AD-BOF — Active Directory

The AD-BOF module provides fundamental tools for interacting with Active Directory during an authorized pentest engagement. It includes LDAP reconnaissance commands, credential extraction via DCSync, LAPS password reading, and WebDAV service manipulation.

Compatible agents: Beacon, Gopher, Kharon
Platform: Windows

adwssearch#

Performs a search query through Active Directory Web Services (ADWS) instead of standard LDAP.

When to use: When the LDAP port (389/636) is blocked or filtered, but the ADWS service (port 9389) is still available. ADWS is an alternative service that exposes the same directory information.

adwssearch "(objectClass=user)"
adwssearch "(&(objectCategory=computer)(operatingSystem=*Server*))"
adwssearch "(memberOf=CN=Domain Admins,CN=Users,DC=corp,DC=local)"

badtakeover#

Executes the BadSuccessor technique for Active Directory domain compromise by exploiting a delegation trust vulnerability.

When to use: When an exploitable trust relationship is identified via the BadSuccessor technique. This is a domain-level privilege escalation path.

badtakeover DC01

Warning: This attack modifies directory objects. Only use with explicit authorization and full understanding of the impact.

dcsync#

Replicates Active Directory credentials by simulating Domain Controller behavior (DCSync attack). This command uses the MS-DRSR (Directory Replication Service Remote Protocol).

Requirements: The executing user or account must have these privileges:

• Replicating Directory Changes
• Replicating Directory Changes All

These are typically held by Domain Admins or accounts explicitly granted these permissions via ACLs.

dcsync single#

Extracts the secrets (NTLM hash, Kerberos keys) for a specific user.

dcsync single CORP\krbtgt
dcsync single CORP\Administrator
dcsync single CORP\Administrator --dc DC01.corp.local

dcsync all#

Extracts secrets for all domain users.

dcsync all
dcsync all --dc DC01.corp.local

Warning: dcsync all generates massive replication traffic. It is extremely noisy and easily detectable by monitoring systems like Microsoft Defender for Identity (MDI) or SIEM solutions. Use dcsync single when you only need a specific user.

When to use: DCSync is the endgame in a domain compromise chain. Once you have the krbtgt hash, you can create Golden Tickets. Use dcsync single CORP\krbtgt first for persistence, then extract specific accounts as needed.

Extracted credentials are automatically added to the client’s Credentials panel.

ldapsearch#

Executes a direct LDAP query against the directory with full control over the filter and returned attributes.

When to use: For custom LDAP queries not covered by other commands. This is the lowest-level tool for querying the directory.

ldapsearch "(objectClass=user)" sAMAccountName,description
ldapsearch "(&(objectCategory=person)(adminCount=1))" distinguishedName
ldapsearch "(servicePrincipalName=*)" sAMAccountName,servicePrincipalName --base "DC=corp,DC=local"

ldapq computers#

Queries computer objects from the domain and automatically registers them in the client’s Targets panel.

When to use: At the beginning of an engagement, to populate the target list with all domain computers. It’s the fastest way to get a machine inventory for planning lateral movement.

ldapq computers

No additional arguments required.

readlaps#

Reads local administrator passwords stored by LAPS (Local Administrator Password Solution) or Windows LAPS.

When to use: When LAPS is deployed in the environment. If you have read permissions on the ms-Mcs-AdmPwd attribute (LAPS v1) or msLAPS-Password (Windows LAPS), you can obtain the local admin password in plaintext.

readlaps WORKSTATION01
readlaps SERVER-DB01

Retrieved credentials are automatically extracted to the Credentials panel.

Note: LAPS read permissions are typically delegated to specific groups (e.g., “Desktop Support”, “Server Admins”). Check the attribute ACLs if you cannot read the password.

webdav#

Controls the WebClient service (WebDAV redirector) on the compromised machine.

webdav enable#

Starts the WebClient service on the target machine.

webdav enable

When to use: To enable WebDAV-based coercion attacks. When WebClient is active, authentication can be forced over HTTP instead of SMB, which allows relaying to services that don’t support SMB (like LDAP or ADCS HTTP endpoints). This is an essential prerequisite for attack chains such as:

1. PetitPotam → ADCS relay: Coerce WebDAV authentication → relay HTTP to ADCS to request a certificate
2. RBCD attack chain: Coerce authentication → relay to LDAP to configure delegation

webdav status#

Checks the current status of the WebClient service.

webdav status

Returns whether the service is started, stopped, or disabled.

Recommended Workflow#

1. ldapq computers              → Populate Targets panel
2. ldapsearch "(...)" ...       → Detailed directory reconnaissance
3. readlaps WORKSTATION01       → Attempt to obtain LAPS credentials
4. webdav enable                → Prepare for coercion attacks
5. dcsync single CORP\krbtgt    → Endgame: obtain krbtgt hash