From 28097c26582bd378ed71a94f9e9101162184a7f0 Mon Sep 17 00:00:00 2001 From: Erik Geiser Date: Fri, 18 Jul 2025 08:52:52 +0200 Subject: [PATCH] dcerpcauth: Add option to disable SPNEGO --- dcerpcauth/dcerpcauth.go | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/dcerpcauth/dcerpcauth.go b/dcerpcauth/dcerpcauth.go index 9a819d5..b214a6e 100644 --- a/dcerpcauth/dcerpcauth.go +++ b/dcerpcauth/dcerpcauth.go @@ -37,6 +37,9 @@ type Options struct { // Debug can be set to enable debug output, for example with // adauth.NewDebugFunc(...). Debug func(string, ...any) + + // Use raw NTLM and Kerberos instead of wrapping it in SPNEGO. + DisableSPNEGO bool } func (opts *Options) debug(format string, a ...any) { @@ -63,7 +66,9 @@ func AuthenticationOptions( return nil, err } - dcerpcOptions = append(dcerpcOptions, dcerpc.WithMechanism(ssp.SPNEGO)) + if !upstreamOptions.DisableSPNEGO { + dcerpcOptions = append(dcerpcOptions, dcerpc.WithMechanism(ssp.SPNEGO)) + } switch { case target.UseKerberos || creds.ClientCert != nil: