Allow NTLMInitiator with empty User/Password/Hash to establish an SMB
anonymous (null) session instead of refusing at dial time.
- client.go: drop the dial-time guard that rejected empty-user NTLM
initiators outright.
- internal/ntlm/client.go: add an anonymous AUTHENTICATE branch per
[MS-NLMP] 3.1.5.1.2 -- empty NtChallengeResponse, a single 0x00 byte
LmChallengeResponse, NTLMSSP_ANONYMOUS set, no MIC and no session key.
DomainName/UserName/Workstation are forced empty and the signing,
sealing and key-exchange flags are cleared (leaving KEY_EXCH set with a
zero-length EncryptedRandomSessionKey makes strict servers such as Samba
reject the bind with STATUS_INVALID_PARAMETER).
- initiator.go: nil-guard Sum/SessionKey/infoMap so the keyless anonymous
path cannot panic.
Verified against Samba: a server permitting null sessions accepts the
bind (logged as ANONYMOUS LOGON, S-1-5-7) and lists shares; a server with
restrict anonymous=2 fails gracefully via os.ErrPermission; authenticated
binds are unchanged.
Clears GHSA-f6x5-jh6r-wrfv (ssh/agent OOB panic) and GHSA-j5w8-q4qc-rx2x
(ssh unbounded memory). We only import x/crypto/md4 and x/crypto/pbkdf2,
so neither vuln is reachable from this repo, but bumping silences the
Dependabot alerts. x/net and x/text pulled forward by go mod tidy.
MS-DRSR 4.1.4.1.1 specifies structLen as the exact byte size, rounded
to a 4-byte boundary. Impacket carries a "+2" on top of the round-up
that no part of the spec or wire trace justifies; AD is forgiving in
practice but a stricter implementation could reject. Keep just the
alignment round, drop the unexplained 2 extra bytes.
This is the last open item from #32. Request-side change with no
parser-side regression detection, so it was held out of #33 pending
lab verification.
Verified end-to-end against the GOAD lab (sevenkingdoms.local forest
root + north.sevenkingdoms.local child domain): secretsdump
--just-dc-ntlm exercises DsBind, DsDomainControllerInfo, DsCrackNames,
and DsGetNCChanges in sequence and returns success on both domains.
Output is byte-for-byte identical to the pre-fix dumps captured before
removing the +2.
Closes#32.
Three of the four follow-ups in #32 from the PR #31 review pass:
1. Replace the loose maxReasonable (10M element) ceiling with a precise
per-call-site bounds check: every wire-driven make/Skip in the V6 parser
now validates count * elemSize against d.Remaining() before allocating,
so a malformed reply with a tiny payload and a huge embedded count can
no longer trigger a multi-MB speculative make for bytes that don't
actually exist on the wire. Product math is uint64 so it stays safe on
32-bit builds. CheckBounds lives on Decoder so other parsers can reach
for the same primitive.
2. firstRDNValue now actually unescapes RFC 4514 backslash sequences via
strings.Builder, so a DN like "CN=Smith\, John,OU=Foo" extracts to
"Smith, John" rather than "Smith\, John". Trailing-backslash (malformed)
drops silently. Table-driven tests cover the common cases.
3. Remove the dead writePartialAttrSet helper. writeGetNCChangesRequestV8
has always written a NULL referent for pPartialAttrSet, so the function
was never reached.
Item #3 of the issue (writeDSNAME structLen += 2 cargo-cult) is deferred:
it's request-side, so there's no parser-side regression detection, and
needs positive lab confirmation across DsBind/DsCrackNames/DsGetNCChanges/
DsGetDomainControllerInfo on both forest root and child domains before
flipping. Filed for a separate PR.
