Merge pull request #26 from mandiant/kerberos-proxy-leak

kerberos, dcerpc: tunnel KDC traffic through pkg/transport

Author: psycep

KNOWN_ISSUES.md

@@ -94,6 +94,27 @@ When reporting, please include:
 
 **Status:** By design. UDP tunneling over SOCKS5 is not a gopacket goal. If your workflow genuinely needs UDP over a proxy, use `proxychains` (which hooks libc at a lower level and can intercept UDP sockets) or a full VPN instead of `-proxy`.
 
+### Kerberos KDC traffic under `-proxy`
+
+All Kerberos KDC traffic (AS-REQ/AS-REP, TGS-REQ/TGS-REP, kpasswd) is tunneled through `-proxy` alongside the rest of the tool. This is enforced two ways:
+
+1. The embedded gokrb5 library has been forked in-tree at `pkg/third_party/gokrb5`. Every client constructor (`NewWithPassword`, `NewWithKeytab`, `NewFromCCache`) takes a required `KDCDialer` as its first argument, making proxy-bypass a compile error rather than a runtime leak. Production call sites all pass `kerberos.TransportKDCDialer{}`, which delegates to `pkg/transport`.
+2. The synthesized krb5 config in `pkg/kerberos` sets `udp_preference_limit = 1` unconditionally, so KRB5 never even attempts UDP/88 — direct and proxied paths behave identically. Modern KRB5 already needs TCP for PAC-bearing TGS responses; the legacy UDP "optimization" is dropped.
+
+`/etc/krb5.conf` and `$KRB5_CONFIG` are intentionally not consulted; the in-memory config is the only one used. A misconfigured host cannot subvert the proxy/DNS guarantees by re-enabling `dns_lookup_kdc` or lowering `udp_preference_limit`.
+
+If you add a new code path that constructs a gokrb5 client, the type system will require a `KDCDialer`. Use `kerberos.TransportKDCDialer{}`; the alternative `client.DirectDialer{}` exists only as an explicit escape hatch.
+
+### DCERPC Kerberos traffic under `-proxy` (secretsdump DCSync, wmiexec, wmiquery, wmipersist, dcomexec)
+
+The DCERPC Kerberos auth path uses a separate Kerberos library (`oiweiwei/gokrb5.fork/v9` reached via `oiweiwei/go-msrpc/ssp/krb5`) because go-msrpc's RPC machinery embeds it. Three things are required to keep that path leak-free, and the codebase enforces all three at every call site:
+
+1. **KDC dialer on the krb5 config.** `pkg/dcerpc/auth_kerberos.go` and the four DCOM tools set `krbConfig.KDCDialer = kerberos.TransportKDCDialer{}` on every `krb5.Config` they construct. Same dialer, same proxy guarantee as the rest of Kerberos.
+2. **DCERPC transport dialer.** Every `dcerpc.Dial(...)` is passed `dcerpc.WithDialer(transport.ContextDialer{})` so the TCP step honors the proxy.
+3. **StringBinding form for the OXID-pivot dial.** The second `dcerpc.Dial` per tool uses `"ncacn_ip_tcp:" + target.Host`, not the bare hostname. The prefix forces go-msrpc to parse the address as a StringBinding instead of triggering its hard-coded pre-dial `net.LookupIP`, which would otherwise leak the target hostname to the operator's local resolver. The FQDN is then handed verbatim to the SOCKS5 dialer so resolution stays proxy-side.
+
+Operator-visible behavior under `-proxy`: every byte of AD attack traffic (Kerberos, SMB, DCERPC, kpasswd, DCSync DRSUAPI, DCOM activation, WMI) is sent through the configured SOCKS5 proxy. Tcpdump on the operator host shows no traffic to the AD subnet at all — only SOCKS5 frames to the proxy. Verified end-to-end in a GOAD lab with secretsdump DCSync extracting `krbtgt`, wmiexec returning `whoami` output, and getTGT/getST/GetUserSPNs/GetNPUsers exchanging with the KDC — all silent on the wire, while the same getTGT without `-proxy` immediately emits direct SYN packets to the KDC.
+
 ---
 
