Skip to content

Commit dbcab9d

Browse files
linting
1 parent 595e54f commit dbcab9d

File tree

1 file changed

+89
-83
lines changed

1 file changed

+89
-83
lines changed

protocol/dotnetremoting/dotnetremoting.go

Lines changed: 89 additions & 83 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
// This is effectively a library for .NET remoting functionality
22
// The exploit remoting service tool by tyranid was the primary
3-
// resource for this and this is basically a port of that project with the ntlmssp
3+
// resource for this and this is basically a port of that project with the ntlmssp
44
// Note: Everything is in little endian
55

66
// Usage Example:
@@ -29,43 +29,45 @@
2929
package dotnetremoting
3030

3131
import (
32+
"encoding/binary"
3233
"fmt"
3334
"net"
3435
"net/url"
3536
"time"
36-
"encoding/binary"
3737

3838
"github.com/LeakIX/nns"
3939
"github.com/LeakIX/ntlmssp"
40-
"github.com/vulncheck-oss/go-exploit/transform"
4140
"github.com/vulncheck-oss/go-exploit/output"
41+
"github.com/vulncheck-oss/go-exploit/transform"
4242
)
4343

4444
// types and 'enums'.
45-
type Message struct{
45+
type Message struct {
4646
PreambleData string
47-
HeaderData string
47+
HeaderData string
4848
}
4949

50-
// Strings, because go thinks strings are as nifty as bytes
50+
// Strings, because go thinks strings are as nifty as bytes.
5151
type MessageResponse struct {
52-
MajorVersion string
53-
MinorVersion string
54-
OperationType string
52+
MajorVersion string
53+
MinorVersion string
54+
OperationType string
5555
ContentDistribution string
56-
DataLength int
57-
Headers map[string]string
58-
Data string
56+
DataLength int
57+
Headers map[string]string
58+
Data string
5959
}
6060

6161
type OperationType string
62+
6263
const ( // OPERATION TYPES (ushort)
6364
OperationTypeRequest OperationType = "\x00\x00"
6465
OperationTypeOneWayRequest OperationType = "\x01\x00"
6566
OperationTypeReply OperationType = "\x02\x00"
6667
)
6768

6869
type HeaderToken string
70+
6971
const ( // HEADER TOKENS (ushort)
7072
HeaderTokenEndHeaders HeaderToken = "\x00\x00"
7173
HeaderTokenCustom HeaderToken = "\x01\x00"
@@ -77,6 +79,7 @@ const ( // HEADER TOKENS (ushort)
7779
)
7880

7981
type HeaderDataFormat string
82+
8083
const ( // HEADER DATA FORMAT (byte)
8184
HeaderDataFormatVoid HeaderDataFormat = "\x00"
8285
HeaderDataFormatCountedString HeaderDataFormat = "\x01"
@@ -86,36 +89,39 @@ const ( // HEADER DATA FORMAT (byte)
8689
)
8790

8891
type ContentDistribution string
92+
8993
const ( // CONTENT DISTRIBUTION (ushort)
9094
ContentDistributionNotChunked ContentDistribution = "\x00\x00"
9195
ContentDistributionChunked ContentDistribution = "\x01\x00"
9296
)
9397

9498
type StringEncoding string
99+
95100
const ( // STRING ENCODING (byte)
96101
StringEncodingUnicode StringEncoding = "\x00"
97102
StringEncodingUtf8 StringEncoding = "\x01"
98103
)
99104

100105
type TCPStatusCode string
106+
101107
const ( // TCP STATUS CODE (byte)
102108
TCPStatusCodeSuccess TCPStatusCode = "\x00"
103109
TCPStatusCodeError TCPStatusCode = "\x01"
104110
)
105111

106-
107112
// The 'preamble' is basically the set of headers before the body.
108113
func (msg *Message) WritePreamble(uri string, opType OperationType, dataLength int, contentDistribution ContentDistribution, contentType string) {
109114
uriObj, err := url.Parse(uri)
110115
if err != nil {
111116
output.PrintfFrameworkError("Could not write preamble: error trying to parse provided uri=%s, err=%s", uri, err)
112-
return
117+
118+
return
113119
}
114120
msg.PreambleData = ".NET"
115-
msg.PreambleData += "\x01" // major version
116-
msg.PreambleData += "\x00" // minor version
117-
msg.PreambleData += string(opType) // operation type
118-
msg.PreambleData += string(contentDistribution) // content distribution
121+
msg.PreambleData += "\x01" // major version
122+
msg.PreambleData += "\x00" // minor version
123+
msg.PreambleData += string(opType) // operation type
124+
msg.PreambleData += string(contentDistribution) // content distribution
119125
msg.PreambleData += transform.PackLittleInt32(dataLength) // length of payload to be sent
120126
msg.AddContentTypeHeader(contentType)
121127
if uri != "" {
@@ -153,7 +159,7 @@ func (msg *Message) AddURIHeader(uri string, headerToken HeaderToken) {
153159
// this will probably be application/octet-stream almost every time but making options.
154160
func (msg *Message) AddContentTypeHeader(contentType string) {
155161
msg.HeaderData += string(HeaderTokenContentType)
156-
msg.HeaderData += string(HeaderDataFormatCountedString)
162+
msg.HeaderData += string(HeaderDataFormatCountedString)
157163
addCountedString(&msg.HeaderData, StringEncodingUtf8, contentType)
158164
}
159165

