How to Run the Doom Tool: Installation and Execution Guide for AD-CS Enumeration

Run the Doom tool by installing it via pipx (pipx install git+https://github.com/000pp/doom) and then executing the doom command in your terminal to launch the interactive Textual TUI for enumerating Active Directory Certificate Services (AD-CS) templates.

Doom is a Python-based Textual TUI application developed by 000pp/doom that connects to Active Directory LDAP servers to audit and display certificate template configurations. Whether you are conducting penetration tests or security assessments, properly installing and launching this tool enables efficient discovery of misconfigurations in enterprise certificate infrastructure.

Installation Methods

Install with pipx (Recommended)

The most reliable way to run the Doom tool is using pipx, which creates an isolated Python environment and automatically adds the doom command to your system PATH. According to the pyproject.toml configuration, the console script entry point maps to doom.__main__:run (lines 22-24).

# Linux - install pipx first

sudo apt install pipx git
pipx ensurepath

# macOS - install pipx first

brew install pipx
pipx ensurepath

# Install Doom globally

pipx install git+https://github.com/000pp/doom

Run from Source (Development Mode)

For developers contributing to 000pp/doom or testing the latest unreleased features, execute Doom directly from a cloned repository using Python's module runner.

git clone https://github.com/000pp/doom.git
cd doom
pipx install .          # or: pip install -e .

python -m doom          # launches the same TUI

Launching the Application

Once installed, simply invoke the command:

doom

This executes the entry point defined in src/doom/__main__.py, which creates a DoomApp instance and calls app.run() (lines 18-22). The Textual application immediately initializes and displays the authentication interface.

For programmatic integration within Python scripts, import the run function directly:

from doom.__main__ import run

if __name__ == "__main__":
    run()          # identical to invoking the console script

Understanding the Doom Execution Workflow

When you run the Doom tool, it orchestrates a multi-stage workflow through three primary screens to authenticate and enumerate certificate templates.

1. Login Screen Authentication

Upon launch, the application pushes LoginScreen (lines 13-16 in src/doom/__main__.py). This interface collects your LDAP host, domain, username, and password through input widgets defined in the compose method of src/doom/screens/login_screen.py (lines 70-88).

2. LDAP Connection and Loading

After credential submission, LoadingScreen displays a progress indicator while spawning an async task. This task calls get_ldap_connection from doom.protocols.ldap to establish a bind with the Active Directory server, attempting plain LDAP first, then falling back to LDAPS (lines 78-84 in src/doom/screens/loading_screen.py).

3. Certificate Template Enumeration

Upon successful authentication, the application transitions to MainScreen, where the on_mount method asynchronously invokes enumerate_templates from doom.modules.enumerate_templates (lines 72-78 in src/doom/screens/main_screen.py). This function performs an LDAP subtree search for objects of class pKICertificateTemplate, parsing raw attributes via parse_attribute and enriching data with analyze_template_properties (lines 5-43 in src/doom/modules/enumerate_templates.py).

4. Interactive Tree Navigation

The enumerated templates populate a collapsible tree interface. Selecting any node expands it to reveal detailed attribute values including boolean flags, string values, and list data (lines 95-124 in src/doom/screens/main_screen.py).

Advanced Programmatic Usage

For automation or custom integrations, bypass the TUI and use Doom's core LDAP functionality directly:

from doom.protocols.ldap import get_ldap_connection
from doom.modules.enumerate_templates import enumerate_templates

# Establish connection

conn, base_dn = get_ldap_connection(
    host="192.168.1.100",
    username="administrator",
    password="SecureP@ss",
    domain="corp.local"
)

# Retrieve templates programmatically

templates = enumerate_templates(conn, base_dn)
for template in templates:
    print(template['cn'], template.get('msPKI-Certificate-Name-Flag'))

Summary

• Install Doom using pipx install git+https://github.com/000pp/doom to create the isolated doom executable command.
• Execute the tool by running doom in your terminal, which triggers the entry point in src/doom/__main__.py.
• Authenticate via the interactive LoginScreen to establish LDAP/LDAPS connections through get_ldap_connection.
• Enumerate certificate templates automatically through the enumerate_templates module, displaying results in a navigable tree view.
• Developers can run python -m doom from the repository root or import doom.__main__:run programmatically for custom workflows.

Frequently Asked Questions

What are the prerequisites to run the Doom tool?

Doom requires Python 3.x and pipx (recommended) or pip with virtual environment support. You must also have network connectivity to an Active Directory domain controller hosting certificate services. The tool handles both LDAP and LDAPS protocols automatically during connection establishment via doom.protocols.ldap.

Can I run Doom without installing it via pipx?

Yes. Clone the repository with git clone https://github.com/000pp/doom.git, navigate to the directory, and execute python -m doom after installing dependencies with pip install -e . or pipx install .. This development mode is ideal for modifying source code in src/doom/ while testing changes to the enumeration logic.

Why does Doom show a loading screen before displaying templates?

The LoadingScreen (implemented in src/doom/screens/loading_screen.py) appears while the application establishes an authenticated LDAP session using get_ldap_connection and retrieves the base DN. This asynchronous process ensures the connection to Active Directory is valid before attempting to enumerate certificate templates, preventing UI freezes during network operations.

How do I troubleshoot connection errors when running Doom?

Verify your LDAP credentials, ensure the domain controller is reachable on port 389 (LDAP) or 636 (LDAPS), and confirm your account has read permissions to the pKICertificateTemplate objects in Active Directory. The doom.protocols.ldap module handles connection logic, and authentication errors are surfaced in the TUI's log output or console traceback depending on your execution method.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}