Query LDAP for certificate authorities. Returns: List of certificate authority entries

Query LDAP for certificate templates. Returns: List of certificate template entries

Get CA configuration using the Remote Registry Protocol (RRP). This method attempts to retrieve the CA configuration using RRP

Get CA configuration via the Remote Registry Protocol. Used as a fallback when CSRA fails. This method navigates the Windows

Resolve a dynamic endpoint for an RPC interface. Args: interface: RPC interface identifier (UUID) target: Target hostname or

Query LDAP for issuance policies (OIDs). Returns: List of issuance policy entries

Get Kerberos principal information from the KRB5CCNAME environment variable. Returns: Tuple containing (username, domain) or None if

Extract OID permissions for output. Args: oid: Issuance policy object Returns: Dictionary of OID pe

Extract OID properties for output. Args: oid: Issuance policy object oid_properties: Optional existing prope

Detect vulnerabilities in issuance policy OIDs. This method checks for Enterprise Security Configuration (ESC) vulnerabilities:

Generate structured output for text and JSON formats. Args: templates: List of certificate templates cas: Li

Factory function to get the appropriate parser. Args: parser_type: Type of parser to create domain: Domain name ca:

Calculate the public key. Returns: Public key value (g^x mod p) Raises: ValueError: If p and g are

Convert certificate template data to CSV format. This function transforms nested certificate templates data into a flattened CSV for

Extract template permissions for output. Args: template: Certificate template Returns: Dictionary o

Extract template properties for output. Args: template: Certificate template template_properties: Optional e

Detect vulnerabilities in certificate templates. This method checks for various Enterprise Security Configuration (ESC) vulnerabilit

Process the RPC certificate retrieval response. Args: response: The RPC response dictionary Returns: Certificate object

Issue (approve) a pending certificate request. Returns: True if successful, False otherwise

Convert a JSON configuration back to a usable LDAP configuration. Converts hexadecimal strings back to binary data for LDAP operatio

Authenticate to Kerberos using PKINIT with a certificate. Args: username: Username to authenticate as domain

Authenticate to LDAP using a certificate. Args: domain: Domain to authenticate to Returns: True if

List templates enabled on the CA. Prints the list of templates to stdout.

Load the CA certificate and private key from the PFX file. Returns: Tuple of (CA private key, CA certificate) R

Load certificate data from a file. Args: file_path: Path to certificate file Returns: Certificate data as bytes

Load a template configuration from a JSON file. Args: configuration_path: Path to the configuration JSON file R

Load private key data from a file. Args: file_path: Path to private key file Returns: Private key data as bytes

Get the current time in Windows ticks (100ns intervals since Jan 1, 1601 UTC). Used for creating timestamps in Key Credential objects.

Check if the OID has vulnerable permissions for the current user. Args: oid: Issuance policy OID to analyze Ret

Parse certificate templates from a file. Args: file: Path to the file containing template data

Parse certificate data from PEM or DER format. Args: cert_data: Raw certificate data Returns: Parsed certificate object

Parse private key data from PEM or DER format. Args: key_data: Raw private key data Returns: Parsed private key object

Display all authentication-related information found in a certificate. This function extracts and prints various identity methods used in a

Convert RSA private key to Microsoft BLOB format. Args: private_key: RSA private key Returns: Microsoft BLOB format key

Remove certificate manager rights from a user. Args: manager: Username to remove as a manager Returns:

Remove certificate officer rights from a user. Args: officer: Username to remove as an officer Returns:

Request a new certificate for the relayed user. Returns: Tuple of (PFX data, filename) on success, False on failure

Retrieve a certificate by request ID. Returns: True on success, False on failure

Retrieve a certificate by request ID. Returns: True if successful, False otherwise

Retry the request with NTLM authentication. Implements the complete NTLM authentication flow: 1. Send Type 1 (Negotiate) mes

Retry the request with Kerberos authentication. This method adds Kerberos SPNEGO authentication header to the request. Args

Create a signed CMS structure containing the AuthPack. Args: data: The AuthPack data to sign key: RSA private key for signin

Convert a time span in seconds to a human-readable string. The function converts the span to the largest appropriate unit (years, months

Start the relay server and wait for connections.