@@ -173,7 +179,7 @@ func (msg *Message) AddStatusCodeHeader(isError bool) { // untested
173179
msg.HeaderData += transform.PackLittleInt16(1)
174180

175181
return
176-
}
182+
}
177183
// success
178184
msg.HeaderData += transform.PackLittleInt16(0)
179185
}
@@ -197,12 +203,12 @@ func (msg *MessageResponse) Dump() {
197203
// Parsing functions.
198204
func ParseResponseFromConn(conn net.Conn) (MessageResponse, bool) {
199205
msg := MessageResponse{}
200-
magicBuf := make ([]byte, 4)
201-
majorVerBuf := make ([]byte, 1)
202-
minorVerBuf := make ([]byte, 1)
203-
opTypeBuf := make ([]byte, 2)
204-
contentDistributionBuf := make ([]byte, 2)
205-
dataLengthBuf := make ([]byte, 4)
206+
magicBuf := make([]byte, 4)
207+
majorVerBuf := make([]byte, 1)
208+
minorVerBuf := make([]byte, 1)
209+
opTypeBuf := make([]byte, 2)
210+
contentDistributionBuf := make([]byte, 2)
211+
dataLengthBuf := make([]byte, 4)
206212

207213
// checking magic bytes from message
208214
_, err := conn.Read(magicBuf)
@@ -241,7 +247,7 @@ func ParseResponseFromConn(conn net.Conn) (MessageResponse, bool) {
241247

242248
return MessageResponse{}, false
243249
}
244-
msg.OperationType = string(opTypeBuf)
250+
msg.OperationType = string(opTypeBuf)
245251

246252
_, err = conn.Read(contentDistributionBuf)
247253
if err != nil {
@@ -294,14 +300,14 @@ func readHeadersFromConn(conn net.Conn) (map[string]string, bool) {
294300
}
295301

296302
// while we have not read the End of Headers 'token'
297-
for string(tokenBuf) != string(HeaderTokenEndHeaders) {
303+
for string(tokenBuf) != string(HeaderTokenEndHeaders) {
298304
name := string(tokenBuf)
299305
value := ""
300306

301307
switch string(tokenBuf) {
302308
case string(HeaderTokenCustom): // HeaderTokenCustom
303309
// untested
304-
str, ok := readHeaderStringFromConn(conn)
310+
str, ok := readHeaderStringFromConn(conn)
305311
if !ok {
306312
output.PrintFrameworkError("Failed reading custom header name from response")
307313

@@ -326,43 +332,43 @@ func readHeadersFromConn(conn net.Conn) (map[string]string, bool) {
326332
}
327333

328334
switch string(dataTypeBuf) {
329-
case string(HeaderDataFormatVoid):
330-
break
331-
case string(HeaderDataFormatCountedString):
332-
data, ok := readHeaderStringFromConn(conn)
333-
if !ok {
334-
output.PrintFrameworkError("Failed reading counted header string")
335-
336-
return map[string]string{}, false
337-
}
338-
value = data
339-
case string(HeaderDataFormatByte):
340-
dataBuf := make([]byte, 1)
341-
_, err = conn.Read(dataBuf)
342-
if err != nil {
343-
output.PrintfFrameworkError("Failed reading format byte, err=%s", err)
344-
345-
return map[string]string{}, false
346-
}
347-
value = string(dataBuf)
348-
case string(HeaderDataFormatUint16):
349-
dataBuf := make([]byte, 2)
350-
_, err = conn.Read(dataBuf)
351-
if err != nil {
352-
output.PrintfFrameworkError("Failed reading uint16, err=%s", err)
353-
354-
return map[string]string{}, false
355-
}
356-
value = string(dataBuf)
357-
case string(HeaderDataFormatInt32):
358-
dataBuf := make([]byte, 4)
359-
_, err = conn.Read(dataBuf)
360-
if err != nil {
361-
output.PrintfFrameworkError("Failed reading uint32, err=%s", err)
362-
363-
return map[string]string{}, false
364-
}
365-
value = string(dataBuf)
335+
case string(HeaderDataFormatVoid):
336+
break
337+
case string(HeaderDataFormatCountedString):
338+
data, ok := readHeaderStringFromConn(conn)
339+
if !ok {
340+
output.PrintFrameworkError("Failed reading counted header string")
341+
342+
return map[string]string{}, false
343+
}
344+
value = data
345+
case string(HeaderDataFormatByte):
346+
dataBuf := make([]byte, 1)
347+
_, err = conn.Read(dataBuf)
348+
if err != nil {
349+
output.PrintfFrameworkError("Failed reading format byte, err=%s", err)
350+
351+
return map[string]string{}, false
352+
}
353+
value = string(dataBuf)
354+
case string(HeaderDataFormatUint16):
355+
dataBuf := make([]byte, 2)
356+
_, err = conn.Read(dataBuf)
357+
if err != nil {
358+
output.PrintfFrameworkError("Failed reading uint16, err=%s", err)
359+
360+
return map[string]string{}, false
361+
}
362+
value = string(dataBuf)
363+
case string(HeaderDataFormatInt32):
364+
dataBuf := make([]byte, 4)
365+
_, err = conn.Read(dataBuf)
366+
if err != nil {
367+
output.PrintfFrameworkError("Failed reading uint32, err=%s", err)
368+
369+
return map[string]string{}, false
370+
}
371+
value = string(dataBuf)
366372
}
367373
}
368374

