R4t — Active Directory Red Team Framework

R4t is a comprehensive Active Directory (AD) exploitation and reconnaissance framework written in Go. It is designed to run from within an already-accessed environment, giving red team operators a single, integrated tool for enumerating, assessing, and exploiting AD environments. R4t is not a command-and-control (C2) framework. It is an operator-side tool — you run it from your attacking machine or a foothold box to interact with a target AD forest.

What R4t Does

R4t covers the full lifecycle of an AD engagement:

Phase	Capabilities
Reconnaissance	Users, groups, computers, OUs, GPOs, trusts, domain controllers, DNS, ADIDNS
Vulnerability Assessment	ADCS ESC1–ESC16, DCSync, LAPS exposure, Kerberoasting, AS-REP Roasting, shadow credentials, pre-Windows 2000 accounts, coercible hosts
Exploitation	Certificate requests, Kerberos ticket manipulation, NT hash extraction, GPP password dumping, authentication coercion
Execution	WMI remote execution, WinRM/PSRemote command execution, payload generation via the payload factory
Persistence & Movement	Credential spraying, DACL modification, shadow credential injection, LAPS enumeration
Reporting	BloodHound collection, structured database of findings, tabular output, file output

Command Overview

R4t is organized into top-level commands. Each command groups related operations:

Command	Description
`targets`	Manage target hosts
`creds`	Manage stored credentials
`set`	Configure persistent settings
`ldap`	LDAP enumeration, modification, and vulnerability scanning
`adcs`	AD Certificate Services analysis and exploitation
`smb`	SMB signing checks and GPP extraction
`spray`	Password spraying across multiple protocols
`coerce`	Authentication coercion attacks
`krb`	Kerberos ticket operations
`bloodhound`	BloodHound data collection
`dns`	DNS enumeration and zone transfers
`adidns`	ADIDNS record manipulation
`adws`	Active Directory Web Services
`rdp`	RDP operations
`ssh`	SSH operations
`winrm`	WinRM operations
`psremote`	PowerShell Remoting operations
`wmi`	WMI queries
`mssql`	MSSQL enumeration and exploitation
`rpc`	RPC operations
`nfs`	NFS enumeration
`ftp`	FTP operations
`tickets`	Kerberos ticket management
`parse`	Parse certificate and key files
`port`	Port scanning and banner grabbing
`arp`	ARP host discovery
`poison`	Network poisoning
`proxy`	SOCKS5 proxy configuration
`sccm`	SCCM enumeration
`visualize`	BloodHound graph visualization
`install`	Install binary and shell aliases
`logs`	Log management
`query`	Database query and export
`tftp`	TFTP operations
`exclude`	Windows Defender exclusions

Global Flags

All commands inherit these persistent flags from the root command:

Authentication

Flag	Description
`-u`, `--username`	Username for authentication
`-p`, `--password`	Password
`--hash`	NT hash (`LM:NT` or just `NT`)
`--aes`	AES key for Kerberos
`--ccache`	Path to Kerberos ccache file
`--pfx`	PFX certificate file path
`--cert`	PEM certificate file path
`--key`	PEM private key file path
`--anonymous`	Use anonymous/unauthenticated access
`--credential-id`	Use a stored credential by ID

Connection

Flag	Description
`-d`, `--domain`	Active Directory domain name
`--ns`, `--nameserver`	DNS nameserver for resolution
`--ldap-server`	LDAP server address (overrides auto-discovery)
`--ldaps`	Use LDAPS (implicit TLS, port 636)
`--start-tls`	Use StartTLS upgrade on LDAP connection
`--insecure`	Skip TLS certificate verification
`--timeout`	Connection timeout in seconds
`--jitter`	Jitter delay between requests in seconds
`--target-id`	Use a stored target by ID

Database

Flag	Description
`--migrate-db`	Force database migration on startup
`--purge-db`	Drop and re-migrate all database tables (prompts for confirmation)

Key Concepts

Targets — Hosts you are operating against. R4t stores them in a database and lets you set a default.
Credentials — Authentication material (passwords, hashes, certificates, ccache files). Stored securely and selected by ID or set as default.
Settings — Persistent configuration like domain, nameserver, proxy, and output options.
Database — A dual-store system (Badger KV + SQLite) that persists all findings, scan results, and configuration.
Payload Factory — A deterministic, recipe-based build system that generates execution artifacts (EXE, DLL, shellcode, PIC, BOF, scripts) on demand with capability-based resolution.

​R4t — Active Directory Red Team Framework

​What R4t Does

​Command Overview

​Global Flags

​Authentication

​Connection

​Database

​Key Concepts

​Further Reading