SharpADWS 是一个为 Red Teams 打造的 Active Directory 侦查和利用工具，其通过 Active Directory Web Services (ADWS) 协议收集并修改 Active Directory 数据。
通常情况下，枚举或操作 Active Directory 是通过 LDAP 协议进行的。SharpADWS 能够在不直接与 LDAP 服务器通信的情况下提取或修改 Active Directory 数据。在 ADWS 下，LDAP 查询被包装在一系列 SOAP 消息中，然后使用 NET TCP Binding 加密信道将它们发送到 ADWS 服务器。随后，ADWS 服务器在其本地解包 LDAP 查询并将其转发到运行在同一域控制器上的 LDAP 服务器。
在安装 Active Directory Domain Services (ADDS) 后，Active Directory Web Services (ADWS) 将自动开启，因此 SharpADWS 在所有域环境中具备通用型。
使用 ADWS 进行 LDAP 后利用的主要好处之一是它相对不为人所知，由于 LDAP 流量不会通过网络发送，因此不容易被常见的监控工具检测到。ADWS 运行与 LDAP 完全不同的服务，可在 TCP 端口 9389 上使用，并使用 SOAP 协议作为其接口。
在研究 ADWS 时，我们注意到，由于它是 SOAP Web 服务，因此实际执行的 LDAP 查询是在域控制器本地完成的。这提供了许多有趣的副作用，结果证明是有利的。比如，在分析域控制器上的 LDAP 查询时，您可能会注意到查询源自 127.0.0.1日志，在许多情况下它们将被忽视。
这样做的第二个好处是该活动不会显示在 LDAPSearch 操作类型下的 DeviceEvents 中，这意味着可用的遥测数据非常少。
SharpADWS 实现了 MS-ADDM、MS-WSTIM 和 MS-WSDS 协议的相关细节，您可以借助该项目的源码，轻松实现对 Active Directory Web Services 的以下操作：
命令行参数 -h 可用于显示以下使用信息：
C:\Users\Marcus>SharpADWS.exe -h
SharpADWS 1.0.0-beta - Copyright (c) 2024 WHOAMI (whoamianony.top)
-h Display this help screen
Connection options:
-d Specify domain for enumeration
-u Username to use for ADWS Connection
-p Password to use for ADWS Connection
Supported methods:
Cache Dump all objectSids to cache file for Acl methods
Acl Enumerate and analyze DACLs for specified objects, specifically Users, Computers, Groups, Domains, DomainControllers and GPOs
DCSync Enumerate all DCSync-capable accounts and can set DCSync backdoors
DontReqPreAuth Enumerates all accounts that do not require kerberos preauthentication, and can enable this option for accounts
Kerberoastable Enumerates all Kerberoastable accounts, and can write SPNs for accounts
AddComputer Add a machine account within the scope of ms-DS-MachineAccountQuota for RBCD attack
RBCD Read, write and remove msDS-AllowedToActOnBehalfOfOtherIdentity attributes for Resource-Based Constrained Delegation attack
Certify Enumerate all ADCS data like Certify.exe, and can write template attributes
Whisker List, add and remove msDS-KeyCredentialLink attribute like Whisker.exe for ShadowCredentials attack
FindDelegation Enumerate all delegation relationships for the target domain
Acl options:
-dn RFC 2253 DN to base search from
-scope Set your Scope, support Base (Default), Onelevel, Subtree
-trustee The sAMAccountName of a security principal to check for its effective permissions
-right Filter DACL for a specific AD rights
-rid Specify a rid value and filter out DACL that security principal's rid is greater than it
-user Enumerate DACL for all user objects
-computer Enumerate DACL for all computer objects
-group Enumerate DACL for all group objects
-domain Enumerate DACL for all domain objects
-domaincontroller Enumerate DACL for all domain controller objects
-gpo Enumerate DACL for all gpo objects
DCSync options:
-action [{list, write}] Action to operate on DCSync method
list List all accounts with DCSync permissions
write Escalate accounts with DCSync permissions
-target Specify the sAMAccountName of the account
DontReqPreAuth options:
-action [{list, write}] Action to operate on DontReqPreAuth method
list List all accounts that do not require kerberos preauthentication
write Enable do not require kerberos preauthentication for an account
-target Specify the sAMAccountName of the account
Kerberoastable options:
-action [{list, write}] Action to operate on Kerberoastable method
list List all kerberoastable accounts
write Write SPNs for an account to kerberoast
-target Specify the sAMAccountName of the account
AddComputer options:
-computer-name Name of computer to add, without '$' suffix
-computer-pass Password to set for the computer
RBCD options:
-action [{read,write,remove}]
Action to operate on RBCD method
read Read the msDS-AllowedToActOnBehalfOfOtherIdentity attribute of the account
write Write the msDS-AllowedToActOnBehalfOfOtherIdentity attribute of the account
remove Remove the msDS-AllowedToActOnBehalfOfOtherIdentity attribute value of the account added by the write action
Certify options:
-action [{find, modify}]
Action to operate on Certify method
find Find all CA and certificate templates
modify Modify certificate templates
-enrolleeSuppliesSubject
Enumerate certificate templates with CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag for find action,
and can enable CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag for modify action
-clientAuth Enumerate certificate templates with client authentication pKIExtendedKeyUsage for find action,
and can enable Client Authentication for modify action
Whisker options:
-action [{list, add, remove}]
Action to operate on ShadowCredentials method
list List all the values of the msDS-KeyCredentialLink attribute for an account
add Add a new value to the msDS-KeyCredentialLink attribute for an account
remove Remove a value from the msDS-KeyCredentialLink attribute for an account
-device-id Specify the DeviceID to remove
-target Specify the sAMAccountName of the account
FindDelegation options:
No options, just run!
SharpADWS 在枚举 ACL 时，为了不对每个未知的受托者对象执行额外的 ADWS 请求，需要提前通过 cache method 创建所有账户对象的完整缓存并将其保存到文件中，从而避免产生大量（不必要的）流量。该缓存包含当前域内每个账户对象名称与其 objectSid 的映射。
C:\Users\Marcus>SharpADWS.exe Cache
[*] Cache file has been generated: object.cache
Acl method 能够枚举指定 -dn 的对象的 DACL，并且支持通过 -trustee、-right 和 -rid 参数对枚举出的 DACL 进行筛选。比如，我们要枚举所有的 Domain Controller 对象，并筛选出受托者为 Marcus 的 DACL，如下所示：
C:\Users\Marcus>SharpADWS.exe acl -dn "OU=Domain Controllers,DC=corp,DC=local" -scope Subtree -trustee Marcus
Severity : Critical
ObjectDN : CN=DC01,OU=Domain Controllers,DC=corp,DC=local
AccessControlType : Allow
ActiveDirectoryRights : ListChildren, ReadProperty, GenericWrite
ObjectType : All
Trustee : Marcus
IsInherited : False
又比如，我们要枚举所有的 User 对象，并筛选出权限为 GenericWrite，受托者的 RID 大于 1000 的 DACL，如下所示：
C:\Users\Marcus>SharpADWS.exe acl -dn "CN=Users,DC=corp,DC=local" -scope Subtree -right Generic -rid 1000