Make Sure to Use SOAP(y) – An Operators Guide to Stealthy AD...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://specterops.io/blog/2025/07/25/make-sure-to-use-soapy-an-operators-guide-to-stealthy-ad-collection-using-adws/
• Blog Title: Make Sure to Use SOAP(y) – An Operators Guide to Stealthy AD Collection Using ADWS
• Suggested Section: Generic Hacking → Active Directory Web Services (ADWS) Enumeration

🎯 Content Summary

Active Directory Web Services (ADWS)

Active Directory Web Services (ADWS) runs by default on domain controllers over TCP port 9389, exposing LDAP data via layered Microsoft .NET protocols (MC-NBFX → MC-NBFSE → MS-NNS → MC-NMF) rather than HTTP/HTTPS. This allows attacker reconnaissance without touching standard LDAP ports.

SoaPy: Native Python Re-implementation

SoaPy (🔧 Technical Details

Stealthy ADWS Enumeration via SoaPy:
SoaPy recreates Microsoft’s SOAP-based .NET framing protocols (MC-NBFX, MC-NBFSE, MS-NNS, MC-NMF) in Python, enabling constrained Active Directory enumeration over TCP/9389 on Linux. By proxying through a SOCKS C2 channel, operators can stealthily query users, groups and computers and perform attribute writes (e.g., msDs-AllowedToActOnBehalfOfOtherIdentity) to facilitate RBCD attacks.

BOFHound Integration for BloodHound Ingestion:
By toggli...

🤖 Agent Actions

Added comprehensive coverage of stealthy Active Directory Web Services (ADWS) enumeration and SoaPy usage:

1. Created new page:
   src/windows-hardening/active-directory-methodology/adws-enumeration.md
   • Explains ADWS protocol stack, SoaPy features & installation
   • Provides full operational workflow (collection, BOFHound, BloodHound)
   • Includes RBCD write example, detection via ADDS logging & SACL canaries
   • Supplies tooling summary and references section (blog, tools, specs)
   • Follows HackTricks banners/structure guidelines

2. Updated BloodHound enumeration page:
   src/windows-hardening/active-directory-methodology/bloodhound.md
   • Restored/refreshed content and added reference block linking to the new ADWS page
   • Ensured banners at top/bottom and ...

✅ Review Checklist

• Content is technically accurate
• Formatting follows HackTricks style guidelines
• Links and references are working
• Content adds educational value
• No sensitive information is exposed

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://specterops.io/blog/2025/07/25/make-sure-to-use-soapy-an-operators-guide-to-stealthy-ad-collection-using-adws/

Content Categories: Based on the analysis, this content was categorized under "Generic Hacking → Active Directory Web Services (ADWS) Enumeration".

Repository Maintenance:

• MD Files Formatting: 861 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0

[carlospolop]

merge