admin/mandiant-gopacket
1
0
Fork 0
mirror of https://github.com/mandiant/gopacket synced 2026-06-21 13:57:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

drsuapi: drop writeDSNAME structLen +2 cargo-cult

Browse Source 
MS-DRSR 4.1.4.1.1 specifies structLen as the exact byte size, rounded
to a 4-byte boundary. Impacket carries a "+2" on top of the round-up
that no part of the spec or wire trace justifies; AD is forgiving in
practice but a stricter implementation could reject. Keep just the
alignment round, drop the unexplained 2 extra bytes.

This is the last open item from #32. Request-side change with no
parser-side regression detection, so it was held out of #33 pending
lab verification.

Verified end-to-end against the GOAD lab (sevenkingdoms.local forest
root + north.sevenkingdoms.local child domain): secretsdump
--just-dc-ntlm exercises DsBind, DsDomainControllerInfo, DsCrackNames,
and DsGetNCChanges in sequence and returns success on both domains.
Output is byte-for-byte identical to the pre-fix dumps captured before
removing the +2.

Closes #32.
This commit is contained in:
Jacob Paullus
2026-05-12 18:26:55 -05:00
parent 56c26e89cc
commit cebc5749ef
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/dcerpc/drsuapi/getncchanges.go
+4 -3
View File
@@ -246,14 +246,15 @@ func writeDSNAME(buf *bytes.Buffer, nameOrGUID string) {
// Calculate structLen: the size of the entire DSNAME structure
// structLen(4) + SidLen(4) + Guid(16) + Sid(28) + NameLen(4) + StringName((nameLen+1)*2)
// MS-DRSR 4.1.4.1.1 specifies structLen as the exact byte size, rounded
// to a 4-byte boundary. Impacket carries a "+2" on top of the round-up
// that no part of the spec or wire trace justifies; AD is forgiving but
// a stricter implementation would reject. Keep just the alignment round.
stringNameBytes := charCount * 2
structLen := uint32(4 + 4 + 16 + 28 + 4 + stringNameBytes)
// Align to 4-byte boundary for the structure size
if structLen%4 != 0 {
structLen += 4 - (structLen % 4)
}
// Per Impacket, add 2 more bytes (possibly for additional alignment)
structLen += 2
// Track start for final alignment
startOffset := buf.Len()