ARES – Active Directory Enumeration & Attack Framework

ARES is an interactive PowerShell toolkit designed for authorized Active Directory security assessments, red team operations, and blue team validation.

It focuses on identifying common AD attack vectors such as Kerberoasting, AS-REP Roasting, stale accounts, weak KRBTGT hygiene, and credential spraying all with built-in safety mechanisms (confirmation prompts, randomized delays, stealth techniques).

Critical Legal & Safety Warning
This tool is strictly for educational purposes and penetration tests with explicit written permission only.
Unauthorized use is illegal and may result in criminal liability.
Some features can trigger EDR alerts, cause account lockouts, or disable security controls.
Use at your own risk the author accepts no responsibility for misuse, damage, alerts, or any consequences.

Features

Enumeration

• Kerberoastable accounts (SPN enumeration)
• AS-REP roastable accounts (DONT_REQUIRE_PREAUTH)
• Inactive / stale user accounts (>90 days – using Search-ADAccount)
• KRBTGT password age & last reset check (Golden Ticket compromise indicator)
• Console output + optional CSV export for findings

Attack Simulation (High-Risk – Explicit Confirmation Required)

Stealth password spraying
Kerberos-based credential validation (PrincipalContext.ValidateCredentials)
No SMB / admin$ access → significantly quieter
Randomized jitter (5–9 seconds between attempts) Windows Defender real-time & behavior monitoring disable
Extremely noisy EDR detectable requires local admin + tamper protection OFF

Operational Enhancements

• Interactive menu (primary & recommended mode)
• Single credential prompt reused for the entire session
• Paging & result limiting for large domains
• Better error handling and user-friendly output
• Memory cleanup attempt for sensitive data

Requirements

• PowerShell 5.1+ (Windows) or PowerShell 7+ (cross-platform)
• ActiveDirectory module (install RSAT: Add-WindowsCapability -Online -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0)
• Network access to at least one domain controller
• Appropriate permissions:
  • Delegated read rights for enumeration
  • Higher privileges for attack features (Defender disable)

Installation

git clone https://github.com/shaheeryasirofficial/ARES.git
cd ARES

# Basic enumeration scan
.\ares.ps1 -EnumAll

# Password spraying (with safety delay)
.\ares.ps1 -PasswordSpray -UserList .\users.txt -Password "Winter2025!" -DelaySeconds 6

# High-risk (requires confirmation flag)
.\ares.ps1 -DisableDefender -ConfirmUnsafe