Manticore on The Manticore Project

Manticore v1.1.5: Bug fixes

Wed, 17 Jun 2026 20:23:02 +0000

Manticore is a Go library of offensive and defensive security primitives maintained by The Manticore Project. This release, v1.1.5, is a maintenance update with no new features: it is a round of bug fixes focused on the LDAP and SMB clients, following the RPC work that landed in v1.1.4. The fixes fall into a few categories.

Pass-the-hash correctness on LDAP and SMB

Two of the fixes correct pass-the-hash, on both the LDAP and the SMB stacks. LDAP pass-the-hash now performs an NTLM hash bind rather than treating the hash as a password (#657), and SMB NTLM authentication now uses the NT hash for the pass-the-hash path (#679). In both cases the supplied hash was not being fed into the right step of the NTLM exchange, so authentication from a harvested hash failed where it should have succeeded. If you authenticate with NT hashes against either protocol, this is the release you want.

Manticore v1.1.4: RPC improvements

Wed, 17 Jun 2026 10:49:11 +0000

Manticore is the Go library of offensive and defensive security primitives that underpins the tools of The Manticore Project: protocol stacks, cryptography, parsers, and the wire structures you need when you cannot rely on a host’s native client. The v1.1.0 release brought SMB 2.0 and the first DCE/RPC and endpoint-mapper layers; this release builds those out into something you can actually point at a domain.

v1.1.4 is an RPC-focused release. It fills in endpoint-mapper enumeration, teaches the stack to decode protocol towers for every common transport, adds a curated catalog of well-known interfaces, brings authenticated binds with pass-the-hash, and lands the MS-DRSR replication blob structures. The sections below group the work by theme.

Manticore v1.1.3: Fix ms_rrp enumeration

Tue, 16 Jun 2026 08:59:36 +0000

Manticore is a Go library of offensive and defensive security primitives maintained by The Manticore Project. This release, v1.1.3, is a small patch that continues the Remote Registry line of work from v1.1.1 and v1.1.2. It carries a single, focused fix: the MS-RRP enumeration corrections are restored after being lost from main.

Restoring the ms_rrp enumeration fixes

During the merges that followed the v1.1.1 Windows REG file parser and the v1.1.2 NDR marshaling fix, a pair of corrections to the MS-RRP (ms_rrp) enumeration path were inadvertently dropped from the main branch. This release restores them (#612, #614) in a single change (Restore ms_rrp enumeration fixes lost from main).

Manticore v1.1.2: Registry-related fixes

Tue, 16 Jun 2026 07:27:22 +0000

Manticore is a Go library of offensive and defensive security primitives maintained by The Manticore Project. This release, v1.1.2, is a small patch that continues the Remote Registry and registry work started in v1.1.1. It contains a single, focused fix to how RPC_SECURITY_DESCRIPTOR is marshaled over NDR.

RPC_SECURITY_DESCRIPTOR marshaling

The fix corrects RPC_SECURITY_DESCRIPTOR marshaling when its size_is and length_is bounds are independent (#618). In NDR, a security descriptor is carried as a conformant-varying array of bytes: the buffer’s allocated capacity is described by size_is (the conformance count) and the number of bytes actually present is described by length_is (the variance count). These two values are not always equal, since a caller can allocate a larger buffer than it fills.

Manticore v1.1.1: A Windows REG file parser, NDR64, and Remote Registry

Tue, 16 Jun 2026 06:41:06 +0000

Manticore is the Go library of offensive and defensive security primitives that The Manticore Project’s tools are built on: SMB, LDAP, Kerberos, DCE/RPC, and the Windows data types that hold them together. Most of the work in a release like this happens below the surface, in the wire encoders that have to match exactly what a real Windows server expects.

In v1.1.1 I focused on three things: bringing the NDR codec up to NDR64 so DCE/RPC interfaces negotiate the transfer syntax modern Windows servers prefer, landing a new ms_rrp package with a Remote Registry client and a real Windows .reg file parser, and a handful of correctness improvements around Kerberos SPNs, SMB security descriptors, and GUID handling.

Manticore v1.1.0: Introducing SMB 2.0

Thu, 11 Jun 2026 14:23:43 +0000

Manticore is the Go library of offensive and defensive security primitives that underpins the tools of The Manticore Project: protocol stacks, cryptography, parsers, and the wire structures you need when you cannot rely on a host’s native client. Until now, the SMB stack in Manticore was effectively SMB1-only. That is enough to talk to legacy targets, but it leaves out the dialect that has been the default on Windows for more than a decade.

Manticore v1.0.9 - Complete SMBv1, NDR 2.0, and the first RPC interfaces

Tue, 09 Jun 2026 12:46:25 +0000

We tagged Manticore v1.0.9 today. The release title is complete working SMBv1, NDR 2.0, and a bit of RPC, and that is a fair summary of where the bulk of the work went. It is the largest release the library has shipped so far, with several hundred merged pull requests. The practical result is that Manticore can now drive an SMBv1 session and DCE/RPC calls end to end.

This post walks through what changed, grouped by area.