Check if the template has vulnerable permissions for the current user. Args: template: Certificate template to analyze

Unpack binary data into a list of (field_type, field_value) tuples. This function parses the Key Credential binary format by reading fields

Apply a new configuration to a certificate template. If no configuration file is provided, applies the default vulnerable co

Initialize the Shadow Authentication module. Args: target: Target information including domain, username, and authentica

Initialize account management with target and account options. Args: target: Target environment information (domain, cre

Initialize the LDAP shell. Args: tcp_shell: Shell to use for I/O domain_dumper: Domain information provider

Initialize with domain root. Args: root: LDAP root path (e.g., DC=contoso,DC=com)

Initialize authentication parameters. Args: target: Target information (domain, DC IP, etc.) pfx: Path to PF

Initialize the certificate template parser. Args: domain: Domain name for the templates (default: UNKNOWN) c

Initialize the certificate forgery parameters. Args: ca_pfx: Path to the CA certificate/private key in PFX format

Initialize the HTTP relay server. Args: adcs_relay: The parent Relay object args: Arguments to pass to the p

Initialize the RPC relay server. Args: serverConfig: NTLMRelayxConfig object with relay settings target: Tar

Initialize the HTTP attack client. Args: adcs_relay: The parent Relay object args: Arguments to pass to the

Initialize the RPC attack client. Args: adcs_relay: The parent Relay object config: NTLMRelayxConfig object

Initialize a CA configuration object. Args: active_policy: Name of the active policy module (typically CertificateAuthor

Initialize a Template object for certificate template operations. Args: target: Target domain information te

Initialize a new DH instance with random private key.

Initialize a security descriptor parser. Args: security_descriptor: Binary representation of a security descriptor

Initialize the extended strategy with a connection. Args: connection: The ExtendedLdapConnection to use

Initialize an extended LDAP connection with the specified target. Args: target: Target object containing connection deta

Initialize the ICertRequestD interface. Args: interface: IRemUnknown2 interface from DCOM connection

Initialize the DCERPCSessionError. Args: error_string: Error description error_code: Numeric error code

Initialize the request interface. Args: parent: The parent Request object

Initialize the DCOM request interface. Args: parent: The parent Request object

Initialize the RPC request interface. Args: parent: The parent Request object

Initialize the Web Enrollment request interface. Args: parent: The parent Request object

Initialize a Target with the specified connection parameters. Args: resolver: DNS resolver for hostname resolution

Initialize a new DNS resolver with default settings.

Initialize the formatter with a simple format string. The format uses a custom 'bullet' attribute added during formatting.

Initialize the NTLM authentication handler. Args: target: Target object containing connection and authentication details

Initialize a mechanism independent token. Args: data: Token data oid: Object identifier for the authenticati

Initialize the KerberosCipher object. Args: cipher: Cipher class for encryption/decryption session_key: Sess

Initialize the Kerberos authentication handler. Args: target: Target object containing connection and authentication det

Initialize a registry entry. Args: **kwargs: Key-value pairs to initialize the entry with

Initialize a registry connection. Args: domain: Domain name for the connection sids: List of security identi

String representation of the Target object.

Format the error message with translated error code. Returns: Human-readable error message

Smart string representation that handles combinations gracefully. Returns: Human-readable string representation of the f

Smart string representation that handles combinations gracefully. Returns: Human-readable string representation of the f

Helper function to search for a user, with caching.

Parse the access control entries from the security descriptor. This method extracts both standard rights and extended rights.

Parse the access control entries from the security descriptor. CA security descriptors have a simpler structure than AD security des