Listen to this Post
Introduction
Active Directory (AD) remains the central authentication and authorization hub for most enterprise networks—and consequently, the primary target for attackers. Traditional AD penetration testing requires manual execution of dozens of disparate tools across multiple kill‑chain phases, a process that is time‑consuming, error‑prone, and difficult to scale. AdStrike, an AI‑powered modular AD attack framework, changes this paradigm by wrapping 58 interactive modules (52 attack primitives, utilities, and management functions) around a shared session state and exposing all of them over the Model Context Protocol (MCP). This allows an LLM‑driven host such as Claude Code, Cursor, or Claude Desktop to autonomously plan, execute, and adapt AD attacks without any API key, while the defender now faces a new class of AI‑orchestrated, fully automated adversary.
Learning Objectives
– Understand how the MCP eliminates the need for a local LLM or API key, enabling any MCP‑compatible host to drive AdStrike’s 53 AD attack tools.
– Learn the installation, configuration, and core commands of the AdStrike framework for authorized red‑team exercises.
– Identify critical detection and mitigation strategies against AI‑powered AD attack frameworks, including Kerberos hardening, ACL monitoring, and MCP security controls.
You Should Know
1. Deploying AdStrike: Installation and Core Commands
AdStrike is designed for Kali Linux 2024+ or Parrot OS with Python 3.10 or higher. The following commands set up the framework and verify its health:
git clone https://github.com/capture0x/AdStrike.git cd AdStrike chmod +x install.sh run.sh bash install.sh source venv/bin/activate bash run.sh
> ⚠️ Important: Never execute `install.sh` or `run.sh` with `sudo`. The installer creates repo‑local files such as `adrt_venv/`, `.env`, and `output/`; running as root leaves these files root‑owned. If you mistakenly used `sudo`, fix ownership once:
> `sudo chown -R “$(id -un):$(id -gn)” .`
After installation, configure the target environment by editing `.env` (copied from `.env.example`):
DC_IP=10.10.10.10 DC_FQDN=dc1.corp.local DOMAIN=corp.local BASE_DN=DC=corp,DC=local USERNAME=user PASSWORD= NT_HASH= USE_KERBEROS=false ATTACKER_IP=10.10.14.5 ENGAGEMENT_NAME=Corp-Internal-2026 ADSTRIKE_SHOW_SECRETS=false
First‑run workflow inside the interactive menu (`bash run.sh`):
1.
Session Manager → set target and credentials. 2. [bash] Tool Checker → verify all external tools (Impacket, NetExec, Certipy, BloodHound, etc.) are installed. 3. [bash] AD Enumeration → collect baseline LDAP/SMB/GPO data. 4. [bash] Smart Analyst → parse output and rank next actions. 5. [bash] Generate Report → export findings in HTML, Markdown, or JSON. <h2 style="color: yellow;">Direct module execution (non‑interactive):</h2> [bash] python3 main.py --module 10 AD enumeration python3 main.py --module 58 --1o-banner Tool checker, no banner python3 main.py --session output/session.json Resume previous session
Kerberos‑only environments (NTLM disabled): use the dedicated workflow from
Kerberos Attacks → [bash] NTLM‑Disabled Attack Workflow. This generates a target‑specific `krb5.conf`, requests a TGT with Impacket, and sets `KRB5CCNAME` and `KRB5_CONFIG` for subsequent modules. Useful Kerberos checks: [bash] date klist cat "$KRB5_CONFIG" echo "$KRB5CCNAME"
2. MCP Server Integration: No API Key, Pure AI Orchestration
AdStrike’s most innovative feature is its MCP server, which exposes all 53 tools over the Model Context Protocol. No `ANTHROPIC_API_KEY`, no Ollama, and no local model are required. Instead, you plug AdStrike into an existing MCP host (Claude Code, Cursor, or Claude Desktop), and that host’s own LLM drives the entire engagement.
Verify the MCP server can load:
./venv/bin/python3 -c "import mcp; from modules.agent._core import TOOLS; print('ok', len(TOOLS))"
Register the server in Claude Code. The repository includes a project `.mcp.json` that is automatically loaded when you start Claude Code from the AdStrike folder:
{
"mcpServers": {
"adstrike": {
"command": "venv/bin/python3",
"args": ["mcp_server.py"]
}
}
}
To register globally (from any directory), use absolute paths:
claude mcp add adstrike -- /path/to/AdStrike/venv/bin/python3 /path/to/AdStrike/mcp_server.py
Start Claude Code from the AdStrike folder and approve the `adstrike` MCP server when prompted. Once live, the LLM can call any AdStrike tool. Set the engagement once, and the session credentials are automatically injected into every later call:
set_engagement: dc_ip 192.168.56.1, domain corp.local, username tester, password 'Pass123!'
