NOEMVEX APEX PREDATOR v6.0 - OMNI-HUNTER EDITION

"Hunt the Vulnerabilities, Dominate the Directory." The ultimate Active Directory Offensive Suite. Engineered for targeted RPC/SMB exploitation, LAPS password extraction, advanced Identity Recon, and OMNI-HUNTER Kerberos/Delegation abuse detection. ⚠️ Disclaimer: This tool is for educational purposes and authorized security testing only.

---

About

NOEMVEX APEX PREDATOR is designed for the modern Active Directory (AD) environment. Standard scanners create excessive noise and alert the Blue Team. The Apex Engine focuses on high-impact, stealthy misconfigurations and vulnerabilities without crashing the Domain Controller or triggering EDR/XDR alarms. By leveraging direct RPC bindings and raw LDAP queries, it bridges the gap between deep technical exploitation and C-Level reporting, generating automated HTML dashboards and SIEM-ready JSON (v3.0) exports.

Capabilities

• Network Protocol Audit: Analyzes SMB signing enforcement (NTLM Relay paths) and safely probes Netlogon RPC endpoints for ZeroLogon (CVE-2020-1472) exposure.
• Identity Reconnaissance: Hunts for AS-REP Roastable accounts, Kerberoastable Service Principal Names (SPNs), Machine Account Quota (MAQ) risks, and active AD Certificate Services (ESC1-ESC14 attack surface).
• Kerberos Hygiene & Delegation (OMNI-HUNTER): Audits krbtgt password staleness (Golden Ticket persistence), Unconstrained Delegation on non-DC objects, and Resource-Based Constrained Delegation (RBCD) backdoors.
• LAPS Extraction: Authenticated LDAP queries to dump Microsoft Local Administrator Password Solution (LAPS) cleartext passwords.
• Executive Dashboarding: Automatically compiles findings into a styled HTML report and a schema v3.0 JSON export for Splunk/Elastic SIEM ingestion.

---

Usage

1. Requirements

Ensure you have Python 3.9+ installed. Install the core dependencies:

pip3 install -r requirements.txt

Core dependencies strictly include impacket (>=0.11.0) for SMB/RPC interactions and ldap3 (>=2.9.1) for stealthy directory querying.

2. Execution

Run the tool using the following command structure. ROOT privileges are required for stable raw socket creation.

Syntax:
sudo python3 noemvex_apex.py --ip <DC_IP> --domain <DOMAIN_NAME> [--user <USERNAME>] [--password <PASSWORD> | --hashes <LM:NT>]

Example (Cleartext Auth):
sudo python3 noemvex_apex.py --ip 192.168.1.100 --domain corp.local --user Administrator --password 'Summer2024!'

Example (Pass-the-Hash):
sudo python3 noemvex_apex.py --ip 192.168.1.100 --domain corp.local --user Administrator --hashes 'aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c'

Example (Unauthenticated / Null Session Recon):
sudo python3 noemvex_apex.py --ip 192.168.1.100 --domain corp.local

---

Output Preview

  █████╗ ██████╗ ███████╗██╗  ██╗    ██████╗ ██████╗ ███████╗██████╗  █████╗ ████████╗ ██████╗ ██████╗ 
 ██╔══██╗██╔══██╗██╔════╝╚██╗██╔╝    ██╔══██╗██╔══██╗██╔════╝██╔══██╗██╔══██╗╚══██╔══╝██╔═══██╗██╔══██╗
 ███████║██████╔╝█████╗   ╚███╔╝     ██████╔╝██████╔╝█████╗  ██║  ██║███████║   ██║   ██║   ██║██████╔╝
 ██╔══██║██╔═══╝ ██╔══╝   ██╔██╗     ██╔═══╝ ██╔══██╗██╔══╝  ██║  ██║██╔══██║   ██║   ██║   ██║██╔══██╗
 ██║  ██║██║     ███████╗██╔╝ ██╗    ██║     ██║  ██║███████╗██████╔╝██║  ██║   ██║   ╚██████╔╝██║  ██║
 ╚═╝  ╚═╝╚═╝     ╚══════╝╚═╝  ╚═╝    ╚═╝     ╚═╝  ╚═╝╚══════╝╚═════╝ ╚═╝  ╚═╝   ╚═╝    ╚═════╝ ╚═╝  ╚═╝
                        [ NOEMVEX APEX PREDATOR v6.0  //  OMNI-HUNTER EDITION ]

[*] Engaging Target: 11.11.1.11 — Domain: localdomain
[*] Output Directory : apex_loot_localdomain_20260617_203805
[*] Authentication   : AuthenticationEngine(mode=CLEARTEXT, user=localdomain\Administrator)

╔══[ PHASE 4 — REPORT GENERATION (v6.0 OMNI-HUNTER) ]══════════════╗
[✓] HTML Dashboard → apex_loot_localdomain_20260617_203805/apex_dashboard.html
[✓] SIEM JSON Export (schema v3.0) → apex_loot_localdomain_20260617_203805/siem_summary_localdomain.json

---

⚠️ Compliance & Ghost Mode

Regulatory Context: This tool assists in auditing privileged access management (PAM) and AD hardening, aligning with NIS2 requirements for infrastructure resilience and GDPR access control mandates. All JSON reporting outputs natively map to MITRE ATT&CK framework IDs.

Ghost Mode: All commits to this repository are GPG signed and metadata is strictly managed. The author assumes no liability for unauthorized usage.

---

Developer

Emre 'noemvex' Sahin Red Team Specialist & Security Architect