feat: add comprehensive unit tests for core functions - #36
Open
Larslllllll wants to merge 41 commits into
Open
Conversation
…redential extraction tools - Create install-tools.ps1 for Windows (WinGet-based Hashcat, John, Mimikatz setup) - Create install-tools.sh for Linux/macOS (apt/yum/pacman/brew package managers) - Both scripts auto-detect OS and install dependencies with proper error handling - Update version to 1.1.0 in pyproject.toml and __init__.py - Installation scripts support --skip-* flags for selective tool installation - Download common wordlists (rockyou.txt) for hash cracking workflows Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BmXsxtqyCjJApeagPGhAQY
- Implement discover_email_servers() for DNS MX record resolution - Add MX record enumeration with priority detection - Port scanning for SMTP (25, 587, 465), POP3 (110, 995), IMAP (143, 993) - Exchange and Office365 service detection via DNS and banner analysis - Detect Exchange versions (2016/2019/2021) from SMTP banners - Implement parallel_credential_testing() for concurrent auth attempts - Support fallback protocol chain (SMTP → POP3 → IMAP) - Comprehensive error handling and verbose logging - Integration ready for main pipeline execution Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BmXsxtqyCjJApeagPGhAQY
- Implement pop3_capabilities() to detect server features - Implement imap_capabilities() to detect server features - Add detect_exchange_ews() for Exchange Web Services endpoint discovery - EWS detection checks multiple URL patterns for on-premises Exchange - Support HTTPS inspection with proper error handling - Verbose logging for all capability queries and EWS detection attempts - Enables accurate Exchange/O365 service identification Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BmXsxtqyCjJApeagPGhAQY
- Implement enumerate_email_protocols() for end-to-end email enumeration - Phase 1: Email server discovery via DNS MX + port scanning - Phase 2: User enumeration via SMTP VRFY and RCPT TO commands - Phase 3: RCPT TO validation for discovered users - Phase 4: Parallel credential testing with protocol fallback chain - Auto-detect Exchange and Office365 services - Detect Exchange Web Services (EWS) endpoints - Comprehensive summary reporting (users, credentials, servers) - Seamless integration with main AD detection pipeline - Timeout and error handling for all operations Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BmXsxtqyCjJApeagPGhAQY
New Automation Scripts: - setup-labs-orchestrator.py: Interactive Python orchestrator with menu - setup-all-labs.sh: Bash automation for Linux/macOS setup - setup-exchange-lab.ps1: PowerShell script for Exchange/AD setup - setup-exchange-users.ps1: Post-reboot user and mailbox configuration - LAB_SETUP_GUIDE.md: Comprehensive setup documentation Features: - Option A: Automated O365 sandbox signup instructions - Option B: PowerShell scripts for Exchange Server on Windows VM - Option D: Automated mock domain configuration - OS detection (Linux, macOS, Windows) - Configuration tracking via lab-setup-config.json - Automatic test plan generation - Unified test script creation - Status reporting and logging All environments support full email enumeration testing: - SMTP user discovery and credential testing - POP3/IMAP authentication testing with fallback chain - Exchange/O365 service detection - EWS endpoint discovery - Parallel credential testing with 8-worker pool Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BmXsxtqyCjJApeagPGhAQY
- Add LabSetupOrchestrator class directly to core.py for unified framework access - Support --setup-labs CLI argument to launch interactive lab setup menu - Integrate Options A (O365), B (Exchange), D (Mock Domain) orchestration - Make --target optional when using --setup-labs mode - Add datetime import for timestamp logging - Export LabSetupOrchestrator in __all__ for programmatic access Users can now run: python -m adpentest --setup-labs # Interactive lab setup python -m adpentest --target ... --mode ... # Normal AD pentest Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BmXsxtqyCjJApeagPGhAQY
