Two compounding bugs in wmiexec / atexec / smbexec / dcomexec made
the output-retrieval loop return early on any command that didn't
finish within the first 100ms poll, leaking the temp file in ADMIN$
/ C$. Issue #22 reports the symptom for wmiexec (systeminfo, ping);
the same broken pattern existed in all four tools.
1. Wrong call site. The polling loop treated a sharing-violation
on smbClient.Cat as the signal "command still running." Cat
opens with FILE_SHARE_READ-compatible access — it succeeds
against the writer on the first poll and returns the file as
it currently exists (typically empty). The conflict actually
lives on Rm: deleting the file requires DELETE access, which
conflicts with the writer's share mode. Moved the sharing-
violation check from Cat to Rm. Matches Impacket's wmiexec.py.
2. Dead string match. The check was
strings.Contains(err.Error(), "STATUS_SHARING_VIOLATION"). The
underlying smb2 library's NtStatus.Error() returns only the
human-readable description ("A file cannot be opened because
the share access flags are incompatible.") — the literal
constant name never appears in err.Error(), so the check could
never fire. Same issue for STATUS_OBJECT_NAME_NOT_FOUND in the
not-found branch (further muddled by smb2/conn.go translating
that NTSTATUS to os.ErrNotExist before wrapping).
Added typed helpers in pkg/smb (IsSharingViolation, IsNotFound)
that unwrap through *os.PathError and match on
*smb2.ResponseError.Code plus the os.ErrNotExist sentinel.
NTSTATUS values are hardcoded since the smb2/internal/erref
package can't be imported from outside the smb2 tree.
The dcomexec "broken / connection reset / use of closed" branch
stays string-matched — those errors come from net, not smb2.
Thanks to @aimogging in #22 for the diagnosis and proof-of-concept
in #29; this change applies the same Cat-vs-Rm insight across all
four exec tools and replaces the err.Error() substring matching
with typed-error helpers so future smb2 library changes don't
silently break the check again.
Verified against GOAD winterfell: wmiexec whoami / systeminfo /
ping -n 4 1.1.1.1 all return full output, exit 0, no ADMIN$
residue, both directly from the operator box and over SOCKS5H
proxy.
The embedded gokrb5/v8 library hard-coded net.DialTimeout for AS/TGS
exchanges, bypassing -proxy and leaking the operator's source IP to the
KDC (UDP/88 first, TCP/88 fallback). The DCERPC Kerberos auth path used
a separate library (oiweiwei/gokrb5.fork/v9 via go-msrpc) that leaked the
same way.
Vendor jcmturner/gokrb5/v8 in-tree at pkg/third_party/gokrb5 with a
required KDCDialer first argument on every client constructor, so
proxy-bypass becomes a compile error. Wire kerberos.TransportKDCDialer
everywhere a gokrb5 client is built. Stamp udp_preference_limit=1 and
dns_lookup_kdc/realm=false unconditionally so KRB5 is TCP-only and the
OS resolver is never consulted; /etc/krb5.conf and $KRB5_CONFIG are
deliberately not read.
For DCERPC: set krbConfig.KDCDialer on every krb5.Config, pass
dcerpc.WithDialer(transport.ContextDialer{}) on every dcerpc.Dial, and
use the "ncacn_ip_tcp:" StringBinding prefix on the OXID-pivot dial so
go-msrpc's hard-coded pre-dial net.LookupIP is skipped (defers FQDN
resolution to the SOCKS5 proxy).
Verified against a live GOAD lab: 8 Kerberos-touching tools plus 5
NTLM/password/PtH regressions all operate through SOCKS5 with zero
direct packets to the AD subnet. Negative control (no -proxy)
immediately emits direct SYNs to the KDC, confirming both the leak
class and the fix.
Fixes#8. smbclient's interactive shell now supports list_snapshots,
which enumerates VSS shadow copies on the currently selected share
via FSCTL_SRV_ENUMERATE_SNAPSHOTS. Matches Impacket smbclient.py's
list_snapshots output format.
The response follows MS-SMB2 2.2.32 and requires a two-call size
probe: the first ioctl uses a 16-byte output buffer to read the
SRV_SNAPSHOT_ARRAY header (SnapShotArraySize tells us how large the
second buffer needs to be), then a second ioctl asks for the full
payload and parses the UTF-16LE NUL-separated @GMT-... tokens.
Changes:
- pkg/third_party/smb2/client.go: add an exported Ioctl method on
*File as a thin wrapper over the internal ioctl helper, so FSCTL
operations beyond FSCTL_PIPE_TRANSCEIVE don't need their own
dedicated method in the vendored library.
- pkg/smb/client.go: EnumerateSnapshots() method on *Client. Handles
the size-probe dance, parses the UTF-16LE token list via
pkg/utf16le, returns []string. Empty slice when no snapshots exist.
- tools/smbclient/main.go: wire list_snapshots into the shell's
command switch and help text.
