test_active_directory

Instructions

Implementation Reference

• src/tools/service-specific.ts:27-142 (handler)

  Main handler function for test_active_directory tool. Performs comprehensive Active Directory testing including LDAP enumeration, Kerberos checks, SMB shares, enum4linux, BloodHound collection, and Kerberoasting potential.

  async testActiveDirectory(target: string, domain?: string): Promise<ScanResult> {
    try {
      console.error(`🔍 Testing Active Directory on ${target}${domain ? ` (domain: ${domain})` : ''}`);
      
      const findings: string[] = [];
      const results: any = {};
      
      // Test 1: LDAP enumeration
      try {
        const ldapPort = 389;
        const { stdout: ldapOutput } = await execAsync(`nmap -p ${ldapPort} --script ldap-rootdse ${target}`, { timeout: 60000 });
        results.ldap_enumeration = ldapOutput;
        
        if (ldapOutput.includes('domainFunctionality')) {
          findings.push('Domain Controller detected via LDAP');
        }
        if (ldapOutput.includes('forestFunctionality')) {
          findings.push('Active Directory Forest detected');
        }
      } catch (e) {
        console.error('LDAP enumeration failed:', e);
      }
  
      // Test 2: Kerberos enumeration
      try {
        const { stdout: kerberosOutput } = await execAsync(`nmap -p 88 --script krb5-enum-users ${target}`, { timeout: 60000 });
        results.kerberos_enumeration = kerberosOutput;
        
        if (kerberosOutput.includes('KDC')) {
          findings.push('Kerberos Key Distribution Center detected');
        }
      } catch (e) {
        console.error('Kerberos enumeration failed:', e);
      }
  
      // Test 3: SMB enumeration for DC
      try {
        const { stdout: smbOutput } = await execAsync(`smbclient -L //${target} -N`, { timeout: 60000 });
        results.smb_enumeration = smbOutput;
        
        if (smbOutput.includes('SYSVOL') || smbOutput.includes('NETLOGON')) {
          findings.push('Domain Controller shares detected (SYSVOL/NETLOGON)');
        }
      } catch (e) {
        console.error('SMB enumeration failed:', e);
      }
  
      // Test 4: enum4linux for comprehensive enumeration
      try {
        const { stdout: enum4linuxOutput } = await execAsync(`enum4linux -a ${target}`, { timeout: 180000 });
        results.enum4linux = enum4linuxOutput;
        
        if (enum4linuxOutput.includes('Domain Name:')) {
          const domainMatch = enum4linuxOutput.match(/Domain Name:\s*([^\n]+)/);
          if (domainMatch) {
            findings.push(`Domain Name identified: ${domainMatch[1].trim()}`);
          }
        }
        if (enum4linuxOutput.includes('Users via RID cycling')) {
          findings.push('User enumeration possible via RID cycling');
        }
      } catch (e) {
        console.error('enum4linux failed:', e);
      }
  
      // Test 5: BloodHound data collection (if available)
      if (domain) {
        try {
          const { stdout: bloodhoundOutput } = await execAsync(`bloodhound-python -d ${domain} -u anonymous -p '' -ns ${target} --dns-tcp`, { timeout: 300000 });
          results.bloodhound_collection = bloodhoundOutput;
          
          if (bloodhoundOutput.includes('Resolved collection methods')) {
            findings.push('BloodHound data collection successful');
          }
        } catch (e) {
          console.error('BloodHound collection failed:', e);
        }
      }
  
      // Test 6: Kerberoasting check
      try {
        const { stdout: kerberoastOutput } = await execAsync(`nmap -p 88 --script krb5-enum-users --script-args krb5-enum-users.realm=${domain || target} ${target}`, { timeout: 120000 });
        results.kerberoasting_check = kerberoastOutput;
        
        if (kerberoastOutput.includes('SPN')) {
          findings.push('Service Principal Names detected - potential Kerberoasting targets');
        }
      } catch (e) {
        console.error('Kerberoasting check failed:', e);
      }
  
      return {
        target,
        timestamp: new Date().toISOString(),
        tool: 'active_directory_test',
        results: {
          service: 'Active Directory',
          domain: domain || 'Unknown',
          findings,
          detailed_results: results,
          recommendations: this.getADRecommendations(findings)
        },
        status: 'success'
      };
      
    } catch (error) {
      return {
        target,
        timestamp: new Date().toISOString(),
        tool: 'active_directory_test',
        results: {},
        status: 'error',
        error: error instanceof Error ? error.message : String(error)
      };
    }
  }

• src/index.ts:365-376 (registration)

  Tool registration in the listTools handler, including name, description, and input schema definition.

  {
    name: "test_active_directory",
    description: "Comprehensive Active Directory penetration testing",
    inputSchema: {
      type: "object",
      properties: {
        target: { type: "string", description: "Domain Controller IP address" },
        domain: { type: "string", description: "Domain name (optional)" }
      },
      required: ["target"]
    }
  },

• src/index.ts:574-575 (registration)

  Dispatch handler in the callTool switch statement that routes the tool call to the serviceSpecificTools.testActiveDirectory method.

  case "test_active_directory":
    return respond(await this.serviceSpecificTools.testActiveDirectory(args.target, args.domain));

• src/index.ts:368-375 (schema)

  Input schema definition for the test_active_directory tool.

  inputSchema: {
    type: "object",
    properties: {
      target: { type: "string", description: "Domain Controller IP address" },
      domain: { type: "string", description: "Domain name (optional)" }
    },
    required: ["target"]
  }

• src/tools/service-specific.ts:889-919 (helper)

  Helper method providing security recommendations based on Active Directory test findings.

  private getADRecommendations(findings: string[]): string[] {
    const recommendations: string[] = [];
    
    if (findings.some(f => f.includes('Domain Controller'))) {
      recommendations.push('Ensure Domain Controller is properly hardened');
      recommendations.push('Implement least privilege access controls');
      recommendations.push('Enable Advanced Audit Policy Configuration');
    }
    
    if (findings.some(f => f.includes('SYSVOL') || f.includes('NETLOGON'))) {
      recommendations.push('Secure SYSVOL and NETLOGON shares with proper permissions');
      recommendations.push('Monitor access to domain controller shares');
    }
    
    if (findings.some(f => f.includes('RID cycling'))) {
      recommendations.push('CRITICAL: Implement measures to prevent user enumeration');
      recommendations.push('Consider disabling null session enumeration');
    }
    
    if (findings.some(f => f.includes('Kerberoasting'))) {
      recommendations.push('Review Service Principal Names (SPNs)');
      recommendations.push('Use strong passwords for service accounts');
      recommendations.push('Consider using Group Managed Service Accounts (gMSA)');
    }
    
    recommendations.push('Implement Windows Event Forwarding (WEF)');
    recommendations.push('Deploy Microsoft Defender for Identity');
    recommendations.push('Regular security assessments using BloodHound');
    
    return recommendations;
  }