Hi, @mverschu! Hope you're doing well.
I tested this tool in my lab environment where LDAP Signing and Channel Binding are required and I couldn't reproduce the vulnerability successfully. After investigating the issue, I identified that the root cause is a limitation in the current dnstool.py, which lacks native support for these LDAP features.
Fortunately, there is an open PR created by @flashlam from Synacktiv in the official krbrelayx.py repository that implements full support for LDAP Signing and Channel Binding.
Old dnstool.py:

dnstool.py with flashlam PR applied:

I suggest using this version of dnstool.py instead of the original one.
Hi, @mverschu! Hope you're doing well.
I tested this tool in my lab environment where LDAP Signing and Channel Binding are required and I couldn't reproduce the vulnerability successfully. After investigating the issue, I identified that the root cause is a limitation in the current dnstool.py, which lacks native support for these LDAP features.
Fortunately, there is an open PR created by @flashlam from Synacktiv in the official krbrelayx.py repository that implements full support for LDAP Signing and Channel Binding.
Old dnstool.py:

dnstool.py with flashlam PR applied:

I suggest using this version of dnstool.py instead of the original one.