ADPulse - Active Directory Vulnerability Scanner

项目说明

ADPulse — Acti Security Scanner

![ko-fi]()

<p align="left">
<img src="
</p>

ADPulse is an open-source Acti security auditing tool that connects to a domain controller via LDAP(S), runs 35 automated security checks, and produces detailed reports in console, JSON, and HTML formats.

It is designed for IT administrators, penetration testers, and security teams who need a fast, read-only assessment of AD misconfigurations and attack surface.

A PowerShell script named test_en.ps1 is also included if you wish to set up your own domain controller to test with.

---

Features

Security Checks (35 total)

| # | Check | Description |
|---|-------|-------------|
| 1 | Password Policy | Minimum length, history, complexity, lockout threshold, re encryption, fine-grained PSOs |
| 2 | Pri Accounts | Membership of Domain Admins, Enterprise Admins, Schema Admins, and other sensiti; stale members, non-expiring passwords, passwords in descriptions, built-in Administrator status, krbtgt age |
| 3 | Kerberos | Kerberoastable accounts (SPNs on user objects), AS-REP roastable accounts, DES-only encryption, high-value targets combining adminCount=1 + SPN + PasswordNe |
| 4 | Unconstrained Delegation | Non-DC computers and user accounts trusted for unconstrained Kerberos delegation |
| 5 | Constrained Delegation | Accounts with protocol transition (S4U2Self) and standard constrained delegation targets |
| 6 | ADCS / PKI | ESC1, ESC2, ESC3, ESC6, ESC8, ESC9, ESC10, ESC11, ESC13, ESC15, weak key sizes, enrollee ACL enumeration |
| 7 | Domain Trusts | Bidirectional trusts without SID filtering, forest trusts, external trusts |
| 8 | Account Hygiene | Stale users/computers, ne accounts, PASSWD_NOTREQD flag, re encryption per-account, old passwords, duplicate SPNs |
| 9 | Protocol Security | LDAP signing/channel binding, DC operating system , domain/forest functional level, NTLMv1/WDigest guidance |
| 10 | Group Policy Objects | Disabled, orphaned, unlinked, and empty GPOs; excessive GPO count |
| 11 | LAPS | Legacy LAPS and Windows LAPS schema detection; computers without LAPS passwords |
| 12 | LAPS Co | Percentage-based co of all non-DC computers with a LAPS-managed password |
| 13 | DNS & Infrastructure | Wildcard DNS records, LLMNR/NetBIOS-NS poisoning guidance |
| 14 | Domain Controllers | Single-DC detection, legacy OS on DCs, FSMO roles, RODC password replication policy |
| 15 | ACL / Permissions | ESC4, ESC5, ESC7, DCSync rights on non-pri principals, Protected Users group, delegation ACLs |
| 16 | Optional Features | AD Recycle Bin, Pri Access Management (PAM) |
| 17 | Replication Health | Site count, site link replication intervals, nTDSDSA objects |
| 18 | Service Accounts | gMSA adoption, regular user service accounts, service accounts with adminCount=1 |
| 19 | Miscellaneous Hardening | Machine account quota, tombstone lifetime, Schema Admins/Enterprise Admins membership, Guest account, audit policy guidance |
| 20 | Deprecated Operating Systems | Enabled computer accounts reporting end-of-life Windows |
| 21 | Legacy Protocols | SMBv1 detection, SMB signing enforcement, null session acceptance (li probes) |
| 22 | Exchange | Exchange Windows Permissions group (Pri / C), Exchange Trusted Subsystem |
| 23 | Protected Admin Users | adminCount=1 in — orphaned, ghost (disabled), and stale accounts |
| 24 | Passwords in Descriptions | Keyword-based detection of credentials stored in the Description field of users, admins, and computers |
| 25 | GPP / cpassword (MS14-025) | Walks SYSVOL for Group Policy Preferences XML files containing cpassword attributes and decrypts them using Microsoft's publicly-known AES key |
| 26 | AdminSDHolder ACL | Reads the binary DACL on CN=AdminSDHolder and flags non-pri principals with write access — these ACEs auto-propagate to all protected accounts every 60 minutes |
| 27 | SID History | Detects accounts with sIDHistory populated; escalates to CRITICAL if any injected SID maps to a pri group (Domain Admins, Enterprise Admins, etc.) |
| 28 | Shadow Credentials | Flags unexpected msDS-KeyCredentialLink entries on user and computer objects, enabling certificate-based authentication without knowing the account password |
| 29 | RC4 / Legacy Kerberos Encryption | Checks msDS-SupportedEncryptionTypes on service accounts, DCs, and admin accounts to identify those still permitting RC4-HMAC — the weak enctype attackers specifically request for offline cracking |
| 30 | Foreign Security Principals in Pri Groups | Enumerates CN=ForeignSecurityPrincipals and flags any FSP from a trusted domain that is a member of a sensiti group (Domain Admins, Backup Operators, etc.) |
| 31 | Pre-Windows 2000 Compatible Access | Checks whether E or Anonymous Logon are members of this group, which enables unauthenticated SAMR/LSARPC enumeration from anywhere on the network |
| 32 | Dangerous Constrained Delegation Targets | Cross-references delegation targets against DC hostnames and flags accounts delegating to high-value service classes (ldap/, cifs/, host/, gc/, krbtgt/) on Domain Controllers |
| 33 | Orphaned AD Subnets | Finds subnets with no siteObject assignment, causing clients to receive a random DC and potentially routing authentication traffic across WAN links |
| 34 | Legacy FRS SYS | Detects whether SYSVOL is still replicating via the deprecated File Replication Service instead of DFSR, and flags stalled mid-migration states |
| 35 | RBCD on Domain Object / DCs | Checks msDS-AllowedToActOnBehalfOfOtherIdentity on the domain NC head and all DC computer objects — either configuration grants effecti Admin to the permitted principals |

