icedracon/adhammer

What it is

ADhammer v1.5.2 is a Rust CLI for authorized Active Directory assessments (github.com/icedracon/adhammer), distributed via cargo install --locked adhammer or prebuilt Linux/macOS/Windows binaries — no Python runtime or sidecar service required.

How it works

The tool follows a Discover → Map → Validate → Report pipeline, and exposes its functions as <group> <verb> commands (e.g. enum, attack, check, doctor). Credential secrets are never passed as literal argv strings — a "SecretString guard" rejects them to prevent shell-history leakage; instead flags like --password, --nt-hash, --krbtgt-aes256, --service-aes256, and --pfx-password take @file:... references.

Preconditions / Affected

Different verbs require different access levels: doctor --domain works with no credentials (DNS SRV + TCP probes); enum ldap-info only needs anonymous LDAP bind; most enum/check commands need a domain user with LDAPS access; enum esc (CA registry read) needs SMB/MS-RRP access to the CA host; the new ESC1/KB5014754 bypass targets Windows Server 2025 "Full-Enforcement" KDCs specifically.

What to do

Ten starting workflows given as copy-adaptable examples (replace example.test hosts/accounts only within approved scope):

adhammer doctor --domain example.test --dc dc.example.test --timeout 3 --json
adhammer doctor --client workstation.example.test --timeout 3 --json
adhammer enum ldap-info --url ldaps://dc.example.test:636 --text
adhammer enum dns --url ldaps://dc.example.test:636 --user auditor@example.test --password "@file:./audit-password.txt" --text
adhammer check adcs --url ldaps://dc.example.test:636 --user auditor@example.test --password "@file:./audit-password.txt" --json
adhammer enum esc --host ca.example.test --domain EXAMPLE --user auditor --password "@file:./audit-password.txt" --ca EXAMPLE-CA --text
adhammer enum adcs --url ldaps://dc.example.test:636 --user auditor@example.test --password "@file:./audit-password.txt" --text
adhammer enum posture --host dc.example.test --domain EXAMPLE --user auditor --password "@file:./audit-password.txt" --text
adhammer enum sccm --url ldaps://dc.example.test:636 --user auditor@example.test --password "@file:./audit-password.txt" --text
adhammer enum scom --url ldaps://dc.example.test:636 --user auditor@example.test --password "@file:./audit-password.txt" --text

--insecure disables certificate verification and is explicitly flagged as unsuitable for production use; use --gssapi or --allow-plaintext-ldap instead of running against misconfigured plaintext LDAP.

Caveats

The page repeatedly stresses that reads are not proof: a skipped bind doesn't establish authentication, port reachability isn't authenticated posture, missing registry values aren't confirmed-secure defaults, and discovered SCCM/SCOM objects are "inventory leads," not evidence of live, exploitable services. The 10 workflows were checked against v1.5.2 source but are "not new live-validation receipts." The validation ledger (linked on the page, not reproduced in the fetched text) is stated to be the authoritative source for support/readiness claims, so method-level confidence should be checked there rather than assumed from this page.