Generate channel binding token (CBT) from a server certificate. This implements the tls-server-end-point channel binding type as described

Extract channel binding data from an HTTPX response. This function extracts the server certificate from an HTTPX response and generates

Extract channel binding data from an SSL socket. This function extracts the server certificate from an SSL socket and generates the chan

Create a CRL distribution point extension. Args: crl: URI of the CRL distribution point (defaults to self.crl)

Get a connected DCE RPC interface. This function attempts to connect to an RPC interface using either named pipes or dynamic endpoints.

Get the CA exchange certificate. Returns: CA exchange certificate Raises: Exception: If the certifi

Generate a Kerberos Type 1 authentication message (AP_REQ). Creates a SPNEGO token containing Kerberos AP_REQ that can be used for HTTP

Extract a Security Identifier (SID) from a certificate's Subject Alternative Name (SAN) URL field. Microsoft AD CS can include SIDs in c

Extract a Security Identifier (SID) from a certificate's Microsoft-specific NTDS_CA_SECURITY_EXT extension. This extension is commonly u

Get list of templates enabled on the CA. Returns: List of template names and their OIDs Returns False if the

Generate an NTLMSSP Type 3 authentication message in response to a server challenge. Args: type1: The Type 1 negotiate message that

Generate an NTLMSSP Type 1 negotiation message. Args: signing_required: Whether signing is required for the connection use_n

Convert PEM-encoded certificate to object.

Convert PEM-encoded private key to object.

Print certificate identity information with appropriate formatting. Args: identities: List of tuples containing (identity_type, iden

Remove a right from a user on the CA. Args: user: Username right: Right to remove (from CERTIFICATION_AUTHOR

Get the current request object. Returns: The current request object

Save the current configuration to a JSON file.

Convert a time span in seconds to Windows FILETIME format. This function converts the time span to a 64-bit integer representing the num

Convert Windows ticks to a UTC datetime object. Args: ticks: Number of 100ns intervals since January 1, 1601 UTC Returns:

Decompose flag into list of individual flags. Returns: List of individual flag members

Truncate a key to the specified size using SHA1 hashing. Args: value: Input key material keysize: Desired key size in bytes

Request a certificate via the web enrollment interface. Args: session: HTTP session client username: Username for the certif

Write data to a file or stdout. Args: data: Data to write output_path: Path to output file or None for stdout

Apply computed changes to a template configuration. Args: old_configuration: Current template configuration

Check for mismatches between provided identity and certificate identity. Args: username: Provided username d

Compute the changes needed to update a template configuration. Args: old_configuration: Current template configuration

Decrypt LDAP message data using the appropriate cipher. Args: data: Encrypted data to decrypt Returns:

Decrypt data using AES cipher. Args: data: Encrypted data to decrypt Returns: Decrypted plaintext

Decrypt data using RC4 cipher. Args: data: Encrypted data to decrypt Returns: Decrypted plaintext

Determine template capabilities from EKU and flags. Args: template: Certificate template extended_key_usage:

Encode a length value in ASN.1 format. Args: length: Length value to encode Returns: ASN.1 encoded

Encrypt LDAP message data using the appropriate cipher. Args: data: Plaintext data to encrypt Returns:

Encrypt data using AES cipher. Args: data: Plaintext data to encrypt sequence_number: Message sequence numbe

Encrypt data using RC4 cipher. Args: data: Plaintext data to encrypt sequence_number: Message sequence numbe

Enumerate available certificate templates from Web Enrollment.

Flatten a nested CA dictionary for CSV output. Handles special cases like permissions dictionaries, web enrollment settings,

Flatten a nested template dictionary for CSV output. Handles special cases like permissions dictionaries, nested objects, an

Get CA configuration and web enrollment settings. Args: ca: Certificate authority object Returns: D

Handle the case where a file already exists. Prompts the user to confirm overwriting or generates a new unique filename. If the user cho

Handle certificate request denied by policy. Args: session: HTTP session client request_id: The certificate request ID

Perform Kerberos authentication to LDAP server. Args: connection: LDAP connection object Raises: Ex

Link certificate authorities to templates and vice versa. Args: cas: List of certificate authorities templat

Link templates to their issuance policies and vice versa. Args: templates: List of certificate templates oid

Log the changes to be applied, grouped by operation type. Args: changes: Dictionary of changes to apply

Parse the access control entries from the security descriptor.

Process CA certificate information. Args: ca: Certificate authority object

Process certificate authority properties and security settings. Args: cas: List of certificate authorities

Process template flag attributes. Args: template: Certificate template

Process template policy attributes and extended key usage. Args: template: Certificate template

Process certificate template properties. Args: templates: List of certificate templates

Process template validity periods. Args: template: Certificate template

Request a new certificate for the relayed user.

