Wiki / Exploitation / Vault

Vault

Exploitation v0.3.1 — Active Directory credential-test orchestrator: wraps impacket-secretsdump (DCSync/SAM), impacket-GetUserSPNs (Kerberoasting), impacket-GetNPUsers (AS-REP roasting), and SMB-signing inspection.
2
Dependencies
4
Phases
VAULT-AD
Finding Prefix

How It Works

🛡️ Sensitive Data Handling

This tool collects, processes, or stores data that may include sensitive, personally identifiable, or client-proprietary information — even when sourced from public repositories or non-client-controlled systems. Handle all collected data in accordance with your engagement’s data handling agreement, applicable privacy regulations (GDPR, CCPA, HIPAA), and your organization’s data classification policy. Store findings in encrypted, access-controlled locations and destroy data per the agreed retention schedule.

Vault is an Active Directory and SMB credential-testing orchestrator built around the Impacket suite. It automates common AD attack techniques (DCSync, Kerberoasting, AS-REP Roasting, SMB signing checks) against a target domain controller or SMB host, collecting evidence and generating structured findings.

Architecture: Vault is a CLI tool with four independent attack modules, each wrapping a specific Impacket script. It can run standalone or under a Vantage-managed environment (when VAULT_MANAGED=1 is set). All subprocess invocations route through pr0t31n_tool_runner.run_tool() for automatic .log sibling generation. Impacket binaries are located automatically via _which_impacket(), which searches multiple naming conventions (name, impacket-name, name.py).

Workflow:

  1. Initialization — Creates a universal run directory with meta.json and event logging (scan.log / errors.log).
  2. Module Execution — Runs selected modules in sequence:
    • smb_relay — Checks if SMB signing is required on the target using rpcdump. Detects "Signing required: False" or "message_signing disabled" patterns in output.
    • asreproast — Runs GetNPUsers in no-pass mode to find accounts with Kerberos pre-auth disabled. Outputs $krb5asrep$ hashes in hashcat format. Supports a --users-file for targeted enumeration.
    • kerberoast — Runs GetUserSPNs with -request to request TGS tickets for offline cracking (requires credentials). Counts captured $krb5tgs$ hashes.
    • secretsdump — Runs secretsdump for DCSync / SAM extraction (requires credentials, 900-second timeout). Counts extracted NTLM hashes by regex-matching the standard hash format.
  3. Output — Writes findings.json, findings.csv, and summary.json in universal schema format. Each finding references both the evidence output file and its .log sibling (comma-joined in output_file).

Token Protocol: When managed, Vault emits __VANTAGE_LOG__, __VANTAGE_ERR__, __VANTAGE_STATUS__, and __VANTAGE_FINDING__ tokens for real-time UI integration.

Phase Pipeline

  1. Phase 1 — Domain Connection
  2. Phase 2 — AD Enumeration
  3. Phase 3 — Privilege Analysis
  4. Phase 4 — Findings Generation

Security

Vault is an active exploitation tool that performs credential dumping and authentication attacks against Active Directory. It requires valid credentials (username/password) for the secretsdump and kerberoast modules, while AS-REP roasting and SMB signing checks can run without authentication.

Captured hashes and credentials are written only to the local run directory. No credentials are transmitted externally. The tool expects to be run within an authorized penetration test engagement.

Features

AD Attack Modules

secretsdump (DCSync/SAM)
Extracts NTLM hashes via impacket-secretsdump using DCSync or SAM dump techniques. Reports the count of compromised accounts detected by regex matching the NTLM hash format. 900-second timeout for large domains.
Kerberoasting (GetUserSPNs)
Requests TGS service tickets for accounts with SPNs using impacket-GetUserSPNs with -request flag. Captured $krb5tgs$ hashes can be cracked offline. Output saved to kerberoast.txt.
AS-REP Roasting (GetNPUsers)
Identifies accounts with 'Do not require Kerberos preauthentication' enabled using impacket-GetNPUsers in no-pass mode. Outputs $krb5asrep$ hashes in hashcat format. Supports --users-file for targeted user lists.
SMB Signing Inspection
Checks whether SMB signing is required on the target using impacket-rpcdump (or smbclient as fallback). Detects 'Signing required: False' and 'message_signing disabled' patterns.

