Load port scan results. Converts lists back to sets.

Check if a target is a Domain Controller. Args: target: hostname or IP of the target Returns: True

Load an existing session from disk.

Run all verification checks

Main function

Record a host as fully scanned, storing its serialized results. Thread-safe. Marks session dirty for periodic flush.

Parse command-line arguments

Parse all target sources and return unique list

Prepare for scan - check credential - prepare target list (or load from session) Returns: dict w

Print the RelayKing ASCII banner

Save only if data has changed and enough time has elapsed.

Run the scan Returns: dict with all results, analysis, and statistics

Initialize scanner Args: timeout: Socket timeout in seconds (default 0.1 = 100ms)

Initialize Tier0Detector Args: ldap_connection: Active LDAP connection object domain: Domain name (for build

Create an authentication handler with optional custom certificate hash. :param str username: Username in 'domain\\username' format :p

Initialize empty lists for IPs if not provided

Check if NTLMv1 is supported This requires attempting an NTLMv1 authentication

Convert domain to base DN

Override to return custom certificate hash if provided, otherwise use parent implementation.

Get UBR (Update Build Revision) from remote registry Returns UBR as int or None Uses semaphore to limit concurrent DCE/RPC c

Query RPC endpoint mapper for available endpoints

Scan a single target for all specified protocols

Check required Python packages

Check a specific host's registry for NTLMv1 support Returns dict with: - enabled: bool (True if NTLMv1 is supported)

Check RelayKing modules can be imported

Check Python version is 3.8+

Check syntax of all Python files

Detect coercion vulnerabilities by actually attempting exploits Only reports vulnerable if exploit succeeds (gets callback)

Detect HTTPS configuration

Detect IMAP configuration

Detect WINRM configuration

Detect IMAPS configuration

Detect WINRMS configuration

Detect protocol configuration on target host Args: host: Target hostname or IP Returns: ProtocolRes

Detect LDAPS configuration

Detect SMB configuration

Detect MSSQL configuration

Detect ADCS by checking /certsrv/ endpoint on HTTP and HTTPS ADCS should return 401 Unauthorized

Enumerate ADCS servers from LDAP Search under CN=Public Key Services,CN=Services,CN=Configuration,DC=domain,DC=local

Format results in specified format Args: results: Scan results dict output_format: Format name (plaintext, j

Format results as plaintext

Format results as JSON

Format results as CSV

Format results as grep-able output

Format results as Markdown

Format coercion results for display

Ping a single host

Try to resolve a single hostname with timeout

Fast scan multiple ports on a single host Args: host: Target hostname or IP ports: List of ports to scan

Check if a protocol should be scanned based on open ports Args: protocol: Protocol name open_ports: Set of o