bloodyAD
Active Directory privilege escalation framework that performs specific LDAP calls to domain controllers. Supports authentication via cleartext passwords, pass-the-hash, pass-the-ticket, or certificates.
Description
bloodyAD is designed for Active Directory privilege escalation, enabling users to exploit domain controllers through targeted LDAP operations. It binds to LDAP services on domain controllers to execute privilege escalation tasks, making it a versatile tool for AD environments.
The tool supports multiple authentication methods including cleartext passwords, pass-the-hash, pass-the-ticket, and certificates. It can operate without LDAPS, allowing exchange of sensitive information over standard LDAP, and is compatible with SOCKS proxies for transparent usage in networked environments.
Use cases include red team engagements where initial access to a domain user is obtained, and escalation to higher privileges is required via AD misconfigurations or weak permissions.
How It Works
bloodyAD connects to domain controller LDAP services using NTLM or Kerberos authentication. It issues specific LDAP calls to perform operations like adding, getting, removing, or setting AD objects, exploiting permission weaknesses for privilege escalation. Supports non-encrypted LDAPS exchanges and proxying via SOCKS.
Installation
sudo apt install bloodyadFlags
Examples
bloodyAD -hbloodyAD -d DOMAIN -u USERNAME -p PASSWORD addbloodyAD -d DOMAIN -u USERNAME -k KERBEROS getbloodyAD -d DOMAIN -u USERNAME -p PASSWORD -s removebloodyAD --dc-ip DC_IP -u USERNAME -p PASSWORD setbloodyAD -d DOMAIN -u USERNAME -c CERTIFICATE --dns DNS getbloodyAD -d DOMAIN -u USERNAME -p PASSWORD -v DEBUG add