 ## 7. Remaining Gaps (Low Priority)

NOTICE

@@ -35,3 +35,15 @@ the full license text.
     A vendored SMB2/SMB3 client library originally authored by Hiroshi Ioka
     and contributors, distributed under the BSD 3-Clause License.
     Upstream: https://github.com/hirochachacha/go-smb2
+
+  * pkg/third_party/gokrb5/
+    A vendored Kerberos 5 client library originally authored by Jonathan
+    Turner and contributors, distributed under the Apache License, Version
+    2.0. See pkg/third_party/gokrb5/LICENSE for the full text. The vendored
+    copy has been modified by this project: the gokrb5 client constructors
+    (NewWithPassword, NewWithKeytab, NewFromCCache) now require a KDCDialer
+    as their first argument, KDC TCP/UDP I/O routes through the supplied
+    dialer instead of net.DialTimeout, and unused subpackages (service/,
+    spnego/) have been removed. See the commit log and KNOWN_ISSUES.md for
+    the full change record.
+    Upstream: https://github.com/jcmturner/gokrb5

go.mod

@@ -9,8 +9,11 @@ require (
 	github.com/go-ldap/ldap/v3 v3.4.12
 	github.com/google/gopacket v1.1.19
 	github.com/google/uuid v1.6.0
+	github.com/hashicorp/go-uuid v1.0.3
+	github.com/jcmturner/aescts/v2 v2.0.0
+	github.com/jcmturner/dnsutils/v2 v2.0.0
 	github.com/jcmturner/gofork v1.7.6
-	github.com/jcmturner/gokrb5/v8 v8.4.4
+	github.com/jcmturner/rpc/v2 v2.0.3
 	github.com/oiweiwei/go-msrpc v1.2.12
 	github.com/oiweiwei/gokrb5.fork/v9 v9.0.6
 	github.com/rs/zerolog v1.32.0
@@ -23,12 +26,9 @@ require (
 
 require (
 	github.com/Azure/go-ntlmssp v0.1.1 // indirect
-	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/indece-official/go-ebcdic v1.2.0 // indirect
-	github.com/jcmturner/aescts/v2 v2.0.0 // indirect
-	github.com/jcmturner/dnsutils/v2 v2.0.0 // indirect
 	github.com/jcmturner/goidentity/v6 v6.0.1 // indirect
-	github.com/jcmturner/rpc/v2 v2.0.3 // indirect
+	github.com/jcmturner/gokrb5/v8 v8.4.4 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.19 // indirect
 	github.com/oiweiwei/go-smb2.fork v1.0.0 // indirect

pkg/dcerpc/auth_kerberos.go

@@ -33,6 +33,7 @@ import (
 	"github.com/oiweiwei/gokrb5.fork/v9/iana/flags"
 
 	"github.com/mandiant/gopacket/internal/build"
+	"github.com/mandiant/gopacket/pkg/kerberos"
 	"github.com/mandiant/gopacket/pkg/session"
 )
 
@@ -70,6 +71,14 @@ func NewKerberosAuthHandler(creds *session.Credentials, target session.Target, d
 	krbConfig := krb5.NewConfig()
 	krbConfig.DCEStyle = true // Required for DCE/RPC
 
+	// Route every KDC call this auth handler makes through pkg/transport.
+	// Without this, go-msrpc's krb5 SSP calls oiweiwei/gokrb5.fork/v9's
+	// client which falls back to net.Dial and leaks the operator IP to the
+	// KDC — see KNOWN_ISSUES.md §8 (Kerberos KDC traffic under -proxy).
+	// kerberos.TransportKDCDialer structurally satisfies the v9 KDCDialer
+	// interface (same Dial signature).
+	krbConfig.KDCDialer = kerberos.TransportKDCDialer{}
+
 	// Check if we should use ccache (no password provided)
 	if creds.Password == "" && creds.Hash == "" {
 		// First check KRB5CCNAME environment variable
@@ -195,6 +204,8 @@ func NewKerberosAuthHandlerMultiRealm(creds *session.Credentials, target session
 
 	krbConfig := krb5.NewConfig()
 	krbConfig.DCEStyle = true
+	// Same proxy-routing requirement as NewKerberosAuthHandler.
+	krbConfig.KDCDialer = kerberos.TransportKDCDialer{}
 
 	// Use ccache-based credential
 	ccachePath := os.Getenv("KRB5CCNAME")

pkg/kerberos/asrep.go

@@ -20,10 +20,10 @@ import (
 
 	"github.com/mandiant/gopacket/pkg/transport"
 
-	"github.com/jcmturner/gokrb5/v8/config"
-	"github.com/jcmturner/gokrb5/v8/iana/nametype"
-	"github.com/jcmturner/gokrb5/v8/messages"
-	"github.com/jcmturner/gokrb5/v8/types"
+	"github.com/mandiant/gopacket/pkg/third_party/gokrb5/config"
+	"github.com/mandiant/gopacket/pkg/third_party/gokrb5/iana/nametype"
+	"github.com/mandiant/gopacket/pkg/third_party/gokrb5/messages"
+	"github.com/mandiant/gopacket/pkg/third_party/gokrb5/types"
 )
 
 // GetASREP fetches the AS-REP for a user and returns the hash.
@@ -39,6 +39,11 @@ func GetASREP(username, domain, kdcHost string, format ...string) (string, error
 
 	cfg := config.New()
 	cfg.LibDefaults.DefaultRealm = realm
+	// Defense-in-depth: this file dials the KDC via transport.Dial directly
+	// (gokrb5's sendToKDC is never invoked), so the opsec keys are currently
+	// no-ops here. Stamp them anyway so a future refactor introducing a
+	// gokrb5 client.Client to this path inherits the proxy/DNS guarantees.
+	ApplyKrb5OpsecDefaults(cfg)
 	// Request RC4 (etype 23) for faster cracking - matches Impacket behavior
 	cfg.LibDefaults.DefaultTktEnctypes = []string{"rc4-hmac"}
 	cfg.LibDefaults.DefaultTktEnctypeIDs = []int32{23}
@@ -62,7 +67,7 @@ func GetASREP(username, domain, kdcHost string, format ...string) (string, error
 	}
 
 	// Connect to KDC (Port 88)
-	conn, err := transport.Dial("tcp", fmt.Sprintf("%s:%d", kdcHost, 88))
+	conn, err := transport.Dial("tcp", FormatKDC(kdcHost, "88"))
 	if err != nil {
 		return "", fmt.Errorf("failed to connect to KDC: %v", err)
 	}

pkg/kerberos/client.go

@@ -21,20 +21,119 @@ import (
 	"encoding/binary"
 	"encoding/hex"
 	"fmt"
+	"net"
 	"os"
 	"strings"
 
-	"github.com/jcmturner/gokrb5/v8/client"
-	"github.com/jcmturner/gokrb5/v8/config"
-	"github.com/jcmturner/gokrb5/v8/credentials"
-	"github.com/jcmturner/gokrb5/v8/gssapi"
-	"github.com/jcmturner/gokrb5/v8/keytab"
-	"github.com/jcmturner/gokrb5/v8/messages"
-	"github.com/jcmturner/gokrb5/v8/types"
 	"github.com/mandiant/gopacket/internal/build"
 	"github.com/mandiant/gopacket/pkg/session"
+	"github.com/mandiant/gopacket/pkg/third_party/gokrb5/client"
+	"github.com/mandiant/gopacket/pkg/third_party/gokrb5/config"
+	"github.com/mandiant/gopacket/pkg/third_party/gokrb5/credentials"
+	"github.com/mandiant/gopacket/pkg/third_party/gokrb5/gssapi"
+	"github.com/mandiant/gopacket/pkg/third_party/gokrb5/keytab"
+	"github.com/mandiant/gopacket/pkg/third_party/gokrb5/messages"
+	"github.com/mandiant/gopacket/pkg/third_party/gokrb5/types"
+	"github.com/mandiant/gopacket/pkg/transport"
 )
 