Then run the standard workflow: `nmap_scan` → `no_cred_surface_recon` → `enumerate_ldap` → `enumerate_shares` → `collect_bloodhound` → `adcs_scan` → `acl_abuse_scan` → `kerberoast` → `asrep_roast` → `discover_winrm_access` → `chain_planner`.
The host LLM never needs the password again; every subsequent tool call reuses the session value, which eliminates credential leakage and ensures the correct target is always used.
3. AdStrike Agent: Optional AI‑Assisted Planning
For those who want a built‑in AI agent rather than an external MCP host, AdStrike includes the AdStrike Agent. It supports two backends:
| Backend | Use Case | Requirement |
||-|-|
| Ollama | Local / offline lab | `ollama serve`, local model (e.g., `qwen2.5-coder:7b`) |
| Claude | API‑backed reasoning | `ANTHROPIC_API_KEY` |
Start the agent:
ollama serve ollama pull qwen2.5-coder:7b bash run.sh Choose [bash] AdStrike Agent → choose backend [bash] Ollama
Troubleshooting GPU acceleration for Ollama (common on Kali Linux): if `ollama ps` shows `100% CPU` instead of `GPU`, edit the systemd service:
sudo nano /etc/systemd/system/ollama.service
Inside the `
` block add:</h2>
[bash]
Environment="CUDA_VISIBLE_DEVICES=0"
Environment="LD_LIBRARY_PATH=/usr/local/lib/ollama/cuda_v12:/usr/lib/x86_64-linux-gnu"
Environment="OLLAMA_GPU_OVERHEAD=0"
Then reload and restart:
sudo systemctl daemon-reload
sudo systemctl restart ollama
ollama ps Should now show GPU
The agent runs in three OPSEC modes:
– `loud` – fast lab/CTF mode
– `normal` – balanced internal pentest (default)
– `stealth` – conservative, native‑first behavior
4. Defensive Countermeasures: Detecting AI‑Orchestrated AD Attacks
AdStrike and similar frameworks exploit well‑known AD weaknesses. Defenders can implement the following mitigations, mapped to specific attack modules:
| Attack Module | Mitigation Strategy |
||-|
| Kerberoasting (module 18) | Use group Managed Service Accounts (gMSA) for service accounts; enforce strong, random passwords longer than 30 characters; monitor Event ID 4769 for abnormal TGS requests. |
| AS‑REP roasting (module 18) | Disable Kerberos pre‑authentication for all user accounts except legacy systems; review accounts with `DONT_REQ_PREAUTH` flag. |
| DCSync (module 35) | Restrict `Replicating Directory Changes` permissions to only authorized backup and replication accounts; audit for `DS-Replication-Get-Changes` access. |
| Pass‑the‑Hash / Over‑Pass‑the‑Hash | Enable Credential Guard on Windows 10/11 and Server 2016+; restrict NTLM usage via Group Policy (Network security: Restrict NTLM). |
| ACL abuse (module 22) | Regularly audit privileged ACLs using tools like BloodHound; implement a tiered administrative model (T0/T1/T2). |
| Certificate abuse (module 23) | Deploy ESC‑1 through ESC‑13 mitigations: disable vulnerable certificate templates, require manager approval, enforce extended key usage. |
| MCP server exposure | Never expose the MCP server to untrusted networks; MCP servers discovered via Shodan are trivial to hijack. Use authentication on all MCP endpoints. |
Detecting the MCP server itself: Monitor for outbound connections to common MCP host ports (typically 5000‑6000) from build servers or developer workstations. Log all `set_engagement` calls that contain credentials.
5. Hardening Active Directory Against Automated Attack Chains
AdStrike’s kill‑chain groups (reconnaissance → initial access → privilege escalation → lateral movement → persistence) require defenders to adopt a layered approach:
1. Reduce the attack surface
– Disable LLMNR and NBT‑NS via Group Policy to prevent responder‑style poisoning.
– Disable SMBv1 and enforce SMB signing.
– Remove unused service principal names (SPNs).
2. Enforce Kerberos armoring (FAST)
– Set `Domain controller: LDAP server signing requirements` to `Require signing`.
– Set `Network security: LDAP client signing requirements` to `Negotiate signing`.
3. Enable advanced auditing
– Audit account logon events (Success/Failure) – Event ID 4624, 4625.