Verified end-to-end against the GOAD lab (sevenkingdoms.local forest root
+ north.sevenkingdoms.local child domain): full --just-dc-ntlm and
--just-dc --history runs both return all accounts with correct NTLM
hashes, hash histories, and parsed Kerberos keys.
skipUpToDateVectorV2 was missing the Align(8) pad between the hoisted
MaxCount conformance and the struct's fixed fields. UPTODATE_VECTOR_V1/V2
cursors contain LONGLONG fields (USN, DSTIME), so the struct's alignment
is 8; NDR demands the struct alignment is applied AFTER MaxCount (which
uses its own primitive 4-byte alignment), before the first struct field.
This is the same correctness pattern PR #16 (commit 8127aec) enumerated
for PROPERTY_META_DATA_EXT_VECTOR -- it was missed for UPTODATE_VECTOR.
PR #16's verification ran against sevenkingdoms.local (forest root)
where the response's DSNAME ends at pos 260 (%8 == 4), so the post-
MaxCount position landed at 264 -- already 8-aligned. Align(8) was a
no-op and the miss was invisible. north.sevenkingdoms.local's longer
DN puts post-MaxCount at 284 (%8 == 4), where the missing pad drops 4
bytes; the parser then misreads cNumCursors as 0, skips zero cursor
bytes instead of the real 32-byte cursor, and walks into garbage in the
prefix-table deferred data. Result: zero accounts emitted, no error
surfaced (V6 parse errors are swallowed unless -debug is on).
Verified against a live GOAD lab: 18/18 NTDS hashes on
north.sevenkingdoms.local now match impacket-secretsdump byte-for-byte,
17/17 on sevenkingdoms.local still match PR #16's original verification.
Bundles a sweep of related correctness and hardening issues surfaced
during the fix:
- skipUpToDateVectorV2 and readPrefixTableV2 now use the wire MaxCount
(the authoritative NDR field for array layout) instead of the in-
struct cNumCursors/cNumPrefixes. The two agree on any well-formed
reply, but the wire value dictates stream position; trusting it
keeps the cursor aligned on malformed input.
- readREPLENTINFLISTArrayV2 now early-terminates when pNextEntInf is
0. REPLENTINFLIST is structurally a linked list per MS-DRSR; the
pointer chain terminator is the structural truth, not cNumObjects.
- Deferred-data reads are now gated only on the pointer referent
being non-zero, never on a sibling inline count. NDR serializes a
4-byte MaxCount==0 for a non-null pointer to an empty array; the
old "pointer AND count > 0" gating dropped that read and drifted.
- Every helper that bails on a maxReasonable cap now calls a new
Decoder.Fail() helper so d.err is set and downstream Read*/Skip
calls become no-ops. The previous silent return left the cursor
unadvanced and downstream helpers read into the wrong data.
- SeekTo now respects the first-error-wins invariant by short-
circuiting when d.err is already set, so descriptive Fail() errors
aren't clobbered by a generic seek-range error in a later Skip.
- DSNAME and PROPERTY_META_DATA_EXT_VECTOR helpers now also enforce
the maxReasonable cap on count*size products that could overflow
int on 32-bit Go builds.
- readDSNAMEv2's RID extraction and processAttribute's RID extraction
for ATTID_objectSid now require sidLen >= 12 (rev + subAuthCount +
idAuth + at least 1 SubAuthority). At sidLen == 8 the "last 4 bytes"
is the tail of IdentifierAuthority, not a RID, and would produce
bogus DES keys for password decryption.
- DN-to-SAMAccountName fallback now uses a backslash-aware RDN split
and a case-insensitive "CN=" prefix check.
Closes#28.
Two compounding bugs in wmiexec / atexec / smbexec / dcomexec made
the output-retrieval loop return early on any command that didn't
finish within the first 100ms poll, leaking the temp file in ADMIN$
/ C$. Issue #22 reports the symptom for wmiexec (systeminfo, ping);
the same broken pattern existed in all four tools.
