Darkmoon: Transitioning AI to Autonomous Active Directory Pentesting Agents
Darkmoon represents a strategic transition from stateless LLM-based chatbots to autonomous "agentic" systems designed for complex Active Directory (AD) exploitation. By implementing a recursive "Enumerate -> Reason -> Pivot" agent loop, the framework effectively overcomes the context window and statefulness limitations inherent in standard large language models. The system utilizes modular Markdown playbooks as state engines and a specialized State Proxy to maintain session context across multi-step, non-linear attack paths. This architecture enables autonomous discovery of privilege escalation routes and domain compromise via automated tool integration, providing an auditable and reproducible evidence trail for every stage of the exploit lifecycle.