AdStrike
AI-powered modular Active Directory red-team framework for authorized penetration testing, AD enumeration, attack-path analysis, Kerberos/ADCS workflows, reporting, operator automation, and MCP server integration.
File Explorer
- FUNDING.yml
- acl_abuse.yml
- cert_abuse.yml
- coercion_attacks.yml
- credential_dump.yml
- dcsync_dcshadow.yml
- edr_evasion.yml
- gpo_abuse.yml
- kerberos_attacks.yml
- lateral_movement.yml
- parsed_techniques.json
- password_attacks.yml
- persistence.yml
- rbcd_attacks.yml
- skills_knowledge_base.md
- tool_sast_analysis.yml
- trust_attacks.yml
- (1).png
- 1.png
- 11.png
- 2.png
- 22.png
- 3.png
- 4.png
- 5.png
- 6.png
- 7.png
- ad.png
- adstrike.mp4
- mcp-demo.gif
- __init__.py
- settings.py
- ADSTRIKE_AND_AGENT_GUIDE.md
- mcp.md
- __init__.py
- _core.py
- backends.py
- constants.py
- logger.py
- __init__.py
- acl_abuse.py
- ad_abuse_extra.py
- ad_advanced_playbook.py
- adfs_attacks.py
- adidns_abuse.py
- aitm_mfa_bypass.py
- amsi_bypass.py
- analyst.py
- azure_ad.py
- bloodhound_helper.py
- c2_integration.py
- cert_abuse.py
- coercion_attacks.py
- credential_dump.py
- cve_exploits.py
- dcsync_dcshadow.py
- dnsadmins_abuse.py
- dpapi_creds.py
- edr_evasion.py
- entra_hybrid_attacks.py
- enum_ad.py
- exploit_chains.py
- gmsa_attacks.py
- golden_certificate.py
- gpo_abuse.py
- initial_access.py
- jea_attacks.py
- kerberos_attacks.py
- kerberos_manager.py
- lateral_movement.py
- local_persistence.py
- local_privesc.py
- loot_parser.py
- m365_teams_attacks.py
- mitre_data.py
- mssql_abuse.py
- netexec_suite.py
- network_discovery.py
- password_attacks.py
- persistence.py
- powerview_enum.py
- pre2k_timeroast.py
- rbcd_attacks.py
- recon_osint.py
- red_team_agent.py
- reporting.py
- rodc_attacks.py
- rubeus_module.py
- sccm_abuse.py
- shadow_copies.py
- shadow_credentials.py
- snaffler_hunter.py
- trust_attacks.py
- uac_bypass.py
- unpac_passthecert.py
- user_hunting.py
- wsus_attack.py
- adstrike_report_20260520_013713.html
- adstrike_report_20260520_013713.json
- adstrike_report_20260520_013713.md
- repair_tools.sh
- test_regression.py
- ADExplorerSnapshot.py
- dnstool.py
- gmsa_grant_and_dump.py
- gMSADumper.py
- PetitPotam.py
- printerbug.py
- __init__.py
- helpers.py
- .env.example
- .mcp.json
- install.sh
- LICENSE
- main.py
- mcp_server.py
- README.md
- requirements.txt
- run.sh
- SECURITY.md
# Use via CDN
jsDelivrjsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.
Command Glossary
Commands referenced in this DOCs, explained below.
claude
View Details ▼
claude
An agent-based coding tool that understands your code base and helps you code faster through natural language commands.
claude prompt
Execute with prompt:
claude update
Update `claude`:
claude mcp list
Get the list of specified MCP servers:
evil-winrm
View Details ▼
evil-winrm
Windows Remote Management (WinRM) shell for pentesting.
