mirror of
https://github.com/mandiant/gopacket
synced 2026-06-21 13:57:02 +00:00
Jacob Paullus
8eea029431
The embedded gokrb5/v8 library hard-coded net.DialTimeout for AS/TGS
exchanges, bypassing -proxy and leaking the operator's source IP to the
KDC (UDP/88 first, TCP/88 fallback). The DCERPC Kerberos auth path used
a separate library (oiweiwei/gokrb5.fork/v9 via go-msrpc) that leaked the
same way.
Vendor jcmturner/gokrb5/v8 in-tree at pkg/third_party/gokrb5 with a
required KDCDialer first argument on every client constructor, so
proxy-bypass becomes a compile error. Wire kerberos.TransportKDCDialer
everywhere a gokrb5 client is built. Stamp udp_preference_limit=1 and
dns_lookup_kdc/realm=false unconditionally so KRB5 is TCP-only and the
OS resolver is never consulted; /etc/krb5.conf and $KRB5_CONFIG are
deliberately not read.
For DCERPC: set krbConfig.KDCDialer on every krb5.Config, pass
dcerpc.WithDialer(transport.ContextDialer{}) on every dcerpc.Dial, and
use the "ncacn_ip_tcp:" StringBinding prefix on the OXID-pivot dial so
go-msrpc's hard-coded pre-dial net.LookupIP is skipped (defers FQDN
resolution to the SOCKS5 proxy).
Verified against a live GOAD lab: 8 Kerberos-touching tools plus 5
NTLM/password/PtH regressions all operate through SOCKS5 with zero
direct packets to the AD subnet. Negative control (no -proxy)
immediately emits direct SYNs to the KDC, confirming both the leak
class and the fix.
37 lines
1.1 KiB
Modula-2
37 lines
1.1 KiB
Modula-2
module github.com/mandiant/gopacket
|
|
|
|
go 1.24.13
|
|
|
|
require (
|
|
github.com/chzyer/readline v1.5.1
|
|
github.com/geoffgarside/ber v1.1.0
|
|
github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667
|
|
github.com/go-ldap/ldap/v3 v3.4.12
|
|
github.com/google/gopacket v1.1.19
|
|
github.com/google/uuid v1.6.0
|
|
github.com/hashicorp/go-uuid v1.0.3
|
|
github.com/jcmturner/aescts/v2 v2.0.0
|
|
github.com/jcmturner/dnsutils/v2 v2.0.0
|
|
github.com/jcmturner/gofork v1.7.6
|
|
github.com/jcmturner/rpc/v2 v2.0.3
|
|
github.com/oiweiwei/go-msrpc v1.2.12
|
|
github.com/oiweiwei/gokrb5.fork/v9 v9.0.6
|
|
github.com/rs/zerolog v1.32.0
|
|
golang.org/x/crypto v0.36.0
|
|
golang.org/x/net v0.38.0
|
|
golang.org/x/term v0.39.0
|
|
golang.org/x/text v0.23.0
|
|
software.sslmate.com/src/go-pkcs12 v0.7.0
|
|
)
|
|
|
|
require (
|
|
github.com/Azure/go-ntlmssp v0.1.1 // indirect
|
|
github.com/indece-official/go-ebcdic v1.2.0 // indirect
|
|
github.com/jcmturner/goidentity/v6 v6.0.1 // indirect
|
|
github.com/jcmturner/gokrb5/v8 v8.4.4 // indirect
|
|
github.com/mattn/go-colorable v0.1.13 // indirect
|
|
github.com/mattn/go-isatty v0.0.19 // indirect
|
|
github.com/oiweiwei/go-smb2.fork v1.0.0 // indirect
|
|
golang.org/x/sys v0.40.0 // indirect
|
|
)
|