ADAPE-Script: Active Directory Assessment and Privilege Escalation Script

by do son · Published July 15, 2019 · Updated October 10, 2021

Active Directory Assessment and Privilege Escalation (ADAPE) Script

This script will do the following:

• Gather hashes via WPAD, LLMNR, and NBT-NS spoofing

• Check for GPP password (MS14-025)

• Gather hashes for accounts via Kerberoast

• Map out the domain and identify targets via BloodHound

• Check for privilege escalation methods

• Search for open SMB shares on the network

• Search those shares and other accessible directories for sensitive files and strings (Passwords, PII, or whatever you want, really). By default, it’s looking for the term “password”. If you wanted to search for CVVs for example, you’d just add it next to ‘password’, e.g. password,cvv

• Check patches of systems on the network

• Search for file servers

• Search attached shares

• Gather the domain policy

This script will completely run on it’s own, without using the internet at all. All the scripts needed are obfuscated powershell and included, so it should bypass most basic AV solutions. By default, it will turn off Windows Defender. If OpSec worries you (e.g. target has alerts configured around when Defender is turned off), then you can comment it out by putting a ‘#’ before “Set-MpPreference -DisableRealtimeMonitoring $true” on line 34.

It uses the following modules:

Inveigh

Bloodhound

The script will ask to run as admin, as it requires it. If you do not have admin access, it will only run the privilege escalation module. If you’re being blocked by UAC, I suggest running a bypass UAC script (https://raw.githubusercontent.com/samratashok/nishang/master/Escalation/Invoke-PsUACme.ps1).

After running the .ps1, it will create the capture file in the same folder it’s running in and zips it. At the end of the script, it deletes all the folders it created (except the .zip file, obviously).

GPP password checking and searching sensitive files takes a while, so don’t be surprised if this script takes a long time to finish depending on the number of domain controllers, open shares, and strings you’re searching for. Comment those sections out if they take too long to run.

Download