View the User Guide on the documentation site

Introduction

Titanis is a library of protocol implementations and command line utilities, written in C#, for interacting with Windows environments. It uses .NET 8 and is cross-platform (Windows and Linux). Some of the protocols implemented:

• SMB2 (MS-SMB2)
  • SMB 2.x and 3.x up to 3.1.1
  • Message security features such as signing and encryption
  • Includes support for filesystem control codes (MS-FSCC)
  • DFS links (MS-DFSC)
• MSRPC (MS-RPCE)
  • Endpoint mapper
  • DCOM (MS-DCOM)
  • Directory Replication (MS-DRSR)
    • Tested with Windows Server 2008 and Windows Server 2025
    • Supports both MS-ZIP and Xpress compression
    • Supports replication of individual objects or entire partitions
  • EFS (MS-EFSR)
  • LSA (MS-LSAD and MS-LSAT)
  • Remote Registry (MS-RRP)
    • Includes support for backup semantics
    • Includes SAM dump functionality
  • Security Accounts Manager (MS-SAMR)
  • Service Control Manager (MS-SCMR)
  • Server service (MS-SRVS)
  • WMI (MS-WMI and MS-WMIO)
  • Directory replication (MS-DRSR)
  • EventLog Remoting Protocol Version 6.0 (MS-EVEN6)
  • Task Scheduler Service Remoting Protocol (MS-TSCH)
  • Remote Authorization API Protocol (MS-RAA)
  • Firewall and Advanced Security Protocol (MS-FASP)
• LDAP (RFC 4511 and parts of MS-ADTS)
• Security
  • NTLM (MS-NLMP)
  • Kerberos (RFC4120 and MS-KILE)
    • Inter-realm referrals
    • PKINIT (MS-PKCA and RFC 4556)
    • S4U (MS-SFU)
      • S4U2self
      • S4U2proxy
    • Encryption profiles
      • DES CBC MD5 (RFC3961) (AS only)
      • RC4-HMAC (RFC4757)
      • AES 128/256 (RFC3962)
      • Support for .kirbi and ccache files
      • Support for keytab files
    • Change / set password (RFC3244)
    • FAST / Armoring and compound identity
  • SP-NEGO (MS-SPNG)
• Integrated SOCKS 5 support (-Socks5 parameter) (RFC1928)

For recent changes, see the change log

For an overview on supported authentication scenarios, see Authentication - Describes how to control authentication with parameters

The toolset implements callbacks and logging features to integrate into your operational environment.

For a list of command line tools and tasks you can perform with them, check the Tool Index

Target Audience

• Security researchers - Research how Windows reacts to various types of requests
• Pentesters - Perform actions and test whether mitigations are enabled and functioning properly
• System administrators - Perform administrative tasks

Getting Started

Build Instructions

If you are a user, see the User Guide for a list of command line utilities and how to use them.

If you are a developer, see the Developer Guide for information on how to enhance the code base.

Project Organization

• doc/ - Project documentation
• src/ - Source code for protocol implementations
• test/ - Unit tests
• tools/ - Standalone command line tools
• samples/ - Sample code that demonstrates how to use the libraries

Within Titanis.sln, the projects are grouped into the following functional areas:

• Base - Utilities used by other components
• Crypto - Implementation of cryptographic algorithms
• Formats - Implementations for reading and writing various formats, such as ASN.1
• Protocols - Network protocol implementations
• Security - Security protocol implementations, such as NTLM and Kerberos
• Test - Unit tests
• Tools - Standalone command line tools
• _Build - Files relevant to the build process.

Several of the projects contain a file named References.txt that references the specifications consulted during development. The source code contains references to these specifications, usually along with the relevant section number.