# jonaslejon/ad-autopwn architecture

> Architecture diagram of the GitHub repository jonaslejon/ad-autopwn, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/jonaslejon/ad-autopwn
- Repository: https://github.com/jonaslejon/ad-autopwn

## Overview

AD AutoPwn is an authorized Active Directory penetration-testing orchestrator. Its principal workflow moves from pre-auth discovery and passive foothold techniques through credential harvesting, graph-guided privilege escalation, domain compromise, and post-exploitation loot. The main implementation is a single large script, so several distinct capabilities documented in the README share its path; their internal wiring is not fully verifiable from the sampled excerpts. The companion CLDAP enumerator and CMC certificate tool are also shown as separate executable components.

Main entry points: [`ad-autopwn.py`](https://github.com/jonaslejon/ad-autopwn/blob/main/ad-autopwn.py) (AD AutoPwn), [`cmc_addext.py`](https://github.com/jonaslejon/ad-autopwn/blob/main/cmc_addext.py) (CMC Certificate Tool), [`userenum-cldap.py`](https://github.com/jonaslejon/ad-autopwn/blob/main/userenum-cldap.py) (CLDAP Enumeration)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_discovery["Initial Discovery"]
  node_autopwn["AD AutoPwn<br/>[ad-autopwn.py]"]
  node_preauth["Pre-auth Discovery<br/>[ad-autopwn.py]"]
end

subgraph group_foothold["Foothold Techniques"]
  node_passive["Passive and L2 Attacks<br/>[ad-autopwn.py]"]
  node_credentials["Credential Harvesting<br/>[ad-autopwn.py]"]
end

subgraph group_escalation["Escalation and Compromise"]
  node_bloodhound["BloodHound Analysis<br/>[ad-autopwn.py]"]
  node_primitives["Privilege Escalation<br/>[ad-autopwn.py]"]
  node_adcs["AD CS Exploitation<br/>[ad-autopwn.py]"]
  node_compromise["Domain Compromise<br/>[ad-autopwn.py]"]
end

subgraph group_loot["Harvest and Loot"]
  node_postloot["Post-exploitation Loot<br/>[ad-autopwn.py]"]
end

subgraph group_companions["Companion Tools"]
  node_cldap["CLDAP Enumeration<br/>[userenum-cldap.py]"]
  node_cmc["CMC Certificate Tool<br/>[cmc_addext.py]"]
end

node_operator(("Operator"))
node_dc[("Active Directory")]
node_attacktools["External Security Tools"]

node_operator -->|"runs phases"| node_autopwn
node_autopwn -->|"runs discovery"| node_preauth
node_preauth -.->|"invokes companion"| node_cldap
node_preauth -->|"queries users"| node_dc
node_autopwn -->|"runs techniques"| node_passive
node_passive -->|"coerces authentication"| node_dc
node_autopwn -->|"runs harvesting"| node_credentials
node_credentials -->|"queries credentials"| node_dc
node_autopwn -->|"runs analysis"| node_bloodhound
node_bloodhound -->|"collects directory data"| node_dc
node_bloodhound -->|"dispatches auto-actions"| node_primitives
node_autopwn -->|"runs escalation"| node_primitives
node_primitives -->|"abuses directory rights"| node_dc
node_autopwn -->|"runs certificate attacks"| node_adcs
node_adcs -.->|"invokes CMC fallback"| node_cmc
node_adcs -->|"requests certificates"| node_dc
node_cmc -->|"enrolls certificate"| node_dc
node_autopwn -->|"runs compromise"| node_compromise
node_compromise -->|"dumps domain secrets"| node_dc
node_autopwn -->|"runs loot phase"| node_postloot
node_postloot -->|"collects host loot"| node_dc
node_credentials -.->|"uses cracking tools"| node_attacktools
node_passive -.->|"uses relay tools"| node_attacktools