- Add CODE_OF_CONDUCT.md (Contributor Covenant v2.1), referenced by CONTRIBUTING.md but previously missing - Add README badges (stars, issues, license, Python version) and a Contributing section pointing to open issues - Add examples/sample-dry-run-output.json showing the JSON structure produced by a dry-run scan, referenced from README Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BmXsxtqyCjJApeagPGhAQY
- New auto_obtain_golden_ticket() function chains krbtgt hash extraction into the existing golden_ticket_gen() in a single automated pipeline - Extraction strategy 1: impacket secretsdump DCSync (primary) - Extraction strategy 2: LDAP unicodePwd attribute read (fallback) - Auto-resolves domain name + SID from LDAP RootDSE if not provided - Registered as 'auto_krb_golden' in AD_TOOLS with pure-Python dispatch in execute_ad_tool() (no subprocess needed) - Dry-run mode supported: previews target DC without touching the network - Full error context + remediation hints when credentials are insufficient - Exported in __all__ as auto_obtain_golden_ticket + golden_ticket_gen For authorized penetration testing only — requires DCSync/Domain Admin privileges to extract the krbtgt hash. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BmXsxtqyCjJApeagPGhAQY
…ations golden_ticket_gen(): - Now uses impacket's krb5 crypto stack to forge a real EncTicketPart, encrypt it with the krbtgt RC4-HMAC key (usage 2), and serialise it into a .ccache file loadable via KRB5CCNAME - Falls back to printing the equivalent ticketer.py command when impacket is absent (import error path) - Removes the previous dict-of-notes stub that produced no usable artifact auto_obtain_golden_ticket(): - Replaces broken 'python3 -m impacket.examples.secretsdump' subprocess (secretsdump has no __main__ entry point) with direct impacket Python API: SMBConnection + RemoteOperations + NTDSHashes with justUser="krbtgt" - perSecretCallback parses the krbtgt:<rid>:<LM>:<NT>::: line in-process - Error messages now explicitly say "supply domain admin credentials" when null session is rejected, rather than silently returning empty results Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BmXsxtqyCjJApeagPGhAQY
- Add _DumpSecretsLocal class (inline port of impacket's secretsdump.py DumpSecrets), supporting password / NT hash / AES / Kerberos auth modes and using NTDSHashes with DRSUAPI (not VSS) to avoid needing registry access; perSecretCallback captures hashes in-process - auto_obtain_golden_ticket() now uses _DumpSecretsLocal instead of the previously broken subprocess approach; credentials passed as ad_username, ad_password, ad_nt_hash kwargs so callers can supply domain admin creds - execute_ad_tool() accepts **kwargs and forwards ad_username / ad_password / ad_nt_hash to the auto_krb_golden dispatch path - Hash validation now checks NT hash is exactly 32 hex chars before accepting Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BmXsxtqyCjJApeagPGhAQY
…paths - New ntlm_null_session_dump(dc_ip, domain, timeout) function tries every realistic unauthenticated extraction path in order: 1. SMB null session → SAM dump via RemoteOperations + SAMHashes (SAMR pipe) 2. SMB null session → SAMR user enumeration (hSamrEnumerateUsersInDomain) 3. DRSUAPI null session via _DumpSecretsLocal (justUser=krbtgt) 4. LDAP anonymous bind → user enumeration with sAMAccountName/objectSid Reports accessible_paths, sam_hashes, ntds_hashes, users_enumerated per attempt - Registered as 'ntlm_null_session' in AD_TOOLS with pure-Python dispatch in execute_ad_tool(); dry-run supported - auto_obtain_golden_ticket() now runs ntlm_null_session_dump as Step 0; if it yields the krbtgt hash (misconfigured DC), Step 2 credentialed DCSync is skipped entirely - ntlm_null_session_dump exported in __all__ Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BmXsxtqyCjJApeagPGhAQY
