Initial commit

Author: maxgrim

.gitignore

@@ -0,0 +1,47 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# pyenv / uv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+.python-version
+
+# Environments
+.env
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# PyCharm
+#  JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#  be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#  and can be added to the global gitignore or merged into this file.  For a more nuclear
+#  option (not recommended) you can uncomment the following to ignore the entire idea folder.
+.idea/
+
+# macOS
+.DS_Store
+default.profraw

README.md

@@ -0,0 +1,54 @@
+# regcertipy
+Parses cached certificate templates from a Windows Registry `.reg` file and 
+displays them in the same style as 
+[Certipy](https://github.com/ly4k/Certipy) does.
+
+## Getting started
+We prefer using the [uv package manager](https://docs.astral.sh/uv/), as it 
+will automatically create a virtual environment for you.
+
+```
+$ uv venv
+$ uv pip install regcertipy
+$ regcertipy -h
+usage: regcertipy [-h] regfile
+
+Regfile ingestor for Certipy
+
+positional arguments:
+  regfile     Path to the .reg file.
+
+options:
+  -h, --help  show this help message and exit
+```
+
+Use regedit.exe to export the keys under 
+`HKEY_USERS\.DEFAULT\Software\ Microsoft\Cryptography\CertificateTemplateCache\`. 
+Then, the .reg file can be fed into regcertipy with: regcertipy <regfile>.
+
+![Example of how to export a .reg file](resources/regedit.png)
+
+## Development
+Note that we use the [Black code formatter](https://black.readthedocs.io/en/stable/) 
+for code formatting. Moreover, we use the Git Flow branching model, meaning 
+that we actively develop on the "develop" branch, and merge to the "main" 
+branch (& tag it) when a new release is made, making the "main" branch the 
+production branch.
+
+```
+$ uv sync --dev # Also installs the Black code formatter.
+$ uv run black . # To format the current code base.
+$ uv run regcertipy -h
+usage: regcertipy [-h] regfile
+
+Regfile ingestor for Certipy
+
+positional arguments:
+  regfile     Path to the .reg file.
+
+options:
+  -h, --help  show this help message and exit
+```
+
+You can also run the `__init__.py` or `__main.py__` Python file in your 
+favourite debugger.

bitbucket-pipelines.yml

@@ -0,0 +1,80 @@
+image: atlassian/default-image:3
+
+definitions:
+  steps:
+    - step: &Test
+        name: "Run unit tests"
+        image: python:3.12
+        script:
+          - pip install -r requirements.txt
+          - (cd src && python -m unittest)
+    - step: &Lint
+        name: "Run linting checks"
+        image: python:3.12
+        script:
+          - pip install black
+          - black --check src/
+    - step: &Validate-Branch-For-Tag-Step
+        name: Validating branch & tag combination
+        script:
+          - |
+            echo "Fetching all the git remote references (such as tags)."
+            git fetch origin "+refs/heads/*:refs/remotes/origin/*"
+
+            if [[ "$BITBUCKET_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+$ ]]; then
+              VALID_BRANCH="^.*remotes/origin/(release|hotfix)/.*$"
+              DEPLOYMENT_ENVIRONMENT="rc"
+            elif [[ "$BITBUCKET_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-alpha\.[0-9]+$ ]]; then
+              VALID_BRANCH="^.*remotes/origin/(release|hotfix)/.*$"
+              DEPLOYMENT_ENVIRONMENT="staging"
+            elif [[ "$BITBUCKET_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+              VALID_BRANCH="^.*remotes/origin/master$"
+              DEPLOYMENT_ENVIRONMENT="production"
+            else
+              echo "Tag \"$BITBUCKET_TAG\" has an invalid format. Aborting..."
+              exit -1
+            fi
+
+            echo "Verifying that tag \"$BITBUCKET_TAG\" is applied on a branch matching \"$VALID_BRANCH\"."
+            FOUND=false
+
+            TAG_BRANCHES=$(git branch -a --contains "$BITBUCKET_TAG")
+            echo "Branches to which tag $BITBUCKET_TAG is applied: "
+            echo $TAG_BRANCHES
+
+            while IFS= read -r BRANCH ; do 
+              NORMALIZED_BRANCH=$(echo $BRANCH | sed -E -e "s/(\* )|(  )//")
+
+              if [ "$(echo $NORMALIZED_BRANCH | grep -cm1 -E "$VALID_BRANCH")" -eq 1 ]; then
+                FOUND=true
+                echo "Tag \"$BITBUCKET_TAG\" is applied to a valid branch: \"$NORMALIZED_BRANCH\"."
+                break
+              fi
+            done <<< "$TAG_BRANCHES"
+
+            if ! $FOUND; then
+              echo "Tag \"$BITBUCKET_TAG\" was not found on a branch matching \"$VALID_BRANCH\". Aborting..."
+              exit -1
+            fi
+
+pipelines:
+  default:
+    - parallel:
+        - step: *Test
+        - step: *Lint
+  branches:
+    "release/*":
+      - parallel:
+          - step: *Test
+          - step: *Lint
+  tags:
+    "{v*.*.*}":
+      - step: *Validate-Branch-For-Tag-Step
+      - parallel:
+          - step: *Test
+          - step: *Lint
+  pull-requests:
+    "*":
+      - parallel:
+          - step: *Test
+          - step: *Lint