1. Wrong call site. The polling loop treated a sharing-violation
on smbClient.Cat as the signal "command still running." Cat
opens with FILE_SHARE_READ-compatible access — it succeeds
against the writer on the first poll and returns the file as
it currently exists (typically empty). The conflict actually
lives on Rm: deleting the file requires DELETE access, which
conflicts with the writer's share mode. Moved the sharing-
violation check from Cat to Rm. Matches Impacket's wmiexec.py.
2. Dead string match. The check was
strings.Contains(err.Error(), "STATUS_SHARING_VIOLATION"). The
underlying smb2 library's NtStatus.Error() returns only the
human-readable description ("A file cannot be opened because
the share access flags are incompatible.") — the literal
constant name never appears in err.Error(), so the check could
never fire. Same issue for STATUS_OBJECT_NAME_NOT_FOUND in the
not-found branch (further muddled by smb2/conn.go translating
that NTSTATUS to os.ErrNotExist before wrapping).
Added typed helpers in pkg/smb (IsSharingViolation, IsNotFound)
that unwrap through *os.PathError and match on
*smb2.ResponseError.Code plus the os.ErrNotExist sentinel.
NTSTATUS values are hardcoded since the smb2/internal/erref
package can't be imported from outside the smb2 tree.
The dcomexec "broken / connection reset / use of closed" branch
stays string-matched — those errors come from net, not smb2.
Thanks to @aimogging in #22 for the diagnosis and proof-of-concept
in #29; this change applies the same Cat-vs-Rm insight across all
four exec tools and replaces the err.Error() substring matching
with typed-error helpers so future smb2 library changes don't
silently break the check again.
Verified against GOAD winterfell: wmiexec whoami / systeminfo /
ping -n 4 1.1.1.1 all return full output, exit 0, no ADMIN$
residue, both directly from the operator box and over SOCKS5H
proxy.
Cover the GetValueData guard added in the previous commit with two
table-driven tests: the rejection path (dataLen ∈ {5, 8, 0xFF,
0x7FFFFFFF} with resident bit set) confirms the guard fires without
panicking and surfaces a helpful error; the happy path (dataLen ∈
{1, 2, 3, 4}) confirms the inline DataOffset bytes are returned
correctly so the guard didn't regress valid hives.
The matching guards in SetValueData (resident + non-resident write
paths) and enumSubKeys (riSig branch) require full NK/VK/sub-list
hive synthesis to exercise end-to-end; they're structurally identical
to the read-path guard and are validated by build/vet plus the lab
regression check on secretsdump. Worth a follow-up to extend the
synth helpers and cover them directly.
Four parser-panic / silent-corruption bugs in pkg/registry/hive.go,
all reachable from attacker-controlled hive bytes:
1. GetValueData resident branch: VKRecord.DataLen lower 31 bits are
read verbatim and used to slice a 4-byte buffer at [:dataLen]. A
DataLen of 0x80000005 panics with "slice bounds out of range".
Found by kajaaz using Zorya (issue #25); fix matches her suggested
one-line bounds check.
2. SetValueData resident branch (structurally identical to #1): the
existing len(newData) == dataLen check doesn't enforce the 4-byte
cap, so a hostile dataLen=5 with a matching 5-byte newData slices
one byte past the DataOffset field into the adjacent cell. Same
guard.
3. SetValueData non-resident branch: vk.DataOffset is attacker-
controlled and the code does copy(h.data[dataPos:dataPos+dataLen],
newData) without ever validating the destination. Hostile offsets
either panic on out-of-bounds or silently scribble over arbitrary
hive bytes (a value of 0xFFFFF000 lands near the regf header). Route
through readCell (which validates the cell header and bounds) and
verify dataLen fits before mutating.
4. enumSubKeys riSig branch: readCell can return a slice shorter than
the 4-byte cell header (minimum-size cell with no usable bytes), so
the immediate subCell[0:2] / subCell[2:4] reads can panic on a
malformed sub-list. The sibling code at line 397/437 already guards
the analogous index; mirror it here.
Fixes#25 plus three structurally similar bugs surfaced while patching.
