Locksmith2 - An AD CS toolkit for AD Admins, Defensive Security

项目说明

Locksmith 2

!The Locksmith 2 logo features the word "locksmith" followed by the number "2" in a bold, blocky pixelated font. The design uses a gradient color scheme transitioning from light la on the left through pink tones to coral/orange on the right, set against a dark purple background with a rectangular border. The retro-digital aesthetic gives the logo a modern yet approachable feel, suggesting a tool that makes security management accessible and straightforward. The "2" indicates this is the second of the Locksmith tool.

An AD CS toolkit for Acti Admins, Defensi Professionals, and Filthy Red Teamers

![PowerShell Gallery]()
![PowerShell]()![Ask DeepWiki]()

O

Locksmith 2 is a comprehensi module for auditing Acti Certificate Services (AD CS) infrastructure. It identifies security misconfigurations across certificate templates, certification authorities, and PKI infrastructure objects based on established ESC (Escalation) techniques.

Built for AD administrators, security professionals, and penetration testers, Locksmith 2 provides:

Locksmith 2 represents the next generation in the Locksmith line of open-source AD CS security tooling, improving upon the original with better code organization, enhanced reporting, and deeper risk analysis.

Features

Installation

From PowerShell Gallery

From Source

Quick Start

Start in Interactive mode

Generate HTML Dashboard

Supported ESC Techniques

| Technique | Description | Target Objects | Sub-techniques |
| --------- | ----------- | -------------- | -------------- |
| ESC1 | Misconfigured Certificate Templates | Templates | — |
| ESC2 | Certificate SubCA Abuse | Templates | — |
| ESC3 | Enrollment Agent Restrictions | Templates | ESC3c1, ESC3c2 |
| ESC4 | Access Control | Templates | ESC4a (ACL), ESC4o (owner) |
| ESC5 | PKI Object Access Control | Infrastructure Objects | ESC5a (ACL), ESC5o (owner) |
| ESC6 | EDITF_ATTRIBUTESUBJECTALTNAME2 Enabled | CAs | — |
| ESC7 | CA Administrator/Manager Roles | CAs | ESC7a (admin), ESC7m (manager) |
| ESC8 | Web Enrollment Endpoints | CAs | — |
| ESC9 | Weak Certificate Mappings | Templates | — |
| ESC11 | Missing RPC Encryption | CAs | — |
| ESC13 | Group-Linked OID Application Policy | Templates | — |
| ESC16 | Disabled CRL/AIA Security Extensions | CAs | — |

For detailed information on ESC techniques, see Certified Pre-Owned by SpecterOps.

cmdlet Reference

Primary Functions

#### In

Performs comprehensive AD CS security audit scanning for all known ESC .

#### Find-LS2

Scans certificate templates for specific ESC .

Returns: LS2Issue objects for programmatic use

#### Find-LS2

Scans certification authorities for configuration issues and dangerous role assignments.

Returns: LS2Issue objects for programmatic use

#### Find-LS2

Scans PKI infrastructure objects (containers, computer accounts) for security issues.

Returns: LS2Issue objects for programmatic use

#### Get-LS2Stores

Returns internal data stores populated during audits for inspection and analysis.

Returns:

#### Set-LS2Forest

Sets the target forest for scanning. Useful for running multiple scans or using Find-LS2* functions independently.

#### Set-LS2Credential

Sets credentials for AD queries. Useful for running multiple scans or using Find-LS2* functions independently.

#### Find-LS2RiskyPrincipal

Pivots from configuration-centric to principal-centric risk analysis. Aggregates by indi principal to show which users or service accounts have the highest AD CS exposure.

Returns: PSCustomObject with Principal, IssueCount, Techniques, , Issues

#### New-LS2Dashboard

Generates an interactive HTML dashboard from current scan results. PSWriteHTML is included () — no separate install needed.

Returns: HTML file at the specified path. Run In or Find-LS2* first to populate the store.

Requirements

Contributing

Locksmith 2 is "Open Source, acknowledged contribution", this means that any contribution will have to be discussed with the Maintainers before being submitted.

1. Open an issue and discuss your proposed change
2. Fork the repository
3. Write some code following PowerShell best practices and existing code style
4. Write clear commit messages using con commits
5. Submit a pull request
6. Request a review from

Acknowledgments

Related Projects

Disclaimer

Locksmith 2 is provided for legitimate security assessment and defensi only. Users are responsible for obtaining proper authorization before running security audits. The authors are not responsible for misuse or damage caused by this tool.

License

MIT License w/Commons Clause - see LICENSE file for details.

---

Made with 💜 by Jake Hildreth

项目信息

开发语言：PowerShell

Star 数：100

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕An AD CS toolkit for AD Admins, Defensive Security Professionals, and Filthy Red Teamers展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。