AdStrike packages 52 offensive Active Directory modules, a shared session model, and an MCP server so authorized operators and their LLM hosts can run engagements end to end.
| Tool | capture0x/AdStrike — modular, terminal-based Active Directory attack framework with MCP server and AI-assisted analysis |
| Category | Red-team framework / AD offensive toolkit (Python) |
| Primary Use | Driving discovery, enumeration, and reporting across an authorized AD engagement from one shared session, with Impacket, NetExec, Certipy, and BloodHound wrappers |
| Safe Use | Use only inside authorized penetration tests, lab ranges, and engagements with explicit written permission — the README states this restriction verbatim |
| Telemetry Note | Wraps well-known external tooling (NetExec, BloodHound, Certipy, Rubeus patterns), so defenders see the underlying tool signatures — LDAP/SMB enumeration bursts, Kerberos anomaly rates, and certificate-service queries — not an AdStrike-specific artifact |
Every operator who has run a multi-day Active Directory engagement knows the real friction point: not the tooling itself, but the context plumbing. AdStrike, hosted at capture0x/AdStrike and sitting at roughly 372 stars in Python, attacks exactly that problem. It is a modular, terminal-based framework that carries target details, credentials, Kerberos state, findings, executed commands, and output paths in a single shared session, so each module reuses context instead of forcing the operator to re-type domain, BASE_DN, or ticket cache paths. The README is explicit and upfront about scope: authorized use only, never against systems without explicit written permission — a framing that defines everything the tool does.
The architecture is best understood as an orchestration layer over the existing AD offense ecosystem rather than a novel exploit engine. AdStrike ships wrappers for Impacket, NetExec/nxc, Certipy, Kerbrute, BloodHound (including SOAPHound and RustHound collectors), PowerView, Rubeus, evil-winrm, hashcat, john, nmap, masscan, and friends. Most of these are installed by install.sh, with scripts/repair_tools.sh as a fallback repair path. That means the framework's value proposition is workflow consolidation and state continuity — the operator works one menu while the session tracks evidence and artifacts underneath.
The menu is large by any standard: 58 entries, of which 52 are attack modules, 4 are utilities, and 2 are management functions, organized into nine kill-chain phase groups plus a utilities block. The phase map in the README runs from reconnaissance (DNS, WHOIS, certificate transparency) through initial access, enumeration, privilege escalation, lateral movement, credential access, persistence, cloud/hybrid operations targeting Azure AD/Entra ID and ADFS, and finally advanced operations including pre-built exploit chains and C2 integration with tooling like Sliver. The breadth is notable — it effectively indexes most of the modern AD attack taxonomy, from Zerologon and PrintNightmare through ADCS misconfiguration classes ESC1 through ESC13, RBCD, shadow credentials, DCSync, and Golden SAML.
The AI layer is where AdStrike diverges from older menu-driven frameworks like a classic pwntools-style launcher. Three components matter. First, the Smart Analyst parses module output and ranks candidate next actions, which is essentially automated findings triage. Second, an optional AdStrike Agent handles AI-assisted planning and tool orchestration, configurable via ANTHROPIC_API_KEY. Third — and most interesting architecturally — the project ships an MCP server exposing all 53 tools (52 modules plus set_engagement) over the Model Context Protocol, so an existing MCP host such as Claude Code, Cursor, or Claude Desktop can drive an engagement with its own subscription. No local model, no separate API key. This makes AdStrike one of the clearer early examples of agentic offensive tooling built on MCP rather than bespoke LLM glue.
Operationally, the session model deserves attention. Configuration lives in a .env file copied from .env.example, holding fields like DC_IP, DC_FQDN, DOMAIN, BASE_DN, credential slots including NT_HASH and KRB5_CCACHE, attacker network details, and an ENGAGEMENT_NAME. The Session Manager can also collect these interactively, and the values propagate to every module automatically. The README is appropriately paranoid about this file: never commit real engagement data, and keep .env, output/, ticket files, hashes, dumps, and reports private and redacted. For a consultant, that .env file is effectively a crown-jewels artifact of the engagement.