The embedded gokrb5/v8 library hard-coded net.DialTimeout for AS/TGS
exchanges, bypassing -proxy and leaking the operator's source IP to the
KDC (UDP/88 first, TCP/88 fallback). The DCERPC Kerberos auth path used
a separate library (oiweiwei/gokrb5.fork/v9 via go-msrpc) that leaked the
same way.
Vendor jcmturner/gokrb5/v8 in-tree at pkg/third_party/gokrb5 with a
required KDCDialer first argument on every client constructor, so
proxy-bypass becomes a compile error. Wire kerberos.TransportKDCDialer
everywhere a gokrb5 client is built. Stamp udp_preference_limit=1 and
dns_lookup_kdc/realm=false unconditionally so KRB5 is TCP-only and the
OS resolver is never consulted; /etc/krb5.conf and $KRB5_CONFIG are
deliberately not read.
For DCERPC: set krbConfig.KDCDialer on every krb5.Config, pass
dcerpc.WithDialer(transport.ContextDialer{}) on every dcerpc.Dial, and
use the "ncacn_ip_tcp:" StringBinding prefix on the OXID-pivot dial so
go-msrpc's hard-coded pre-dial net.LookupIP is skipped (defers FQDN
resolution to the SOCKS5 proxy).
Verified against a live GOAD lab: 8 Kerberos-touching tools plus 5
NTLM/password/PtH regressions all operate through SOCKS5 with zero
direct packets to the AD subnet. Negative control (no -proxy)
immediately emits direct SYNs to the KDC, confirming both the leak
class and the fix.
When AceSize is less than 8, the fixed 4-byte header plus 4-byte Mask
are not contained in the ACE. The existing len(data) < aceSize check
passes (len(data) may be >= 8) but later slices like data[4:8] and
data[offset:aceSize] panic with 'slice bounds out of range'.
Fixes#23.
After a successful relay samdump/secretsdump the deferred
restoreRemoteRegistryState tried to CreatePipe("svcctl") and got
STATUS_OBJECT_NAME_NOT_FOUND (0xc0000034). The attack downloads its
hives from ADMIN$ before returning, which switches the SMB session's
tree away from IPC$, and svcctl lives on IPC$.
Fixed by re-TreeConnect'ing to IPC$ at the top of
restoreRemoteRegistryState. The function is now tree-state-agnostic
and safe to invoke from any defer position without coupling to the
attack's tree management.
Verified live against GOAD srv02 with RemoteRegistry set to
Stopped+Manual and eddard.stark relayed via net use: attack
auto-starts the service, dumps SAM hashes, then cleanup stops the
service and srv02's final state is Stopped+Manual again (was
Running+Manual before this fix).
Two entries in KNOWN_ISSUES.md described the relay samdump/secretsdump
attacks as broken in ways they aren't, or fixable in ways we hadn't
tried. Verified both live against GOAD and retired them.
KNOWN_ISSUES #1 ("SMB Relay Registry Access Denied")
Reproduced by coercing WINTERFELL$ via PetitPotam to relay-samdump
against srv02: BaseRegOpenKey(SYSTEM\Select) returns 0x00000005 as
documented. Then reproduced the documented "workaround works" direction
with NORTH\administrator direct auth (dumps cleanly). Then the test
the entry never tried: relayed a user with admin on the target via
cmd /c net use \\relay\IPC$ /user:north\eddard.stark (Domain Admin) on
dc02, watched it flow through our relay to srv02. Result: dumped
Administrator, Guest, DefaultAccount, WDAGUtilityAccount, vagrant SAM
hashes cleanly.
So the relay transport does not drop privilege. The symptom the entry
captured was simply "relayed principal doesn't have admin on target",
which is the same precondition Impacket's ntlmrelayx samdump has, and
the same constraint a direct secretsdump has. Rewrote the entry to say
that plainly and flag the PetitPotam pitfall (DC$ machine accounts
aren't admin on member servers, so coercion-to-relay against member
servers with default inventory always hits this).
