Kerberos & Certificate Trace Presenters for Metasploit
GSoC 2026 · mentored by @jheysel-r7 & @zeroSteiner
Welcome to my Google Summer of Code 2026 build log. This page tracks my work on two new inline tracing capabilities for the Metasploit Framework - KerberosTicketTracePresenter and CertificateTracePresenter - that bring HttpTrace-style transparency to Kerberos tickets and X.509 certificates inside msfconsole, so operators no longer need to export .ccache or .pfx artefacts to disk to inspect them.
About the Program
Google Summer of Code
GSoC is a global, online program focused on bringing new contributors into open-source software development. Contributors work with a mentor organisation on a 12+ week programming project, gain real-world experience, and ship production-grade code that lands in tools used by millions.
Metasploit Framework
Metasploit is the leading open-source penetration testing platform, written primarily in Ruby and maintained by Rapid7 alongside hundreds of community contributors. It powers exploit development, post-exploitation, payload generation, and red-team operations worldwide.
My Goal
To contribute meaningful, well-tested code to a framework I use daily, deepen my Ruby and offensive-security skills, and build long-term relationships with the Rapid7 maintainers and the wider open-source security community.
The Project
Two new inline tracing presenters for the Metasploit Framework that bring HttpTrace-style transparency to Kerberos and X.509 authentication artefacts. Backward-compatible by default and modelled directly on the existing krb5_ccache_presenter.rb precedent.
Proposal Abstract
This project introduces two new inline tracing capabilities to the Metasploit Framework: CertificateTracePresenter and KerberosTicketTracePresenter. These features let penetration-testing operators inspect every Kerberos ticket and X.509 certificate artefact produced during module execution - principal names, encryption types, validity windows, serial numbers, SHA-256 fingerprints, ticket flags, and session keys - all without leaving the msfconsole session.
The work is modelled directly on Metasploit's existing HttpTrace capability in Exploit::Remote::HttpClient. Just as HttpTrace brought transparent HTTP request/response debugging inline, these two presenters extend the same design philosophy to the authentication layer. The implementation follows the established presenter pattern exemplified by krb5_ccache_presenter.rb - instantiating a presenter, calling to_s_* instance methods that return formatted strings, and letting the module call print_line().
Modern red-team engagements are increasingly centred on Active Directory abuse and certificate-based authentication (ADCS ESC1–ESC16). This project eliminates the need to export artefacts to disk or switch to auxiliary modules mid-exploitation - a workflow break that degrades both operator efficiency and OPSEC. The implementation is fully backward-compatible: when options are set to off (the default), no behaviour changes occur in any existing module.
Project Title
KerberosTicketTracePresenter & CertificateTracePresenter Support for the Metasploit Framework
Mentors
@jheysel-r7 (primary) · @zeroSteiner (co-mentor)
Size & Difficulty
175 hours · Medium
Working Fork
Tech Stack
Current Status: Week 12 · Final stretch - CertificateTrace track complete, Kerberos relay in upstream review
Both presenter cores merged in Week 1 (originally scoped for Weeks 3–10). All six CertificateTrace PRs are now merged upstream (#21198, #21469, #21580, #21599, #21607, #21608): SSL peer-cert tracing has fully landed across HTTP (Phase 1), LDAP + RDP (Phase 2), and Postgres TLS + full cert chain (Phase 3) - the CertificateTrace track is complete. With the midterm bar well exceeded, focus has moved to a new mentor-endorsed track: the first native Kerberos relay framework in Metasploit (CVE-2026-20929), now open upstream as three PRs (#21709, #21724, #21725) with a supporting DNS-stack fix (#21784) already merged.
CertificateTracePresenter (Phase 3 work, done early): fully implemented with a 343-line presenter + 88-line shared CertificateTrace mixin. Integrated into 10+ Metasploit modules: icpr_cert, web_enrollment_cert, certifried, esc_update_ldap_object, bad_successor, rbcd, shadow_credentials, ldap_esc_vulnerable_cert_finder, relay modules, and more. RSpec: 403-line presenter suite + 184-line mixin suite. PR #21198 merged, with multiple review cycles addressed including MS Application Policies OID decoding, X.509 version display, SAN parsing, and non-ASCII sanitisation. Featured in the Rapid7 Metasploit Wrap-Up (June 13, 2026).
