Manticore v1.1.1: A Windows REG file parser, NDR64, and Remote Registry

Tue, 16 Jun 2026 06:41:06 +0000

Manticore is the Go library of offensive and defensive security primitives that The Manticore Project’s tools are built on: SMB, LDAP, Kerberos, DCE/RPC, and the Windows data types that hold them together. Most of the work in a release like this happens below the surface, in the wire encoders that have to match exactly what a real Windows server expects.

In v1.1.1 I focused on three things: bringing the NDR codec up to NDR64 so DCE/RPC interfaces negotiate the transfer syntax modern Windows servers prefer, landing a new ms_rrp package with a Remote Registry client and a real Windows .reg file parser, and a handful of correctness improvements around Kerberos SPNs, SMB security descriptors, and GUID handling.

Active Directory - Auditing and managing Kerberos delegations with Delegations

Mon, 02 Jun 2025 10:00:00 +0000

During security assessments of Active Directory environments, one of the first things I look at is Kerberos delegations. Misconfigured delegations are a well-known attack vector: an attacker who compromises a service account with unconstrained delegation can impersonate any user who authenticates to that service. Constrained delegations and resource-based constrained delegations (RBCD) are safer, but they still require careful configuration.

The problem is that existing tools often only cover one side of the coin: they can find delegations, but not modify them. Or they can set up RBCD for exploitation, but not audit the full picture. I wanted a single tool that could audit, find, add, remove, clear, and monitor all three types of Kerberos delegations from a single binary, on any platform.

Kerberos on The Manticore Project

Manticore v1.1.1: A Windows REG file parser, NDR64, and Remote Registry

Active Directory - Auditing and managing Kerberos delegations with Delegations