Small alignment-with-Impacket change while there: pkg/dcerpc/winreg/
remote.go and pkg/relay/secretsdump_attack.go now request
MAXIMUM_ALLOWED on the boot-key subkey opens instead of KEY_READ,
matching rrp.hBaseRegOpenKey's default in Impacket. KEY_READ demands
the full read bundle; MAXIMUM_ALLOWED returns a handle with whatever
the token actually has. Doesn't fix the ACCESS_DENIED on a no-admin
token, but reduces the surface for partial-access edge cases.
KNOWN_ISSUES #3 ("Intermittent PIPE_NOT_AVAILABLE on winreg")
Same failure mode the standalone secretsdump handles already: if
RemoteRegistry is stopped or disabled, opening the winreg named pipe
fails with STATUS_PIPE_NOT_AVAILABLE. Standalone tools/secretsdump
opens svcctl first, starts RemoteRegistry, runs the attack, then stops
the service (and restores SERVICE_DISABLED if it was disabled). The
relay path wasn't doing any of that.
Factored the "ensure started on entry / restore on exit" flow into
pkg/relay/remoteregistry.go and wired it into both relay samdump and
secretsdump attacks via TreeConnect("IPC$"), open svcctl, manage
RemoteRegistry, proceed with winreg. Failures to manage the service
are logged as warnings rather than returned as errors: if the relayed
token lacks SERVICE_* access, the attack still tries the winreg open
and often succeeds (if the service happens to be running already).
Verified live: set srv02 RemoteRegistry to Stopped+Manual, relayed
eddard.stark (Domain Admin via net use), watched:
[*] Service RemoteRegistry is in stopped state
[*] Starting service RemoteRegistry
[*] Target system bootKey: 0x...
[*] Dumping local SAM hashes
Administrator:500:...:...::: (etc)
[*] Cleanup complete
Cleanup's attempt to stop the service after dumping gets a
STATUS_OBJECT_NAME_NOT_FOUND (pipe was closed by the post-attack
session teardown); that warning is cosmetic. The service's start-type
was preserved (Manual), only its current state stayed Running. Leaving
that as a minor follow-up rather than blocking the fix.
KNOWN_ISSUES.md renumbered to reflect the two retirements.
readCell trusted the cell's size header without bounds-checking the
positive side, so any cell whose raw size field was 0 or a negative
value with absolute magnitude smaller than the 4-byte cell header
produced an inverted slice expression (h.data[pos+4 : pos+size] with
size < 4) and crashed the process. Reported as a runtime panic
`slice bounds out of range [5052:5048]` in secretsdump's cached
domain logon parse path.
Treat raw size >= 0 as free/invalid (return error) and require the
allocated size to be at least 4 bytes so the data slice is never
inverted. Regression test synthesizes a minimal hive with each of
the previously-panicking inputs.
Removes the now-resolved entry from KNOWN_ISSUES.md and renumbers
the remaining sections.
Rewrites the hand-rolled DRS_MSG_GETCHGREPLY_V6 parser as a declarative
NDR struct walker. The old parser used empirical byte offsets that were
wrong in several places and drifted out of alignment within the first few
REPLENTINFLIST entries, so secretsdump emitted zero NTDS hashes against
any modern DC (issue #9).
New files:
pkg/dcerpc/drsuapi/ndr.go - NDR Decoder primitives: alignment,
conformant arrays, pointer referents, UTF-16LE strings, GUIDs, with
a sticky error model so partial results survive downstream faults.
pkg/dcerpc/drsuapi/getncchanges_v6.go - V6/V7/V9 reply parser driven
by MS-DRSR struct definitions.
Correctness points that were wrong in the old parser:
1. V6 fixed header is 148 bytes, not 136. The old code omitted cNumValues
+ rgValues + dwDRSError and treated those 12 bytes as pNC's DSNAME.
2. DSNAME.StringName is a pure conformant array (NDRUniConformantArray),
not conformant-varying. No Offset/ActualCount between NameLen and the
WCHAR elements.
3. UPTODATE_VECTOR is V2_EXT on current DCs: 32-byte cursors (UUID + USN
+ DSTIME), not the V1 24-byte cursors the old parser hard-coded.
4. REPLENTINFLIST is serialized as a linked list via pNextEntInf. NDR
uses strict DFS through the first-encountered pointer in each struct,
which lays out all N fixed parts consecutively, then the non-pNext
deferreds (pName, pAttr, pParent, pMeta) unwind bottom-up - the
deepest node's appear first, the head's last. The parser iterates
captured headers in reverse to match.
5. PROPERTY_META_DATA_EXT_VECTOR alignment: the array's MaxCount is
hoisted to the front by NDR early conformance, but hoisted MaxCount
uses only its primitive (4-byte) alignment. The struct's 8-byte
alignment applies AFTER MaxCount, before cNumProps and the elements.
Getting this wrong drifted every entry whose prior pParent UUID
landed on a 4-aligned (non-8-aligned) position.
Verification against live GOAD sevenkingdoms.local DC: 17/17 NTDS
password hashes (Administrator, krbtgt, vagrant, KINGSLANDING\$, ESSOS\$,
NORTH\$, and all domain users) match impacket-secretsdump byte-for-byte.
Independent Python byte-level reference walker confirms the same 17
unicodePwd-bearing entries offline.
Also removes ~950 lines of the now-unreachable legacy V6 helpers
(parseGetNCChangesResponseV6, skipDSNAME, skipUpToDateVector,
skipPropertyMetaDataExtVector, parsePrefixTable, parseREPLENTINFLIST,
parseENTINF, findValidDSNAME, parseDSNAMEIntoObject, parseATTRBLOCK)
from getncchanges.go.
Closes#9.
Fixes#8. smbclient's interactive shell now supports list_snapshots,
which enumerates VSS shadow copies on the currently selected share
via FSCTL_SRV_ENUMERATE_SNAPSHOTS. Matches Impacket smbclient.py's
list_snapshots output format.
The response follows MS-SMB2 2.2.32 and requires a two-call size
probe: the first ioctl uses a 16-byte output buffer to read the
SRV_SNAPSHOT_ARRAY header (SnapShotArraySize tells us how large the
second buffer needs to be), then a second ioctl asks for the full
payload and parses the UTF-16LE NUL-separated @GMT-... tokens.
Changes:
- pkg/third_party/smb2/client.go: add an exported Ioctl method on
*File as a thin wrapper over the internal ioctl helper, so FSCTL
operations beyond FSCTL_PIPE_TRANSCEIVE don't need their own
dedicated method in the vendored library.
- pkg/smb/client.go: EnumerateSnapshots() method on *Client. Handles
the size-probe dance, parses the UTF-16LE token list via
pkg/utf16le, returns []string. Empty slice when no snapshots exist.
- tools/smbclient/main.go: wire list_snapshots into the shell's
command switch and help text.
Unblocks the VSS-based NTDS extraction path:
use c$
list_snapshots # get @GMT-YYYY.MM.DD-HH.MM.SS
get @GMT-...\Windows\NTDS\ntds.dit
secretsdump -ntds ntds.dit -system SYSTEM
Before this, 26 tools hardcoded the literal "gopacket vX.Y.Z-beta -
Copyright 2026 Google LLC" banner in print statements, totaling 34
occurrences across the tree. Every version bump meant updating the
same string 34 times.
Switches every tool to call flags.Banner(), which builds the banner
from flags.Version. The Version const in pkg/flags/flags.go is now
the single source of truth; future version bumps are a one-line
change.
Mechanical split:
- 3 common print patterns (fmt.Println, fmt.Fprintln os.Stderr,
fmt.Fprintf with trailing \n\n) swept with sed.
