The value of Adinfo lies incompleting panoramic domain environment information gathering with a single command—key information such as domain controllers, domain admins, trusts, SPNs, delegation, and GPOs is all output, saving the trouble of manually writing LDAP queries.
Project address:https://github.com/lzzbb/Adinfo
Basic Usage
# 使用域用户凭据收集
adinfo -d DOMAIN -u user -p password -dc DC_IP
# 使用 NTLM 哈希
adinfo -d DOMAIN -u user -H NTLM_HASH -dc DC_IP
Output Content
Adinfo automatically collects and outputs the following information:
| Category | Content |
|---|---|
| Basic Information | Domain name, domain SID, functional level |
| Domain Controller List | Hostnames and IPs of all DCs |
| Domain Admin Users | Members of Domain Admins / Enterprise Admins |
| Trust Relationships | Domain trust types and directions |
| Password Policy | Minimum length, complexity, lockout threshold |
| SPN Accounts | Service accounts that can be Kerberoasted |
| Delegation Configuration | Unconstrained delegation / constrained delegation / RBCD |
| AS-REP | Accounts that do not require pre-authentication |
| GPO | Group Policy List |
| OU Structure | Organizational unit hierarchy |
| Computer Accounts | List of computers in the domain |
Practical Workflow
获得域用户凭据后：
│
├─ 1. adinfo 快速收集全景信息
│ └→ 识别域管用户、SPN 账户、委派配置
│
├─ 2. 根据 adinfo 输出选择攻击路径
│ ├─ 有 SPN 账户 → Kerberoast (GetUserSPNs.py)
│ ├─ 有 AS-REP 账户 → AS-REP Roast (GetNPUsers.py)
│ ├─ 有非约束委派 → 委派攻击
│ ├─ 有信任关系 → 跨域攻击
│ └─ 密码策略弱 → 密码喷洒
│
├─ 3. 深入枚举（需要更详细信息时）
│ ├─ BloodHound → 可视化攻击路径
│ ├─ nxc ldap → 特定 LDAP 查询
│ └─ ldapsearch → 自定义过滤器
│
└─ 4. 横向移动 + 提权
Comparison with Other AD Tools
| Tool | Advantages | Applicable Scenarios |
|---|---|---|
| Adinfo | Panoramic view with one command, concise output | Initial domain information gathering |
| BloodHound | Visualize attack paths | Path analysis in complex domain environments |
| nxc ldap | Flexible queries, rich modules | Specific information queries |
| ldapsearch | Native LDAP, most flexible | Custom complex queries |