LAZARUS
What it is — LAZARUS automates the full Active Directory attack chain in practice environments. Its output is designed so you know exactly what's happening at a glance: commands appear in distinct boxes, important findings are highlighted in green, and privilege escalation vectors in red. The third piece of my toolkit — it kicks in when REAPER detects AD (ports 445+88+389).
| Type | CLI · Python 3.10+ |
| License | MIT |
| Platform | Kali / Parrot |
| Use | Authorised environments only (HTB, THM, VulnHub, your own labs) |
| Repo | github.com/DonTrebor1/LAZARUS |
What sets it apart
- Clear visual output (boxes, colours, separators)
- Findings highlighted against raw command output
- Privilege escalation vectors visually flagged
- BadSuccessor / dMSA (CVE-2025-26647)
- ADCS ESC1-8 with certipy
- ACL analysis (WriteDacl, GenericAll, GenericWrite)
- Native Pass-the-Hash
- Persistent state across sessions
- Per-phase OPSEC labels
Requirements
sudo apt install nmap netexec impacket-scripts evil-winrm hashcat bloodhound-python certipy-adHow to use it
Full automatic chain:
python3 lazarus.py -t 10.10.11.x -d corp.local --autoWith credentials already known:
python3 lazarus.py -t 10.10.11.x -d corp.local --creds 'jsmith:Password123' --autoPass-the-Hash:
python3 lazarus.py -t 10.10.11.x -d corp.local --hash 'administrator:8846f7eaee8fb117ad06bdd830b7586c' --autoWith an already-enumerated user list:
python3 lazarus.py -t 10.10.11.x -d corp.local --users users.txt --autoPreview the attack plan without running anything / resume a session / re-analyse vectors:
python3 lazarus.py -t 10.10.11.x -d corp.local --plan
python3 lazarus.py --resume lazarus_output/lazarus_state.json
python3 lazarus.py --resume lazarus_output/lazarus_state.json --reanalyzeAttack phases
| # | Phase | Tools | OPSEC |
|---|---|---|---|
| 1 | Reconnaissance | nmap | MEDIUM |
| 2 | User enumeration | netexec RID brute, anonymous LDAP | MEDIUM |
| 3 | AS-REP Roasting | impacket-GetNPUsers | MEDIUM |
| 4 | Kerberoasting | impacket-GetUserSPNs | MEDIUM |
| 5 | Cracking | hashcat (18200/13100) | LOW |
| 6 | Credential validation | netexec smb/winrm | MEDIUM |
| 7 | Post-enum | netexec, BloodHound, certipy, dacledit, dMSA | LOW-HIGH |
| 8 | Analysis and escalation | Privilege/group/ADCS/ACL map | — |
Output
lazarus_output/
├── lazarus_state.json # Full state (resume with --resume)
├── nmap.txt
├── enum_users.txt / users.txt
├── asrep.txt / asrep_hashes.txt / asrep.pot
├── kerberoast.txt / kerb_hashes.txt / kerb.pot
├── validate.txt / post_enum.txt / smb_shares.txt
├── bloodhound/ # BloodHound data
├── adcs.txt # ADCS ESC1-8
├── dmsa.txt # BadSuccessor/dMSA
└── acl.txt # Dangerous ACLs⚠️ Legal notice: exclusively for controlled, authorised practice environments (HackTheBox, TryHackMe, VulnHub, your own labs). Using it against systems without explicit authorisation is illegal.
Repository
Qué es — LAZARUS automatiza la cadena completa de ataque sobre Active Directory en entornos de práctica. Su output está diseñado para que de un vistazo sepas exactamente qué está pasando: los comandos aparecen en cajas diferenciadas, los hallazgos importantes se resaltan en verde, y los vectores de escalada de privilegios en rojo. Tercera pieza de mi toolkit — se activa cuando REAPER detecta AD (puertos 445+88+389).
| Tipo | CLI · Python 3.10+ |
| Licencia | MIT |
| Plataforma | Kali / Parrot |
| Uso | Solo entornos autorizados (HTB, THM, VulnHub, labs propios) |
| Repo | github.com/DonTrebor1/LAZARUS |
Qué lo diferencia
- Output visual claro (cajas, colores, separadores)
- Findings resaltados frente al output crudo de los comandos
- Vectores de escalada destacados visualmente
- BadSuccessor / dMSA (CVE-2025-26647)
- ADCS ESC1-8 con certipy
- Análisis de ACLs (WriteDacl, GenericAll, GenericWrite)
- Pass-the-Hash nativo
- Estado persistente entre sesiones
- Etiquetas OPSEC por fase
Requisitos
sudo apt install nmap netexec impacket-scripts evil-winrm hashcat bloodhound-python certipy-adUso
Cadena completa automática:
python3 lazarus.py -t 10.10.11.x -d corp.local --autoCon credenciales ya conocidas:
python3 lazarus.py -t 10.10.11.x -d corp.local --creds 'jsmith:Password123' --autoPass-the-Hash:
python3 lazarus.py -t 10.10.11.x -d corp.local --hash 'administrator:8846f7eaee8fb117ad06bdd830b7586c' --autoCon lista de usuarios ya enumerados:
python3 lazarus.py -t 10.10.11.x -d corp.local --users users.txt --autoVer el plan de ataque sin ejecutar nada / reanudar sesión / re-analizar vectores:
python3 lazarus.py -t 10.10.11.x -d corp.local --plan
python3 lazarus.py --resume lazarus_output/lazarus_state.json
python3 lazarus.py --resume lazarus_output/lazarus_state.json --reanalyzeFases de ataque
| # | Fase | Herramientas | OPSEC |
|---|---|---|---|
| 1 | Reconocimiento | nmap | MEDIUM |
| 2 | Enumeración de usuarios | netexec RID brute, LDAP anónimo | MEDIUM |
| 3 | AS-REP Roasting | impacket-GetNPUsers | MEDIUM |
| 4 | Kerberoasting | impacket-GetUserSPNs | MEDIUM |
| 5 | Cracking | hashcat (18200/13100) | LOW |
| 6 | Validación de credenciales | netexec smb/winrm | MEDIUM |
| 7 | Post-enum | netexec, BloodHound, certipy, dacledit, dMSA | LOW-HIGH |
| 8 | Análisis y escalada | Mapa de privilegios/grupos/ADCS/ACL | — |
Output
lazarus_output/
├── lazarus_state.json # Estado completo (resume con --resume)
├── nmap.txt
├── enum_users.txt / users.txt
├── asrep.txt / asrep_hashes.txt / asrep.pot
├── kerberoast.txt / kerb_hashes.txt / kerb.pot
├── validate.txt / post_enum.txt / smb_shares.txt
├── bloodhound/ # Datos BloodHound
├── adcs.txt # ADCS ESC1-8
├── dmsa.txt # BadSuccessor/dMSA
└── acl.txt # ACLs peligrosas⚠️ Aviso legal: exclusivamente para entornos de práctica controlados y autorizados (HackTheBox, TryHackMe, VulnHub, laboratorios propios). Usarlo contra sistemas sin autorización explícita es ilegal.