Retrieve a certificate by request ID. Args: request_id: The ID of the certificate request to retrieve

Main attack logic - request or retrieve a certificate for the relayed user.

Main attack logic - request or retrieve a certificate for the relayed user.

Generate and save output in requested formats. Args: templates: List of certificate templates cas: List of c

Process and send authentication data to the target. Args: authenticateMessageBlob: The authentication message

Write data to stdout, encoding binary data as base64 if needed. Args: data: Data to output (binary data will be base64 encoded)

Add certificate manager rights for a user. Managers can manage CA configuration. Args: manager: Username to add

Add certificate officer rights for a user. Officers can approve/deny certificate requests. Args: officer: Userna

Create a backup of the CA key and certificate. Returns: True if successful, False otherwise

Convert a DNWithBinary string to its binary representation. DNWithBinary format: "B:<length>:<hex_data>:<dn>" Example: "B:826:4e544c4d53

Build a certificate using an existing certificate as a template. Args: ca_private_key: CA private key ca_pub

Build a new certificate without a template. Args: ca_private_key: CA private key ca_public_key: CA public ke

Build a PKINIT AS-REQ message. Args: username: Client username domain: Domain/realm name key: RSA private key for si

Check if the CA has vulnerable permissions for the current user. Args: ca: Certificate authority to analyze Ret

Check if the current user can enroll in the CA. Args: ca: CA to analyze Returns: Tuple of (can_enro

Check if the current user can enroll in the template. Args: template: Certificate template to analyze Returns:

Check if a Certificate Authority web enrollment endpoint enforces channel binding (EPA). This method tests HTTPS web enrollment auth

Clear all Key Credentials for a user. Returns: True on success, False on failure

Compute NTLMv2 response based on the provided parameters. Args: server_challenge: Challenge received from the server client_

Convert a template configuration to a JSON string. Converts binary attribute values to their hexadecimal representation for

Create a DnsResolver with specified parameters. Args: target: Target object which may contain DC IP information

ESC1 vulnerable template configuration with full control for the passed sid. This configuration creates a template that allows `sid` to enrol

Create a certificate request on behalf of another user. Args: request: Original request data on_behalf_of: Username to reque

Create a certificate renewal request. Args: request: Original request data cert: Certificate being renewed key: Priv

Create a security descriptor setting `sid` as owner, and also add an ACE of GenericAll for `sid`, and also add an ACE of GenericRead for

Create a self-signed CA certificate. This method generates a self-signed CA certificate and saves it to the specified output file.

Deny a pending certificate request. Returns: True if successful, False otherwise

Convert DER-encoded private key to object.

Convert DER-encoded data to PEM format. Args: der: DER-encoded binary data pem_type: PEM header/footer type (e.g., "CERTIFIC

Determine the output filename for the forged certificate. Args: id_type: Identification type (UPN, DNS) id_v

Disable a template on the CA. Convenience method that calls enable() with disable=True. Returns: True if success

Perform key exchange with peer's public key. Args: peer_public_key: Peer's public key value Returns:

Convert Windows FILETIME to time span in seconds. Windows FILETIME is a 64-bit value representing the number of 100-nanosecond intervals

Clean up after attack completion.

Forge a certificate with the specified parameters. This is the main method that performs the certificate forgery process. R

Format the log record by adding an appropriate bullet point. Args: record: The log record to format Returns:

Create a DH instance from a dictionary of parameters. Args: dhp: Dictionary containing 'p' and 'g' keys Returns

Generate a new certificate and Key Credential object. Args: subject: Certificate subject name Returns:

Determine the type of Active Directory account based on sAMAccountType and objectClass. Args: entry: LDAP entry containing account a

Get the authentication method from the WWW-Authenticate header. Args: authenticate_header: The WWW-Authenticate header value Re

Retrieve CA backup file from the target. Returns: PFX data as bytes or None if retrieval fails

Convert Certificate Authority data to CSV format. This function transforms nested CA data into a flattened CSV format. It ha

Extract CA permissions for output. Args: ca: Certificate authority Returns: Dictionary of CA permis

Extract CA properties for output. Args: ca: Certificate authority ca_properties: Optional existing propertie

Detect vulnerabilities in certificate authorities. This method checks for various Enterprise Security Configuration (ESC) vulnerabil

Retrieve the CAX (Exchange) certificate. Returns: CAX certificate in DER format if successful, False otherwise