pyproject.toml

@@ -0,0 +1,28 @@
+[project]
+name = "regcertipy"
+version = "1.0.0"
+description = """
+Parses cached certificate templates from a Windows Registry file and \
+displays them in the same style as Certipy does.
+"""
+readme = "README.md"
+authors = [
+    { name = "Max Grim", email = "max@outflank.nl" },
+    { name = "Cedric van Bockhaven", email = "cedric@outflank.nl" },
+]
+requires-python = ">=3.12"
+dependencies = [
+    "certipy-ad==4.8.2",
+]
+
+[project.scripts]
+regcertipy = "regcertipy:main"
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[dependency-groups]
+dev = [
+    "black>=25.1.0",
+]

resources/example.reg

@@ -0,0 +1,40 @@
+import argparse
+
+from certipy.lib.formatting import pretty_print
+from regcertipy.models import CertTemplate
+from regcertipy.parsers import RegfileParser
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        add_help=True,
+        description="Regfile ingestor for Certipy",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+    )
+    parser.add_argument("regfile", help="Path to the .reg file.")
+    args = parser.parse_args()
+
+    parser = RegfileParser(args.regfile)
+
+    templates = []
+
+    for key, dct in parser.to_dict().items():
+        if not key.startswith(
+            "HKEY_USERS\\.DEFAULT\\Software\\Microsoft"
+            "\\Cryptography\\CertificateTemplateCache\\"
+        ):
+            continue
+
+        name = key.split("\\")[-1]
+
+        template = CertTemplate(name, dct)
+        templates.append(template)
+
+    print(f"[*] Found {len(templates)} templates in the registry")
+
+    for template in templates:
+        pretty_print(template.to_dict())
+
+
+if __name__ == "__main__":
+    main()

resources/regedit.png

@@ -0,0 +1,3 @@
+import regcertipy
+
+regcertipy.main()