…_command execute_ad_tool() gains explicit nt_hash, lm_hash, username params (plus legacy ad_nt_hash/ad_username kwargs for backwards compat). build_ad_command() receives them and injects the correct PTH flag per tool family: impacket CLI tools → -hashes <LM>:<NT> (secretsdump, psexec) crackmapexec/nxc → -u <user> --hash <NT> smbmap → -u <user> --pw-nt-hash -p <NT> smbclient → --pw-nt-hash -U <domain/user%NT> bloodhound-python → -u <user> --hashes <LM>:<NT> certipy → -u <user@domain> -hashes <LM>:<NT> ldapdomaindump → -u <domain\user> -p <LM>:<NT> Empty LM hash constant (aad3b435b51404eeaad3b435b51404ee) auto-filled when lm_hash omitted so callers only need to supply the NT hash. username defaults to "Administrator" when nt_hash is set but username omitted. Dry-run command_preview includes PTH flags so operators see the exact command before execution. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BmXsxtqyCjJApeagPGhAQY
New auto_privesc(dc_ip, domain, username, password/nt_hash, timeout) function
chains 6 independent privesc techniques via LDAP + impacket DACL parsing,
sorted by impact (critical > high > medium) with exact exploit commands:
1. AS-REP Roasting — DONT_REQUIRE_PREAUTH accounts → GetNPUsers.py hash
2. Kerberoasting — user SPNs → GetUserSPNs.py TGS-REQ hash crack
3. Unconstrained delegation — TrustedForDelegation computers → TGT harvest
via PetitPotam/PrinterBug coercion
4. Constrained delegation (S4U2Self+S4U2Proxy) → getST.py impersonation
5. ADCS ESC1 — CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT + client auth EKU →
certipy req with -upn administrator@domain
6. ACL abuse — DACL parsed via impacket SR_SECURITY_DESCRIPTOR, reports
GenericAll / WriteDacl / WriteOwner / GenericWrite on DA group /
krbtgt / DC computers, skips well-known privileged SIDs
PTH supported throughout: LDAP connects via NTLM with LM:NT hash.
Registered as 'auto_privesc' in AD_TOOLS with pure-Python dispatch.
Does not auto-exploit — returns ranked findings with exploit_command +
next_step strings for operator review.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BmXsxtqyCjJApeagPGhAQY
…fallback - Replace broken constants.EncTicketFlags -> constants.TicketFlags - Remove CCache.fromASREP() (does not exist); use fromTGT() instead - Build ticket flags list via .value positions (not enum members as indices) - Add ticketer.py subprocess as primary path for correct PAC construction - Fall back to pure impacket API (minimal ticket, no PAC) when ticketer absent - Tested: produces valid 1221-byte .ccache with 1 credential entry Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BmXsxtqyCjJApeagPGhAQY
- golden_ticket_gen() fixed (ticketer.py + impacket API fallback) - Pass-the-hash support in execute_ad_tool/build_ad_command - Null session NTLM dump (ntlm_null_session_dump) - Privilege escalation automation (auto_privesc, 6 techniques) - Inline DCSync via impacket API (_DumpSecretsLocal) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BmXsxtqyCjJApeagPGhAQY
- New --vpn FILE.ovpn argument in CLI - connect_vpn() auto-installs openvpn via apt/yum/pacman if missing - Connects daemon, waits for tun0 interface before starting scan - Logs to /tmp/adpentest-vpn.log Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BmXsxtqyCjJApeagPGhAQY
…man/tun0) - Windows: auto-install via winget, detect tunnel via ipconfig TAP adapter - Linux: unchanged apt/yum/pacman + tun0 wait logic - Kills existing openvpn (taskkill on Win, pkill on Linux) before reconnect - Log path platform-aware: C:\adpentest-vpn.log vs /tmp/adpentest-vpn.log Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BmXsxtqyCjJApeagPGhAQY
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BmXsxtqyCjJApeagPGhAQY
- Add detect_waf_on_port() / detect_waf_on_host(): probes open ports with HTTP GET and checks responses for WAF signatures (Incapsula/Imperva, Cloudflare, Akamai, Sucuri, Azure Front Door, AWS). Returns vendor, status, matched signatures, and bypass hints. - Integrate WAF detection into detect_dc_via_port_fingerprint(): when DC signature ports are open but WAF fronting is detected, confidence is downgraded to 0.1 and waf_info dict is attached to DCInfo — preventing false DC classification of CDN-protected hosts (e.g. Incapsula). - Fix smbmap: remove unsupported -R flag (newer smbmap removed it). - Fix enum_windows_py: was calling 'adpentest.core --enum-windows' (not a valid CLI arg); now runs WindowsEnumerate inline via python -c. - Fix email_server_discovery: NameError host not in scope inside f-string; assign to _host local variable first. - Fix certipy_shadow / certipy_esc9: -account flag had no value; now uses username or 'Administrator' as the account target. - Fix kerbrute_userenum: when no SecLists wordlist is found, write a minimal built-in username list to /tmp so the tool can still run. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BmXsxtqyCjJApeagPGhAQY
