daemon-sec-cheatsheet

adws-enumeration.md (13720B)

---

 ---
 title: "Active Directory Web Services (ADWS) Enumeration & Stealth Collection"
 section: "Windows"
 sectionSlug: "windows-hardening"
 sourcePath: "src/windows-hardening/active-directory-methodology/adws-enumeration.md"
 sourceUrl: "https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/windows-hardening/active-directory-methodology/adws-enumeration.md"
 sha: "188de82beb54e70956b2952367a0af91d26758b8"
 isIndex: false
 modified: true
 license: "CC-BY-NC-4.0"
 ---
 
 # Active Directory Web Services (ADWS) Enumeration & Stealth Collection
 
 ## What is ADWS?
 
 Active Directory Web Services (ADWS) is **enabled by default on every Domain Controller since Windows Server 2008 R2** and listens on TCP **9389**.  Despite the name, **no HTTP is involved**.  Instead, the service exposes LDAP-style data through a stack of proprietary .NET framing protocols:<sup>[[1]](#references)[[6]](#references)[[7]](#references)</sup>
 
 * MC-NBFX → MC-NBFSE → MS-NNS → MC-NMF
 
 Because the traffic is encapsulated inside these binary SOAP frames and travels over an uncommon port, **enumeration through ADWS is far less likely to be inspected, filtered or signatured than classic LDAP/389 & 636 traffic**.  For operators this means:<sup>[[1]](#references)[[7]](#references)</sup>
 
 * Stealthier recon – Blue teams often concentrate on LDAP queries.
 * Freedom to collect from **non-Windows hosts (Linux, macOS)** by tunnelling 9389/TCP through a SOCKS proxy.
 * The same data you would obtain via LDAP (users, groups, ACLs, schema, etc.) and the ability to perform **writes** (e.g. `msDs-AllowedToActOnBehalfOfOtherIdentity` for **RBCD**).
 
 ADWS interactions are implemented over WS-Enumeration: every query starts with an `Enumerate` message that defines the LDAP filter/attributes and returns an `EnumerationContext` GUID, followed by one or more `Pull` messages that stream up to the server-defined result window.<sup>[[7]](#references)</sup> Contexts age out after ~30 minutes, so tooling either needs to page results or split filters (prefix queries per CN) to avoid losing state.<sup>[[8]](#references)</sup> When asking for security descriptors, specify the `LDAP_SERVER_SD_FLAGS_OID` control to omit SACLs, otherwise ADWS simply drops the `nTSecurityDescriptor` attribute from its SOAP response.
 
 > NOTE: ADWS is also used by many RSAT GUI/PowerShell tools, so traffic may blend with legitimate admin activity.
 
 ## SoaPy – Native Python Client
 
 [SoaPy](https://github.com/logangoins/soapy) is a **full re-implementation of the ADWS protocol stack in pure Python**.  It crafts the NBFX/NBFSE/NNS/NMF frames byte-for-byte, allowing collection from Unix-like systems without touching the .NET runtime.<sup>[[1]](#references)[[2]](#references)</sup>
 
 ### Key Features
 
 * Supports **proxying through SOCKS** (useful from C2 implants).
 * Fine-grained search filters identical to LDAP `-q '(objectClass=user)'`.
 * Optional **write** operations ( `--set` / `--delete` ).
 * **BOFHound output mode** for direct ingestion into BloodHound.<sup>[[3]](#references)</sup>
 * `--parse` flag to prettify timestamps / `userAccountControl` when human readability is required.<sup>[[2]](#references)</sup>
 
 ### Targeted collection flags & write operations
 
 SoaPy ships with curated switches that replicate the most common LDAP hunting tasks over ADWS: `--users`, `--computers`, `--groups`, `--spns`, `--asreproastable`, `--admins`, `--constrained`, `--unconstrained`, `--rbcds`, plus raw `--query` / `--filter` knobs for custom pulls. Pair those with write primitives such as `--rbcd <source>` (sets `msDs-AllowedToActOnBehalfOfOtherIdentity`), `--spn <service/cn>` (SPN staging for targeted Kerberoasting) and `--asrep` (flip `DONT_REQ_PREAUTH` in `userAccountControl`).<sup>[[2]](#references)</sup>
 
