diff options
| author | Bryan McNulty <bryanmcnulty@protonmail.com> | 2025-04-26 16:18:38 -0500 |
|---|---|---|
| committer | Bryan McNulty <bryanmcnulty@protonmail.com> | 2025-04-26 16:18:38 -0500 |
| commit | 59512108fbc859a77b34063b8e2752ae046ef669 (patch) | |
| tree | e2ab7fc30bee3db63ad8c3988d289717848d63ca | |
| parent | aadf3819a559db8186ba92078dfc33d0f92e47ed (diff) | |
| download | goexec-59512108fbc859a77b34063b8e2752ae046ef669.tar.gz goexec-59512108fbc859a77b34063b8e2752ae046ef669.zip | |
WMI: use exclusively ncacn_ip_tcp endpoints from remote activation response
| -rw-r--r-- | pkg/goexec/wmi/module.go | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/pkg/goexec/wmi/module.go b/pkg/goexec/wmi/module.go index 3ae98cc..b21c3e3 100644 --- a/pkg/goexec/wmi/module.go +++ b/pkg/goexec/wmi/module.go @@ -81,8 +81,11 @@ func (m *Wmi) Init(ctx context.Context) (err error) { log.Debug().Err(err).Msg("Failed to parse string binding") continue } - stringBinding.NetworkAddress = m.Client.Target.AddressWithoutPort() - newOpts = append(newOpts, dcerpc.WithEndpoint(stringBinding.String())) + // Only consider ncacn_ip_tcp endpoints + if stringBinding.ProtocolSequence == dcerpc.ProtocolSequenceIPTCP { + stringBinding.NetworkAddress = m.Client.Target.AddressWithoutPort() + newOpts = append(newOpts, dcerpc.WithEndpoint(stringBinding.String())) + } } if err = m.Client.Reconnect(ctx, newOpts...); err != nil { |