Manticore v1.0.8: KeyCredentialLink refactor and cleanup

Wed, 12 Nov 2025 10:07:49 +0000

Manticore is the Go library of offensive and defensive security primitives I maintain for The Manticore Project. It provides the building blocks (Windows structures, cryptography, LDAP and network plumbing) that the project’s tools rely on. Not every release adds a feature; some exist to clean up and tighten the existing code.

v1.0.8 is one of those. There are no new capabilities here. Instead, I spent this release refactoring the KeyCredentialLink and CustomKeyInformation code, tidying up the LDAP DNWithBinary type, tightening error handling, and removing debug output that should never have shipped. This kind of work does not change what the library does, but makes it easier and safer to build on.

Manticore v1.0.7: KeyCredential refactor and BCrypt ECC keys

Tue, 11 Nov 2025 12:21:19 +0000

Manticore is The Manticore Project’s Go library of offensive and defensive security primitives. It is the foundation that most of our tools build on, so each release tends to focus on making one or two of those primitives more correct and more pleasant to use. In v1.0.7 I focused on the keycredential package: extending its cryptographic key support, tidying up its internal structure, and aligning one piece of its API with the naming conventions used across the rest of the library.

Manticore v1.0.6: Windows CNG/BCrypt structures

Fri, 07 Nov 2025 09:07:33 +0000

Manticore is the Go library that backs the offensive and defensive security tooling of The Manticore Project. It collects the low-level primitives those tools rely on: wire structures, cryptographic key formats, identifier types, and parsers for the binary blobs that Windows and Active Directory hand you. The goal is that a tool author never has to re-implement a security descriptor parser or a UUID generator from scratch.

In this release, v1.0.6, I focused on two fronts. The first is breadth: new Windows CNG/BCrypt key structures and the remaining members of the UUID family. The second is consistency: a sweep across the codebase to align naming and parsing APIs so that everything behaves the same way.

Manticore v1.0.4: Minor bug fixes on Windows KeyCredential time functions

Wed, 29 Oct 2025 10:58:34 +0000

Manticore is the Go library of offensive and defensive security primitives that underpins the tools of The Manticore Project. This release, v1.0.4, is a small maintenance update: there are no new features, just a focused round of bug fixes in the Windows KeyCredential time handling.

KeyCredential time functions

KeyCredential blobs (the msDS-KeyCredentialLink attribute used by Windows Hello for Business and shadow-credentials tooling) carry timestamps such as the key creation and last-update times. Getting these conversions right matters, since an off-by-one or misencoded timestamp can produce a blob that the directory rejects, or one that misrepresents when a key was created.

Manticore v1.0.3: Parts of SMBv1 and minor fixes

Tue, 28 Oct 2025 16:12:47 +0000

Manticore is the Go library of offensive and defensive security primitives that powers the tools of The Manticore Project. It provides the building blocks (protocol structures, Active Directory abstractions, cryptographic helpers) that the individual tools rely on so that each tool does not have to reimplement the same plumbing.

This release, v1.0.3, is a mix of new groundwork and small corrections. The headline is the start of SMB v1.0 support, but most of the work here is about tightening interfaces that already existed and adding the project governance documents that the repository was missing. None of these changes are large on their own; together they make the library a little more correct and a little easier to contribute to.

Manticore v1.0.2: NBTNS and LDAP improvements

Sat, 31 May 2025 13:34:12 +0000

Manticore is the Go library of offensive and defensive security primitives that powers the tools built by The Manticore Project. It provides the building blocks (network protocol implementations, Active Directory helpers, cryptography, and parsing routines) that the higher-level tools rely on.

This release, v1.0.2, is a small but meaningful one. It focuses on two areas: a correctness fix in the NBTNS (NetBIOS Name Service) protocol implementation, and a round of improvements to the LDAP functions. It is also the first release to include a contribution from outside the core team.

Manticore v1.0.1: UUID and LDAP improvements

Wed, 21 May 2025 08:39:52 +0000

Manticore is the Go library of offensive and defensive security primitives that underpins the tools built by The Manticore Project. This v1.0.1 release is a round of minor improvements: no new tool, no breaking change, just rounding out two areas of the library that the tools lean on the most. In this release I focused on the UUID package and the LDAP package.

UUID generation

Identifiers turn up everywhere in security tooling. Active Directory objects, RPC interface bindings, and many Windows structures are addressed by UUIDs, and when you build or test against those systems you frequently need to generate identifiers of a specific version rather than just a random one. A library that only produces UUID v4 leaves you reaching for handwritten byte-twiddling whenever a particular version is required.

Manticore v1.0.0: The beast awakens

Tue, 13 May 2025 05:49:58 +0000

Over the past while, building security tooling for The Manticore Project, I kept running into the same situation: each new tool needed the same low-level building blocks. LDAP connectivity and authentication, protocol structures, cryptography helpers, and the assorted primitives that sit underneath any serious offensive or defensive utility. Re-implementing these per tool is wasteful and error-prone, so I started consolidating them into a single, reusable Go library.

That library is Manticore, and this v1.0.0 release marks its first public release.