 Example targeted SPN hunt that only returns `samAccountName` and `servicePrincipalName`:
 
 ```bash
 soapy corp.local/alice:'Winter2025!'@dc01.corp.local \
       --spns -f samAccountName,servicePrincipalName --parse
 ```
 
 Use the same host/credentials to immediately weaponise findings: dump RBCD-capable objects with `--rbcds`, then apply `--rbcd 'WEBSRV01$' --account 'FILE01$'` to stage a Resource-Based Constrained Delegation chain (see [Resource-Based Constrained Delegation](/hacktricks/windows-hardening/active-directory-methodology/resource-based-constrained-delegation) for the full abuse path).
 
 ### Installation (operator host)
 
 ```bash
 python3 -m pip install soapy-adws   # or git clone && pip install -r requirements.txt
 ```
 
 ## ADWSDomainDump – LDAPDomainDump over ADWS (Linux/Windows)
 
 * Fork of `ldapdomaindump` that swaps LDAP queries for ADWS calls on TCP/9389 to reduce LDAP-signature hits.
 * Performs an initial reachability check to 9389 unless `--force` is passed (skips the probe if port scans are noisy/filtered).
 * Tested against Microsoft Defender for Endpoint and CrowdStrike Falcon with successful bypass in the README.<sup>[[4]](#references)</sup>
 
 ### Installation
 
 ```bash
 pipx install .
 ```
 
 ### Usage
 
 ```bash
 adwsdomaindump -u 'thewoods.local\mathijs.verschuuren' -p 'password' -n 10.10.10.1 dc01.thewoods.local
 ```
 
 Typical output logs the 9389 reachability check, ADWS bind, and dump start/finish:
 
 ```text
 [*] Connecting to ADWS host...
 [+] ADWS port 9389 is reachable
 [*] Binding to ADWS host
 [+] Bind OK
 [*] Starting domain dump
 [+] Domain dump finished
 ```
 
 ## Sopa - A practical client for ADWS in Golang
 
 Similarly as soapy, [sopa](https://github.com/Macmod/sopa) implements the ADWS protocol stack (MS-NNS + MC-NMF + SOAP) in Golang, exposing command-line flags to issue ADWS calls such as:<sup>[[5]](#references)</sup>
 
 * **Object search & retrieval** - `query` / `get`
 * **Object lifecycle** - `create [user|computer|group|ou|container|custom]` and `delete`
 * **Attribute editing** - `attr [add|replace|delete]`
 * **Account management** - `set-password` / `change-password`
 * and others such as `groups`, `members`, `optfeature`, `info [version|domain|forest|dcs]`, etc.
 
 ### Protocol mapping highlights
 
 * LDAP-style searches are issued via **WS-Enumeration** (`Enumerate` + `Pull`) with attribute projection, scope control (Base/OneLevel/Subtree) and pagination.
 * Single-object fetch uses **WS-Transfer** `Get`; attribute changes use `Put`; deletions use `Delete`.
 * Built-in object creation uses **WS-Transfer ResourceFactory**; custom objects use an **IMDA AddRequest** driven by YAML templates.
 * Password operations are **MS-ADCAP** actions (`SetPassword`, `ChangePassword`).<sup>[[5]](#references)</sup>
 
 ### Unauthenticated metadata discovery (mex)
 
 ADWS exposes WS-MetadataExchange without credentials, which is a quick way to validate exposure before authenticating:<sup>[[5]](#references)</sup>
 
 ```bash
 sopa mex --dc <DC>
 ```
 
 ### DNS/DC discovery & Kerberos targeting notes
 
 Sopa can resolve DCs via SRV if `--dc` is omitted and `--domain` is provided. It queries in this order and uses the highest-priority target:<sup>[[5]](#references)</sup>
 
 ```text
 _ldap._tcp.<domain>
 _kerberos._tcp.<domain>
 ```
 
 Operationally, prefer a DC-controlled resolver to avoid failures in segmented environments:
 
 * Use `--dns <DC-IP>` so **all** SRV/PTR/forward lookups go through the DC DNS.
 * Use `--dns-tcp` when UDP is blocked or SRV answers are large.
 * If Kerberos is enabled and `--dc` is an IP, sopa performs a **reverse PTR** to obtain an FQDN for correct SPN/KDC targeting. If Kerberos is not used, no PTR lookup happens.
 
