fixed some bugs involving DCERPC arguments

4 files changed, 55 insertions, 36 deletions

diff --git a/internal/client/dce/dce.go b/internal/client/dce/dce.go
index 1ddec65..f58123b 100644
--- a/internal/client/dce/dce.go
+++ b/internal/client/dce/dce.go
@@ -2,30 +2,29 @@ package dce
 
 import (
   "context"
+  "errors"
   "fmt"
   "github.com/RedTeamPentesting/adauth"
   "github.com/RedTeamPentesting/adauth/dcerpcauth"
   "github.com/oiweiwei/go-msrpc/dcerpc"
+  "github.com/oiweiwei/go-msrpc/midl/uuid"
   "github.com/oiweiwei/go-msrpc/msrpc/epm/epm/v3"
   "github.com/oiweiwei/go-msrpc/ssp/gssapi"
   "github.com/rs/zerolog"
 )
 
-var (
-  NP   = "ncacn_np"
-  TCP  = "ncacn_ip_tcp"
-  HTTP = "ncacn_http"
-)
-
 type ConnectionMethodDCEConfig struct {
-  NoEpm      bool                  // NoEpm disables EPM
-  EpmAuto    bool                  // EpmAuto will find any suitable endpoint, without any filter
-  Endpoint   *dcerpc.StringBinding // Endpoint is the endpoint passed to dcerpc.WithEndpoint. ignored if EpmAuto is false
+  NoEpm      bool // NoEpm disables EPM
+  EpmAuto    bool // EpmAuto will find any suitable endpoint, without any filter
+  Insecure   bool
+  NoSign     bool
+  Endpoint   *dcerpc.StringBinding // Endpoint is the explicit endpoint passed to dcerpc.WithEndpoint for use without EPM
+  EpmFilter  *dcerpc.StringBinding // EpmFilter is the rough filter used to pick an EPM endpoint
   DceOptions []dcerpc.Option       // DceOptions are the options passed to dcerpc.Dial
   EpmOptions []dcerpc.Option       // EpmOptions are the options passed to epm.EndpointMapper
 }
 
-func (cfg *ConnectionMethodDCEConfig) GetDce(ctx context.Context, creds *adauth.Credential, target *adauth.Target, opts ...dcerpc.Option) (cc dcerpc.Conn, err error) {
+func (cfg *ConnectionMethodDCEConfig) GetDce(ctx context.Context, cred *adauth.Credential, target *adauth.Target, endpoint, object string, opts ...dcerpc.Option) (cc dcerpc.Conn, err error) {
   dceOpts := append(opts, cfg.DceOptions...)
   epmOpts := append(opts, cfg.EpmOptions...)
 
@@ -37,17 +36,41 @@ func (cfg *ConnectionMethodDCEConfig) GetDce(ctx context.Context, creds *adauth.
   epmOpts = append(epmOpts, dcerpc.WithLogger(log))
 
   ctx = gssapi.NewSecurityContext(ctx)
-  ao, err := dcerpcauth.AuthenticationOptions(ctx, creds, target, &dcerpcauth.Options{})
+  auth, err := dcerpcauth.AuthenticationOptions(ctx, cred, target, &dcerpcauth.Options{})
   if err != nil {
     log.Error().Err(err).Msg("Failed to parse authentication options")
     return nil, fmt.Errorf("parse auth options: %w", err)
   }
-  if cfg.Endpoint != nil && !cfg.EpmAuto {
-    dceOpts = append(dceOpts, dcerpc.WithEndpoint(cfg.Endpoint.String()))
+  addr := target.AddressWithoutPort()
+  log = log.With().Str("address", addr).Logger()
+
+  if object != "" {
+    if id, err := uuid.Parse(object); err != nil {
+      log.Error().Err(err).Msg("Failed to parse input object UUID")
+    } else {
+      dceOpts = append(dceOpts, dcerpc.WithObjectUUID(id))
+    }
   }
-  if !cfg.NoEpm {
-    dceOpts = append(dceOpts,
-      epm.EndpointMapper(ctx, target.AddressWithoutPort(), append(epmOpts, ao...)...))
+  if cfg.Endpoint != nil {
+    dceOpts = append(dceOpts, dcerpc.WithEndpoint(cfg.Endpoint.String()))
+    log.Debug().Str("binding", cfg.Endpoint.String()).Msg("Using endpoint")
+
+  } else if !cfg.NoEpm {
+    dceOpts = append(dceOpts, epm.EndpointMapper(ctx, addr, append(epmOpts, auth...)...))
+    log.Debug().Msg("Using endpoint mapper")
+
+    if cfg.EpmFilter != nil {
+      dceOpts = append(dceOpts, dcerpc.WithEndpoint(cfg.EpmFilter.String()))
+      log.Debug().Str("filter", cfg.EpmFilter.String()).Msg("Using endpoint filter")
+    }
+  } else if endpoint != "" {
+    dceOpts = append(dceOpts, dcerpc.WithEndpoint(endpoint))
+    log.Debug().Str("endpoint", endpoint).Msg("Using default endpoint")
+
+  } else {
+    log.Err(err).Msg("Invalid DCE connection options")
+    return nil, errors.New("get DCE: invalid connection options")
   }
-  return dcerpc.Dial(ctx, target.AddressWithoutPort(), append(dceOpts, ao...)...)
+
+  return dcerpc.Dial(ctx, target.AddressWithoutPort(), append(dceOpts, auth...)...)
 }
diff --git a/internal/exec/exec.go b/internal/exec/exec.go
index 56edead..f3fe7ae 100644
--- a/internal/exec/exec.go
+++ b/internal/exec/exec.go
@@ -2,7 +2,9 @@ package exec
 
