What is Titanis?
Titanis is a library of protocol implementations and command-line utilities, written in C#, for interacting with Windows environments. Built on .NET 8, it runs on both Windows and Linux, providing a uniform experience across platforms.SMB2/3 Client
Full SMB 2.x and 3.x implementation with signing, encryption, DFS links, and filesystem control codes (MS-SMB2, MS-FSCC, MS-DFSC).
MSRPC & DCOM
RPC endpoint mapper, DCOM, WMI, LSA, SAM, SCM, EFS, Remote Registry, and Server service interfaces.
Kerberos
Full Kerberos implementation with PKINIT, S4U2self/S4U2proxy, inter-realm referrals, ccache/kirbi ticket management, and multiple encryption profiles.
NTLM & SPNEGO
NTLM authentication with pass-the-hash support. SP-NEGO negotiation wrapping both NTLM and Kerberos contexts.
LDAP
RFC 4511 LDAP client with SSL, channel binding, and Active Directory extensions (MS-ADTS).
SOCKS5 Proxy
Integrated SOCKS5 proxy support (
-Socks5 parameter) for all network tools — route traffic through a pivot host.Target Audience
Security Researchers
Research how Windows reacts to various types of protocol requests. Inspect protocol behavior at a deep level.
Pentesters
Perform actions and test whether mitigations are enabled and functioning properly. Full support for pass-the-hash, pass-the-ticket, Kerberoasting, and lateral movement.
System Administrators
Perform administrative tasks against Windows systems remotely from Linux or Windows without needing a domain-joined machine.
Getting Started
Build from source
Build Titanis using
dotnet build on Windows or Linux with .NET 8 SDK.Installation
Download pre-built binaries and set up Titanis for your operating system.
Command line syntax
Learn the uniform command line syntax shared by all Titanis tools.
Authentication
Understand how to authenticate using passwords, NTLM hashes, AES keys, and Kerberos tickets.
Supported Protocols
| Protocol | Specification | Notes |
|---|---|---|
| SMB2/3 | MS-SMB2 | Versions 2.x and 3.x up to 3.1.1 |
| MSRPC | MS-RPCE | Endpoint mapper, DCOM, named pipe transport |
| LDAP | RFC 4511 | With MS-ADTS extensions |
| Kerberos | RFC 4120, MS-KILE | PKINIT, S4U, inter-realm referrals |
| NTLM | MS-NLMP | Pass-the-hash support |
| SPNEGO | MS-SPNG | Automatic negotiation |
| SOCKS5 | RFC 1928 | All tools support proxy routing |
Tool Suite
Titanis ships a set of standalone command-line tools as pre-built binaries for both Windows and Linux.Kerb
Kerberos ticket management: request TGTs, TGS tickets, renew tickets, manage ticket files.
Smb2Client
SMB filesystem operations: list, get, put, delete, watch, enumerate shares, sessions, and snapshots.
Wmi
WMI query, method invocation, remote command execution, and repository management.
Lsa
LSA policy: enumerate accounts, manage privileges, look up SIDs and account names.
Sam
Security Accounts Manager: enumerate users in the SAM database.
Scm
Service Control Manager: create, start, stop, query, and delete Windows services.
Epm
RPC endpoint mapper: enumerate dynamic RPC endpoints registered on a system.
Ldap
LDAP queries against Active Directory with full filter and attribute support.
Reg
Remote Registry access including backup semantics and SAM database dump.
CredCoerce
Coerce a Windows system to authenticate to a remote target via RPC callbacks.
Dcom
Activate and invoke methods on remote DCOM automation objects.
Sddl
Parse and describe SDDL security descriptor strings.