 Example (IP + Kerberos, forced DNS via the DC):
 
 ```bash
 sopa info version --dc 192.168.1.10 --dns 192.168.1.10 -k --domain corp.local -u user -p pass
 ```
 
 ### Auth material options
 
 Besides plaintext passwords, sopa supports **NT hashes**, **Kerberos AES keys**, **ccache**, and **PKINIT certificates** (PFX or PEM) for ADWS auth. Kerberos is implied when using `--aes-key`, `-c` (ccache) or certificate-based options.<sup>[[5]](#references)</sup>
 
 ```bash
 # NT hash
 sopa --dc <DC> -d <DOMAIN> -u <USER> -H <NT_HASH> query --filter '(objectClass=user)'
 
 # Kerberos ccache
 sopa --dc <DC> -d <DOMAIN> -u <USER> -c <CCACHE> info domain
 ```
 
 ### Custom object creation via templates
 
 For arbitrary object classes, the `create custom` command consumes a YAML template that maps to an IMDA `AddRequest`:<sup>[[5]](#references)</sup>
 
 * `parentDN` and `rdn` define the container and relative DN.
 * `attributes[].name` supports `cn` or namespaced `addata:cn`.
 * `attributes[].type` accepts `string|int|bool|base64|hex` or explicit `xsd:*`.
 * Do **not** include `ad:relativeDistinguishedName` or `ad:container-hierarchy-parent`; sopa injects them.
 * `hex` values are converted to `xsd:base64Binary`; use `value: ""` to set empty strings.
 
 ## SOAPHound – High-Volume ADWS Collection (Windows)
 
 [FalconForce SOAPHound](https://github.com/FalconForceTeam/SOAPHound) is a .NET collector that keeps all LDAP interactions inside ADWS and emits BloodHound v4-compatible JSON. It builds a complete cache of `objectSid`, `objectGUID`, `distinguishedName` and `objectClass` once (`--buildcache`), then reuses it for high-volume `--bhdump`, `--certdump` (ADCS), or `--dnsdump` (AD-integrated DNS) passes so only ~35 critical attributes ever leave the DC. AutoSplit (`--autosplit --threshold <N>`) automatically shards queries by CN prefix to stay under the 30-minute EnumerationContext timeout in large forests.<sup>[[8]](#references)</sup>
 
 Typical workflow on a domain-joined operator VM:
 
 ```powershell
 # Build cache (JSON map of every object SID/GUID)
 SOAPHound.exe --buildcache -c C:\temp\corp-cache.json
 
 # BloodHound collection in autosplit mode, skipping LAPS noise
 SOAPHound.exe -c C:\temp\corp-cache.json --bhdump \
               --autosplit --threshold 1200 --nolaps \
               -o C:\temp\BH-output
 
 # ADCS & DNS enrichment for ESC chains
 SOAPHound.exe -c C:\temp\corp-cache.json --certdump -o C:\temp\BH-output
 SOAPHound.exe --dnsdump -o C:\temp\dns-snapshot
 ```
 
 Exported JSON slots directly into SharpHound/BloodHound workflows—see [BloodHound methodology](/hacktricks/windows-hardening/active-directory-methodology/bloodhound) for downstream graphing ideas. AutoSplit makes SOAPHound resilient on multi-million object forests while keeping the query count lower than ADExplorer-style snapshots.
 
 ## Stealth AD Collection Workflow
 
 The following workflow shows how to enumerate **domain & ADCS objects** over ADWS, convert them to BloodHound JSON and hunt for certificate-based attack paths – all from Linux:
 
 1. **Tunnel 9389/TCP** from the target network to your box (e.g. via Chisel, Meterpreter, SSH dynamic port-forward, etc.).  Export `export HTTPS_PROXY=socks5://127.0.0.1:1080` or use SoaPy’s `--proxyHost/--proxyPort`.
 