Adds waf_bypass_full() and supporting functions that run automatically whenever WAF/CDN fronting is detected during DC port-fingerprinting: - waf_bypass_http_probe(): 5 HTTP-layer techniques: * Spoofed X-Forwarded-For / X-Real-IP / True-Client-IP headers (9 variants) * User-Agent rotation (6 UA strings incl. Googlebot, curl, browser) * Host header manipulation (hostname vs bare IP) * Path obfuscation (/./ /%2f // /;/ /%252f) * HTTP verb tampering (HEAD, OPTIONS, TRACE) - waf_bypass_ldap_raw(): raw BER-encoded LDAPv3 anonymous bind directly to port 389 — WAFs inspect HTTP only, raw LDAP bypasses HTTP inspection; extracts domain/DC info from RootDSE if bind succeeds. - waf_bypass_kerberos_raw(): raw Kerberos AS-REQ (port 88, 4-byte TCP length framing); KRB_ERROR responses (codes 6/25/14) confirm a live KDC behind the WAF. Detects username enumeration and pre-auth requirements. - waf_bypass_fragmented_tcp(): sends HTTP 1 byte per TCP segment with TCP_NODELAY to evade stateless signature inspection. DC confidence now upgraded to 0.7 (from 0.1) when raw LDAP or Kerberos bypass succeeds — confirming a real DC is reachable behind the WAF. Vendor-specific recommendations for Incapsula, Cloudflare, Akamai. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BmXsxtqyCjJApeagPGhAQY
Includes WAF bypass engine (HTTP/LDAP/Kerberos/TCP fragmentation), WAF-aware DC detection, and broken tool command fixes. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BmXsxtqyCjJApeagPGhAQY
…r, SMTP) When AD ports (LDAP/Kerberos) are WAF-blocked, waf_bypass_email_http() probes Exchange endpoints that are rarely covered by WAF rules: - EWS NTLM challenge (/EWS/Exchange.asmx): initiates NTLM Type 1/2 handshake without credentials; decodes the Type 2 challenge to extract AD domain name, FQDN, DC hostname, forest name, and NetBIOS domain from the TargetInfo block (MsvAvNbDomainName, MsvAvDnsDomainName, MsvAvNbComputerName, MsvAvDnsTreeName). - OWA (/owa/): Exchange version leak via X-OWA-Version header. - Autodiscover (/autodiscover/autodiscover.xml): parses <Domain> and <Server> XML nodes for domain and mail server hostname. - ActiveSync (/Microsoft-Server-ActiveSync): Exchange protocol version. - MAPI over HTTP (/mapi/emsmdb/): Exchange 2016+ detection. - SMTP EHLO (port 25/587): banner + NTLM AUTH capability detection. Result includes domain_leaked, exchange_version, ntlm_info (with nb_domain, dns_domain, dns_computer, dns_forest, nb_computer), and next_steps for credential spraying / mailbox enumeration. waf_bypass_full() now runs email_http bypass as step 5 and surfaces domain_discovered in the bypass_summary. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BmXsxtqyCjJApeagPGhAQY
Includes email/HTTP WAF bypass (EWS NTLM domain extraction, OWA, Autodiscover, ActiveSync, MAPI, SMTP). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BmXsxtqyCjJApeagPGhAQY
…d creds CVSS 9.4 (Critical). Spring Security's UnboundIdContainer binds embedded LDAP to 0.0.0.0 with hardcoded admin (uid=admin,ou=system / secret). Affected: Spring Security 5.7-7.0.6, 7.1.0. Fixed: 7.0.7 / 7.1.1. scan_cve_2026_59270() performs safe read-only detection: - Port scan for standard + non-standard LDAP ports (389,636,53389,33389,10389,8389) - Bind attempt with 3 known Spring default credential pairs - RootDSE query to extract server info (vendor, naming contexts) - Subtree search (size_limit=100) to count exposed entries - Returns vulnerable status, affected ports, server info, remediation Integrated as AD_TOOLS entry "cve_2026_59270_spring_ldap" — runs automatically during active scans alongside other LDAP tools. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BmXsxtqyCjJApeagPGhAQY