src/regcertipy/__init__.py

@@ -0,0 +1 @@
+from .cert_template import CertTemplate

src/regcertipy/__main__.py

@@ -0,0 +1,120 @@
+from typing import Dict
+
+import regcertipy.utils
+from certipy.commands.find import filetime_to_str
+from certipy.lib.constants import (
+    CERTIFICATE_RIGHTS,
+    EXTENDED_RIGHTS_NAME_MAP,
+    MS_PKI_CERTIFICATE_NAME_FLAG,
+    MS_PKI_ENROLLMENT_FLAG,
+    OID_TO_STR_MAP,
+)
+from certipy.lib.security import CertifcateSecurity
+
+
+class CertTemplate:
+    def __init__(self, name: str, data: Dict):
+        self.data = data
+
+        self.name = name
+        self.display_name = self.data["DisplayName"]
+        self.oid = (
+            self.data["msPKI-Cert-Template-OID"].decode("utf-16-le").rstrip("\0\0")
+        )
+        self.validity_period = filetime_to_str(self.data["ValidityPeriod"])
+        self.renewal_period = filetime_to_str(self.data["RenewalOverlap"])
+        self.name_flags = MS_PKI_CERTIFICATE_NAME_FLAG(
+            self.data["msPKI-Certificate-Name-Flag"]
+        )
+
+        self.enrollment_flags = MS_PKI_ENROLLMENT_FLAG(
+            self.data["msPKI-Enrollment-Flag"]
+        )
+        self.signatures_required = self.data["msPKI-RA-Signature"]
+
+        self.extended_key_usage = list(
+            map(
+                lambda x: OID_TO_STR_MAP[x] if x in OID_TO_STR_MAP else x,
+                data["ExtKeyUsageSyntax"]
+                .decode("utf-16-le")
+                .rstrip("\0\0")
+                .split("\0"),
+            )
+        )
+
+        self.permissions = self._build_permissions(self.data["Security"])
+
+    @staticmethod
+    def _build_permissions(security_dict: Dict):
+        security = CertifcateSecurity(security_dict)
+
+        enrollment_permissions = {}
+        enrollment_rights = []
+        all_extended_rights = []
+
+        permissions = {}
+
+        for sid, rights in security.aces.items():
+            if (
+                EXTENDED_RIGHTS_NAME_MAP["Enroll"] in rights["extended_rights"]
+                or EXTENDED_RIGHTS_NAME_MAP["AutoEnroll"] in rights["extended_rights"]
+            ):
+                enrollment_rights.append(regcertipy.utils.sid_to_name(sid))
+            if (
+                EXTENDED_RIGHTS_NAME_MAP["All-Extended-Rights"]
+                in rights["extended_rights"]
+            ):
+                all_extended_rights.append(regcertipy.utils.sid_to_name(sid))
+
+        if len(enrollment_rights) > 0:
+            enrollment_permissions["Enrollment Rights"] = enrollment_rights
+
+        if len(all_extended_rights) > 0:
+            enrollment_permissions["All Extended Rights"] = all_extended_rights
+
+        if len(enrollment_permissions) > 0:
+            permissions["Enrollment Permissions"] = enrollment_permissions
+
+        object_control_permissions = {"Owner": security.owner}
+
+        rights_mapping = [
+            (CERTIFICATE_RIGHTS.GENERIC_ALL, [], "Full Control Principals"),
+            (CERTIFICATE_RIGHTS.WRITE_OWNER, [], "Write Owner Principals"),
+            (CERTIFICATE_RIGHTS.WRITE_DACL, [], "Write Dacl Principals"),
+            (
+                CERTIFICATE_RIGHTS.WRITE_PROPERTY,
+                [],
+                "Write Property Principals",
+            ),
+        ]
+
+        for sid, rights in security.aces.items():
+            rights = rights["rights"]
+            sid = regcertipy.utils.sid_to_name(sid)
+
+            for right, principal_list, _ in rights_mapping:
+                if right in rights:
+                    principal_list.append(sid)
+
+        for _, rights, name in rights_mapping:
+            if len(rights) > 0:
+                object_control_permissions[name] = rights
+
+        if len(object_control_permissions) > 0:
+            permissions["Object Control Permissions"] = object_control_permissions
+
+        return permissions
+
+    def to_dict(self):
+        return {
+            "Name": self.name,
+            "Friendly Name": self.display_name,
+            "Template OID": self.oid,
+            "Validity Period": self.validity_period,
+            "Renewal Period": self.renewal_period,
+            "Name Flags": self.name_flags,
+            "Enrollment Flags": self.enrollment_flags,
+            "Signatures Required": self.signatures_required,
+            "Extended Key Usage": self.extended_key_usage,
+            "Permissions": self.permissions,
+        }