📋 Known Limitations & Future Improvements (v1.0.2)

Known Limitations & Future Improvements

Current Limitations (v1.0.2)

🔒 Kerberos Exploitation

• Ticket Injection: Golden/Silver tickets require OS cache injection or Kerberos client integration

  • Currently preview/dry-run mode only
  • Future: Implement ticket injection via klist.exe or krb5 cache manipulation

• Credential Requirements: Most attacks require:

  • Service account hashes (from secretsdump.py, DCSync, credential dumps)
  • Domain SID (enumerated via LDAP RootDSE)
  • Current: Limited to preview commands without actual compromise

🌐 Domain Trust Exploitation

• Forest Takeover: Requires successful compromise of child domain first

  • Not applicable to single-domain environments
  • DCShadow attacks require DC compromise or network proximity

• Selective Authentication Bypass: Limited detection of all bypass methods

  • Future: Add PAC manipulation detection & exploitation

🏛️ ADCS Exploitation

• ESC Detection: Only detects major misconfigurations

  • Future: Add ESC10-14 detection (newer vulnerability categories)
  • ESC8 (HTTP enrollment): Requires web enumeration integration

• Certificate Chain Analysis: Does not validate full certificate chain for trust relationships

  • Future: Cross-domain certificate trust validation

📮 Coercion & Relay

• PetitPotam: Requires RPC access to target (port 135)

  • Blocked by Windows Firewall in default configuration on modern Windows
  • Limited to internal network attacks

• PrinterBug: Print Spooler service must be running

  • Disabled by default on Windows Server 2019+
  • May not work on hardened environments

• Relay Signing: SMB signing enforcement blocks relay to some targets

  • Future: Add relay chain alternatives for signed SMB environments

🔓 Privilege Escalation

• ACL Enumeration: Does not detect all inherited ACE combinations

  • Future: Implement full ACL graph analysis (similar to BloodHound)

• GPO Abuse: Requires write access to GPO objects

  • Currently only previews commands, does not execute
  • Future: Implement GPO modification automation

🔑 Persistence

• DCShadow: Requires DC compromise or administrator access

  • Not applicable without existing domain admin
  • Stealth limited by replication monitoring

• Skeleton Key: Patched/mitigated in Windows Server 2016+

  • Only applicable to legacy environments (2008 R2, 2012, 2012 R2)
  • Modern Windows: Kernel Driver Signature Enforcement prevents injection

• DSRM: Requires physical/console access or remote boot capability

  • Not practical in most cloud environments
  • Limited to on-premises infrastructure

⚠️ Prerequisites & Constraints

Attack	Prerequisites	Constraints
Golden Ticket	krbtgt hash	Requires active Kerberos cache
Silver Ticket	Service hash	Service-specific (CIFS, HOST, LDAP, etc.)
AS-REP Roasting	User enumeration	Pre-auth disabled users only
Unconstrained Delegation	Server compromise	User TGT must be captured
Constrained Delegation	Server compromise	Target must allow delegation
RBCD	Write to object	Misconfigured RBCD settings
Domain Trust Abuse	Trust account hash	Cross-domain trust required
ESC1	Enrollment rights	Overly permissive template
PetitPotam	RPC access (port 135)	Not on modern hardened Windows
PrinterBug	Print Spooler running	Disabled by default on 2019+
NTLM Relay	Network access	SMB signing blocks some relays
ACL Abuse	Write permissions	Specific ACE on target object
GPO Abuse	Write to GPO	Requires full policy access
DCShadow	DC compromise	Replication monitoring detects it
Skeleton Key	SYSTEM on DC	Patched in Windows 2016+

🔧 Not Yet Implemented

• DFS Abuse: DFS namespace & referral manipulation
• DPAPI Abuse: Data Protection API credential extraction
• DNS Poisoning: Dynamic DNS record manipulation
• Delegation Chain Analysis: Full S4U chain optimization
• LAPS Extraction: Local Administrator Password Solution reading
• AdminSDHolder Abuse: Automated permission injection
• Group Policy Preferences: Cpassword extraction & decryption
• Kerberos Pre-Auth Brute Force: User enumeration via timing attacks
• AS-REP Relay: AS-REP message relaying to other services

📈 Performance Notes

• Tool Execution: Multi-threaded (ThreadPoolExecutor, 16 workers)

  • Expected 10-15x speedup vs. sequential execution
  • Large networks (500+ hosts) may timeout after 15 minutes

• LDAP Queries: Anonymous binding with timeout (10 seconds default)

  • High-latency networks may experience timeouts
  • Future: Add connection pooling & batch queries

• Coercion Attacks: Sequential execution (one target at a time)

  • Future: Parallel coercion against multiple targets
  • Current limitation: NTLM relay listener is single-threaded

🎯 Future v1.0.3+ Roadmap

Phase 1: Extended Attack Vectors

• DFS namespace abuse (cross-site referrals)
• DPAPI credential extraction
• AdminSDHolder automated abuse
• Group Policy Preferences exploitation
• LAPS reading & privilege escalation

Phase 2: Performance Optimization

• Connection pooling for LDAP/SMB
• Parallel coercion targeting (multiple hosts)
• Batch Kerberos pre-auth attacks
• Optimized AS-REP roasting (faster hash extraction)

Phase 3: Stealth & Detection Evasion

• Credential Guard bypass techniques
• Event log tampering automation
• Kerberos signing bypass (if applicable)
• AMSI bypass for PowerShell exploitation

Phase 4: Ecosystem Integration

• BloodHound data import/export
• Sharphound integration
• Covenant C2 command generation
• Metasploit module export

📝 Workarounds

For limitations that affect specific scenarios:

Print Spooler Disabled?

# Alternative: Use RPC-based coercion methods
# Or use manual PetitPotam via Python
python3 -c "from impacket.examples import petitpotam; ..."

SMB Signing Enforced?

# Use HTTP/LDAP relay instead of SMB
# Or chain attacks through unsigned protocols

Forest Root Unreachable?

# Compromise child domain first
# Use trust account hash for inter-realm TGT

🙏 Contributions Welcome

If you have:

• Attack vectors not listed here
• Workarounds for current limitations
• Performance optimization ideas
• Additional ESC vulnerabilities
• New persistence mechanisms

Please open a discussion or PR! This framework grows with community feedback.

---

AdPentestAI v1.0.2 covers the core exploitation vectors. v1.0.3 will extend coverage and optimize performance.

No source file, test, or entry point is named. Start by confirming whether this issue is intended to document current limitations or track the broad v1.0.3 roadmap; the listed sections, prerequisites, workarounds, and future items define the scope. Done should mean the agreed documentation is complete and consistent with the implemented behavior.