Several environment flags reveal the design priorities. ADSTRIKE_SHOW_SECRETS defaults to false, masking passwords, hashes, and loot in logs and reports unless explicitly enabled — a sensible evidentiary hygiene default. ADSTRIKE_NO_ANIMATION cleans up logs for documentation, ADSTRIKE_PORT_CHECK triggers an nmap reachability check during session setup against the usual AD ports (88, 389, 443, 445, 636, 5985), and TGT_AUTO_RENEW manages Kerberos ticket renewal. Most interesting from a tradecraft perspective is ADSTRIKE_OPSEC, which switches agent behavior between loud, normal, and stealth — an explicit acknowledgment that agentic tooling needs noise controls when the LLM, not the human, is choosing the next module.
Getting started is deliberately simple, targeting Kali Linux 2024+ or Parrot OS with Python 3.10+. The canonical path is git clone https://github.com/capture0x/AdStrike.git, then bash install.sh, source venv/bin/activate, and bash run.sh to enter the interactive menu. One operational note from the README worth internalizing: never run install.sh or run.sh with sudo. The installer creates repo-local artifacts — adrt_venv/, .env, output/ — that end up root-owned if invoked as root, and the fix (chown -R back to your user) is annoying on a live engagement. This is normal-user tooling; only specific wrapped actions like packet capture need elevated privileges.
For headless or scripted work, AdStrike supports direct module execution: python3 main.py --module 10 runs a specific module, --no-banner suppresses chrome, and --session output/session.json loads prior state. A built-in health check via python3 main.py --check verifies contiguous, unique menu numbering and module imports — the README reports 56/56 healthy locally. The recommended first-run flow the authors document is instructive about intended usage: configure the session, run the Tool Checker to verify external dependencies, do baseline AD enumeration, feed output to Smart Analyst for ranking, then generate the report. That is a full assessment lifecycle, not a point tool.
The Kerberos-aware workflows are a deliberate differentiator, aimed at environments where NTLM is disabled and LDAP signing is enforced — increasingly common hardening in mature estates. The framework tracks KRB5_CCACHE state and renewal in-session, meaning subsequent modules operate ticket-based rather than falling back to legacy hash authentication. Modules also cover coercion techniques (PrinterBug, PetitPotam, DFSCoerce), WSUS HTTP spoofing, MSSQL and SCCM/MECM abuse paths, and hybrid identity attacks like MSOL DCSync and PTA injection — a map of where real enterprise attack surface currently sits.
From a defensive standpoint, AdStrike matters less as a novel threat and more as an accelerant. It does not appear to introduce new primitives; it industrializes known ones. Blue teams should therefore anchor detection on the underlying tool behaviors: anomalous LDAP query patterns and BloodHound-style graph collection, Kerberos anomalies like AS-REP roasting rates and S4U usage, ADCS certificate-request irregularities matching the ESC classes, and coercion-typical authentication callbacks. The agentic angle adds a wrinkle worth monitoring — faster module-to-module pivoting and higher query volume per unit time — which can actually make automated engagements noisier than patient human ones.
Caveats before adoption: the project self-identifies as a beta/research build, with module success dependent on target state, credentials, network reachability, and installed third-party tools. The repo metadata lists an MIT badge in the README header imagery while GitHub reports the license — a minor inconsistency worth noting for anyone doing supply-chain review. There is also an inherent tension in letting an MCP-driven LLM select offensive actions; the ADSTRIKE_OPSEC switch helps, but a human should remain in the loop on any authorized engagement, both for scope compliance and for evidentiary integrity in the generated HTML/Markdown/JSON reports. Used inside a lab or contracted assessment, AdStrike is a well-documented, thoughtfully sessionized consolidation of the modern AD offense toolkit with a genuinely forward-looking agentic interface.
capture0x/AdStrike.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.