After a successful relay samdump/secretsdump the deferred
restoreRemoteRegistryState tried to CreatePipe("svcctl") and got
STATUS_OBJECT_NAME_NOT_FOUND (0xc0000034). The attack downloads its
hives from ADMIN$ before returning, which switches the SMB session's
tree away from IPC$, and svcctl lives on IPC$.
Fixed by re-TreeConnect'ing to IPC$ at the top of
restoreRemoteRegistryState. The function is now tree-state-agnostic
and safe to invoke from any defer position without coupling to the
attack's tree management.
Verified live against GOAD srv02 with RemoteRegistry set to
Stopped+Manual and eddard.stark relayed via net use: attack
auto-starts the service, dumps SAM hashes, then cleanup stops the
service and srv02's final state is Stopped+Manual again (was
Running+Manual before this fix).
psycep
cd8463346c