+// TransportKDCDialer routes every KDC connection (AS, TGS, kpasswd) through
+// pkg/transport, so a configured -proxy / ALL_PROXY tunnels Kerberos traffic
+// in lockstep with the rest of the tool. Without this, gokrb5's default path
+// uses raw net.Dial and leaks the operator's real source IP to the KDC.
+//
+// Every gokrb5 client constructor in our fork (NewWithPassword, NewWithKeytab,
+// NewFromCCache) requires a KDCDialer; passing this type is how the rest of
+// the codebase satisfies that contract while keeping the proxy guarantee.
+type TransportKDCDialer struct{}
+
+func (TransportKDCDialer) Dial(network, address string) (net.Conn, error) {
+	return transport.DialTimeout(network, address, 10)
+}
+
+// The opsec invariants every gokrb5 config in this project must enforce:
+//
+//   - dns_lookup_realm / dns_lookup_kdc = false → no SRV lookups via the OS
+//     resolver, which would bypass our KDCDialer.
+//   - udp_preference_limit = 1 → TCP-only KDC. Modern KRB5 already requires
+//     TCP for PAC-bearing TGS responses >1500 bytes; forcing it uniformly
+//     deletes a code path and keeps direct vs proxied behavior identical.
+//
+// /etc/krb5.conf and $KRB5_CONFIG are intentionally never consulted; the
+// in-memory cfg is the only source. ApplyKrb5OpsecDefaults is the choke point
+// for programmatic callers; SynthesizeKrb5Config is the choke point for
+// string-template callers. Anything else risks drift.
+
+// ApplyKrb5OpsecDefaults stamps the proxy-/DNS-safety invariants onto a
+// programmatically-built *config.Config. Call it after config.New() and
+// before constructing a gokrb5 client. Safe to call repeatedly.
+func ApplyKrb5OpsecDefaults(cfg *config.Config) {
+	cfg.LibDefaults.UDPPreferenceLimit = 1
+	cfg.LibDefaults.DNSLookupKDC = false
+	cfg.LibDefaults.DNSLookupRealm = false
+}
+
+// FormatKDC normalizes a "host" or "host:port" string into a canonical
+// "host:port" using net.JoinHostPort, which correctly brackets IPv6 literals.
+// Required so that callers passing "[::1]:88", bare "::1", "10.0.0.1:8888",
+// or "dc.example.com" all produce valid krb5.conf entries — the naïve
+// fmt.Sprintf("%s:88", kdc) form mangles every IPv6 case.
+//
+// A user-supplied port is preserved: "10.0.0.1:8888" stays on 8888. The
+// defaultPort applies only when input has no port (bare host) or a malformed
+// trailing-colon form ("host:"). This matches operator expectation for
+// lab/tunnel routing where the KDC may not be on the canonical 88/464.
+func FormatKDC(kdc, defaultPort string) string {
+	host, port, err := net.SplitHostPort(kdc)
+	if err != nil {
+		// Bare host: IPv4 ("10.0.0.1"), hostname ("dc.example.com"),
+		// unbracketed IPv6 ("::1"), or bracketed-but-portless IPv6 ("[::1]").
+		// Strip wrapping brackets before re-joining so JoinHostPort doesn't
+		// double-bracket ("[::1]" → "[[::1]]:88"). TrimPrefix/TrimSuffix is
+		// idempotent if the brackets aren't present.
+		host = strings.TrimSuffix(strings.TrimPrefix(kdc, "["), "]")
+		port = defaultPort
+	} else if port == "" {
+		// "host:" — port-less colon-suffix form.
+		port = defaultPort
+	}
+	return net.JoinHostPort(host, port)
+}
+
+// SynthesizeKrb5Config builds the in-memory krb5.conf text for callers that
+// need only the KDC. For kpasswd callers, use SynthesizeKrb5ConfigWithKpasswd.
+// kdc may be a bare host, host:port, or bracketed IPv6 — FormatKDC normalizes.
+func SynthesizeKrb5Config(realm, kdc string) string {
+	return fmt.Sprintf(`
+[libdefaults]
+  default_realm = %s
+  dns_lookup_realm = false
+  dns_lookup_kdc = false
+  udp_preference_limit = 1
+[realms]
+  %s = {
+    kdc = %s
+  }
+`, realm, realm, FormatKDC(kdc, "88"))
+}
+
+// SynthesizeKrb5ConfigWithKpasswd is SynthesizeKrb5Config plus a kpasswd_server
+// per-realm line. Both kdc and kpasswdServer accept the same input forms.
+func SynthesizeKrb5ConfigWithKpasswd(realm, kdc, kpasswdServer string) string {
+	return fmt.Sprintf(`
+[libdefaults]
+  default_realm = %s
+  dns_lookup_realm = false
+  dns_lookup_kdc = false
+  udp_preference_limit = 1
+[realms]
+  %s = {
+    kdc = %s
+    kpasswd_server = %s
+  }
+`, realm, realm, FormatKDC(kdc, "88"), FormatKDC(kpasswdServer, "464"))
+}
+
 // OID for Kerberos V5 (GSSAPI)
 var oidKerberos = asn1.ObjectIdentifier{1, 2, 840, 113554, 1, 2, 2}
 
@@ -102,18 +201,7 @@ func NewClientFromSession(creds *session.Credentials, target session.Target, dcI
 				realm = ccacheRealm
 			}
 
-			// Create config with the correct realm from ccache
-			cfgStr := fmt.Sprintf(`
-[libdefaults]
-  default_realm = %s
-  dns_lookup_realm = false
-  dns_lookup_kdc = false
-[realms]
-  %s = {
-    kdc = %s:88
-  }
-`, realm, realm, kdc)
-			cfg, err := config.NewFromString(cfgStr)
+			cfg, err := config.NewFromString(SynthesizeKrb5Config(realm, kdc))
 			if err != nil {
 				return nil, fmt.Errorf("failed to create krb5 config: %v", err)
 			}
@@ -126,7 +214,7 @@ func NewClientFromSession(creds *session.Credentials, target session.Target, dcI
 			}
 
 			// Try to create client from ccache (requires TGT)
-			cl, err := client.NewFromCCache(ccache, cfg)
+			cl, err := client.NewFromCCache(TransportKDCDialer{}, ccache, cfg)
 			if err == nil {
 				krbClient.KrbClient = cl
 			}
@@ -136,18 +224,7 @@ func NewClientFromSession(creds *session.Credentials, target session.Target, dcI
 		}
 	}
 
-	// Create config for non-ccache cases
-	cfgStr := fmt.Sprintf(`
-[libdefaults]
-  default_realm = %s
-  dns_lookup_realm = false
-  dns_lookup_kdc = false
-[realms]
-  %s = {
-    kdc = %s:88
-  }
-`, realm, realm, kdc)
-	cfg, err := config.NewFromString(cfgStr)
+	cfg, err := config.NewFromString(SynthesizeKrb5Config(realm, kdc))
 	if err != nil {
 		return nil, fmt.Errorf("failed to create krb5 config: %v", err)
 	}
@@ -164,7 +241,7 @@ func NewClientFromSession(creds *session.Credentials, target session.Target, dcI
 		if err != nil {
 			return nil, fmt.Errorf("failed to load keytab %s: %v", creds.Keytab, err)
 		}
-		krbClient.KrbClient = client.NewWithKeytab(creds.Username, realm, kt, cfg, client.DisablePAFXFAST(true))
+		krbClient.KrbClient = client.NewWithKeytab(TransportKDCDialer{}, creds.Username, realm, kt, cfg, client.DisablePAFXFAST(true))
 		return krbClient, nil
 	}
 