click node_autopwn "https://github.com/jonaslejon/ad-autopwn/blob/main/ad-autopwn.py"
click node_preauth "https://github.com/jonaslejon/ad-autopwn/blob/main/ad-autopwn.py"
click node_cldap "https://github.com/jonaslejon/ad-autopwn/blob/main/userenum-cldap.py"
click node_passive "https://github.com/jonaslejon/ad-autopwn/blob/main/ad-autopwn.py"
click node_credentials "https://github.com/jonaslejon/ad-autopwn/blob/main/ad-autopwn.py"
click node_bloodhound "https://github.com/jonaslejon/ad-autopwn/blob/main/ad-autopwn.py"
click node_primitives "https://github.com/jonaslejon/ad-autopwn/blob/main/ad-autopwn.py"
click node_adcs "https://github.com/jonaslejon/ad-autopwn/blob/main/ad-autopwn.py"
click node_cmc "https://github.com/jonaslejon/ad-autopwn/blob/main/cmc_addext.py"
click node_compromise "https://github.com/jonaslejon/ad-autopwn/blob/main/ad-autopwn.py"
click node_postloot "https://github.com/jonaslejon/ad-autopwn/blob/main/ad-autopwn.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_autopwn,node_preauth toneBlue
class node_passive,node_credentials,node_dc toneAmber
class node_bloodhound,node_primitives,node_adcs,node_compromise toneMint
class node_postloot toneRose
class node_cldap,node_cmc,node_operator,node_attacktools toneIndigo
```

## Components

### Initial Discovery

- [AD AutoPwn](https://github.com/jonaslejon/ad-autopwn/blob/main/ad-autopwn.py): `ad-autopwn.py`
- [Pre-auth Discovery](https://github.com/jonaslejon/ad-autopwn/blob/main/ad-autopwn.py): `ad-autopwn.py`

### Foothold Techniques

- [Passive and L2 Attacks](https://github.com/jonaslejon/ad-autopwn/blob/main/ad-autopwn.py): `ad-autopwn.py`
- [Credential Harvesting](https://github.com/jonaslejon/ad-autopwn/blob/main/ad-autopwn.py): `ad-autopwn.py`

### Escalation and Compromise

- [BloodHound Analysis](https://github.com/jonaslejon/ad-autopwn/blob/main/ad-autopwn.py): `ad-autopwn.py`
- [Privilege Escalation](https://github.com/jonaslejon/ad-autopwn/blob/main/ad-autopwn.py): `ad-autopwn.py`
- [AD CS Exploitation](https://github.com/jonaslejon/ad-autopwn/blob/main/ad-autopwn.py): `ad-autopwn.py`
- [Domain Compromise](https://github.com/jonaslejon/ad-autopwn/blob/main/ad-autopwn.py): `ad-autopwn.py`

### Harvest and Loot

- [Post-exploitation Loot](https://github.com/jonaslejon/ad-autopwn/blob/main/ad-autopwn.py): `ad-autopwn.py`

### Companion Tools

- [CLDAP Enumeration](https://github.com/jonaslejon/ad-autopwn/blob/main/userenum-cldap.py): `userenum-cldap.py`
- [CMC Certificate Tool](https://github.com/jonaslejon/ad-autopwn/blob/main/cmc_addext.py): `cmc_addext.py`

### Other components

- **Operator**
- **Active Directory**
- **External Security Tools**

## Connections

- Operator → AD AutoPwn: runs phases
- AD AutoPwn → Pre-auth Discovery: runs discovery
- Pre-auth Discovery → CLDAP Enumeration: invokes companion
- Pre-auth Discovery → Active Directory: queries users
- AD AutoPwn → Passive and L2 Attacks: runs techniques
- Passive and L2 Attacks → Active Directory: coerces authentication
- AD AutoPwn → Credential Harvesting: runs harvesting
- Credential Harvesting → Active Directory: queries credentials
- AD AutoPwn → BloodHound Analysis: runs analysis
- BloodHound Analysis → Active Directory: collects directory data
- BloodHound Analysis → Privilege Escalation: dispatches auto-actions
- AD AutoPwn → Privilege Escalation: runs escalation
- Privilege Escalation → Active Directory: abuses directory rights
- AD AutoPwn → AD CS Exploitation: runs certificate attacks
- AD CS Exploitation → CMC Certificate Tool: invokes CMC fallback
- AD CS Exploitation → Active Directory: requests certificates
- CMC Certificate Tool → Active Directory: enrolls certificate
- AD AutoPwn → Domain Compromise: runs compromise
- Domain Compromise → Active Directory: dumps domain secrets
- AD AutoPwn → Post-exploitation Loot: runs loot phase
- Post-exploitation Loot → Active Directory: collects host loot
- Credential Harvesting → External Security Tools: uses cracking tools
- Passive and L2 Attacks → External Security Tools: uses relay tools