Atlas: a New Offensive-Security Toolkit for Active Directory Built on Titanis

Researcher portbuster1337 has released Atlas — a cross-platform C# network execution and security assessment toolkit for Windows and Linux. The project is built on TrustedSec's Titanis library and follows the familiar NetExec/CrackMapExec workflow: target lists, credential sets, multi-host processing, modular enumeration, and a unified CLI.

Atlas provides the following functionality: • SMB — NTLM/Kerberos/anonymous authentication checks, enumeration of shares, users, groups, disks, and sessions via SRVS/SAMR RPC; SAM and LSA secret extraction via Remote Registry; SMB2/3 file operations; and remote execution via WMI or SCM. • Kerberos — user enumeration via AS-REQ, detection of accounts without pre-authentication for AS-REP Roasting, Kerberoasting, and Key List attacks against RODCs. • WMI — authentication via DCOM/WMI and remote command execution using Win32_Process.Create. • LDAP — SASL authentication via NTLM/Kerberos or a standard RFC 4511 bind, LDAP queries, Active Directory enumeration modules, and BloodHound CE collection. • DCSync — credential replication from a domain controller via MS-DRSR (DRSGetNCChanges). SMB also includes modules such as spider, shareaccess, and localadmins, while targets can be specified as individual hosts/IPs, CIDR blocks, IP ranges, comma-separated lists, or files. Password spraying is also supported.

One of Atlas's strengths is its shared authentication model inherited from Titanis. In addition to passwords, it supports NT hashes, Kerberos AES keys, keytabs, .kirbi/.ccache tickets, PKINIT certificates, S4U, SPN overrides, and SOCKS5.

The project is still at an early stage, so Atlas is best viewed as a new and evolving offensive-security toolkit rather than a mature replacement for NetExec.

Tool: https://github.com/portbuster1337/Atlas