On red team engagements we often may start from a dropbox on the internal network (LAN/Wi-Fi) with no valid domain account. The DCs are easy to find via DNS, and still in plenty of environments anonymous access to the SAMR and LSARPC named pipes are open. github.com/crypt0p3g/adnulle… Many of us lean on rpcclient for this (I do too), but over a null session it lists standard users by name only — no machine ($) accounts, full detail one queryuser at a time, and no way to RID-cycle when enumeration is locked down. enum4linux-ng and NetExec cover this ground too and I still use them. I wanted one command that does the whole pass and writes clean, reusable output: • Users with full detail — descriptions, account restrictions, group memberships • Groups resolved to their members • Computer ($) accounts — via RID cycling, which is how you get them at all • Domain + password/lockout policy, plus LSA/DNS (domain SID, forest, trusts) • "Interesting" accounts flagged Output is txt/csv/json plus ready-to-use lists: usernames for AS-REP roasting, computer names for the pre-Windows 2000 machine-account check. SAMR first; if that's locked it still returns LSA recon, with an optional LSA RID-cycling fallback. Use it only on directories you are authorised to inspect.

One more to go: adexview - browse, search and audit an AD Explorer snapshot offline, in your browser, from any OS. github.com/crypt0p3g/adexvie… Every engagement I had a .dat file and questions BloodHound doesn't answer: subnets, DNS name to IP, DFS shares, GPO links, LAPS coverage, certificate templates, trusts. AD Explorer knows, one object at a time, on Windows only. So I built adexview on top of adx-query by @takito1812, whose offline LDAP engine for snapshots proved the whole idea. Thank you, Víctor. What you get: - directory tree, every attribute decoded (ACLs, DNS, certs, flags) - LDAP filters and full-text search over the whole snapshot - an audit with findings: dangerous ACLs, DCSync, RBCD, ESC1-5, LAPS, trusts - a multi-snapshot library with upload and convert - password login by default Pairs with adexsnap for taking the snapshot from Linux or macOS.

AD Explorer snapshots without Windows. github.com/crypt0p3g/adexsna… adexsnap is a Python CLI that talks LDAP from Linux or macOS and writes a real AD Explorer .dat file. Open it in AD Explorer, feed it to ADExplorerSnapshot.py or BOFHound, ingest into BloodHound. NTLM, Kerberos (ccache/kirbi), LDAPS. Built-in verifier. Authorized use only. Hope it will be useful.