Unblocks the VSS-based NTDS extraction path:
use c$
list_snapshots # get @GMT-YYYY.MM.DD-HH.MM.SS
get @GMT-...\Windows\NTDS\ntds.dit
secretsdump -ntds ntds.dit -system SYSTEM
Before this, 26 tools hardcoded the literal "gopacket vX.Y.Z-beta -
Copyright 2026 Google LLC" banner in print statements, totaling 34
occurrences across the tree. Every version bump meant updating the
same string 34 times.
Switches every tool to call flags.Banner(), which builds the banner
from flags.Version. The Version const in pkg/flags/flags.go is now
the single source of truth; future version bumps are a one-line
change.
Mechanical split:
- 3 common print patterns (fmt.Println, fmt.Fprintln os.Stderr,
fmt.Fprintf with trailing \n\n) swept with sed.
- 6 heredoc-style flag.Usage functions had the banner line on a
backtick-quoted format string. Each was split into a separate
fmt.Fprintln(os.Stderr, flags.Banner()) followed by the existing
Fprintf with the banner line trimmed off the format string.
- 9 tools needed a new pkg/flags import added.
- tools/describeTicket already imports github.com/jcmturner/gokrb5
/v8/iana/flags for Kerberos flag constants, so pkg/flags is aliased
as gopflags there to avoid the name collision.
Verified: go build, go vet, and go test ./pkg/transport/ all clean
under default, CGO_ENABLED=0, and GOOS=windows CGO_ENABLED=0. Spot-
checked -h output on samrdump, rpcmap, mssqlinstance, ping, and
describeTicket; each renders the banner identically to before.
Enables clean builds under GOOS=windows CGO_ENABLED=0 and under
CGO_ENABLED=0 on Linux. The three tools that can't be built in those
configurations now substitute a stub that prints a clear message
and exits 1, so go build ./... succeeds across all target platforms.
- tools/sniff: tagged !windows && cgo (needs libpcap via cgo).
Stub (main_stub.go) covers windows || !cgo.
- tools/split: same tags as sniff (also pcap).
- tools/sniffer: tagged !windows (uses Unix raw sockets directly via
syscall, not cgo). Stub (main_windows.go) covers Windows.
Verified:
- go build ./... clean (default, cgo=1 Linux)
- CGO_ENABLED=0 go build ./... clean (portable Linux)
- GOOS=windows CGO_ENABLED=0 go build ./... clean (Windows)
- go vet clean across all three configurations
- All 13 pkg/transport tests pass under CGO_ENABLED=0, confirming
direct_portable.go's directDial path is correct.
Fixes#6. The module was declared as `module gopacket` in go.mod,
which is not a canonical import path. External projects could not
`go get github.com/mandiant/gopacket` to use any of the 24
protocol packages as a library; the only workaround was to clone
the repo and add a `replace` directive to their own go.mod.
This commit:
- Sets `module github.com/mandiant/gopacket` in go.mod.
- Rewrites 434 import statements across 157 files from the bare
`gopacket/...` prefix to `github.com/mandiant/gopacket/...`.
Pure mechanical change, no behavior difference. Makes the README's
library story (pkg/ directory, 24 reusable packages) actually
usable from external code.
Bumps the version string across pkg/flags and all tool banners to
v0.1.1-beta. Marks the first feature release after the initial beta
(adds the -proxy socks flag and UDP-under-proxy guard landing in
this PR).
Note: the version string is currently duplicated 34 times across 27
tool binaries and flags.go. A follow-up PR should refactor every
tool to call flags.Banner() instead of hardcoding the literal, so
future bumps are one-line changes.
Four tools register their flags directly via the stdlib flag package
rather than going through flags.Parse, so they didn't inherit -proxy
and transport.Configure was never called (silent no-op for the user).
Wires each to flags.RegisterProxyFlag, a two-line integration that
registers -proxy and returns a finalizer to call after flag.Parse():
- tools/CheckLDAPStatus
- tools/DumpNTLMInfo
- tools/rpcmap (also adds the pkg/flags import)
- tools/mssqlinstance (also adds the pkg/flags import; -proxy will
immediately error with ErrUDPUnderProxy since the tool's whole job
is a UDP SQL Browser probe, but the error is surfaced clearly
instead of silently bypassing)
Four tools that already used flags.Parse (and therefore already had
-proxy registered transparently) still reached out via net.Dial* or
ran DNS resolution past the proxy. Migrate the network calls:
- tools/GetADComputers: custom net.Resolver now dials via
transport.DialContext, so UDP DNS through the DC surfaces
ErrUDPUnderProxy cleanly rather than bypassing -proxy.
- tools/changepasswd: kpasswd TCP dial now uses transport.DialTimeout.
- tools/smbexec: getLocalIP() short-circuits when
transport.IsProxyConfigured(). The "dial UDP to find the local
source address" trick has no meaning when traffic flows through a
SOCKS5 proxy.
- tools/raiseChild: the DNS forest-FQDN fallback (net.LookupHost) is
skipped under -proxy with a message pointing the user to -parent-dc,
since net.LookupHost goes to the OS resolver and would leak DNS.
Jacob Paullus