Manticore is the Go library of offensive and defensive security primitives I maintain for The Manticore Project. It provides the building blocks (Windows structures, cryptography, LDAP and network plumbing) that the project’s tools rely on. Not every release adds a feature; some exist to clean up and tighten the existing code.
v1.0.8 is one of those. There are no new capabilities here. Instead, I spent this release refactoring the KeyCredentialLink and CustomKeyInformation code, tidying up the LDAP DNWithBinary type, tightening error handling, and removing debug output that should never have shipped. This kind of work does not change what the library does, but makes it easier and safer to build on.
KeyCredentialLink and CustomKeyInformation refactor
The bulk of this release went into windows/keycredentiallink/key/customkeyinformation. This code parses the structures behind msDS-KeyCredentialLink, the attribute used by Windows Hello for Business and the basis of well-known abuse techniques such as Shadow Credentials. These structures are fiddly to parse correctly, so the refactor focused on making the implementation clearer and more maintainable without changing its behaviour.
Alongside the refactor, I improved the error handling around CustomKeyInformationVolumeType. Parsing untrusted, attacker-influenced binary blobs means you want decoding to fail loudly and explicitly rather than silently accept something malformed. Surfacing a clear error here makes the failure mode obvious to callers instead of leaving them with a half-parsed structure.
LDAP DNWithBinary
I also refactored network/ldap/DNWithBinary. This type represents the LDAP Object(DN-Binary) syntax: a distinguished name paired with a binary value, which is how attributes like msDS-KeyCredentialLink are carried on the wire. Keeping this type consistent with the KeyCredentialLink work makes the two easier to use together.
Removing debug output
Finally, I removed the remaining debug printf calls left over in the bcrypt key code, including a stray debug print in the bcrypt RSA key path. Leftover debug output is a small thing, but for a library it means callers no longer see unexpected lines on stdout.