11// This is effectively a library for .NET remoting functionality
22// The exploit remoting service tool by tyranid was the primary
3- // resource for this and this is basically a port of that project with the ntlmssp
43// Note: Everything is in little endian
54
65// Usage Example:
76// data = "\x00\x00blahblah"
87// uri = "tcp://192.168.113.231:9999/SomeEndpoint"
9- // conn,err := dotnetremoting.GetNTLMSSPTCPConnection("user", "asdf", "192.168.113.231:9999")
10- // if err != nil {
11- // fmt.Println(fmt.Sprintf("Error connecting: %s", err))
12- // return
13- // }
8+ // // conn = get a net.Conn somehow...
149// newmessage := dotnetremoting.Message{}
1510// newmessage.WriteDefaultPreamble(dotnetremoting.OperationRequest, len(data), uri)
1611// _,err = conn.Write([]byte(newmessage.GetMessage(data))) // NOTE THE GetMessage call here, this finalizes the message
@@ -30,13 +25,9 @@ package dotnetremoting
3025
3126import (
3227 "encoding/binary"
33- "fmt"
3428 "net"
3529 "net/url"
36- "time"
3730
38- "github.com/LeakIX/nns"
39- "github.com/LeakIX/ntlmssp"
4031 "github.com/vulncheck-oss/go-exploit/output"
4132 "github.com/vulncheck-oss/go-exploit/transform"
4233)
@@ -445,19 +436,3 @@ func addCountedString(msg *string, encodingType StringEncoding, stringValue stri
445436 * msg += transform .PackLittleInt32 (len (stringValue ))
446437 * msg += stringValue
447438}
448-
449- // Some connection helper functions, exists mostly to wrap around ntlmssp.
450- // For anonymous connections, just pass "" to user and password.
451- func GetNTLMSSPTCPConnection (user string , password string , socketAddr string ) (net.Conn , error ) {
452- ntlmsspClient , err := ntlmssp .NewClient (ntlmssp .SetCompatibilityLevel (1 ), ntlmssp .SetUserInfo (user , password ))
453- if err != nil {
454- return nil , fmt .Errorf ("error creating NTLMSSPClient, err=%w" , err )
455- }
456- nnsConn , err := nns .DialNTLMSSP (socketAddr , ntlmsspClient , 10 * time .Second )
457- if err != nil {
458- return nil , fmt .Errorf ("error connecting with NTLMSSP to %s, err=%w" , socketAddr , err )
459- }
460- output .PrintfFrameworkStatus ("NTLMSSP connection to %s was successful" , socketAddr )
461-
462- return nnsConn , nil
463- }
0 commit comments