adPEAS v2.3.0
Herramienta de Powershell para automatizar la enumeración de Active Directory.
adPEAS v2 — Active Directory Privilege Escalation Awesome Scripts
Comprehensive Active Directory security assessment — zero dependencies, single file, ready to go.
What is adPEAS?
adPEAS is a PowerShell-based security assessment tool that identifies misconfigurations, vulnerabilities, and privilege escalation paths in Active Directory environments. It is designed for penetration testers, security auditors, and red teams who need a reliable, self-contained tool that works on any Windows system — no RSAT, no ActiveDirectory module, no third-party dependencies.
adPEAS v2 is a complete rewrite of adPEAS v1. It replaces the legacy DirectoryEntry/DirectorySearcher approach with a unified System.DirectoryServices.Protocols.LdapConnection architecture and adds native Kerberos authentication, advanced reporting, and offensive operations — all in pure PowerShell.
What's New in v2
- Native Kerberos stack — AS-REQ/AS-REP, TGS-REQ/TGS-REP, Pass-the-Ticket, PKINIT, all in pure PowerShell
- Multiple auth methods — Password, NT-Hash (OPtH), AES keys (PtK), Certificates (PKINIT & Pass-the-Cert/Schannel), Windows integrated
- 40+ security checks across 9 categories with severity scoring
- Interactive HTML reports with search, filtering, risk scores, and tooltips
- JSON export for offline report conversion, incremental scanning, and scan comparison
- BloodHound CE collector — built-in data collection for attack path analysis
- Offensive operations — Kerberoasting, AS-REP Roasting, Golden/Silver/Diamond Tickets, RBCD abuse, Shadow Credentials, and more
- Session-based workflow — connect once, run multiple checks interactively
- Tab-completion — autocomplete AD object names for interactive exploration
New to adPEAS? Check the Quick-Start Guide or read the blog series on blog.sekurity.de for a deep dive into architecture, authentication, and internals.
Features at a Glance
| Category | Highlights |
|---|---|
| Authentication | Credentials, PKINIT, Pass-the-Cert, NT-Hash, AES keys, Windows auth, Kerberos-first with automatic fallback |
| Security Checks | Domain config, Kerberoast, ASREPRoast, ACLs, DCSync, delegation, AD CS escalation paths, GPO abuse, LAPS, BitLocker recovery keys, outdated systems |
| Reporting | Console (color-coded), plain text, interactive HTML, JSON export |
| Offensive Ops | Kerberoasting, AS-REP Roasting, Golden/Silver/Diamond Tickets, RBCD, Shadow Credentials, Pass-the-Ticket |
| BloodHound | Built-in BloodHound CE collector (ZIP export) |
| OPSEC Mode | Skip active testing (Kerberoast, ASREPRoast, BloodHound, SMB to file servers named by GPO scripts) |
| Deployment | Single .ps1 file, no RSAT, no external modules, works offline and air-gapped |
Requirements
- OS: Windows 10/11, Windows Server 2016/2019/2022/2025
- PowerShell: 5.1+ (Windows PowerShell)
- .NET Framework: 4.5+ (included in Windows)
- Network: LDAP (389), LDAPS (636), Kerberos (88), SMB (445)
No ActiveDirectory module, RSAT, or external PowerShell modules required.
Download
Release Versions
| File | Size | Use Case |
|---|---|---|
adPEAS.ps1 | ~4.5 MB | Development, debugging, code review |
adPEAS_min.ps1 | ~3-4 MB | Regular use with smaller footprint |
adPEAS_ultra.ps1 | ~3 MB | Minimal size, no comments |
adPEAS_obf.ps1 | <1 MB | Smallest size, obfuscated for transfer |
All four versions are functionally identical. Choose based on your deployment scenario.