KerberosTicketTracePresenter (Phase 2, Mingqing/@eve0805): core presenter merged upstream via PR #21466; enum-modes follow-up merged via PR #21637 (superseding the closed #21568). My initial draft on kerberos-trace was superseded by Mingqing's implementation.
Week 2: LDAP Schannel cert tracing merged upstream via PR #21469 (2026-06-18), extending CertificateTrace to LDAP authentication over Schannel. CSR trace follow-up PR #21580 opened the same week (2026-06-18) and merged upstream in Week 4 (2026-07-08): adds to_s_csr_metadata / to_s_csr_full presenter methods, a certificate_csr_trace hook in CertRequest#with_adcs_certificate_request, and 73 green RSpec examples decoding requested template, SAN, and EKU OIDs from a real PKCS#10 CSR.
Weeks 3–8: SSL peer-cert tracing extended across 4 protocols in 3 PRs (opened Week 3, live-lab-tested Weeks 4 & 6, all merged by Week 8). Phase 1 (HTTP) via PR #21599 (merged 2026-07-15): certificate_peer_cert_trace wired into HttpClient after send_recv, dedup via DB note, 47 RSpec examples green. Phase 2 (LDAP + RDP) via PR #21607 (merged 2026-07-17): wraps ldap_open and swap_sock_plain_to_ssl with peer-cert capture, with a respond_to?(:datastore) guard to prevent crashes in scanner contexts. Phase 3+4 (Postgres TLS + full cert chain) via PR #21608 (merged 2026-07-28): reads peer cert from postgres_conn.conn with respond_to?(:peer_cert) guard for plain-TCP connections; chain members printed with "Chain N/M" headers in full mode. All three Copilot review findings addressed and re-validated live against HTTP, LDAP, RDP and a CA-signed Postgres chain before merge.
Weeks 5–12 - Native Kerberos relay (CVE-2026-20929): a new mentor-endorsed track building the first Kerberos relay framework in Metasploit, mirroring the existing NTLM relay design. Now open upstream as three PRs: the relay stack + ESC8 AD CS relay target (#21709) - a reusable relay mixin (GSS-SPNEGO AP-REQ capture/forward, protocol-agnostic relay handler, SMB capture server, HTTP relay-target client); and native IPv6 DNS-takeover coercion split into a rogue DHCPv6 server (#21724) and a rogue Router Advertisement / RDNSS module (#21725) - the mitm6 equivalents, no external tooling. A supporting DNS forward/cache crash fix (#21784) is already merged (2026-08-20). Lab-validated: relay-to-ESC8 certificate issuance confirmed end to end and the DHCPv6 coercion proven on the wire; mentor review findings addressed with SMB2 SessionSetup and SPNEGO relay-thread hardening landed on the branch.
Total: ~4,500+ lines of new production code + specs across all branches through Week 12.
Timeline
The 12-week / 175-hour build plan, mapped onto the four project phases from the accepted proposal. GSoC milestones - Community Bonding, midterm, and final submission - are anchored inside the relevant phases.
Community Bonding · Phase 1 (Study) ✓
Weeks 1–2 · 25 hrs · CompleteDeep-dived into HttpTrace in Exploit::Remote::HttpClient, mapped the Kerberos client mixin, stood up the Windows Server 2022 + ADCS lab on TEST.LOCAL, and verified AS-REQ / TGS-REQ ticket capture in Wireshark.
Phase 2 - KerberosTicketTracePresenter ✓ Mingqing
Weeks 3–6 · Delivered by @eve0805Implemented and merged upstream by fellow GSoC contributor Mingqing (@eve0805). Core presenter merged via PR #21466; enum-modes follow-up merged via PR #21637 (superseding the closed #21568). My initial draft on kerberos-trace (PRs #21152 / #21190, closed) was superseded by her implementation.