- 6 heredoc-style flag.Usage functions had the banner line on a
backtick-quoted format string. Each was split into a separate
fmt.Fprintln(os.Stderr, flags.Banner()) followed by the existing
Fprintf with the banner line trimmed off the format string.
- 9 tools needed a new pkg/flags import added.
- tools/describeTicket already imports github.com/jcmturner/gokrb5
/v8/iana/flags for Kerberos flag constants, so pkg/flags is aliased
as gopflags there to avoid the name collision.
Verified: go build, go vet, and go test ./pkg/transport/ all clean
under default, CGO_ENABLED=0, and GOOS=windows CGO_ENABLED=0. Spot-
checked -h output on samrdump, rpcmap, mssqlinstance, ping, and
describeTicket; each renders the banner identically to before.
The native install already renamed each tool to gopacket-<toolname>
before copying to /usr/local/bin, but the portable and windows cross-
compile targets dropped raw binaries like ping.exe, net.exe, reg.exe,
attrib.exe, services.exe into ./dist/. When a user copies one of those
to a Windows host and runs it from the same directory, cmd.exe's PATH
resolution picks up the local binary before the Windows built-in of
the same name, shadowing tools users rely on. The portable target on
Linux has the same risk for binaries named ping, net, etc.
Applies the same normalization (lowercase, underscores to hyphens)
and gopacket- prefix the native install already uses, but at build
time for the cross-compile targets. Native behavior is unchanged:
./bin/ still gets raw names so install_native can prefix on copy.
The Platform Support table already described the three build targets
but the Installation block still only showed the default invocation.
A reader could see that a windows target existed without knowing how
to actually build it. Adds example --target invocations for portable,
windows, and all, and softens the dependency paragraph since GCC and
libpcap are only required for the native target.
Extends the installer to produce CGO_ENABLED=0 static Linux binaries
and GOOS=windows .exe cross-compiles, not just the default native
cgo build. New flag:
--target native (default) Linux/macOS cgo + install (today's flow)
--target portable CGO_ENABLED=0, host OS, output to ./dist/portable/
--target windows GOOS=windows amd64, output to ./dist/windows/
--target all build every target in one run
When run with no --target and a TTY on stdin, the installer prints an
interactive menu that explains each target briefly (tool set, proxy
path, output location). Non-TTY invocations (CI, pipes) default
silently to native so existing automation keeps working unchanged.
Cross-compile targets never install to /usr/local/bin. They drop
binaries in ./dist/<target>/ for the user to copy to the right host.
The libpcap check and GCC check are now conditional: required for the
native target, skipped for portable/windows since those paths use
build-tag stubs for libpcap/raw-socket tools.
Replaces the "Linux/macOS only, use WSL on Windows" note with a
table showing the three supported build configurations (default cgo,
CGO_ENABLED=0 Linux, Windows), which tools are available in each,
and which proxy path works. Also drops a stray reference to a
specific KNOWN_ISSUES section number that will drift over time.
Enables clean builds under GOOS=windows CGO_ENABLED=0 and under
CGO_ENABLED=0 on Linux. The three tools that can't be built in those
configurations now substitute a stub that prints a clear message
and exits 1, so go build ./... succeeds across all target platforms.
- tools/sniff: tagged !windows && cgo (needs libpcap via cgo).
Stub (main_stub.go) covers windows || !cgo.
- tools/split: same tags as sniff (also pcap).
- tools/sniffer: tagged !windows (uses Unix raw sockets directly via
syscall, not cgo). Stub (main_windows.go) covers Windows.
Verified:
- go build ./... clean (default, cgo=1 Linux)
- CGO_ENABLED=0 go build ./... clean (portable Linux)
- GOOS=windows CGO_ENABLED=0 go build ./... clean (Windows)
- go vet clean across all three configurations
- All 13 pkg/transport tests pass under CGO_ENABLED=0, confirming
direct_portable.go's directDial path is correct.
