mirror of
https://github.com/mandiant/gopacket
synced 2026-06-21 13:57:02 +00:00
Jacob Paullus
8eea029431
The embedded gokrb5/v8 library hard-coded net.DialTimeout for AS/TGS
exchanges, bypassing -proxy and leaking the operator's source IP to the
KDC (UDP/88 first, TCP/88 fallback). The DCERPC Kerberos auth path used
a separate library (oiweiwei/gokrb5.fork/v9 via go-msrpc) that leaked the
same way.
Vendor jcmturner/gokrb5/v8 in-tree at pkg/third_party/gokrb5 with a
required KDCDialer first argument on every client constructor, so
proxy-bypass becomes a compile error. Wire kerberos.TransportKDCDialer
everywhere a gokrb5 client is built. Stamp udp_preference_limit=1 and
dns_lookup_kdc/realm=false unconditionally so KRB5 is TCP-only and the
OS resolver is never consulted; /etc/krb5.conf and $KRB5_CONFIG are
deliberately not read.
For DCERPC: set krbConfig.KDCDialer on every krb5.Config, pass
dcerpc.WithDialer(transport.ContextDialer{}) on every dcerpc.Dial, and
use the "ncacn_ip_tcp:" StringBinding prefix on the OXID-pivot dial so
go-msrpc's hard-coded pre-dial net.LookupIP is skipped (defers FQDN
resolution to the SOCKS5 proxy).
Verified against a live GOAD lab: 8 Kerberos-touching tools plus 5
NTLM/password/PtH regressions all operate through SOCKS5 with zero
direct packets to the AD subnet. Negative control (no -proxy)
immediately emits direct SYNs to the KDC, confirming both the leak
class and the fix.
50 lines
2.5 KiB
Plaintext
50 lines
2.5 KiB
Plaintext
gopacket
|
|
Copyright 2026 Google LLC
|
|
|
|
This product is licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this product except in compliance with the License. You may
|
|
obtain a copy of the License in the LICENSE file distributed with this work, or
|
|
at http://www.apache.org/licenses/LICENSE-2.0.
|
|
|
|
------------------------------------------------------------------------------
|
|
Acknowledgments
|
|
------------------------------------------------------------------------------
|
|
|
|
This project is a Go reimplementation of concepts, protocols, tool designs,
|
|
and command-line interfaces from Impacket (https://github.com/fortra/impacket),
|
|
originally developed by SecureAuth Corporation and currently maintained by
|
|
Fortra. Impacket is distributed under its own permissive license. No Impacket
|
|
source code is included in this project; all code in this repository
|
|
(excluding the third-party components listed below) was written from scratch
|
|
in Go after studying Microsoft protocol specifications and Impacket's behavior.
|
|
|
|
Output formats and command-line flags of several tools in this project
|
|
intentionally mirror their Impacket counterparts to ease migration for
|
|
existing users. This functional compatibility does not constitute use of
|
|
Impacket's source code.
|
|
|
|
------------------------------------------------------------------------------
|
|
Third-Party Components
|
|
------------------------------------------------------------------------------
|
|
|
|
This product includes the following third-party software, each of which is
|
|
distributed under its own license. See the corresponding source files for
|
|
the full license text.
|
|
|
|
* pkg/third_party/smb2/
|
|
A vendored SMB2/SMB3 client library originally authored by Hiroshi Ioka
|
|
and contributors, distributed under the BSD 3-Clause License.
|
|
Upstream: https://github.com/hirochachacha/go-smb2
|
|
|
|
* pkg/third_party/gokrb5/
|
|
A vendored Kerberos 5 client library originally authored by Jonathan
|
|
Turner and contributors, distributed under the Apache License, Version
|
|
2.0. See pkg/third_party/gokrb5/LICENSE for the full text. The vendored
|
|
copy has been modified by this project: the gokrb5 client constructors
|
|
(NewWithPassword, NewWithKeytab, NewFromCCache) now require a KDCDialer
|
|
as their first argument, KDC TCP/UDP I/O routes through the supplied
|
|
dialer instead of net.DialTimeout, and unused subpackages (service/,
|
|
spnego/) have been removed. See the commit log and KNOWN_ISSUES.md for
|
|
the full change record.
|
|
Upstream: https://github.com/jcmturner/gokrb5
|