys or SIDs.
Show Image
The money demo: a golden ticket a patched Server 2025 accepts
"Golden tickets are dead on patched DCs." Not quite — a correctly forged one is still accepted. What changed is the PAC bar: KB5020805 makes PAC_REQUESTOR / PAC_ATTRIBUTES mandatory, and most from-scratch forgers omit them. ADhammer builds the PAC from scratch with them, signs it with the AES256 checksum, and a fully-patched 2025 KDC accepts the forged Domain-Admin TGT → pass-the-ticket over SMB → NT AUTHORITY\SYSTEM, run from Kali.
I wrote up exactly how the 2025 PAC enforcement works (and the RC4-golden-accepted-but-service-ticket-refused asymmetry) here → Forging a golden ticket for a patched Server 2025 KDC.
Try it
cargo install adhammer
audit a domain (low-priv creds are enough) + export a BloodHound graph
adhammer scan --url ldaps://dc:636 --user 'CORP\svc' --password … --insecure --bloodhound out.zip
Or grab the prebuilt binary from the v1.1.0 release. Rust 1.80+, runs from Kali/Linux or Windows.
Authorized use only
The validation modules are real offensive techniques (DCSync, ticket forging, relay, RCE). ADhammer is for systems you own or are explicitly authorized to test — authorized engagements, red-team validation, and education. MIT-licensed; built as security research at ITMO, sibling to a Windows kernel 0-day I disclosed to Microsoft MSRC.
⭐ Repo: https://github.com/icedracon/adhammer — feedback and issues welcome.
Top comments (0)