Get an attribute value from the LDAP entry with support for default values. This method provides convenient access to LDAP attribute

Show detailed information about a specific Key Credential. Returns: True if the Key Credential was found and info displa

Handle errors by printing the error message and exiting the program. This function is a placeholder for error handling logic. It can be exte

Set an attribute value in the LDAP entry. Args: key: Attribute name to set value: Value to assign to the att

Convert an Impacket enum member to its integer value. Static type analysis is confused by the fact that Impacket enums are not standard

Try to write data to a file or stdout if file writing fails. This function attempts to save data to the specified path. If writing fails,

Read and display account attributes. This method retrieves and displays key attributes of the specified account. Returns:

Convert the token to its binary representation. Returns: Tuple of (header_bytes, data_bytes)

Look up an object by its SID. This method finds an Active Directory object by its security identifier, or returns a syntheti

Find a user by samAccountName. This method searches for a user by samAccountName and automatically handles computer account

Search the LDAP directory with the given filter and return matching entries. Args: search_filter: LDAP search filter str

Translate a Windows API error code to a human-readable string. Args: error_code: Windows API error code (HRESULT) Returns:

Connect to the LDAP server with the specified SSL/TLS version. This method establishes a connection to the LDAP server and handles

Get the SAM account name from a user entry. Args: user: LDAP user entry Returns: SAM account name s

Extract username and domain from certificate identities. Args: identities: List of (id_type, id_value) tuples from certificate

Create a PKCS#12/PFX container with certificate and private key. Args: key: Private key object cert: Certificate object

Get all SIDs associated with a user, including groups. This method collects all security identifiers (SIDs) that apply to a user,

Resolve hostname to IP address using DNS or local resolution. Uses cache for previously resolved hostnames. Args:

Convert certificate to DER format.

Convert DER-encoded certificate to object.

Create a Target from command line options. Args: options: Command line options dc_as_target: Whether to use

Create a Name object from a subject string. Args: subject: Subject DN string Returns: x509.Name object

Compute hash digest of data. Args: data: Data to hash hash_algorithm: Hash algorithm to use Returns: Hash diges

Check if a security identifier (SID) belongs to an administrative group. This function identifies built-in administrator accounts and groups

Load key and certificate from PKCS#12/PFX data. Args: pfx: PKCS#12 data password: Optional decryption password Returns:

Send a request to the CA service. Args: req: Request object *args: Additional arguments **kwargs

Decompose flag into list of individual flags. Returns: List of individual flag members

Update an existing account's attributes. This method modifies specified attributes of an existing account. Returns:

Get the distinguished name from a user entry and validate it. Args: user: LDAP user entry Returns:

Log response content if verbose logging is enabled. Args: content: Response content to log

Discover and analyze AD CS components and detect vulnerabilities. This is the main entry point that: 1. Discovers templates,

Check if verbose logging is enabled. Returns: Boolean indicating whether verbose logging is enabled

Convert a snake_case string to PascalCase. Args: snake_str: String in snake_case format Returns: String converted to Pa

Add a new entry to the LDAP directory. Args: *args: Arguments to pass to the underlying LDAP add operation *

Encrypt data using the appropriate Kerberos cipher. Automatically selects between RC4 and AES encryption based on the cipher

Format a list of SIDs into a human-readable string. Args: sids: List of SIDs to format Returns: Lis

Parse a mechanism independent token from its binary representation. Args: data: Binary data to parse Returns:

Pretty print a dictionary with customizable indentation and padding. Handles nested dictionaries, lists, and various data types with appropr

Sign data using RSA PKCS#1 v1.5 padding. Args: data: Data to sign key: Private key for signing hash_algorithm: Hash

Initialize the NTLM relay attack. Args: target: Target AD CS server (http://server/certsrv/ or rpc://server)

Initialize CA management object. Args: target: Target information (hostname, credentials, etc.) ca: CA name

Convert CSR to DER format.

Establish a DCOM connection to the target. Args: target: Target object containing connection parameters Returns: DCOMCo

Extract identity information from a certificate. Args: certificate: X.509 certificate to analyze Returns: List of tuple

Retrieve the current Key Credentials for a user. Args: target_dn: Distinguished name of the target user user

Obtain a Ticket Granting Service (TGS) ticket for the specified service. This function implements a multi-step strategy for acquiring a TGS:

Request a new certificate from AD CS. Returns: PFX data and filename if successful, False otherwise

Set new Key Credentials for a user. Args: target_dn: Distinguished name of the target user user: LDAP user e

Convert string hex representation to binary bytes. Args: data: String hex representation or None Returns: Bytes represe

Add a right for a user on the CA. Args: user: Username right: Right to add (from CERTIFICATION_AUTHORITY_RIG

Convert certificate to PEM format.

