One Bash Script to Wrap Your Entire Active Directory Pentest Toolkit
If you've ever run an Active Directory assessment from a Linux box, you know the drill: a dozen terminals, a folder full of half-remembered command syntax, and a mental checklist you're terrified of losing track of. linWinPwn is a single bash script that pulls that whole workflow under one roof, wrapping the tools you already reach for into a guided, menu-driven affair.
What It Does
linWinPwn is a bash script that wraps a long list of Active Directory tooling for Linux-based pentesting. It brings together enumeration (LDAP, RPC, ADCS, MSSQL, Kerberos, SCCM), vulnerability checks (noPac, ZeroLogon, MS17-010, MS14-068), object modifications (password changes, adding users to groups, RBCD, Shadow Credentials), and password dumping (secretsdump, lsassy, nanodump, DonPAPI). Rather than reinventing any of that, it orchestrates the tools you probably already have installed.
Under the hood, it leans on impacket, BloodHound, netexec, enum4linux-ng, ldapdomaindump, lsassy, smbmap, kerbrute, certipy, silenthound, bloodyAD, DonPAPI, and plenty of others. You can install it by cloning the repo and running the install.sh script, or pull a pre-built Docker image from Docker Hub if you'd rather not touch your host system.
The script runs in two modes. Interactive mode (the default) opens a menu so you can fire off checks individually. Automated mode, triggered with --auto, runs enumeration only—no exploitation, no modifications, no password dumping—and tailors what it runs based on how you authenticated.
Why It's Cool
It respects the reconnaissance phase. The --auto flag is a smart boundary. Automation is great right up until it starts changing things on a live domain, so linWinPwn draws a hard line: automated mode enumerates, and that's it. If you want to modify objects or dump credentials, you go back to interactive mode and make that choice deliberately. That's a design decision born from experience, not one made for a demo.
The unauthenticated workflow is genuinely thorough. Give it nothing but a domain controller IP and it'll run anonymous enumeration across netexec, enum4linux-ng, ldapdomaindump, and ldeep, then move into RID bruteforce, kerbrute user spraying, Pre2k authentication checks, ASREPRoast with automatic hash cracking via john-the-ripper and the rockyou wordlist, blind Kerberoast, and a CVE-2022-33679 exploit. It also checks for unsecure DNS updates, enumerates SMB shares, and probes for WebDav, dfscoerce, shadowcoerce, and Spooler services—then checks for ms17-010, zerologon, petitpotam, nopac, SMB signing, NTLMv1, and runasppl weaknesses. That's a full first pass from a cold start.
Authenticated runs chain the tools together. Once you've got credentials (password, NTLM hash, Kerberos ticket, AES key, or a pfx certificate), it extracts DNS, collects BloodHound data, and enumerates with netexec, bloodyAD, sccmhunter, rdwatool, and GPOParser. It generates a wordlist for cracking, hunts for accounts where the username equals the password, checks Pre2k auth, pulls ADCS info with certipy and certi.py, and runs ASREPRoast, Kerberoast, and targeted Kerberoast—cracking hashes at each step. SMB shares get enumerated across all domain servers with smbmap, FindUncommonShares, and cme's spider_plus.
It meets you where you are. The interactive mode is the default for a reason: it's the safer choice when you're mid-engagement and want to run one specific check. But when you're doing a broad sweep or repeating the same recon across multiple targets, --auto saves you from typing the same twenty commands again.
How to Try It
You've got three paths depending on how much setup you want.
- Clone and install locally:
git clone https://github.com/lefayjey/linWinPwn
cd linWinPwn
chmod +x install.sh
./install.sh
- Use the pre-built Docker image (handy if you don't want to pollute your host):
docker pull lefayjey/linwinpwn:latest
echo -e "docker run --rm --init -it --net=host -v \$(pwd):/opt/lwp-output lefayjey/linwinpwn:latest \$@" | sudo tee "/usr/local/sbin/linWinPwn_docker"
sudo chmod 755 /usr/local/sbin/linWinPwn_docker
linWinPwn_docker -t <DC_IP>
linWinPwn_docker -t <DC_IP> -d <domain> -u <user> -p <password> --auto
- Build from source if you want to tweak the image yourself:
docker build -t linwinpwn .
docker run --rm --init -it --net=host -v $(pwd):/opt/lwp-output linwinpwn -t <DC_IP>
Once installed, the basic invocation is:
linWinPwn -t <Domain_Controller_IP> [-d <AD_domain> -u <AD_user> -p <AD_password> -H <hash> -K <kerbticket> -A <AES_key> -C <cert> -o <output_dir>]
The Docker wrapper mounts your current directory as /opt/lwp-output, so anything the script writes lands on your host.
You can find the full source and documentation at github.com/lefayjey/linWinPwn.
Final Thoughts
linWinPwn isn't trying to replace impacket or BloodHound—it's trying to stop you from having to remember how to invoke all of them in the right order. If you do AD assessments from Linux and you're tired of maintaining your own shell aliases and note files, this is worth a look. The automated mode's enumeration-only scope makes it a reasonable starting point even on engagements where you want to be careful, and the interactive menu gives you the control back when it matters. It's a practical, opinionated wrapper built by someone who clearly runs these tools regularly.