$ show aniqfakhrul/powerview.py
This repository is the Python implementation of PowerView, a comprehensive Active Directory (AD) security assessment and exploitation tool. It provides a feature-rich CLI (with an interactive shell), a web-based UI (Flask + vanilla JS), and a Model Context Protocol (MCP) server for AI agent integration. The tool enumerates AD objects (users, groups, computers, GPOs, trusts, certificates, DNS, SMB shares, etc.), identifies security vulnerabilities (kerberoasting, AS-REP roasting, shadow credentials, ACL abuse, certificate template misconfigurations), and supports active exploitation (DACL modification, RBCD, coercion attacks, SMB file operations). It is designed for red team operations and AD security audits. The architecture is a monolith centered on a large `PowerView` class (in `powerview.py`) that orchestrates all commands and dispatches to specialized modules (e.g., `kerberoast.py`, `ca.py`, `exchange.py`, `ldapattack.py`). It supports both standard LDAP and a custom implementation of Microsoft's Active Directory Web Services (ADWS) protocol (SOAP over .NET Message Framing and NegotiateStream), enabling operations without conventional LDAP. The tool leverages Impacket for low-level Windows protocols (SMB, RPC, Kerberos) and includes a plugin system with decorator-based registration and before/after hooks. The web front-end offers interactive graph visualization, object exploration, and real-time command history, while the MCP server exposes AD operations to AI assistants. Key data flows involve LDAP/ADWS queries for object enumeration, SMB/RPC sessions for remote system interaction, and Kerberos tickets for authentication attacks. External dependencies include `ldap3` (forked), `impacket` (forked), `dsinternals`, `flask`, `werkzeug`, and client-side libraries (Cytoscape.js, Alpine.js, Tailwind CSS). The codebase is large and tightly coupled in places, but the custom ADWS implementation, plugin system, and vulnerability detection engine are notable achievements that could be extracted and reused.
The LLM identified 4 files worth highlighting for reuse:
A standalone implementation of Microsoft's Active Directory Web Services (ADWS) protocol. This module handles .NET Message Framing (NMF), NegotiateStream (NNS) authentication, and binary XML (MC-NBFX) encoding/decoding. It enables LDAP-like AD operations over SOAP/HTTP transport. The implementation is self-contained, tightly modeled on Microsoft's protocol specifications, and could be extracted as a reusable Python library for interacting with ADWS without the full toolchain.
A decorator-based plugin framework supporting command registration, before/after hooks, priority ordering, and source tracking. Plugins are loaded dynamically from a directory and registered with a central `PluginRegistry`. Commands can be defined with typed signatures, and hooks allow cross-cutting concerns (e.g., logging, validation). This pattern is cleanly isolated from the rest of the codebase and could be extracted for any CLI or event-driven Python application needing extensibility.
A module for parsing and representing Windows Active Directory security descriptors. It handles canonical ACE ordering, object ACEs (for extended rights), SID resolution, and flags (e.g., INHERITED, OBJECT_INHERIT). The class `ActiveDirectorySecurity` and its subclasses (`CertificateSecurity`, `CASecurity`) provide a consistent interface for evaluating permissions across different AD subsystems. The code is decoupled from the rest of the tool (it only imports standard types) and could be reused in any Python-based AD security analysis project.
A rule-based vulnerability detection engine for Active Directory. It defines 30+ rules (kerberoastable accounts, AS-REP targets, weak delegation, SID history, etc.) with conditions (`exists`, `equals`, `contains`, `startswith`, `older_than`, `has_flag`), exclusions, and severity levels. The `VulnerabilityDetector` scans AD objects via LDAP and returns structured findings. The rule evaluation pattern (`_check_condition`) is generic and could be extracted for building any rule-based scanning or validation system, not just AD.