Receive data over the socket and handle message encryption/decryption. Returns: List of received LDAP messages

Try dynamic endpoint connection.

Try named pipe connection.

Add a new Key Credential to a user and save the certificate as a PFX file. Returns: True on success, False on failure

Add common target, connection, and authentication arguments to a parser. This function adds standard options for connecting to Active Direct

Add the shadow credentials command subparser to the main parser. This function creates and configures a subparser for managing Shadow Creden

Add the account management command subparser to the main parser. This function creates and configures a subparser for managing Active Direct

Add the certificate authentication command subparser to the main parser. This function creates and configures a subparser for authenticating

Add the parse command subparser to the main parser. This function creates and configures a subparser for analyzing AD CS certificate tem

Add the certificate forging command subparser to the main parser. This function creates and configures a subparser for forging certificates

Add the certificate management command subparser to the main parser. This function creates and configures a subparser for managing certifica

Add the certificate request command subparser to the main parser. This function creates and configures a subparser for requesting certificat

Add the NTLM relay command subparser to the main parser. This function creates and configures a subparser for relaying NTLM authentication

Add the AD CS enumeration command subparser to the main parser. This function creates and configures a subparser for finding and analyzing

Add the Certificate Authority management command subparser to the main parser. This function creates and configures a subparser for managing

Add the certificate template command subparser to the main parser. This function creates and configures a subparser for managing certificate

Implement the authentication flow for HTTPX. This generator handles the NTLM authentication protocol flow by: 1. Sending the

Implement the authentication flow for HTTPX. This generator handles the first request and delegates to retry_with_auth if au

Automatically add a Key Credential, authenticate, get NT hash, and restore original state. This is the most common attack scenario -

Get or create an ICertAdminD interface. Returns: ICertAdminD interface

Get or create an ICertAdminD2 interface. Returns: ICertAdminD2 interface

Get or create an ICertRequestD2 interface. Returns: ICertRequestD2 interface

Get or establish an LDAP connection to the domain. Returns: Active LDAP connection Raises: Exceptio

Get or establish an LDAP connection to the target. Returns: Active LDAP connection

Get or create a registry connection for SID resolution. Returns: RegConnection object for SID resolution

Get or create an LDAP connection. Returns: Active LDAP connection to the target

Get or create an LDAP connection to the domain. Returns: Active LDAP connection Raises: ValueError:

Lazily establish and return an LDAP connection. Returns: An active LDAP connection to the target domain

Get or establish an RPC connection to the certificate authority. Returns: Active RPC connection Raises:

Get or establish a DCOM connection to the certificate authority. Returns: Active DCOM connection Raises:

Default transformer function that converts a value to its original form. Args: value: The value to transform Returns: T

Default transformer function that returns the value unchanged. Args: value: The value to transform Returns: The origina

Delete an account from Active Directory. This method permanently removes the specified account. Returns: True i

Delete an entry from the LDAP directory. Args: *args: Arguments to pass to the underlying LDAP delete operation

Parse a Distinguished Name string into components. Args: dn: DN string (e.g., "CN=username,DC=domain,DC=local") Returns:

Placeholder for domain dumping functionality. Args: line: Command line input

Exit the shell. Args: line: Command line input Returns: True to signal shell exit

Perform NTLM bind operation with optional controls. This method implements the complete NTLM authentication flow: 1. Sicily

Get the domain's security identifier (SID). The domain SID is the base identifier used for all domain security principals.

Command-line entry point for Shadow Authentication operations. Args: options: Command-line arguments

Entry point for the 'account' command. This function creates the Account object and dispatches to the appropriate method based on the sp

Entry point for the 'auth' command. Args: options: Command-line arguments

Command-line entry point for the parse functionality. Args: options: Command line arguments

Command-line entry point for certificate forgery. Args: options: Command line arguments

Entry point for the 'cert' command. Processes certificates and private keys according to specified options. Args: options: Comm

Command-line entry point for certificate operations. Args: options: Command-line arguments

Command-line entry point for relay functionality. Args: options: Command line arguments

Entry point for the 'find' command. Args: options: Command-line arguments

Entry point for the 'ca' command. Args: options: Command-line arguments

Entry point for the template command. Args: options: Command-line arguments

Entry point for the shadow command. This function imports and calls the actual implementation of the shadow command from the certipy.com

