Enumerating Certificate Templates in Doom: LDAP Module Architecture and Implementation

The doom.modules.enumerate_templates module handles certificate template enumeration by executing LDAP subtree searches for pKICertificateTemplate objects and transforming raw directory attributes into human-readable security properties.

The 000pp/doom repository provides active directory enumeration capabilities for security assessments, with enumerating certificate templates serving as a core function for identifying PKI vulnerabilities. This capability is implemented through a dedicated Python module that connects to domain controllers, queries the certificate template container, and parses complex LDAP attributes into structured intelligence.

The enumerate_templates Module

Certificate template enumeration in Doom is centralized in src/doom/modules/enumerate_templates.py. This module exposes the primary enumerate_templates function, which serves as the main entry point for discovering and analyzing certificate templates within an Active Directory environment.

The module performs a complete workflow from raw LDAP query to processed security data:

• Establishes the correct search base for certificate template containers
• Executes targeted LDAP searches for pKICertificateTemplate objects
• Safely extracts and parses binary and string attributes
• Analyzes security flags to determine template capabilities
• Returns structured dictionaries ready for UI rendering or export

LDAP Search Strategy and Query Construction

According to the source code in src/doom/modules/enumerate_templates.py (lines 5‑17), the module constructs a specific LDAP search targeting the certificate templates container. The implementation builds a search base targeting CN=Certificate Templates within the domain naming context and executes a subtree search using the filter (objectClass=pKICertificateTemplate).

This approach ensures comprehensive discovery of all certificate templates published in the Active Directory, including those with custom configurations or non-default security settings.

Attribute Extraction and Parsing Pipeline

Once the LDAP search returns results, the module processes each entry through a multi-stage parsing pipeline (lines 28‑38). The implementation relies on two critical helper functions:

• safe_ldap_attr from doom.protocols.ldap – Safely retrieves LDAP attributes, handling missing or null values without raising exceptions
• parse_attribute from doom.parsers.attribute – Converts raw LDAP byte strings and structured data into native Python types

This pipeline ensures that binary flags, distinguished names, and encoded OIDs are transformed into accessible Python dictionaries while maintaining data integrity.

Security Flag Analysis and Property Derivation

The module performs deep analysis of certificate template security characteristics through the analyze_template_properties function (lines 56‑90). This function interprets raw numeric flags to determine template behavior and security implications:

• msPKI-Enrollment-Flag – Determines auto-enrollment capabilities and authentication requirements
• msPKI-Certificate-Name-Flag – Controls subject name construction and supply options
• msPKI-Private-Key-Flag – Indicates whether private keys are exportable or archived
• flags – General template flags defining purpose and compatibility

The analysis produces human-readable properties such as Auto_Enrollment, Exportable_Key, and Client_Authentication, enabling security professionals to quickly identify templates vulnerable to ESC1, ESC2, or other certificate-based attacks.

Result Assembly and Data Structure

After processing, the module assembles the final result structure (lines 41‑51). Each certificate template is returned as a dictionary containing:

• name – The template's canonical name
• display_name – Human-readable identifier
• dn – Full distinguished name
• attributes – Parsed dictionary of all LDAP attributes
• properties – Derived security properties from flag analysis
• raw – Original LDAP entry for advanced inspection

This structure provides both immediate usability for UI display and complete data retention for forensic analysis.

Practical Usage Example

The following example demonstrates how to use the module to enumerate certificate templates from a domain controller:

from doom.modules.enumerate_templates import enumerate_templates
from doom.protocols.ldap import get_ldap_connection

# Establish LDAP connection with domain credentials

ldap_conn, base_dn = get_ldap_connection(
    server="ldap.corp.local",
    user="CORP\\security_audit",
    password="SecurePass123!"
)

# Enumerate all certificate templates

templates = enumerate_templates(ldap_conn, base_dn)

# Process results

for template in templates:
    print(f"Template: {template['display_name']} ({template['name']})")
    print(f"  Auto Enrollment: {template['properties'].get('Auto_Enrollment', False)}")
    print(f"  Exportable Key: {template['properties'].get('Exportable_Key', False)}")
    
    # Check for high-risk configurations

    if template['properties'].get('Client_Authentication') and template['properties'].get('Exportable_Key'):
        print("  [!] Potential ESC1 vulnerability detected")
    print("-" * 40)

The function requires an established LDAP connection object and the domain's base distinguished name. It returns a list of template dictionaries containing both raw LDAP data and computed security properties.

Integration with the User Interface

The enumeration functionality is integrated into Doom's user interface layer through src/doom/screens/main_screen.py (line 6). This UI module imports enumerate_templates and invokes it to populate interface panels with live certificate template data, allowing security operators to browse template configurations, identify misconfigurations, and export findings without writing custom scripts.

Summary

• The doom.modules.enumerate_templates module provides the primary interface for enumerating certificate templates in Active Directory environments.
• The implementation in src/doom/modules/enumerate_templates.py executes targeted LDAP searches for objects of class pKICertificateTemplate within the domain's certificate templates container.
• Raw LDAP attributes are processed using safe_ldap_attr and parse_attribute to handle binary data and missing fields gracefully.
• The analyze_template_properties function interprets PKI flags including msPKI-Enrollment-Flag, msPKI-Certificate-Name-Flag, and msPKI-Private-Key-Flag to identify security-relevant properties like Auto_Enrollment and Exportable_Key.
• Results are structured as dictionaries containing parsed attributes, derived properties, and raw LDAP entries for comprehensive analysis.
• The UI layer in src/doom/screens/main_screen.py consumes this module to display certificate templates interactively.

Frequently Asked Questions

What module is responsible for enumerating certificate templates in Doom?

The doom.modules.enumerate_templates module handles all certificate template enumeration functionality. Implemented in src/doom/modules/enumerate_templates.py, this module provides the enumerate_templates function that queries LDAP, parses attributes, and analyzes security flags to return structured template data.

How does Doom parse raw LDAP attributes into readable formats?

Doom uses a two-stage parsing process. First, safe_ldap_attr from doom.protocols.ldap safely retrieves values while handling missing attributes. Then, parse_attribute from doom.parsers.attribute converts raw byte strings and structured LDAP data into native Python types such as strings, integers, and booleans.

Which certificate template flags does Doom analyze for security assessment?

The module analyzes four critical flag attributes: msPKI-Enrollment-Flag (controls enrollment behavior), msPKI-Certificate-Name-Flag (governs subject name supply), msPKI-Private-Key-Flag (determines key exportability), and general flags (defines template purpose). These are processed by analyze_template_properties to generate human-readable security indicators.

Where does Doom display the enumerated certificate template data?

The UI layer imports the enumeration module in src/doom/screens/main_screen.py (line 6) and uses it to populate interface components. This allows operators to view template configurations, security properties, and potential vulnerabilities through the interactive terminal interface rather than raw JSON or CSV exports.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}