Manticore is the Go library of offensive and defensive security primitives that underpins the tools of The Manticore Project: protocol stacks, cryptography, parsers, and the wire structures you need when you cannot rely on a host’s native client. The v1.1.0 release brought SMB 2.0 and the first DCE/RPC and endpoint-mapper layers; this release builds those out into something you can actually point at a domain.
v1.1.4 is an RPC-focused release. It fills in endpoint-mapper enumeration, teaches the stack to decode protocol towers for every common transport, adds a curated catalog of well-known interfaces, brings authenticated binds with pass-the-hash, and lands the MS-DRSR replication blob structures. The sections below group the work by theme.
Endpoint mapper: full enumeration and tower decoding
The endpoint mapper (EPM) is how you discover where a given RPC interface is actually listening on a host. This release implements ept_lookup (opnum 2) to enumerate all registered endpoints (#622), rather than only resolving a single interface you already know about. With it, you can walk a target’s complete endpoint-mapper database and see every interface it exposes.
Making that output useful meant decoding the protocol towers EPM returns. A tower is the packed description of how to reach an interface: the binding protocol and its addressing. The stack now decodes towers for all common bindings, including ncacn_np, ncacn_http, and ncadg_ip_udp (#623), and ncalrpc local towers as well (#636). The ept_lookup integration output is rendered through Tower.Binding for every transport (#624, #626), so each enumerated endpoint is presented as a readable binding string regardless of how it is reached.
Two correctness fixes accompany the new enumeration: the EPM ept_lookup and ept_map paths now decode their inline conformant-varying arrays correctly (#631, #633), and ept_lookup_handle_free uses the right opnum, corrected from 1 to 4 (#634). NDR conformant-varying arrays are exactly the place where an off-by-one in the bounds shifts every following field, so these fixes are what make the enumeration reliable against real servers.
A curated catalog of well-known interfaces
An enumerated endpoint is just a UUID until you know what it is. This release adds a catalog of well-known DCE/RPC interfaces mapping interface UUIDs to metadata (#627), so the output of an endpoint-mapper sweep names the interfaces instead of leaving you to look up GUIDs by hand. The catalog includes local and host-service RPC interfaces (#638) alongside the network-facing ones.
I briefly imported the full impacket endpoint-mapper tables to grow the catalog (#628), then reverted that bulk import in favour of a curated set (#629). A hand-maintained catalog stays accurate and avoids carrying a large table of entries that are mostly noise; the goal is recognising the interfaces that matter, not cataloguing every UUID in existence.
Authenticated DCE/RPC binds
Until now the RPC binds were effectively unauthenticated. This release adds authenticated DCE/RPC binds using an NTLM auth_verifier, supporting both RPC_C_AUTHN_LEVEL_PKT_INTEGRITY and RPC_C_AUTHN_LEVEL_PKT_PRIVACY (#640), so RPC traffic can be signed or signed-and-sealed rather than sent in the clear. The authentication levels RPC_C_AUTHN_LEVEL_CALL and RPC_C_AUTHN_LEVEL_PKT are supported as well (#651).
Crucially, NTLM authentication supports pass-the-hash (#650): you can bind with an NT hash instead of a plaintext password, which is the common case for offensive tooling working from harvested credentials. Rounding out the authentication surface, the SChannel, Netlogon, and Default RPC security-provider constants are now defined, so the right provider can be selected for a given interface.
MS-DRSR replication structures
The release also implements the DS_REPL_*_BLOB structures in windows/activedirectory/replication/dsrepl (#641 through #647). These are the MS-DRSR blobs that describe directory replication state: replication neighbours, cursors, metadata, and pending operations. Having them as first-class typed structures means tooling can parse the replication metadata exposed by a domain controller without hand-rolling each blob layout, which is groundwork for the kind of replication-aware enumeration that DCSync-adjacent tooling depends on.
Housekeeping
The README was reformatted to match the standard TheManticoreProject layout (#621), keeping the library’s documentation consistent with the rest of the ecosystem.