Once connected, we get a PowerShell prompt on the target host.
evil-winrm {{[-i|--ip]}} {{ip_address}} {{[-u|--user]}} {{user}} {{[-p|--password]}} {{password}}
Connect to a host and start an interactive session:
evil-winrm {{[-i|--ip]}} {{ip_address}} {{[-u|--user]}} {{user}} {{[-H|--hash]}} {{nt_hash}}
Connect to a host using pass-the-hash authentication instead of a password:
evil-winrm {{[-i|--ip]}} {{ip_address}} {{[-u|--user]}} {{user}} {{[-p|--password]}} {{password}} {{[-s|--scripts]}} {{path/to/scripts}} {{[-e|--executables]}} {{path/to/executables}}
Connect to a host, specifying directories for PowerShell scripts and executables:
git clone
View Details ▼
git clone
Clone an existing repository.
git clone {{remote_repository_location}} {{path/to/directory}}
Clone an existing repository into a new directory (the default directory is the repository name):
git clone --recursive {{remote_repository_location}}
Clone an existing repository and its submodules:
git clone {{[-n|--no-checkout]}} {{remote_repository_location}}
Clone only the `.git` directory of an existing repository:
hashcat
View Details ▼
hashcat
Fast and advanced password recovery tool.
hashcat {{[-m|--hash-type]}} {{hash_type_id}} {{[-a|--attack-mode]}} 3 {{hash_value}}
Perform a brute-force attack (mode 3) with the default hashcat mask:
hashcat {{[-m|--hash-type]}} {{hash_type_id}} {{[-a|--attack-mode]}} 3 {{hash_value}} "{{?d?d?d?d}}"
Perform a brute-force attack (mode 3) with a known pattern of 4 digits:
hashcat {{[-m|--hash-type]}} {{hash_type_id}} {{[-a|--attack-mode]}} 3 --increment {{hash_value}} "{{?a?a?a?a?a?a?a?a}}"
Perform a brute-force attack (mode 3) using at most 8 of all printable ASCII characters:
nano
View Details ▼
nano
Text editor. An enhanced `pico` clone.
See also: `pico`, `rnano`.
nano {{path/to/file1 path/to/file2 ...}}
Open specific files, moving to the next file after closing the previous one:
nano {{[-I|--ignorercfiles]}}
Start the editor without using configuration files:
nano +{{line}},{{column}} {{path/to/file}}
Open a file and position the cursor at a specific line and column:
nxc
View Details ▼
nxc
Network service enumeration and exploitation tool.
Some subcommands such as `smb` have their own usage documentation.
nxc {{smb|ssh|ldap|ftp|wmi|winrm|rdp|vnc|mssql}} {{[-L|--list-modules]}}
List available modules for the specified protocol:
nxc {{smb|ssh|ldap|ftp|wmi|winrm|rdp|vnc|mssql}} {{[-M|--module]}} {{module_name}} --options
List the options available for the specified module:
nxc {{smb|ssh|ldap|ftp|wmi|winrm|rdp|vnc|mssql}} {{[-M|--module]}} {{module_name}} -o {{OPTION_NAME}}={{option_value}}
Specify an [o]ption for a module:
ollama
View Details ▼
ollama
A large language model runner.
For a list of available models, see <https://ollama.com/library>.
ollama serve
Start the daemon required to run other commands:
ollama run {{model}}
Run a model and chat with it (will automatically download the model if it's not downloaded):
ollama run {{model}} --think=false "{{prompt}}"
Run a model with a single prompt and thinking turned off:
python
View Details ▼
python
Python language interpreter.
python
Start a REPL (interactive shell):
python {{path/to/file.py}}
Execute a specific Python file:
python -i {{path/to/file.py}}
Execute a specific Python file and start a REPL:
python3
View Details ▼
python3
This command is an alias of `python`.
tldr python
View documentation for the original command:
systemctl daemon-reload
View Details ▼
systemctl daemon-reload
Reload systemd manager configuration.
Use this after creating, modifying, or deleting unit files.
See also: `systemctl reload`.
systemctl daemon-reload
Reload systemd to apply changes in unit files:
systemctl restart
View Details ▼
systemctl restart
Stop and then start one or more systemd units.
Can be used in place of `systemctl start` on a stopped unit, but `start` is safer so that a running unit isn't accidentally restarted.
systemctl restart {{unit}}
Restart a unit:
systemctl restart {{unit1 unit2 ...}}
Restart more than one unit:
systemctl restart {{unit}} --user
Restart a user unit:
