DEdeoxykev·Jan 6, 2024
Here’s a similar project, but for windows AD networks
https://github.com/byt3bl33d3r/DeathStar
In SSH-Snake: Automated SSH-Based Network Traversalbyt3bl33d3r
DeathStar
Python2022–2024
byt3bl33d3r / DeathStar · Archived
DeathStar
Uses Empire's (https://github.com/BC-SECURITY/Empire) RESTful API to automate gaining Domain and/or Enterprise Admin rights in Active Directory environments using some of the most common offensive TTPs.
2Distinct people
2Mentions
0Explicit recommenders
1.6KGitHub stars
What to know before exploring
What it is
Uses Empire's (https://github.com/BC-SECURITY/Empire) RESTful API to automate gaining Domain and/or Enterprise Admin rights in Active Directory environments using some of the most common offensive TTPs.
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by month2 dated mentions
Observed mentions: 2022-09-09 01:37:54 UTC to 2024-01-06 06:47:07 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| Sep 2022 | 2022-09-01 00:00:00 UTC | 2022-10-01 00:00:00 UTC | 1 | 0 | 1 |
| Oct 2022 | 2022-10-01 00:00:00 UTC | 2022-11-01 00:00:00 UTC | 0 | 0 | 0 |
| Nov 2022 | 2022-11-01 00:00:00 UTC | 2022-12-01 00:00:00 UTC | 0 | 0 | 0 |
| Dec 2022 | 2022-12-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 0 | 0 | 0 |
| Jan 2023 | 2023-01-01 00:00:00 UTC | 2023-02-01 00:00:00 UTC | 0 | 0 | 0 |
| Feb 2023 | 2023-02-01 00:00:00 UTC | 2023-03-01 00:00:00 UTC | 0 | 0 | 0 |
| Mar 2023 | 2023-03-01 00:00:00 UTC | 2023-04-01 00:00:00 UTC | 0 | 0 | 0 |
| Apr 2023 | 2023-04-01 00:00:00 UTC | 2023-05-01 00:00:00 UTC | 0 | 0 | 0 |
| May 2023 | 2023-05-01 00:00:00 UTC | 2023-06-01 00:00:00 UTC | 0 | 0 | 0 |
| Jun 2023 | 2023-06-01 00:00:00 UTC | 2023-07-01 00:00:00 UTC | 0 | 0 | 0 |
| Jul 2023 | 2023-07-01 00:00:00 UTC | 2023-08-01 00:00:00 UTC | 0 | 0 | 0 |
| Aug 2023 | 2023-08-01 00:00:00 UTC | 2023-09-01 00:00:00 UTC | 0 | 0 | 0 |
| Sep 2023 | 2023-09-01 00:00:00 UTC | 2023-10-01 00:00:00 UTC | 0 | 0 | 0 |
| Oct 2023 | 2023-10-01 00:00:00 UTC | 2023-11-01 00:00:00 UTC | 0 | 0 | 0 |
| Nov 2023 | 2023-11-01 00:00:00 UTC | 2023-12-01 00:00:00 UTC | 0 | 0 | 0 |
| Dec 2023 | 2023-12-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 0 | 0 | 0 |
| Jan 2024 | 2024-01-01 00:00:00 UTC | 2024-02-01 00:00:00 UTC | 1 | 0 | 1 |
What Hacker News says
2 sourcesDisaster recovery specialists tend to focus on things like restoring from tape drives in a hurry.
I do general IT consulting, and all that was required was some "general security knowledge".
There's like a couple of tricks that will crack open any large-ish network in seconds given nothing much more than a command-line.
If you want to get fancy, Deathstar[1] will break open the vast majority of Active Directory networks in minutes. In some talk about it I saw on YouTube, one of the authors quipped that it'll grant you "Domain Admin in under 5 minutes, or your money back."
We didn't have to run it. I just used one of the initial attack vectors (scanning SYSVOL for passwords) and went from there.
This "one trick"[2] will get you an admin account password on something like 50% of all Active Directory networks:
dir \\domainname\SYSVOL -Re
Read the rest
curse | Select-String 'password'
The other trick is that the Configuration Manager client (or any similar agent) is often mis-configured to use the same account and password across the whole network. That, or it deploys packages with similar embedded passwords that can be read from any workstation. These type of accounts are very nearly domain admin accounts, and their password hashes are typically available on every workstation and server. Any user granted local admin rights to their own workstation can obtain it with a short PowerShell snippet.
Reversing password hashes on Windows networks is now hilariously simple, because the NT hash is very old and weak. For compatibility reasons it's almost never replaced with something stronger. Any Windows password that is shorter than about 9 characters should be considered trivially reversible, to the point that it should be treated as "plain text" for security purposes.[3]
[1] https://github.com/byt3bl33d3r/DeathStar
[2] https://adsecurity.org/?p=2288
[3] https://www.tomsguide.com/us/8-character-password-dead,news-...