Integration

Vantage-Managed Mode
Emits __VANTAGE_LOG/ERR/STATUS/FINDING__ protocol tokens when VAULT_MANAGED=1 for real-time UI integration with the Vantage management platform.
Impacket Binary Resolution
Automatically locates Impacket scripts by searching multiple naming conventions (name, impacket-name, name.py) via shutil.which(), handling different installation layouts.

Module Selection

Selective Module Execution
Run specific modules via --modules (comma-separated: secretsdump, kerberoast, asreproast, smb_relay) or run all with --modules all. Modules requiring credentials are auto-skipped when --user/--password are not provided.

Output & Reporting

Universal Schema Output
Writes findings in pr0t31n universal schema format (findings.json, findings.csv, summary.json, meta.json) with VAULT-AD-xxx catalogue IDs for Prometheus ingestion.
Evidence Preservation
Each module writes its raw output (secretsdump.txt, kerberoast.txt, asreproast.txt, smb_signing.txt) plus .log siblings capturing the exact command, timing, and exit code. Both paths are referenced in the finding's output_file field.

Use Cases

Domain Controller Credential Audit

Given valid domain credentials, run all modules against a DC to test for DCSync exposure, Kerberoastable service accounts, AS-REP roastable users, and SMB signing enforcement. A single command produces structured findings covering the full AD attack surface.

Kerberos Pre-Auth Sweep

Supply a users-file with --users-file and run the asreproast module without credentials to identify accounts vulnerable to AS-REP roasting across the domain. No authentication needed.

SMB Relay Attack Surface Assessment

Run the smb_relay module against hosts to identify those without required SMB signing, which are candidates for NTLM relay lateral movement via tools like ntlmrelayx.

Post-Compromise Evidence Collection

After obtaining domain admin credentials during a penetration test, run secretsdump to demonstrate the full impact (number of compromised accounts) with structured evidence and .log audit trails for the report.

Vantage-Integrated AD Testing

Run Vault under the Vantage platform for real-time progress tracking, per-module status updates, and centralized findings management during an internal network assessment.

CLI Reference

Third-Party Tool Invocations

Commands and flags used when this tool invokes third-party dependencies during operation.

smbclient
Fallback SMB client for signing inspection when impacket-rpcdump is unavailable
smbclient <target>
impacket-secretsdump
DCSync/SAM credential dumping
secretsdump <domain/user:password@target>
impacket-GetUserSPNs
Kerberoasting — requests TGS-REP hashes for service accounts
GetUserSPNs -request -dc-ip <target> <domain/user:password> -outputfile <file>
impacket-GetNPUsers
AS-REP Roasting — finds accounts without pre-authentication
GetNPUsers -no-pass -dc-ip <target> -format hashcat <domain/>
impacket-rpcdump
RPC endpoint enumeration for relay surface assessment
rpcdump <target>

Finding Nomenclature

Vault uses the VAULT-AD-* prefix:

  • VAULT-AD-001 — DCSync / SAM Dump (credential extraction)
  • VAULT-AD-002 — Kerberoastable Service Accounts
  • VAULT-AD-003 — AS-REP Roastable Accounts
  • VAULT-AD-004 — SMB Signing Disabled/Not Required

Output Files

FileFormatDescription
meta.json JSON Tool identity and engagement metadata
findings.json JSON Universal findings array v1.1
findings.csv CSV CSV mirror of findings
summary.json JSON Aggregated statistics
scan.log TXT Human-readable timestamped log
scan.log.json JSONL Machine-readable JSON log events
errors.log TXT ERROR-level entries only

Invocation Methods

MethodUsage
CLI — Direct cd /opt/pr0t31n/Vault && python3 vault.py [OPTIONS]

Run directly with command-line arguments.

Integration

Third-Party Dependencies & Credits

Tool / LibraryDeveloperTypeLink
Impacket SecureAuth / Fortra python https://github.com/fortra/impacket
smbclient (Samba) Samba Team / Andrew Tridgell system https://www.samba.org/

Metadata

NameVault
CategoryExploitation
Version0.3.1
Install Path/opt/pr0t31n/Vault
Main Filevault.py
GitHubhttps://github.com/pr0t31n/Vault.git