Manticore is a Go library of offensive and defensive security primitives maintained by The Manticore Project. This release, v1.1.5, is a maintenance update with no new features: it is a round of bug fixes focused on the LDAP and SMB clients, following the RPC work that landed in v1.1.4. The fixes fall into a few categories.
Pass-the-hash correctness on LDAP and SMB
Two of the fixes correct pass-the-hash, on both the LDAP and the SMB stacks. LDAP pass-the-hash now performs an NTLM hash bind rather than treating the hash as a password (#657), and SMB NTLM authentication now uses the NT hash for the pass-the-hash path (#679). In both cases the supplied hash was not being fed into the right step of the NTLM exchange, so authentication from a harvested hash failed where it should have succeeded. If you authenticate with NT hashes against either protocol, this is the release you want.
LDAP client robustness
The bulk of this release hardens the LDAP client against edge cases and bad state:
- Timestamp overflow.
ConvertLDAPTimeStampToUnixTimeStampno longer overflowsint64on large values (#663), which previously produced wrong times for far-future or sentinel timestamps. - Nil-pointer safety.
CloseandReConnectno longer panic when the session was never connected (#665), so cleanup paths are safe to call unconditionally. - Error propagation.
GetAllCertificatesnow propagates LDAP query errors instead of swallowing them (#661), andGetAllDomainsrequests thedcattribute so it can resolve the NetBIOS name correctly (#659). - DN parsing.
DNWithBinary.Unmarshalnow allows colons inside a DN and validates the prefix (#671), fixing values that were previously rejected or mis-parsed. - RootDSE fetching.
Queryfetches the RootDSE only when it actually needs to resolve naming-context placeholders (#667), avoiding an unnecessary round trip on every query. - DNS probing.
GetDomainDNSServersnow bounds its DNS probe with a timeout and stops treating partial failures as fatal (#672), so a single unresponsive server no longer sinks the whole lookup.
Configurable LDAPS verification and API cleanup
LDAPS TLS certificate verification is now configurable via SetTLSSkipVerify (#668), which matters when connecting to domain controllers that present self-signed or otherwise untrusted certificates, a common situation in lab and assessment environments.
The release also tidies the LDAP surface: a dead debug flag and the unreachable logging it gated in Query are removed (#669), and the documentation examples now use NewSession instead of the obsolete InitSession (#670), so copy-pasted snippets compile against the current API.