Open-source Rust · Active Directory pentest tool

See the domain.Understand the proof.

ADhammer is a single Rust engine that collects the directory, builds its control graph, validates the path, and leaves behind evidence you can inspect.

one binary61 protocol crateslive evidenceMIT licensed
See the benchmarks →
Tier-0 / resolved Move pointer to rotate
Scroll to enter the engine
32identity nodes
46control edges
03evidence hops
01resolved path

No dashboard theatre.

No vague alerts.

Just the system, explained.

The idea

Every Active Directory environment is already a graph. ADhammer makes that graph legible, then separates a theoretical route from one supported by evidence.

01 / Inside the engine

Four transformations.
One continuous model.

01 / Collect

Read the domain.

LDAP objects, access-control entries, trusts, certificate services, delegation, and security posture enter one typed in-memory model.

LDAPSD_FLAGSAD CSTrusts
02 / Graph

Reveal control.

Identity relationships become directional edges. ADhammer resolves the cheapest viable control path to Tier-0 without leaving the process.

DijkstraACL edgesTier-0BloodHound
03 / Validate

Illuminate proof.

The chosen route is walked under authorization. Each hop changes state only when concrete evidence exists on the wire.

HashCertificateTicketSecret
04 / Report

Preserve context.

Finding, path, proof, command, and MITRE technique stay connected across every export — ready for operators and defenders to inspect.

JSONHTMLMarkdownBloodHound CE
ADHAMMER / ENGINE SCHEMACOLLECTING
01 objects02 graph03 proof04 exports
Domain intakeLDAP → typed objects
41 checks in context
The evidence flow

Signal becomes structure.
Structure becomes proof.

A finding never travels alone. Its origin, graph relationship, validation state, and report identity remain connected.

Input / 01

Directory objects

Users, groups, machines, trusts, CAs, templates, and ACLs.

Model / 02

Typed relations

Permission and identity data becomes a consistent Rust model.

Graph / 03

Control paths

Directed edges reveal who can become what, through which primitive.

Proof / 04

Validated state

Evidence promotes an edge from possible to reproducibly demonstrated.

Output / 05

Portable record

The same context arrives in JSON, HTML, Markdown, and BloodHound CE.

One continuous session

Watch the model change state.

The console is not decoration. It mirrors the internal lifecycle: collect, resolve, validate, attach evidence, export.

operator@engagement — adhammer● authorized session
$ adhammer
[domain] binding to dc.corp.local as low-priv identity
[collect] 486 objects · 1,204 ACEs · 7 templates · 2 trusts
[audit] running 41 hygiene checks + AD CS classes
[graph] constructing directional control model
[graph] shortest route to Tier-0: 3 hops
[path] svc-build → workstation-07 → delegation → krbtgt
[validate] collecting protocol-level evidence
[proof] T1558.003 · artifact attached · sha256 recorded
[validated] path state changed: POSSIBLE → PROVEN
[export] JSON · HTML · Markdown · BloodHound CE
[complete] evidence preserved with every hop
System online

The engine, brought online.

A live readout of the run loop — the same collect, resolve, and validate cycle, rendered as a holographic console.

ADHAMMER · REACTOR COREOPERATOR zevs · ORG icedracon
Proof under load

Compiled speed,
measured in the open.

0×
Zerologon safe-detect
54 ms · vs NetExec
0×
AD CS enumeration
67 ms · vs certipy
0×
ESC1 end-to-end
315 ms · vs certipy
0×
Full audit + report
88 ms · vs NetExec
Head-to-head — wall-clock, Windows Server 202511 / 12 wins + 1 exclusive
Process spawn to exit against a fully-patched DC. Tool versions, method, and raw logs are published — reproduce or discount with one command. vs impacket · certipy · bloodyAD · NetExec
AD CS coverage

Fifteen of sixteen
ESC classes, mapped.

15 / 16

Every AD CS ESC class is covered except ESC12 (hardware-token / YubiHSM), which is out of scope. Colour shows how far ADhammer takes each one — from passive detection to issuing a real certificate.

Active enrollment · issues a real cert
Registry probe · MS-RRP
Passive detection
Out of scope
Protocol universe

One tool.
Sixty-one precise parts.

ADhammer is built on the icedracon protocol ecosystem: small Rust crates for Microsoft security protocols, composed into one inspectable engine.

AD//HAMMER
DCE/RPCms-drsr · ms-nrpc · ms-samr
KERBEROSms-pac · FAST · PKINIT
AUTH / CRYPTOntlmssp · credssp · dpapi-ng
TRANSPORTdcerpc · smb2-client · ms-ndr
Move pointer to orbit the stack61 independent crates / one composed binary
Design principles

Evidence over assumption.

01

Protocol-shaped

Implementation follows Microsoft protocol structures instead of hiding them behind a loose collection of shell wrappers.

02

State is explicit

A theoretical edge and a validated edge are different objects. The interface and every export preserve that difference.

03

Context survives

The graph, technique, command, and artifact remain connected from collection through the final report.

04

Built to be inspected

One static Rust binary on top of standalone crates, open source and MIT licensed.

Get ADhammer

One command.
No runtime to carry.

shell
# latest, straight from crates.io
$ cargo install adhammer

# audit low-priv, export a BloodHound bundle
$ adhammer scan --url ldaps://dc.corp.local:636 \
    --user 'CORP\svc' --insecure --bloodhound out.zip

# or just run it — guided wizard
$ adhammer
Prebuilt binaries

musl (static) · glibc · macOS arm64 + x64 · Windows x64 — per release.

As a library

cargo add adhammer-sdk — every protocol module importable on its own.

Runs everywhere

Kali · Ubuntu · Debian · macOS · native Windows. Builds on Rust 1.80+.

crates.io ↗Releases ↗
The domain, made visible

This is
ADhammer.

Audit·Graph·Attack·Report
Rust · Active Directory security engineering

The open-source Rust Active Directory pentest & audit engine — explore the implementation, the protocol crates, and the evidence model in the source.

Open the GitHub repository ↗
Forged by zevs · an icedracon project