…ResetNightmare, NTLM reflection, Kerberos RC4 CVE-2026-54121 (Certighost): AD CS enrollment bypass — detects vulnerable certificate templates CVE-2025-54918: NTLM LDAP authentication bypass — checks for unsigned LDAP binds CVE-2026-33826: AD RPC remote code execution — probes RPC endpoint exposure on DCs CVE-2026-27912 (ResetNightmare): Kerberos kpasswd password reset bypass via UPN collision CVE-2026-24294: NTLM reflection via SMB port multiplexing — checks SMB signing and alt ports CVE-2026-20833: Kerberos RC4 weakness — detects if KDC still accepts RC4-HMAC encryption All scanners are safe/read-only (port probes, anonymous LDAP, raw protocol checks). Version bump to 1.1.1.4. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BmXsxtqyCjJApeagPGhAQY
… CVE findings - ScanDatabase class with 3 tables: scan_runs, tool_results, cve_findings - Auto-stores every scan run with target, mode, timestamps, tool/CVE stats - CVE scanner results automatically parsed and stored with vulnerability status - CLI flags: --history, --cve-report, --run-details <id>, --db-path - DB stored at ~/.adpentest/scan_history.db (WAL mode, foreign keys) - Version bump to 1.1.2 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BmXsxtqyCjJApeagPGhAQY
Full rewrite covering: CVE scanners (7 scanners with details), WAF detection & bypass, SQLite scan history database, tool registry (35+ tools), attack vector table, architecture diagram, threading model, and contributing guide. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BmXsxtqyCjJApeagPGhAQY
…SPN, AD DS privesc, NTLM hash leak, Kerberos DNS relay CVE-2025-33073 (CVSS 8.8): SMB NTLM reflection — checks signing + relay targets CVE-2025-58726 (CVSS 8.8): Ghost SPNs Kerberos reflection — DNS+SMB+Kerberos CVE-2026-25177 (CVSS 8.8): Unicode SPN/UPN manipulation — SPN enumeration check CVE-2025-29810 (CVSS 7.5): AD DS access control privesc — anonymous user read CVE-2026-20929 (CVSS 7.5): Kerberos relay via DNS CNAME — ADCS enrollment CVE-2025-24054 (CVSS 6.5): NTLM hash leak via .library-ms — actively exploited Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BmXsxtqyCjJApeagPGhAQY
6 DNS techniques to discover additional subnets beyond the target: - AD Sites-and-Services SRV records (site-specific DC lookups) - NS/MX record resolution for infrastructure IPs - _msdcs forest-wide DC enumeration (PDC, GC, Kerberos) - DNS zone transfer attempts (AXFR) to extract all A records - Reverse DNS sweep on known subnets for adjacent hosts - Common AD hostname brute-force (dc1, exchange, ca, adfs, etc.) Integrated as Strategy 5 in auto_detect_dcs pipeline — discovered subnets are scanned for DCs via Kerberos port + LDAP fingerprint. Results reported in JSON output as dns_discovered_subnets. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BmXsxtqyCjJApeagPGhAQY
Three extraction methods with automatic fallback: - DCSYNC: DCSync via DRSUAPI (fastest, requires replication rights) - VSS: Volume Shadow Copy (SAM + LSA + NTDS, requires local admin) - NTDSUTIL: IFM export via WMI/DCOM + SMB file pull Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01StfRVksGuSEQdzZAoXUNpC
…xtraction ADCVERegistry: Comprehensive database of 40 critical Active Directory CVEs - Metadata includes CVSS scores, components, exploitation status - Query methods: filter by severity, component, tag, CVSS, auth requirement - Report generation for vulnerability assessment - Covers LDAP, SMB, Certificate Services, Kerberos, Exchange, RPC, ADFS RemoteNtdsDumpService (from previous commit): - Python port of C# NTDS dump service - Three extraction methods with automatic fallback: * DCSYNC: DCSync via DRSUAPI (fastest, requires replication rights) * VSS: Volume Shadow Copy (SAM + LSA + NTDS, requires local admin) * NTDSUTIL: IFM export via WMI/DCOM + SMB file pull Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01StfRVksGuSEQdzZAoXUNpC
