Overthrone is an all-Rust Active Directory security assessment framework that combines LDAP/SMB/Kerberos enumeration, BloodHound-style attack graph pathfinding, and reporting into one static binary for authorized engagements.
| Tool | Karmanya03/Overthrone — all-Rust Active Directory exploitation framework shipped as a single static binary (v0.4.9, MIT) |
| Category | Active Directory red team / offensive security framework |
| Primary Use | End-to-end AD assessment on authorized targets: LDAP/SMB/Kerberos enumeration, attack-graph pathfinding, credential auditing, and reporting |
| Safe Use | Intended solely for penetration testers working under signed scope on lab environments or environments they are contractually authorized to assess |
| Telemetry Note | Generates substantial domain-controller traffic — Kerberos AS/TGS requests, LDAP paginated searches, SMB2 sessions, and MS-DRSR replication calls — that defenders can correlate via DC security event logging, Kerberos error rates, and authentication monitoring |
Overthrone is a work-in-progress Active Directory exploitation framework written entirely in Rust, and the pitch is architectural as much as functional: instead of stitching together impacket, Mimikatz, BloodHound, Neo4j, hashcat, and a pile of Python glue, the project collapses the entire assessment pipeline into a single statically linked binary. The README is unusually candid about this positioning, with a wall of not needed badges making the argument explicit — no Python, no .NET, no JVM, no Wine, no Neo4j server. For operators who have spent evenings fixing dependency drift across an engagement toolkit, that consolidation is the real feature, and everything else flows from it.
The repository metadata shows a small but real project: roughly 20 stars, MIT licensed, tagged with active-directory, ad-pentesting, and redteam-tools topics. The README badges a version of 0.4.9, and the title itself carries a WIP marker, so this should be read as an ambitious young tool rather than a hardened production suite. The binary responds to both overthrone and the shorthand ovt, a small ergonomic touch the author highlights repeatedly, and the README notes that an earlier ovt auto-pwn command was deprecated and replaced by an interactive ovt wizard with per-stage approval gates — a deliberate safety-conscious redesign worth noting.
Internally, the project documents a five-layer architecture with strict adjacency between layers: an operator layer (CLI via clap, a TUI via ratatui, a REPL, and a web GUI built on Axum and Three.js), an orchestration layer holding the wizard and session management, a capability layer for enumeration, relay, forge, crawl and reporting functions, a core engine for protocols and cryptography, and a target layer spanning domain controllers, ADCS, Exchange, and Azure AD. The component names — overthrone-pilot, overthrone-reaper, overthrone-hunter, overthrone-forge, overthrone-core — map cleanly onto these layers, and the separation is claimed to keep protocol logic, attack execution, and interfaces independently testable. The README cites 2,148 tests, which suggests the test discipline is more than an afterthought.
The enumeration story is where Overthrone most directly competes with the Python ecosystem. The kill-chain diagram in the README describes an enum_all flow that binds to LDAP on ports 389/636, walks RootDSE and naming contexts, and paginates through users, groups, computers, trusts, ACLs, GPOs, LAPS values, SPNs, and delegation settings into a structured result. Enrichment steps include LAPS v1/v2 decryption, GPP password decryption, a Snaffler-style share crawl, and ADCS certificate template auditing. That last capability is notable — misconfigured certificate templates have become one of the most common escalation paths in modern AD reviews, and having the scan integrated rather than bolted on matters in practice.
The attack-graph component is the most interesting design decision. Rather than exporting to a Neo4j backend the way classic BloodHound tooling does, Overthrone builds a petgraph directed graph in-process with more than 30 weighted edge types and runs a reverse Dijkstra search from the Domain Admins group outward, returning hop-by-hop shortest paths annotated with the technique involved. For defenders reading this analytically, the edges it models are essentially a curriculum of AD misconfigurations — excess ACL grants, unconstrained delegation, GPO abuse paths — and the tool's pathfinding output doubles as a prioritized hardening checklist once translated into remediation work.
On the credential-access side, the README describes Kerberoasting via per-SPN TGS-REQ exchanges, offline cracking with an embedded wordlist parallelized through rayon, and lockout-aware password spraying using Kerberos AS-REQ pre-auth attempts with delay logic. The framework also advertises ticket forgery capabilities — golden, silver, diamond, and sapphire tickets — and DCSync replication through MS-DRSR. These are standard documented AD attack techniques, and the important analytical point for defenders is that all of them operate through legitimate Windows protocols; detection therefore rests on monitoring Kerberos anomaly rates, unusual DRSGetNCChanges replication calls, and ticket encryption type usage, not on spotting a signature of the binary itself.
The relay capability list is broad: HTTP, SMB, LDAP, Exchange, and IPv6 attack surfaces, which the badges associate with the usual internal network relay prerequisites — unsigned SMB and DHCPv6/LLMNR conditions. A pure-Rust SMB2 client underpins file operations, an smbclient-style shell (ovt smb shell), an RPC command set (ovt rpc), and remote execution paths documented as PsExec via SVCCTL named pipes, SmbExec over SCM, WinRM on port 5985, and WmiExec over DCOM. The README notes the external smbclient binary exists only as a last-resort fallback where the built-in client cannot negotiate, which keeps the dependency footprint genuinely small.
The README also advertises evasive engineering — ntdll unhooking, ETW suppression, direct syscall usage, and a Credential Guard bypass — alongside crawler features referencing JA3/JA4 fingerprint rotation and OPLOCK techniques. This is the part of the tool that demands the most caution: it is explicitly offensive capability aimed at defeating endpoint telemetry, and there is no legitimate use for it outside an authorized red team engagement or a defensive research lab studying EDR coverage gaps. For blue teams, the existence of these features is itself useful threat intelligence — memory-safe, single-binary tooling with built-in unhooking lowers the skill floor for exactly the tradecraft that EDR products are graded against.
Reporting closes the loop: findings from all modules are collected into an engagement session object and rendered as markdown, JSON, or PDF, with MITRE ATT&CK mapping, credential tables, and remediation guidance included. The PDF output framing in the README — a page-count joke about proving domain ownership — reflects the tool's stated audience of contract testers who need deliverables. Configuration follows XDG conventions with TOML profiles, which makes multi-environment work (lab versus client) cleaner than environment-variable sprawl, and the wizard's resumable sessions with Q-learning-derived advisory ordering suggest the author has thought about long, interruptible engagements.
Getting it is straightforward: releases are published on GitHub, or you can git clone https://github.com/Karmanya03/Overthrone and build with cargo build --release. The README also documents a doctor command for environment sanity checks, which is a welcome reliability feature for a tool this early in its lifecycle.
Where does Overthrone fit? For authorized assessors, it is an ambitious consolidation play — one binary replacing a dozen fragile dependencies, with an architecture diagram that reads like a serious engineering document rather than a weekend script. The WIP status, modest star count, and aggressive feature list (C2 plugins, Azure AD targeting, Q-learning orchestration) mean it should be validated in a lab before any client use, and its evasive features make it a tool to handle with the same governance you would apply to commercial red team platforms. For defenders, studying its enumeration model and attack-graph edges is worthwhile purely as a map of what misconfigurations attackers automate first — and its MIT license makes that study easy.
Karmanya03/Overthrone.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.