@@ -173,7 +250,7 @@ func NewClientFromSession(creds *session.Credentials, target session.Target, dcI
 		// Check if it's an AES key (64 hex chars)?
 		// Note: Manual Keytab construction is blocked by unexported keytab.entry in gokrb5 v8.
 		// For now, treat everything as a password.
-		krbClient.KrbClient = client.NewWithPassword(creds.Username, realm, creds.Password, cfg, client.DisablePAFXFAST(true))
+		krbClient.KrbClient = client.NewWithPassword(TransportKDCDialer{}, creds.Username, realm, creds.Password, cfg, client.DisablePAFXFAST(true))
 		return krbClient, nil
 	}
 	return nil, fmt.Errorf("no valid kerberos credentials found (set KRB5CCNAME, provide password, or use -keytab)")

pkg/kerberos/getpac.go

@@ -21,15 +21,15 @@ import (
 	"strings"
 	"time"
 
-	"github.com/jcmturner/gokrb5/v8/config"
-	"github.com/jcmturner/gokrb5/v8/crypto"
-	"github.com/jcmturner/gokrb5/v8/iana"
-	"github.com/jcmturner/gokrb5/v8/iana/flags"
-	"github.com/jcmturner/gokrb5/v8/iana/msgtype"
-	"github.com/jcmturner/gokrb5/v8/iana/nametype"
-	"github.com/jcmturner/gokrb5/v8/iana/patype"
-	"github.com/jcmturner/gokrb5/v8/messages"
-	"github.com/jcmturner/gokrb5/v8/types"
+	"github.com/mandiant/gopacket/pkg/third_party/gokrb5/config"
+	"github.com/mandiant/gopacket/pkg/third_party/gokrb5/crypto"
+	"github.com/mandiant/gopacket/pkg/third_party/gokrb5/iana"
+	"github.com/mandiant/gopacket/pkg/third_party/gokrb5/iana/flags"
+	"github.com/mandiant/gopacket/pkg/third_party/gokrb5/iana/msgtype"
+	"github.com/mandiant/gopacket/pkg/third_party/gokrb5/iana/nametype"
+	"github.com/mandiant/gopacket/pkg/third_party/gokrb5/iana/patype"
+	"github.com/mandiant/gopacket/pkg/third_party/gokrb5/messages"
+	"github.com/mandiant/gopacket/pkg/third_party/gokrb5/types"
 )
 
 // PACRequest holds configuration for a PAC retrieval request.
@@ -48,9 +48,13 @@ type PACRequest struct {
 func GetPAC(req *PACRequest) (*PAC, error) {
 	realm := strings.ToUpper(req.Domain)
 
-	// Build kerberos config
+	// Build kerberos config. Defense-in-depth: networking in this file is
+	// hand-rolled via sendKDCRequest → transport.Dial, so the opsec keys
+	// are no-ops here today. Stamp them so future use of a gokrb5 client
+	// inherits the proxy/DNS guarantees automatically.
 	cfg := config.New()
 	cfg.LibDefaults.DefaultRealm = realm
+	ApplyKrb5OpsecDefaults(cfg)
 	cfg.LibDefaults.DefaultTktEnctypes = []string{"aes256-cts-hmac-sha1-96", "aes128-cts-hmac-sha1-96", "rc4-hmac"}
 	cfg.LibDefaults.DefaultTktEnctypeIDs = []int32{18, 17, 23}
 	cfg.LibDefaults.DefaultTGSEnctypes = []string{"aes256-cts-hmac-sha1-96", "aes128-cts-hmac-sha1-96", "rc4-hmac"}