Create a certificate signing request (CSR) with optional extensions. Args: username: Username for the subject alt_dns: Alter

Create a list of CSR attributes based on the provided template and Subject Alternative Name options. This function generates the attributes

Create a key archival request. Args: csr: Certificate signing request private_key: Private key to be archived cax_ce

Decrypt data using the appropriate Kerberos cipher. Automatically selects between RC4 and AES decryption based on the cipher

Clean up after attack completion.

Generate a new RSA private key. Args: key_size: Key size in bits (default: 2048) Returns: RSA private key object

Retrieve the configuration for a certificate template from AD. Searches for the template by CN or displayName and returns its config

Create a DCE RPC connection from a string binding. Args: string_binding: The RPC string binding (e.g., "ncacn_np:server[pipe]")

Extract Device ID and Creation Time from a Key Credential binary. Args: key_credential: Key Credential binary data or DNWithBinary s

Extract a Security Identifier (SID) from a certificate using multiple methods. This function attempts to find SIDs in both the Subject Alter

Get the raw (unprocessed) attribute value from the LDAP entry. Args: key: Attribute name to retrieve Returns:

Get the certificate serial number. Returns: Integer representation of the serial number

Offer to save the private key for pending certificate requests. Args: request_id: The certificate request ID key: The privat

Process a successful certificate request by saving the certificate and private key. Args: cert: The issued certificate key:

Process a retrieved certificate by saving it with the private key if available. Args: cert: The retrieved certificate reques

Process the RPC certificate request response. Args: response: The RPC response dictionary Returns: Certificate object i

Check if the given hostname is an IP address. Args: hostname: The hostname to check Returns: bool: True if the hostname

Convert private key to PEM format (PKCS#8). Args: key: Private key object Returns: PEM-encoded key as bytes

Modify an existing entry in the LDAP directory. Args: *args: Arguments to pass to the underlying LDAP modify operation

Gracefully shut down the relay server.

Retrieve a certificate via the web enrollment interface. Args: session: HTTP session client request_id: The certificate requ

Initialize an LDAP connection with the specified target. Args: target: Target object containing connection details

Initialize a certificate request object. Args: target: Target information including host and authentication

Handle LDAP errors based on the result dictionary. Args: result: Result dictionary from the LDAP bind operation

Determine the output filename to use for saving certificates/keys. Args: out: User-specified output name (if any) identities

Extract ASN.1 length from the given data. Args: data: Binary data containing ASN.1 length Returns:

Handle other certificate request errors. Args: content: Response content

Add or remove rights for a user on the CA. Args: user: Username right: Right to add/remove (from CERTIFICATI

Parse hex data that might span multiple lines. Args: initial_data: The initial hex data string lines_iter: I

Try to connect to a specific string binding.

Try to connect to the Web Enrollment interface. Args: session: HTTP session to use base_url: Base URL to con

Add a new Key Credential to a user. Args: target_dn: Distinguished name of the target user user: LDAP user e

Authenticate using a certificate. This is the main entry point for authentication. It will determine whether to use LDAP or

Check if web enrollment is enabled on the CA. Args: ca: Certificate authority object channel: Protocol to ch

Create a new computer account in Active Directory. This method creates a computer account with the specified properties, or

Create an extension containing the application policies for the certificate. Returns: UnrecognizedExtension containing t

Create an extension containing the SID for the certificate. Returns: UnrecognizedExtension containing the SID or None if

Create an extension containing the S/MIME capability for the certificate. Returns: UnrecognizedExtension containing the

Create subject alternative names for the certificate. Returns: List of subject alternative name entries

Convert CSR to PEM format.

Send a DCE RPC request and handle the response. This wrapper method properly handles the DCE RPC request to ensure static co

Convert DER-encoded CSR to object.

Enable or disable a template on the CA. Args: disable: If True, disable the template; otherwise enable it Retur

Convert Windows FILETIME to a human-readable time span string. This is a convenience function that combines filetime_to_span() and span_

Get an appropriate hash algorithm for certificate signing. Args: template_hash_algorithm: Hash algorithm from template c