Entry point for the account management command. This function imports and calls the actual implementation of the account command from th

Entry point for the auth command. This function imports and calls the actual implementation of the auth command from the certipy.command

Entry point for the parse command. This function imports and calls the actual implementation of the parse command from the certipy.comma

Entry point for the forge command. This function imports and calls the actual implementation of the forge command from the certipy.comma

Entry point for the cert command. This function imports and calls the actual implementation of the cert command from the certipy.command

Entry point for the certificate request command. This function imports and calls the actual implementation of the req command from the c

Entry point for the relay command. This function imports and calls the actual implementation of the relay command from the certipy.comma

Entry point for the find command. This function imports and calls the actual implementation of the find command from the certipy.command

Entry point for the CA management command. This function imports and calls the actual implementation of the CA command from the certipy.

Entry point for the template command. This function imports and calls the actual implementation of the template command from the certipy

Create a DnsResolver from command line options. Args: options: The command line options target: The Target o

Factory method to create an HTTP attack client. Returns: Configured HTTP attack client

Factory method to create an RPC attack client. Returns: Configured RPC attack client

Get certificate authorities. Creates a mock CA entry with the provided templates for analysis. Returns: List co

Parse certificate templates from BOF output. Returns: List of RegEntry objects representing certificate templates

Parse certificate templates from BOF output. Returns: List of RegEntry objects representing certificate templates

Parse certificate templates from a .reg file. Returns: List of RegEntry objects representing certificate templates

Get a specific enrollment service. Args: ca: CA name Returns: Enrollment service object or None if

Get all enrollment services in the domain. Returns: List of enrollment service objects

Get certificate issuance policies. Returns: Empty list (not implemented for offline analysis)

Get a raw (bytes) representation of an attribute value. Args: key: The attribute name to retrieve Returns:

Factory method to create an HTTP relay server. Returns: Configured HTTP relay server

Factory method to create an RPC relay server. Returns: Configured RPC relay server

Get user security identifiers. Args: _username: Username (not used in this implementation) _user_sid: User's

Initialize the Certipy logger with the appropriate formatter. Args: level: Log level to set (default: INFO) logger_name: Nam

Establish a connection to the AD CS Web Enrollment service. Returns: True if connection was successful

Get the appropriate request interface based on configuration. Returns: Configured request interface instance

Convert private key to DER format (PKCS#8). Args: key: Private key object Returns: DER-encoded key as bytes

List all Key Credentials for a user. Returns: True if Key Credentials were found and listed, False otherwise

Look up a security identifier and return corresponding registry entry. Args: sid: Security identifier to look up

Open a connection to the remote registry service. Args: target_ip: IP address of the target dns_host_name: D

Remove a specific Key Credential identified by its Device ID. Returns: True on success, False on failure

Submit a certificate request. Args: csr: Certificate signing request data attributes_list: List of certifica

Submit a certificate request via DCOM. Args: csr: Certificate signing request data attributes_list: List of

Submit a certificate request via RPC. Args: csr: Certificate signing request data attributes_list: List of c

Submit a certificate request via Web Enrollment. Args: csr_bytes: Certificate signing request data attribute

Resolve a hostname to IP address using the configured resolver. Args: hostname: The hostname to resolve Returns

Retrieve a certificate by request ID. Args: request_id: The request ID to retrieve Returns: Certifi

Retrieve a certificate by request ID via DCOM. Args: request_id: The request ID to retrieve Returns:

Retrieve a certificate by request ID via RPC. Args: request_id: The request ID to retrieve Returns:

Retrieve a certificate by request ID via Web Enrollment. Args: request_id: The request ID to retrieve Returns:

Get or create a connection to the remote registry service. Returns: RRP DCE/RPC connection or None if connection fails

Execute the certificate request attack with proper locking.

Execute the certificate request attack with proper locking.

Send authentication data to the target with proper locking to prevent race conditions. Args: authenticateMessageBlob: Th

Send authentication data to the target RPC service. Args: authenticateMessageBlob: The authentication message

Send an LDAP message, optionally encrypting it first. Args: ldap_message: The LDAP message to send Raises: