mirror of
https://github.com/mandiant/gopacket
synced 2026-06-21 13:57:02 +00:00
Jacob Paullus
8eea029431
The embedded gokrb5/v8 library hard-coded net.DialTimeout for AS/TGS
exchanges, bypassing -proxy and leaking the operator's source IP to the
KDC (UDP/88 first, TCP/88 fallback). The DCERPC Kerberos auth path used
a separate library (oiweiwei/gokrb5.fork/v9 via go-msrpc) that leaked the
same way.
Vendor jcmturner/gokrb5/v8 in-tree at pkg/third_party/gokrb5 with a
required KDCDialer first argument on every client constructor, so
proxy-bypass becomes a compile error. Wire kerberos.TransportKDCDialer
everywhere a gokrb5 client is built. Stamp udp_preference_limit=1 and
dns_lookup_kdc/realm=false unconditionally so KRB5 is TCP-only and the
OS resolver is never consulted; /etc/krb5.conf and $KRB5_CONFIG are
deliberately not read.
For DCERPC: set krbConfig.KDCDialer on every krb5.Config, pass
dcerpc.WithDialer(transport.ContextDialer{}) on every dcerpc.Dial, and
use the "ncacn_ip_tcp:" StringBinding prefix on the OXID-pivot dial so
go-msrpc's hard-coded pre-dial net.LookupIP is skipped (defers FQDN
resolution to the SOCKS5 proxy).
Verified against a live GOAD lab: 8 Kerberos-touching tools plus 5
NTLM/password/PtH regressions all operate through SOCKS5 with zero
direct packets to the AD subnet. Negative control (no -proxy)
immediately emits direct SYNs to the KDC, confirming both the leak
class and the fix.
90 lines
3.2 KiB
Go
90 lines
3.2 KiB
Go
// Package rfc3962 provides encryption and checksum methods as specified in RFC 3962
|
|
package rfc3962
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"errors"
|
|
"fmt"
|
|
|
|
"github.com/jcmturner/aescts/v2"
|
|
"github.com/mandiant/gopacket/pkg/third_party/gokrb5/crypto/common"
|
|
"github.com/mandiant/gopacket/pkg/third_party/gokrb5/crypto/etype"
|
|
)
|
|
|
|
// EncryptData encrypts the data provided using methods specific to the etype provided as defined in RFC 3962.
|
|
func EncryptData(key, data []byte, e etype.EType) ([]byte, []byte, error) {
|
|
if len(key) != e.GetKeyByteSize() {
|
|
return []byte{}, []byte{}, fmt.Errorf("incorrect keysize: expected: %v actual: %v", e.GetKeyByteSize(), len(key))
|
|
}
|
|
ivz := make([]byte, e.GetCypherBlockBitLength()/8)
|
|
return aescts.Encrypt(key, ivz, data)
|
|
}
|
|
|
|
// EncryptMessage encrypts the message provided using the methods specific to the etype provided as defined in RFC 3962.
|
|
// The encrypted data is concatenated with its integrity hash to create an encrypted message.
|
|
func EncryptMessage(key, message []byte, usage uint32, e etype.EType) ([]byte, []byte, error) {
|
|
if len(key) != e.GetKeyByteSize() {
|
|
return []byte{}, []byte{}, fmt.Errorf("incorrect keysize: expected: %v actual: %v", e.GetKeyByteSize(), len(key))
|
|
}
|
|
//confounder
|
|
c := make([]byte, e.GetConfounderByteSize())
|
|
_, err := rand.Read(c)
|
|
if err != nil {
|
|
return []byte{}, []byte{}, fmt.Errorf("could not generate random confounder: %v", err)
|
|
}
|
|
plainBytes := append(c, message...)
|
|
|
|
// Derive key for encryption from usage
|
|
var k []byte
|
|
if usage != 0 {
|
|
k, err = e.DeriveKey(key, common.GetUsageKe(usage))
|
|
if err != nil {
|
|
return []byte{}, []byte{}, fmt.Errorf("error deriving key for encryption: %v", err)
|
|
}
|
|
}
|
|
|
|
// Encrypt the data
|
|
iv, b, err := e.EncryptData(k, plainBytes)
|
|
if err != nil {
|
|
return iv, b, fmt.Errorf("error encrypting data: %v", err)
|
|
}
|
|
|
|
// Generate and append integrity hash
|
|
ih, err := common.GetIntegrityHash(plainBytes, key, usage, e)
|
|
if err != nil {
|
|
return iv, b, fmt.Errorf("error encrypting data: %v", err)
|
|
}
|
|
b = append(b, ih...)
|
|
return iv, b, nil
|
|
}
|
|
|
|
// DecryptData decrypts the data provided using the methods specific to the etype provided as defined in RFC 3962.
|
|
func DecryptData(key, data []byte, e etype.EType) ([]byte, error) {
|
|
if len(key) != e.GetKeyByteSize() {
|
|
return []byte{}, fmt.Errorf("incorrect keysize: expected: %v actual: %v", e.GetKeyByteSize(), len(key))
|
|
}
|
|
ivz := make([]byte, e.GetCypherBlockBitLength()/8)
|
|
return aescts.Decrypt(key, ivz, data)
|
|
}
|
|
|
|
// DecryptMessage decrypts the message provided using the methods specific to the etype provided as defined in RFC 3962.
|
|
// The integrity of the message is also verified.
|
|
func DecryptMessage(key, ciphertext []byte, usage uint32, e etype.EType) ([]byte, error) {
|
|
//Derive the key
|
|
k, err := e.DeriveKey(key, common.GetUsageKe(usage))
|
|
if err != nil {
|
|
return nil, fmt.Errorf("error deriving key: %v", err)
|
|
}
|
|
// Strip off the checksum from the end
|
|
b, err := e.DecryptData(k, ciphertext[:len(ciphertext)-e.GetHMACBitLength()/8])
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
//Verify checksum
|
|
if !e.VerifyIntegrity(key, ciphertext, b, usage) {
|
|
return nil, errors.New("integrity verification failed")
|
|
}
|
|
//Remove the confounder bytes
|
|
return b[e.GetConfounderByteSize():], nil
|
|
}
|