Fixes#6. The module was declared as `module gopacket` in go.mod,
which is not a canonical import path. External projects could not
`go get github.com/mandiant/gopacket` to use any of the 24
protocol packages as a library; the only workaround was to clone
the repo and add a `replace` directive to their own go.mod.
This commit:
- Sets `module github.com/mandiant/gopacket` in go.mod.
- Rewrites 434 import statements across 157 files from the bare
`gopacket/...` prefix to `github.com/mandiant/gopacket/...`.
Pure mechanical change, no behavior difference. Makes the README's
library story (pkg/ directory, 24 reusable packages) actually
usable from external code.
Bumps the version string across pkg/flags and all tool banners to
v0.1.1-beta. Marks the first feature release after the initial beta
(adds the -proxy socks flag and UDP-under-proxy guard landing in
this PR).
Note: the version string is currently duplicated 34 times across 27
tool binaries and flags.go. A follow-up PR should refactor every
tool to call flags.Banner() instead of hardcoding the literal, so
future bumps are one-line changes.
- README.md: expand "Proxychains Support" into "Proxy Support" with
two subsections (proxychains via LD_PRELOAD, and the new -proxy
SOCKS5 flag). Adds -proxy to the Common Flags table, adds a quick
example, and updates the final Notes line so "all tools work
through proxychains" also covers -proxy.
- KNOWN_ISSUES.md: add entry #8 "UDP Features Disabled Under -proxy"
with a table mapping affected tools to concrete workarounds
(supply -port directly, pass -dc-host / -dc-ip / -target-ip,
supply -parent-dc). Renumbers "Remaining Gaps" to #9.
Four tools register their flags directly via the stdlib flag package
rather than going through flags.Parse, so they didn't inherit -proxy
and transport.Configure was never called (silent no-op for the user).
Wires each to flags.RegisterProxyFlag, a two-line integration that
registers -proxy and returns a finalizer to call after flag.Parse():
- tools/CheckLDAPStatus
- tools/DumpNTLMInfo
- tools/rpcmap (also adds the pkg/flags import)
- tools/mssqlinstance (also adds the pkg/flags import; -proxy will
immediately error with ErrUDPUnderProxy since the tool's whole job
is a UDP SQL Browser probe, but the error is surfaced clearly
instead of silently bypassing)
Four tools that already used flags.Parse (and therefore already had
-proxy registered transparently) still reached out via net.Dial* or
ran DNS resolution past the proxy. Migrate the network calls:
- tools/GetADComputers: custom net.Resolver now dials via
transport.DialContext, so UDP DNS through the DC surfaces
ErrUDPUnderProxy cleanly rather than bypassing -proxy.
- tools/changepasswd: kpasswd TCP dial now uses transport.DialTimeout.
- tools/smbexec: getLocalIP() short-circuits when
transport.IsProxyConfigured(). The "dial UDP to find the local
source address" trick has no meaning when traffic flows through a
SOCKS5 proxy.
- tools/raiseChild: the DNS forest-FQDN fallback (net.LookupHost) is
skipped under -proxy with a message pointing the user to -parent-dc,
since net.LookupHost goes to the OS resolver and would leak DNS.
- pkg/relay/http_client.go, winrm_client.go: swap the http.Transport
DialContext from &net.Dialer{Timeout: 10s}.DialContext to a closure
that calls transport.DialContext. NTLM relay now respects -proxy.
- pkg/relay/socks.go: add a comment on the HTTP DNS passthrough path
explaining why it intentionally uses net.DialTimeout rather than
transport. That path is the outbound leg of our own SOCKS5 server,
so routing it through -proxy would double-tunnel the operator's
proxy through the operator's proxy.
- pkg/tds/sqlr.go: SQL Server Browser discovery (UDP 1434) now uses
transport.DialUDP, which surfaces ErrUDPUnderProxy when a proxy is
configured rather than silently bypassing it.
Jacob Paullus