# Clone the repository
git clone https://github.com/61106960/adPEAS.git
cd adPEAS
Building from Source
The main branch always carries a current build of all four variants, rebuilt with every fix and feature, so the raw URLs above serve the newest code. Those builds carry a development version string (2.5.1+20260917-1759). Every tagged GitHub Release has the four stable builds attached as downloadable assets, with a clean version string (2.5.1) — use those if you need a known, citable version. To build from source yourself:
git clone https://github.com/61106960/adPEAS.git
cd adPEAS
.\Build-Release.ps1
This produces all four variants (adPEAS.ps1, adPEAS_min.ps1, adPEAS_ultra.ps1, adPEAS_obf.ps1) in the repository root. Requires Windows PowerShell 5.1 and no additional dependencies.
Quick Start
# Option 1: Import as module (recommended)
Import-Module .\adPEAS.ps1
# Option 2: Dot-sourcing
. .\adPEAS.ps1
# Option 3: Read and execute in memory
Get-Content -Raw .\adPEAS.ps1 | Invoke-Expression
# Option 4: Load directly from GitHub into memory (no file on disk).
# Both variants work; on an older/hardened host that still defaults to TLS 1.0,
# prepend once: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
# 4a: WebClient - shortest. DownloadString detects and strips the file's UTF-8 BOM
# itself, so nothing extra is needed. WebClient is a legacy API but works everywhere.
Invoke-Expression (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/61106960/adPEAS/main/adPEAS_obf.ps1')
# 4b: Invoke-WebRequest - the modern cmdlet. Its .Content keeps the BOM as a leading
# U+FEFF that Invoke-Expression cannot parse, so TrimStart removes it first.
Invoke-Expression ((Invoke-WebRequest -Uri "https://raw.githubusercontent.com/61106960/adPEAS/main/adPEAS_obf.ps1" -UseBasicParsing).Content.TrimStart([char]0xFEFF))
One-Liner (v1 Compatible)
# Domain-joined machine (current user)
Invoke-adPEAS -Domain "contoso.com" -UseWindowsAuth
# With credentials
Invoke-adPEAS -Domain "contoso.com" -Username "john.doe" -Password "P@ssw0rd!"
# OPSEC mode (skip Kerberoast, ASREPRoast, BloodHound)
Invoke-adPEAS -Domain "contoso.com" -UseWindowsAuth -OPSEC
Session-Based (v2 Style)
# Connect once
Connect-adPEAS -Domain "contoso.com" -UseWindowsAuth
# Run full scan
Invoke-adPEAS
# Or run individual checks
Get-KerberoastableAccounts
Get-ADCSVulnerabilities
Get-DangerousACLs
# Disconnect when done
Disconnect-adPEAS
Authentication Methods
# Credentials
Connect-adPEAS -Domain "contoso.com" -Credential (Get-Credential)
# Overpass-the-Hash (NT-Hash)
Connect-adPEAS -Domain "contoso.com" -Username "admin" -NTHash "32ED87BDB5FDC5E9CBA88547376818D4"
# Pass-the-Key (AES256)
Connect-adPEAS -Domain "contoso.com" -Username "admin" -AES256Key "4a3b2c1d5e6f..."
# PKINIT (Certificate)
Connect-adPEAS -Domain "contoso.com" -Certificate "user.pfx"
# Pass-the-Cert / Schannel (LDAPS, no Kerberos)
Connect-adPEAS -Domain "contoso.com" -Certificate "user.pfx" -PassTheCert
# LDAPS
Connect-adPEAS -Domain "contoso.com" -UseWindowsAuth -UseLDAPS
Output & Reporting
# All formats (default) — creates .txt, .html, and .json
Invoke-adPEAS -Domain "contoso.com" -UseWindowsAuth -Outputfile .\report
# HTML only
Invoke-adPEAS -Domain "contoso.com" -UseWindowsAuth -Outputfile .\report -Format HTML
# Offline report conversion from JSON
Convert-adPEASReport -InputJson ".\report.json" -OutputPath ".\new_report"
# Compare two scans (diff report)
Compare-adPEASReport -Baseline ".\scan_q1.json" -Current ".\scan_q2.json" -OutputPath ".\diff"