- Update version to 1.1.2 in __init__.py (matches pyproject.toml) - Build distribution packages (sdist + wheel) - Add comprehensive PyPI publication guide with authentication setup - Add automated publish_to_pypi.py script for easy uploads - Distributions ready for upload (in dist/ directory) Publication steps: 1. Create PyPI account: https://pypi.org/account/register/ 2. Generate API token: https://pypi.org/manage/account/tokens/ 3. Run: python3 publish_to_pypi.py --upload --token <token> Or follow manual steps in PYPI_PUBLISH_GUIDE.md Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01StfRVksGuSEQdzZAoXUNpC
- Update version in pyproject.toml to 1.1.2a - Update version in adpentest/__init__.py to 1.1.2a - Rebuild distributions for alpha release - Ready for PyPI publication as pre-release This is an alpha (pre-release) version of 1.1.2 containing: - ADCVERegistry with 40 critical AD CVEs - RemoteNtdsDumpService for NTDS extraction - Top 40 AD CVE vulnerability database Publish with: python3 publish_to_pypi.py --upload --token <token> Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01StfRVksGuSEQdzZAoXUNpC
Replace all em-dashes, en-dashes, and arrows with ASCII equivalents to prevent UnicodeEncodeError on Windows charmap encoding. - Replace — (em-dash) with - - Replace – (en-dash) with - - Replace → (arrow) with -> This ensures the tool works correctly when output to Windows console or systems with limited Unicode support. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01StfRVksGuSEQdzZAoXUNpC
Implement parallel penetration attempts across all discovered alive IP addresses using the same technique in parallel. This allows for efficient security testing across the entire network scope with configurable concurrency. New Features: - parallel_pentest_attempt() function for executing techniques across multiple IPs - Supported techniques: smb-null-session, ldap-anonymous, rpc-probe, smtp-vrfy, kerberos-probe - Parallel execution with configurable worker threads (default: 32) - Detailed reporting of successes, failures, and errors - Integration with main scan pipeline - Command-line options: --pentest-technique, --pentest-workers Usage Examples: adpentest --target domain.local --pentest-technique smb-null-session --scope-confirmed adpentest --target 10.0.0.1 --pentest-technique ldap-anonymous --pentest-workers 64 --scope-confirmed adpentest --target corp.local --pentest-technique rpc-probe --mode active --scope-confirmed Techniques: - smb-null-session: Test SMB null session access (port 445) - ldap-anonymous: Test LDAP anonymous bind (port 389) - rpc-probe: Probe RPC endpoints (ports 135, 139, 445) - smtp-vrfy: SMTP user enumeration via VRFY command (port 25) - kerberos-probe: Check Kerberos service availability (port 88) Results include host-by-host status, success rates, and timing information. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01StfRVksGuSEQdzZAoXUNpC
Document the new parallel penetration testing functionality including: - Overview of the feature and supported techniques - Detailed documentation for each technique (SMB, LDAP, RPC, SMTP, Kerberos) - Command-line usage examples and advanced options - Performance tuning and worker thread recommendations - Practical examples for common scenarios - Output format and result interpretation guide - Integration with other adpentest features - Security considerations and authorization requirements - Troubleshooting guide for common issues This guide helps users leverage the parallel pentest feature for efficient network security assessment across multiple hosts. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01StfRVksGuSEQdzZAoXUNpC