Reporting

Scoring

Every finding carries a risk-score deduction. The o score starts at 100 and is reduced per finding:

| Score | Risk Level | Meaning |
|-------|-----------|---------|
| 80–100 | LOW | Good security posture, minor issues only |
| 60–79 | MEDIUM | Notable weaknesses that should be addressed |
| 40–59 | HIGH | Significant present |
| 0–39 | CRITICAL | Severe risks — immediate remediation required |

---

Requirements

Python Dependencies

---

Installation

---

Usage

Basic Scan

The DC IP is auto-resolved via DNS. All three report formats (console, JSON, HTML) are generated by default into a Reports/ folder.

Specify a Domain Controller

Choose Report Format

Custom Output Directory

Reports are written to <output-dir>/Reports/.

Disable Colour Output

Full Argument Reference

| Argument | Required | Default | Description |
|----------|----------|---------|-------------|
| --domain | Yes | — | Target AD domain (e.g. corp.local) |
| --user | Yes | — | Domain username |
| --password | Yes | — | Domain password |
| --hash | Only without Password | — | Domain NTLM hash |
| --dc-ip | No | Auto-resolved | Domain Controller IP address |
| --report | No | all | Report format: console, json, html, or all |
| --output-dir | No | . | Parent directory for the Reports/ folder |
| --no-color | No | false | Disable colour in console output |

---

Project Structure

---

How It Works

1. Connect — ADPulse binds to the target DC o (port 636) with automatic fallback to LDAP (port 389). Authentication is attempted via NTLM and SIMPLE bind.
2. Scan — Each of the 35 check functions queries AD via LDAP and, for certain checks, performs supplementary operations: lightweight network probes (SMBv1, signing, null sessions) against discovered hosts, SYS tra for GPP credential detection, and raw binary DACL parsing for ACL-based checks.
3. Score — Findings are assigned a se (CRITICAL → INFO) and a point deduction. The o score is max(0, 100 - total_deductions).
4. Report — Results are rendered to the console and optionally exported as JSON and/or a self-contained HTML file.

All operations are read-only. ADPulse does not modify any AD objects, group memberships, GPOs, or ACLs.

---

Security Considerations

---

Limitations

---

Contributing

Contributions are welcome. To add a new check:

1. Create a function in checks.py following the signature def check_name(ad: ADConnector) -> Tuple[List[Finding], Dict].
2. Add it to the checks list inside run_all_checks().
3. Add any new stat keys to _SPECIAL_STATS in report.py if they need dedicated rendering, or to _build_stat_cards() if they warrant a key-metric card.

---

License

This project is released under the MIT License. See LICENSE for details.

---

Disclaimer

ADPulse is provided as-is for authorised security assessments only. Always obtain written permission before scanning any Acti en. The authors are not responsible for misuse or any damage caused by this tool.

项目信息

开发语言：Python

Star 数：481

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Active Directory Vulnerability Scanner展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。