mirror of
https://github.com/FalconOpsLLC/goexec
synced 2026-06-06 15:44:27 +00:00
Bryan McNulty
53 lines
1.6 KiB
Go
53 lines
1.6 KiB
Go
package dcomexec
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
"github.com/FalconOpsLLC/goexec/pkg/goexec"
|
|
"github.com/oiweiwei/go-msrpc/midl/uuid"
|
|
"github.com/rs/zerolog"
|
|
|
|
_ "github.com/oiweiwei/go-msrpc/msrpc/erref/hresult"
|
|
_ "github.com/oiweiwei/go-msrpc/msrpc/erref/ntstatus"
|
|
_ "github.com/oiweiwei/go-msrpc/msrpc/erref/win32"
|
|
)
|
|
|
|
const (
|
|
MethodShellBrowserWindow = "ShellBrowserWindow" // ShellBrowserWindow::Document.Application.ShellExecute
|
|
ShellBrowserWindowUuid = "C08AFD90-F2A1-11D1-8455-00A0C91F3880"
|
|
)
|
|
|
|
type DcomShellBrowserWindow struct {
|
|
Dispatch
|
|
WorkingDirectory string
|
|
WindowState string
|
|
}
|
|
|
|
// Init will initialize the ShellBrowserWindow instance
|
|
func (m *DcomShellBrowserWindow) Init(ctx context.Context) (err error) {
|
|
if err = m.Dcom.Init(ctx); err == nil {
|
|
return m.getDispatch(ctx, uuid.MustParse(ShellBrowserWindowUuid))
|
|
}
|
|
return
|
|
}
|
|
|
|
// Execute will perform command execution via the ShellBrowserWindow object. See https://enigma0x3.net/2017/01/23/lateral-movement-via-dcom-round-2/
|
|
func (m *DcomShellBrowserWindow) Execute(ctx context.Context, execIO *goexec.ExecutionIO) (err error) {
|
|
method := "Document.Application.ShellExecute"
|
|
cmdline := execIO.CommandLine()
|
|
|
|
// Arguments must be passed in reverse order
|
|
if _, err := m.callComMethod(ctx, nil, method,
|
|
stringToVariant(m.WindowState),
|
|
stringToVariant(""), // FUTURE?
|
|
stringToVariant(m.WorkingDirectory),
|
|
stringToVariant(cmdline[1]),
|
|
stringToVariant(cmdline[0])); err != nil {
|
|
|
|
return fmt.Errorf("call %q: %w", method, err)
|
|
}
|
|
zerolog.Ctx(ctx).Info().Msg("Method call successful")
|
|
return
|
|
}
|