Enhance golden ticket generation with automatic credential extraction and obtaining from Active Directory using multiple methods: New Features: - Automatic NTDS credential extraction from null session probes - Full credential dumping via DCSync (secretsdump.py) - Extraction of admin accounts, service accounts, and regular user credentials - golden_ticket_with_extracted_creds() function for post-exploitation planning Credential Sources: 1. Null Session NTDS Dump (no auth required) 2. DCSync via DRSUAPI (requires Domain Admin credentials) 3. LDAP unicodePwd fallback (special privileges needed) The pipeline now extracts and combines: - KRBTGT hash (for golden ticket generation) - Admin account hashes (for lateral movement) - Service account hashes (for service-level compromise) - User account hashes (for privilege escalation) Post-Exploitation Chains: 1. Golden Ticket + Admin Hash (Pass-the-Hash) - Use Kerberos TGT from golden ticket for transparent auth - Use extracted admin hash for SMB/RPC when needed 2. Service Account Abuse - Target compromised service accounts discovered during extraction - Execute in context of service account privileges 3. Kerberos + SMB Hybrid - Golden ticket for Kerberos TGT - Extracted hashes for fallback authentication Usage: adpentest --target dc.domain.local --pentest-technique golden-ticket --scope-confirmed Output includes: - extracted_credentials: Dict of obtained account hashes - credential_extraction_count: Number of credentials obtained - exploitation_chains: Post-exploitation techniques using combined credentials - recommended_exploits: Tools and commands for lateral movement Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01StfRVksGuSEQdzZAoXUNpC
Document the integrated golden ticket generation with automatic credential extraction feature, including: - Overview of the dual-approach (Kerberos TGT + NTLM Hashes) - Automatic KRBTGT hash extraction via multiple methods - Additional credential extraction from NTDS (null session + DCSync) - Credential extraction methods and requirements - Output format with extracted_credentials and exploitation analysis - Post-exploitation chains combining golden tickets + extracted hashes - Practical exploitation workflows (4-phase process) - Defense mechanisms and detection strategies - Mitigation recommendations for Active Directory - Ethical and legal considerations - Limitations and constraints of the techniques Extraction Methods Covered: 1. Null Session NTDS Dump (no authentication required) 2. DCSync Full Dump (Domain Admin credentials required) 3. Hybrid Approach (combined null session + DCSync) Post-Exploitation Chains: 1. Golden Ticket + Admin Hash for lateral movement 2. Service Account Abuse using extracted service hashes 3. Credential Spraying with all extracted hashes This guide helps penetration testers understand and leverage the combined power of forged Kerberos tickets and extracted credential hashes for comprehensive Active Directory compromise scenarios. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01StfRVksGuSEQdzZAoXUNpC
Update version from 1.1.2a (alpha) to 1.1.2 (stable) for official PyPI release. New Features in 1.1.2: - Parallel penetration testing on all alive IPs (5 techniques) - Golden ticket generation with automatic credential extraction - Unicode encoding fixes for Windows console compatibility - Enhanced NTDS credential dumping (null session + DCSync) - Post-exploitation chain planning - Comprehensive documentation guides Ready for PyPI publication. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01StfRVksGuSEQdzZAoXUNpC
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01StfRVksGuSEQdzZAoXUNpC
- Add pytest test suite for SMTP/POP3/IMAP authentication functions - Add tests for DC discovery, AD tool discovery and execution - Add tests for DNS configuration and threaded executor - Mock all external services (smtplib, poplib, imaplib, subprocess) - 36 tests covering success, failure, and error cases
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a comprehensive pytest unit test suite for the core functions in
adpentest/core.py.Tests Added
smtp_vrfy_enum,smtp_rcpt_enum,smtp_auth_test(success, failure, timeout, connection refused)pop3_auth_test(success, SSL, failure, connection refused)imap_auth_test(success, SSL, failure, connection refused)discover_tools,find_executablebuild_ad_command(nmap, credentials, domain)execute_ad_tool(success, credentials)Coverage
Files Changed
tests/conftest.py- pytest fixtures and mockstests/test_core.py- comprehensive test suitetests/mocks/__init__.py- mock utilities