How jonaslejon/ad-autopwn works
AD AutoPwn is an authorized Active Directory penetration-testing orchestrator. Its principal workflow moves from pre-auth discovery and passive foothold techniques through credential harvesting, graph-guided privilege escalation, domain compromise, and post-exploitation loot. The main implementation is a single large script, so several distinct capabilities documented in the README share its path; their internal wiring is not fully verifiable from the sampled excerpts. The companion CLDAP enumerator and CMC certificate tool are also shown as separate executable components.
Main entry points: ad-autopwn.py AD AutoPwn · cmc_addext.py CMC Certificate Tool · userenum-cldap.py CLDAP Enumeration
Components 14
Initial Discovery
- AD AutoPwn
ad-autopwn.py - Pre-auth Discovery
ad-autopwn.py
Foothold Techniques
- Passive and L2 Attacks
ad-autopwn.py - Credential Harvesting
ad-autopwn.py
Escalation and Compromise
- BloodHound Analysis
ad-autopwn.py - Privilege Escalation
ad-autopwn.py - AD CS Exploitation
ad-autopwn.py - Domain Compromise
ad-autopwn.py
Harvest and Loot
- Post-exploitation Loot
ad-autopwn.py
Companion Tools
- CLDAP Enumeration
userenum-cldap.py - CMC Certificate Tool
cmc_addext.py
Other components
- Operator
- Active Directory
- External Security Tools
Connections 23
- Operator → AD AutoPwn: runs phases
- AD AutoPwn → Pre-auth Discovery: runs discovery
- Pre-auth Discovery → CLDAP Enumeration: invokes companion
- Pre-auth Discovery → Active Directory: queries users
- AD AutoPwn → Passive and L2 Attacks: runs techniques
- Passive and L2 Attacks → Active Directory: coerces authentication
- AD AutoPwn → Credential Harvesting: runs harvesting
- Credential Harvesting → Active Directory: queries credentials
- AD AutoPwn → BloodHound Analysis: runs analysis
- BloodHound Analysis → Active Directory: collects directory data
- BloodHound Analysis → Privilege Escalation: dispatches auto-actions
- AD AutoPwn → Privilege Escalation: runs escalation
- Privilege Escalation → Active Directory: abuses directory rights
- AD AutoPwn → AD CS Exploitation: runs certificate attacks
- AD CS Exploitation → CMC Certificate Tool: invokes CMC fallback
- AD CS Exploitation → Active Directory: requests certificates
- CMC Certificate Tool → Active Directory: enrolls certificate
- AD AutoPwn → Domain Compromise: runs compromise
- Domain Compromise → Active Directory: dumps domain secrets
- AD AutoPwn → Post-exploitation Loot: runs loot phase
- Post-exploitation Loot → Active Directory: collects host loot
- Credential Harvesting → External Security Tools: uses cracking tools
- Passive and L2 Attacks → External Security Tools: uses relay tools