v2.12.0

Improvements

All authentication methods now use RedTeamPentesting/adauth instead of our previous ad-hoc implementation, allowing for channel binding support and additional credential inputs for Kerberos (-k) - not only supporting just a ticket, but also password, NT hash, AES key via --aes-key, or a certificate/private key pair for PKINIT. The following improvements derive from this migration:

• Changed the default auth method for -u / -p from simple binds to NTLM via the Sicily path, with a newly-added flag to use simple bind instead (--simple).
• The -t / --spn flag was removed. The target SPN for Kerberos binds is now derived automatically from the target host, and a PTR lookup is used to infer it when the target is an IP.
• The target positional argument is now optional; if it is omitted, godap discovers a domain controller via a SRV DNS query to _kerberos._tcp.DOMAIN, using the domain provided through -d / --domain or inferred from a domain-qualified username (user@domain or DOMAIN\user).
• A PTR lookup to infer the SPN for Kerberos will also be triggered if the provided target is an IP.
• The behavior of newly-introduced DNS queries can be customized providing --dns (a custom server), --dns-tcp or --no-proxy-dns (for special cases involving SOCKS).
• Authentication can now also be selected and edited at runtime from the connection settings panel: pick a mechanism (Simple Bind, NTLM, Kerberos or Certificate) from the Auth Type dropdown, fill in the credential fields and reconnect with Update.

Fixes

• The SOCKS proxy set via -x / --socks is now used for Kerberos KDC traffic (apparently it was mistakenly ignored in previous versions).
• On Linux/Darwin builds the CCache path now defaults to /tmp/krb5cc_UID; on any platform the FILE: prefix is stripped if present.