– Audit Kerberos service ticket operations – Event ID 4769 (TGS request), 4770 (TGS renewal).
– Audit directory service access – Event ID 4662 for sensitive objects.
4. Deploy a SIEM with UEBA
– Correlate rapid enumeration of LDAP attributes (e.g., `enumerate_ldap` module) with source IP.
– Alert on `DS-Replication-Get-Changes` access from non‑backup accounts.
What Undercode Say:
– Key Takeaway 1: AdStrike is not just another AD tool—it is a blueprint for how AI agents will conduct offensive operations. Its MCP server architecture removes the need for any local AI infrastructure, allowing an LLM from any vendor to autonomously plan, execute, and pivot through a full AD attack chain. Defenders can no longer assume that human speed or manual tool switching will limit an attacker.
– Key Takeaway 2: The combination of a unified session store and MCP‑driven orchestration dramatically compresses the time from reconnaissance to domain compromise. A human red‑team operator might take hours to manually coordinate Impacket, BloodHound, and Certipy; an LLM driving AdStrike can complete the same steps in minutes. This forces defenders to shift from reactive alerting to proactive posture hardening.
Analysis: AdStrike’s emergence signals a broader industry trend: the commoditization of AI‑powered red‑team automation. While the tool itself is clearly labeled for authorized use only, its architecture can be trivially adapted by threat actors. The MCP integration is particularly concerning because it decouples the attack tools from the AI brain—an adversary could run the tools on a compromised server while directing them via a cloud‑hosted LLM. Enterprises must now assume that attackers have the ability to launch fully autonomous, context‑aware AD attacks and should invest in continuous validation (e.g., autonomous breach and attack simulation) rather than periodic pentests.
Expected Output
Introduction: Active Directory remains the crown jewel of enterprise identity management, yet traditional penetration testing struggles to keep pace with modern attack speeds. AdStrike leverages AI orchestration and the Model Context Protocol to automate the entire AD kill chain, forcing defenders to rethink their detection and hardening strategies.
What Undercode Say:
– AI‑driven frameworks like AdStrike eliminate the manual overhead of coordinating disparate AD tools, enabling an LLM to plan and execute a full attack in minutes.
– The MCP server design—no API key, no local model—lowers the barrier to entry for adversarial AI usage, as any MCP‑compatible host can drive the attack.
Prediction
– +1 Over the next 12‑18 months, MCP‑powered red‑team frameworks will become the standard for authorized penetration testing, leading to a new generation of continuous, autonomous security validation platforms.
– -1 Threat actors will quickly adopt and modify tools like AdStrike to conduct fully automated AD compromise campaigns, drastically reducing the time from initial access to domain privilege escalation.
– -1 The security community will witness a surge in MCP‑related vulnerabilities, including prompt injection and tool poisoning attacks against the AI host itself, creating a novel attack surface that current EDR and SIEM solutions are not designed to detect.
– +1 Defenders will respond by integrating MCP monitoring and Kerberos hardening into compliance frameworks (e.g., CIS, NIST), and by adopting autonomous purple‑team platforms that continuously validate both AD and MCP security controls.
– -1 Organizations that rely on legacy AD configurations (e.g., NTLM enabled, unpatched certificate templates, weak service account passwords) will face an elevated risk of automated, AI‑orchestrated compromise, potentially outpacing their incident response capabilities.
▶️ Related Video (80% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
[Join Undercode Academy for Verified Certifications](https://undercode.co.uk/certifications/)
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[[email protected]](mailto:[email protected])
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: [Gmfaruk Adstrike](https://www.linkedin.com/posts/gmfaruk_adstrike-%F0%9D%90%80%F0%9D%90%88-%F0%9D%90%8F%F0%9D%90%A8%F0%9D%90%B0%F0%9D%90%9E%F0%9D%90%AB%F0%9D%90%9E%F0%9D%90%9D-%F0%9D%90%8F%F0%9D%90%AB%F0%9D%90%A8%F0%9D%90%9F-share-7467844091809132544-4pkp/) – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
[💬 Whatsapp](https://undercode.help/whatsapp) | [💬 Telegram](https://t.me/UndercodeCommunity)
📢 Follow UndercodeTesting & Stay Tuned:
[𝕏 formerly Twitter 🐦](https://x.com/undercodeupdate) | [@ Threads](https://www.threads.net/@undercodetesting) | [🔗 Linkedin](https://www.linkedin.com/company/undercodetesting/) | [🦋BlueSky](https://bsky.app/profile/undercode.bsky.social)