 import (
   "context"
+  "fmt"
   "github.com/RedTeamPentesting/adauth"
+  "strings"
 )
 
 const (
@@ -42,8 +44,12 @@ type Module interface {
 }
 
 func (cfg *ExecutionConfig) GetRawCommand() string {
+  executable := cfg.ExecutablePath
+  if strings.Contains(executable, " ") {
+    executable = fmt.Sprintf("%q", executable)
+  }
   if cfg.ExecutableArgs != "" {
-    return cfg.ExecutablePath + " " + cfg.ExecutableArgs
+    return executable + " " + cfg.ExecutableArgs
   }
-  return cfg.ExecutablePath
+  return executable
 }
diff --git a/internal/exec/scmr/exec.go b/internal/exec/scmr/exec.go
index c47fcee..588c580 100644
--- a/internal/exec/scmr/exec.go
+++ b/internal/exec/scmr/exec.go
@@ -9,18 +9,13 @@ import (
   "github.com/FalconOpsLLC/goexec/internal/util"
   "github.com/FalconOpsLLC/goexec/internal/windows"
   "github.com/RedTeamPentesting/adauth"
-  "github.com/oiweiwei/go-msrpc/dcerpc"
-  "github.com/oiweiwei/go-msrpc/midl/uuid"
   "github.com/oiweiwei/go-msrpc/msrpc/scmr/svcctl/v2"
   "github.com/rs/zerolog"
 )
 
 const (
-  DefaultEndpoint = "ncacn_np:[srvsvc]"
-)
-
-var (
-  ScmrRpcUuid = uuid.MustParse("367ABB81-9844-35F1-AD32-98F038001003")
+  ScmrDefaultEndpoint = "ncacn_np:[svcctl]"
+  ScmrDefaultObject   = "367ABB81-9844-35F1-AD32-98F038001003"
 )
 
 func (mod *Module) Connect(ctx context.Context, creds *adauth.Credential, target *adauth.Target, ccfg *exec.ConnectionConfig) (err error) {
@@ -41,7 +36,7 @@ func (mod *Module) Connect(ctx context.Context, creds *adauth.Credential, target
       }
       connect := func(ctx context.Context) error {
         // Create DCE connection
-        if mod.dce, err = cfg.GetDce(ctx, creds, target, dcerpc.WithObjectUUID(ScmrRpcUuid)); err != nil {
+        if mod.dce, err = cfg.GetDce(ctx, creds, target, ScmrDefaultEndpoint, ScmrDefaultObject); err != nil {
           log.Error().Err(err).Msg("Failed to initialize DCE dialer")
           return fmt.Errorf("create DCE dialer: %w", err)
         }
@@ -191,7 +186,7 @@ func (mod *Module) Exec(ctx context.Context, ecfg *exec.ExecutionConfig) (err er
         ServiceManager: mod.scm,
         ServiceName:    serviceName,
         DisplayName:    util.RandomStringIfBlank(cfg.DisplayName),
-        BinaryPathName: util.CheckNullString(ecfg.GetRawCommand()),
+        BinaryPathName: ecfg.GetRawCommand(),
         ServiceType:    windows.SERVICE_WIN32_OWN_PROCESS,
         StartType:      windows.SERVICE_DEMAND_START,
         DesiredAccess:  ServiceAllAccess, // TODO: Replace
diff --git a/internal/exec/tsch/exec.go b/internal/exec/tsch/exec.go
index 44f11d1..1996f27 100644
--- a/internal/exec/tsch/exec.go
+++ b/internal/exec/tsch/exec.go
@@ -8,19 +8,14 @@ import (
   "github.com/FalconOpsLLC/goexec/internal/exec"
   "github.com/FalconOpsLLC/goexec/internal/util"
   "github.com/RedTeamPentesting/adauth"
-  "github.com/oiweiwei/go-msrpc/dcerpc"
-  "github.com/oiweiwei/go-msrpc/midl/uuid"
   "github.com/oiweiwei/go-msrpc/msrpc/tsch/itaskschedulerservice/v1"
   "github.com/rs/zerolog"
   "time"
 )
 
 const (
-  DefaultEndpoint = "ncacn_np:[atsvc]"
-)
-
-var (
-  TschRpcUuid = uuid.MustParse("86D35949-83C9-4044-B424-DB363231FD0C")
+  TschDefaultEndpoint = "ncacn_np:[atsvc]"
+  TschDefaultObject   = "86D35949-83C9-4044-B424-DB363231FD0C"
 )
 
 // Connect to the target & initialize DCE & TSCH clients
@@ -34,7 +29,7 @@ func (mod *Module) Connect(ctx context.Context, creds *adauth.Credential, target
       return fmt.Errorf("invalid configuration for DCE connection method")
     } else {
       // Create DCERPC dialer
-      mod.dce, err = cfg.GetDce(ctx, creds, target, dcerpc.WithObjectUUID(TschRpcUuid))
+      mod.dce, err = cfg.GetDce(ctx, creds, target, TschDefaultEndpoint, TschDefaultObject)
       if err != nil {
         log.Error().Err(err).Msg("Failed to create DCERPC dialer")
         return fmt.Errorf("create DCERPC dialer: %w", err)