mirror of
https://github.com/mandiant/gopacket
synced 2026-06-21 13:57:02 +00:00
Jacob Paullus
8eea029431
The embedded gokrb5/v8 library hard-coded net.DialTimeout for AS/TGS
exchanges, bypassing -proxy and leaking the operator's source IP to the
KDC (UDP/88 first, TCP/88 fallback). The DCERPC Kerberos auth path used
a separate library (oiweiwei/gokrb5.fork/v9 via go-msrpc) that leaked the
same way.
Vendor jcmturner/gokrb5/v8 in-tree at pkg/third_party/gokrb5 with a
required KDCDialer first argument on every client constructor, so
proxy-bypass becomes a compile error. Wire kerberos.TransportKDCDialer
everywhere a gokrb5 client is built. Stamp udp_preference_limit=1 and
dns_lookup_kdc/realm=false unconditionally so KRB5 is TCP-only and the
OS resolver is never consulted; /etc/krb5.conf and $KRB5_CONFIG are
deliberately not read.
For DCERPC: set krbConfig.KDCDialer on every krb5.Config, pass
dcerpc.WithDialer(transport.ContextDialer{}) on every dcerpc.Dial, and
use the "ncacn_ip_tcp:" StringBinding prefix on the OXID-pivot dial so
go-msrpc's hard-coded pre-dial net.LookupIP is skipped (defers FQDN
resolution to the SOCKS5 proxy).
Verified against a live GOAD lab: 8 Kerberos-touching tools plus 5
NTLM/password/PtH regressions all operate through SOCKS5 with zero
direct packets to the AD subnet. Negative control (no -proxy)
immediately emits direct SYNs to the KDC, confirming both the leak
class and the fix.
68 lines
1.6 KiB
Go
68 lines
1.6 KiB
Go
// Package krberror provides error type and functions for gokrb5.
|
|
package krberror
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
)
|
|
|
|
// Error type descriptions.
|
|
const (
|
|
separator = " < "
|
|
EncodingError = "Encoding_Error"
|
|
NetworkingError = "Networking_Error"
|
|
DecryptingError = "Decrypting_Error"
|
|
EncryptingError = "Encrypting_Error"
|
|
ChksumError = "Checksum_Error"
|
|
KRBMsgError = "KRBMessage_Handling_Error"
|
|
ConfigError = "Configuration_Error"
|
|
KDCError = "KDC_Error"
|
|
)
|
|
|
|
// Krberror is an error type for gokrb5
|
|
type Krberror struct {
|
|
RootCause string
|
|
EText []string
|
|
}
|
|
|
|
// Error function to implement the error interface.
|
|
func (e Krberror) Error() string {
|
|
return fmt.Sprintf("[Root cause: %s] ", e.RootCause) + strings.Join(e.EText, separator)
|
|
}
|
|
|
|
// Add another error statement to the error.
|
|
func (e *Krberror) Add(et string, s string) {
|
|
e.EText = append([]string{fmt.Sprintf("%s: %s", et, s)}, e.EText...)
|
|
}
|
|
|
|
// New creates a new instance of Krberror.
|
|
func New(et, s string) Krberror {
|
|
return Krberror{
|
|
RootCause: et,
|
|
EText: []string{s},
|
|
}
|
|
}
|
|
|
|
// Errorf appends to or creates a new Krberror.
|
|
func Errorf(err error, et, format string, a ...interface{}) Krberror {
|
|
if e, ok := err.(Krberror); ok {
|
|
e.Add(et, fmt.Sprintf(format, a...))
|
|
return e
|
|
}
|
|
return NewErrorf(et, format+": %s", append(a, err)...)
|
|
}
|
|
|
|
// NewErrorf creates a new Krberror from a formatted string.
|
|
func NewErrorf(et, format string, a ...interface{}) Krberror {
|
|
var s string
|
|
if len(a) > 0 {
|
|
s = fmt.Sprintf("%s: %s", et, fmt.Sprintf(format, a...))
|
|
} else {
|
|
s = fmt.Sprintf("%s: %s", et, format)
|
|
}
|
|
return Krberror{
|
|
RootCause: et,
|
|
EText: []string{s},
|
|
}
|
|
}
|