 2. **Collect the root domain object:**
 
 ```bash
 soapy ludus.domain/jdoe:'P@ssw0rd'@10.2.10.10 \
       -q '(objectClass=domain)' \
       | tee data/domain.log
 ```
 
 3. **Collect ADCS-related objects from the Configuration NC:**
 
 ```bash
 soapy ludus.domain/jdoe:'P@ssw0rd'@10.2.10.10 \
       -dn 'CN=Configuration,DC=ludus,DC=domain' \
       -q '(|(objectClass=pkiCertificateTemplate)(objectClass=CertificationAuthority) \\
            (objectClass=pkiEnrollmentService)(objectClass=msPKI-Enterprise-Oid))' \
       | tee data/adcs.log
 ```
 
 4. **Convert to BloodHound:**
 
 ```bash
 bofhound -i data --zip   # produces BloodHound.zip
 ```
 
 5. **Upload the ZIP** in the BloodHound GUI and run cypher queries such as `MATCH (u:User)-[:Can_Enroll*1..]->(c:CertTemplate) RETURN u,c` to reveal certificate escalation paths (ESC1, ESC8, etc.).
 
 ### Writing `msDs-AllowedToActOnBehalfOfOtherIdentity` (RBCD)
 
 ```bash
 soapy ludus.domain/jdoe:'P@ssw0rd'@dc.ludus.domain \
       --set 'CN=Victim,OU=Servers,DC=ludus,DC=domain' \
       msDs-AllowedToActOnBehalfOfOtherIdentity 'B:32:01....'
 ```
 
 Combine this with `s4u2proxy`/`Rubeus /getticket` for a full **Resource-Based Constrained Delegation** chain (see [Resource-Based Constrained Delegation](/hacktricks/windows-hardening/active-directory-methodology/resource-based-constrained-delegation)).
 
 ## Tooling Summary
 
 | Purpose | Tool | Notes |
 |---------|------|-------|
 | ADWS enumeration | [SoaPy](https://github.com/logangoins/soapy) | Python, SOCKS, read/write |
 | High-volume ADWS dump | [SOAPHound](https://github.com/FalconForceTeam/SOAPHound) | .NET, cache-first, BH/ADCS/DNS modes |
 | BloodHound ingest | [BOFHound](https://github.com/bohops/BOFHound) | Converts SoaPy/ldapsearch logs |
 | Cert compromise | [Certipy](https://github.com/ly4k/Certipy) | Can be proxied through same SOCKS |
 | ADWS enumeration & object changes | [sopa](https://github.com/Macmod/sopa) | Generic client to interface with known ADWS endpoints - allows for enumeration, object creation, attribute modifications, and password changes |
 
 ## References
 
 - [1] [SpecterOps – Make Sure to Use SOAP(y) – An Operators Guide to Stealthy AD Collection Using ADWS](https://specterops.io/blog/2025/07/25/make-sure-to-use-soapy-an-operators-guide-to-stealthy-ad-collection-using-adws/)
 - [2] [SoaPy GitHub](https://github.com/logangoins/soapy)
 - [3] [BOFHound GitHub](https://github.com/bohops/BOFHound)
 - [4] [ADWSDomainDump GitHub](https://github.com/mverschu/adwsdomaindump)
 - [5] [Sopa GitHub](https://github.com/Macmod/sopa)
 - [6] [Microsoft – MC-NBFX, MC-NBFSE, MS-NNS, MC-NMF specifications](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nbfx/)
 - [7] [IBM X-Force Red – Stealthy Enumeration of Active Directory Environments Through ADWS](https://logan-goins.com/2025-02-21-stealthy-enum-adws/)
 - [8] [FalconForce – SOAPHound tool to collect Active Directory data via ADWS](https://falconforce.nl/soaphound-tool-to-collect-active-directory-data-via-adws/)