Midterm Evaluation ✓
Week 5 · 10 July 2026 · PassedMentor review of progress against proposal milestones. With three CertificateTrace PRs already merged upstream (#21198, #21469, #21580) and SSL peer-cert tracing live-lab-tested, the midterm bar was well exceeded. Since the checkpoint: peer-cert Phase 1 (#21599) and Phase 2 (#21607) landed, Phase 3 (#21608) entered review, and a new native Kerberos relay track (CVE-2026-20929) kicked off.
Phase 3 - CertificateTracePresenter ✓ · LDAP Schannel ✓ · CSR trace ✓ · SSL peer-cert ✓
Originally Weeks 7–10 · Core merged Week 1 · Schannel Week 2 · CSR merged Week 4 · peer-cert Phases 1–3 all merged by Week 8CertificateTracePresenter (343 lines) + shared CertificateTrace mixin merged upstream via PR #21198 (Week 1, 2026-06-05). Week 2: LDAP Schannel cert tracing merged via PR #21469 (2026-06-18) and CSR trace opened as PR #21580 (merged 2026-07-08). SSL peer-cert tracing opened Week 3 and landed across Weeks 5–8: HTTP (#21599 merged 2026-07-15), LDAP+RDP (#21607 merged 2026-07-17), and Postgres+chain (#21608 merged 2026-07-28) - the CertificateTrace track is complete.
Phase 3.5 - Native Kerberos relay (CVE-2026-20929) In review
Weeks 5–12 · Mentor-endorsed trackThe first native Kerberos relay framework in Metasploit, mirroring the NTLM relay design. Open upstream as three PRs: relay stack + ESC8 AD CS target (#21709), rogue DHCPv6 coercion (#21724), and rogue RA/RDNSS coercion (#21725). Supporting DNS forward/cache crash fix (#21784) merged 2026-08-20. Relay-to-ESC8 issuance validated end to end in the lab.
Phase 4 - Test & Docs
Weeks 11–12 · 50 hrsFull AD lab integration testing across both presenters, documentation and worked msfconsole usage examples, PR polish across PR 1 and PR 2, plus a feedback-driven changes buffer for mentor review cycles.
Final Submission
Late August / early September 2026Final code submission, deliverables write-up, blog wrap-up, and final mentor evaluation.
Results Announcement
November 2026GSoC 2026 final results made public by Google. Contribution continues outside the program (LDAP-over-Kerberos, SMB-with-Kerberos modules, and the rest of the Rex::Proto::Kerberos consumers).
Weekly Updates Live blog
Weekly notes from the coding period - what I shipped, what blocked me, and what I learned. Updates will be published here every Sunday during GSoC.
Onboarding & env setup ✓
Completed HttpTrace deep-dive, mapped Kerberos client mixin, stood up Windows Server 2022 + ADCS lab on TEST.LOCAL, and validated AS-REQ / TGS-REQ flows in Wireshark. Groundwork for both presenters laid.
Both presenter cores merged upstream · #21198 + #21466
CertificateTracePresenter (Phase 3 work, done 6–9 weeks early): 343-line presenter + 88-line shared CertificateTrace mixin. Wired into 10+ modules: icpr_cert, web_enrollment_cert, certifried, esc_update_ldap_object, bad_successor, rbcd, shadow_credentials, ldap_esc_vulnerable_cert_finder, relay modules, and more. RSpec: 403-line presenter suite + 184-line mixin suite. Merged via PR #21198 (2026-06-05) after multiple review cycles: X.509 version display, SAN parsing, non-ASCII sanitisation, MS Application Policies OID decoding. Featured in the Rapid7 Metasploit Wrap-Up (June 13, 2026).
KerberosTicketTracePresenter (Phase 2, Mingqing/@eve0805): initial draft on kerberos-trace (PRs #21152 / #21190, closed) was superseded by Mingqing's implementation, which merged upstream as PR #21466 (2026-06-04).
LDAP Schannel merged · CSR trace PR opened
LDAP Schannel cert tracing merged upstream via PR #21469 (2026-06-18), extending CertificateTrace to cover LDAP authentication over Schannel TLS.
