PingCastle
Audits a domain's security posture and scores its weaknesses.
A defensive auditing tool that, in an engagement, is used for fast diagnosis. Given domain credentials it produces an HTML report that scores the domain's security posture and flags the typical weaknesses: accounts with non-expiring passwords, dangerous delegations, misconfigured trusts, obsolete systems, excessive permissions. It exploits nothing, but in minutes it gives a prioritised list of where to attack, and it is what you hand the client as a picture of structural risk.
Family Active Directory enumeration
Flags --healthcheck --server
Concepts LDAP Enumeration, ACL Abuse (DACL), GPO abuse (SharpGPOAbuse, Restricted Groups)
Cheatsheet Enumeration
Installation
# Prebuilt Windows binary (not installed on Kali): download the .exe from the
# repo's latest release and upload it to the target, e.g. serving it from Kali:
python3 -m http.server 80 # on Kali, in the binary's folder
certutil -urlcache -f http://<lhost>/PingCastle.exe PingCastle.exe # on the target (or SMB / evil-winrm 'upload')
# run it on a domain Windows host: '.\PingCastle.exe --healthcheck'Useful commands
Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.