Ndr on The Manticore Project

Manticore v1.1.2: Registry-related fixes

Tue, 16 Jun 2026 07:27:22 +0000

Manticore is a Go library of offensive and defensive security primitives maintained by The Manticore Project. This release, v1.1.2, is a small patch that continues the Remote Registry and registry work started in v1.1.1. It contains a single, focused fix to how RPC_SECURITY_DESCRIPTOR is marshaled over NDR.

RPC_SECURITY_DESCRIPTOR marshaling

The fix corrects RPC_SECURITY_DESCRIPTOR marshaling when its size_is and length_is bounds are independent (#618). In NDR, a security descriptor is carried as a conformant-varying array of bytes: the buffer’s allocated capacity is described by size_is (the conformance count) and the number of bytes actually present is described by length_is (the variance count). These two values are not always equal, since a caller can allocate a larger buffer than it fills.

Manticore v1.1.1: A Windows REG file parser, NDR64, and Remote Registry

Tue, 16 Jun 2026 06:41:06 +0000

Manticore is the Go library of offensive and defensive security primitives that The Manticore Project’s tools are built on: SMB, LDAP, Kerberos, DCE/RPC, and the Windows data types that hold them together. Most of the work in a release like this happens below the surface, in the wire encoders that have to match exactly what a real Windows server expects.

In v1.1.1 I focused on three things: bringing the NDR codec up to NDR64 so DCE/RPC interfaces negotiate the transfer syntax modern Windows servers prefer, landing a new ms_rrp package with a Remote Registry client and a real Windows .reg file parser, and a handful of correctness improvements around Kerberos SPNs, SMB security descriptors, and GUID handling.

Manticore v1.0.9 - Complete SMBv1, NDR 2.0, and the first RPC interfaces

Tue, 09 Jun 2026 12:46:25 +0000

We tagged Manticore v1.0.9 today. The release title is complete working SMBv1, NDR 2.0, and a bit of RPC, and that is a fair summary of where the bulk of the work went. It is the largest release the library has shipped so far, with several hundred merged pull requests. The practical result is that Manticore can now drive an SMBv1 session and DCE/RPC calls end to end.

This post walks through what changed, grouped by area.