CSR tracing opened as a focused follow-up to the merged CertificateTracePresenter: to_s_csr_metadata / to_s_csr_full + coerce_csr, hook in CertRequest#with_adcs_certificate_request, 73 RSpec examples green, decoding requested template, SAN, and EKU OIDs from a real PKCS#10 CSR. PR #21580 opened (2026-06-18).
SSL peer-cert tracing built · 4 protocols · 3 PRs opened
Phase 1 (HTTP): PR #21599 opened (2026-06-23): certificate_peer_cert_trace wired into HttpClient after send_recv, DB dedup, 47 RSpec examples green. Live-tested against WEBrick HTTPS using auxiliary/scanner/http/http_version.
Phase 2 (LDAP + RDP): PR #21607 opened (2026-06-25): wraps ldap_open and swap_sock_plain_to_ssl; respond_to?(:datastore) guard prevents crashes in LoginScanner contexts. Phase 3+4 (Postgres TLS + full cert chain): PR #21608 opened (2026-06-25): reads peer cert from postgres_conn.conn, chain members printed with "Chain N/M" headers in full mode.
CSR + Kerberos enum-modes merged · peer-cert live-lab-tested
CSR trace PR #21580 merged upstream (2026-07-08), all test-plan checkboxes ticked. Kerberos enum-modes follow-up (Mingqing) PR #21637 merged the same day.
All three SSL peer-cert PRs (#21599, #21607, #21608) live-lab-tested against the Windows Server 2022 AD CS lab (2026-07-09) - mergeable, CI-green, and awaiting upstream review.
Midterm passed · Phase 1 peer-cert merged
Midterm evaluation checkpoint cleared. HTTP peer-cert tracing PR #21599 merged upstream (2026-07-15); Phase 2 (LDAP/RDP #21607) and Phase 3 (Postgres #21608) queued for review.
Phase 2 merged · Phase 3 queued · Kerberos relay kicked off
LDAP + RDP peer-cert PR #21607 merged upstream (2026-07-17). Postgres + chain PR #21608 rebased on master, all three Copilot findings addressed, re-validated live, queued for merge.
Started a new mentor-endorsed track: a native Kerberos relay framework (CVE-2026-20929) - reusable relay mixin, ESC8 AD CS relay target, and native IPv6 DNS-takeover coercion (rogue DHCPv6 + Router Advertisement/RDNSS). Relay-to-ESC8 certificate issuance validated end to end in the lab.
Kerberos relay stack + ESC8 opened upstream · #21709
Opened the native Kerberos relay stack and ESC8 AD CS Web Enrollment target upstream as PR #21709 (2026-07-24): reusable relay mixin, GSS-SPNEGO AP-REQ capture/forward, protocol-agnostic relay handler, SMB capture server, HTTP relay-target client. Relay-to-ESC8 certificate issuance validated end to end in the two-host CA/KDC lab.
Postgres peer-cert merged · IPv6 coercion PRs opened
Postgres + full cert chain peer-cert PR #21608 merged upstream (2026-07-28), completing the CertificateTrace track. Native IPv6 DNS-takeover coercion opened as two PRs the next day: rogue DHCPv6 (#21724) and rogue RA/RDNSS (#21725), both 2026-07-29 - the mitm6 equivalents, no external tooling.
Relay review cycles · SMB2/SPNEGO hardening
Addressed mentor review findings across the relay stack: fixed SMB2 SessionSetup bookkeeping and hardened the SPNEGO NegTokenResp path so a malformed token no longer kills the relay thread.
Relay robustness fixes
Fixed two errors that only surface once a relay succeeds and guarded the peer-cert trace when the relayed client exposes no connection. Continued two-host CA/KDC lab validation of the full coerce->relay->cert chain.
DNS-stack crash fix merged · #21784
DNS forward/cache crash fix PR #21784 merged upstream (2026-08-20), fixing two crashes in the default DNS forward/cache path that the coercion modules rely on.
Resources & Links
Rapid7 Metasploit Blog
Every Rapid7 Metasploit wrap-up post, auto-synced daily. Posts marked Featured mention my GSoC work directly.
Operator Console Restricted
Authenticated channel · operator-only ledger. Access key required. Only legends know the key.