@@ -375,7 +381,7 @@ func readHeadersFromConn(conn net.Conn) (map[string]string, bool) {
375381

376382
return map[string]string{}, false
377383
}
378-
output.PrintfFrameworkTrace("token value %x",tokenBuf)
384+
output.PrintfFrameworkTrace("token value %x", tokenBuf)
379385
}
380386
output.PrintFrameworkTrace("done parsing headers")
381387

@@ -384,7 +390,7 @@ func readHeadersFromConn(conn net.Conn) (map[string]string, bool) {
384390

385391
func readHeaderStringFromConn(conn net.Conn) (string, bool) {
386392
encodingTypeBuf := make([]byte, 1)
387-
stringLengthBuf := make([]byte, 4)
393+
stringLengthBuf := make([]byte, 4)
388394
_, err := conn.Read(encodingTypeBuf)
389395
if err != nil {
390396
output.PrintfFrameworkError("Failed reading encoding type from header string")
@@ -401,7 +407,6 @@ func readHeaderStringFromConn(conn net.Conn) (string, bool) {
401407
// encodingType := string(encodingTypeBuf) // sorry, just going to ignore this for now.
402408
stringLength := int(binary.LittleEndian.Uint32(stringLengthBuf))
403409

404-
405410
stringData, ok := readNBytes(conn, stringLength)
406411
if !ok {
407412
return "", false
@@ -410,8 +415,8 @@ func readHeaderStringFromConn(conn net.Conn) (string, bool) {
410415
return stringData, true
411416
}
412417

413-
// don't love this function
414-
func readNBytes(conn net.Conn, n int) (string, bool){
418+
// don't love this function.
419+
func readNBytes(conn net.Conn, n int) (string, bool) {
415420
data := ""
416421
buf := make([]byte, 1) // ugh...
417422
remaining := n
@@ -432,8 +437,9 @@ func readNBytes(conn net.Conn, n int) (string, bool){
432437
}
433438

434439
// Helper functions.
435-
//nolint:unparam
436440
// This is private on purpose to promote helper functions to keep things easier to use.
441+
//
442+
//nolint:unparam
437443
func addCountedString(msg *string, encodingType StringEncoding, stringValue string) {
438444
*msg += string(encodingType)
439445
*msg += transform.PackLittleInt32(len(stringValue))
@@ -443,15 +449,15 @@ func addCountedString(msg *string, encodingType StringEncoding, stringValue stri
443449
// Some connection helper functions, exists mostly to wrap around ntlmssp.
444450
// For anonymous connections, just pass "" to user and password.
445451
func GetNTLMSSPTCPConnection(user string, password string, socketAddr string) (net.Conn, error) {
446-
ntlmsspClient, err := ntlmssp.NewClient(ntlmssp.SetCompatibilityLevel(1), ntlmssp.SetUserInfo(user, password))
447-
if err != nil {
448-
return nil, fmt.Errorf("error creating NTLMSSPClient, err=%w", err)
449-
}
450-
nnsConn, err := nns.DialNTLMSSP(socketAddr, ntlmsspClient, 10 * time.Second)
451-
if err != nil {
452-
return nil, fmt.Errorf("error connecting with NTLMSSP to %s, err=%w", socketAddr, err)
453-
}
454-
output.PrintfFrameworkStatus("NTLMSSP connection to %s was successful", socketAddr)
455-
456-
return nnsConn, nil
452+
ntlmsspClient, err := ntlmssp.NewClient(ntlmssp.SetCompatibilityLevel(1), ntlmssp.SetUserInfo(user, password))
453+
if err != nil {
454+
return nil, fmt.Errorf("error creating NTLMSSPClient, err=%w", err)
455+
}
456+
nnsConn, err := nns.DialNTLMSSP(socketAddr, ntlmsspClient, 10*time.Second)
457+
if err != nil {
458+
return nil, fmt.Errorf("error connecting with NTLMSSP to %s, err=%w", socketAddr, err)
459+
}
460+
output.PrintfFrameworkStatus("NTLMSSP connection to %s was successful", socketAddr)
461+
462+
return nnsConn, nil
457463
}

0 commit comments

Comments
 (0)