End to End Examples

End-to-End Examples

Custom Share Scanner

package main

import (
    "fmt"
    "gopacket/pkg/flags"
    "gopacket/pkg/session"
    "gopacket/pkg/smb"
)

func main() {
    opts := flags.Parse()
    target, creds, _ := session.ParseTargetString(opts.TargetStr)
    opts.ApplyToSession(&target, &creds)
    session.EnsurePassword(&creds)

    client := smb.NewClient(target, &creds)
    defer client.Close()

    if err := client.Connect(); err != nil {
        fmt.Printf("[-] %v\n", err)
        return
    }

    shares, _ := client.ListShares()
    for _, share := range shares {
        fmt.Printf("[+] \\\\%s\\%s\n", target.Host, share)

        if err := client.UseShare(share); err != nil {
            fmt.Printf("    [-] Access denied\n")
            continue
        }

        files, err := client.Ls(".")
        if err != nil {
            fmt.Printf("    [-] Cannot list: %v\n", err)
            continue
        }
        fmt.Printf("    [+] %d items\n", len(files))
    }
}

LDAP + DACL Editor

package main

import (
    "fmt"
    "gopacket/pkg/flags"
    "gopacket/pkg/ldap"
    "gopacket/pkg/security"
    "gopacket/pkg/session"
)

func main() {
    opts := flags.Parse()
    target, creds, _ := session.ParseTargetString(opts.TargetStr)
    opts.ApplyToSession(&target, &creds)
    session.EnsurePassword(&creds)

    client := ldap.NewClient(target, &creds)
    defer client.Close()
    client.Connect(false)
    client.Login()

    baseDN, _ := client.GetDefaultNamingContext()

    result, _ := client.Search(
        baseDN,
        "(sAMAccountName=target-user)",
        []string{"nTSecurityDescriptor"},
    )

    if len(result.Entries) > 0 {
        sdBytes := result.Entries[0].GetRawAttributeValue("nTSecurityDescriptor")
        sd, _ := security.ParseSecurityDescriptor(sdBytes)
        fmt.Printf("Owner: %s\n", sd.Owner.String())

        if sd.DACL != nil {
            for _, ace := range sd.DACL.ACEs {
                fmt.Printf("  ACE: SID=%s Mask=0x%x\n", ace.SID.String(), ace.AccessMask)
            }
        }
    }
}

DCE/RPC Service Control

package main

import (
    "fmt"
    "gopacket/pkg/dcerpc"
    "gopacket/pkg/dcerpc/svcctl"
    "gopacket/pkg/flags"
    "gopacket/pkg/session"
    "gopacket/pkg/smb"
)

func main() {
    opts := flags.Parse()
    target, creds, _ := session.ParseTargetString(opts.TargetStr)
    opts.ApplyToSession(&target, &creds)
    session.EnsurePassword(&creds)

    smbClient := smb.NewClient(target, &creds)
    defer smbClient.Close()
    smbClient.Connect()

    pipe, _ := smbClient.OpenPipe("svcctl")
    rpcClient := dcerpc.NewClient(pipe)
    rpcClient.Bind(svcctl.UUID, svcctl.MajorVersion, svcctl.MinorVersion)

    // Use SVCCTL operations...
    // (see tools/services/ and tools/psexec/ for complete examples)
}

Offline Registry + SAM Dump

package main

import (
    "fmt"
    "os"
    "gopacket/pkg/registry"
)

func main() {
    systemData, _ := os.ReadFile("SYSTEM")
    samData, _ := os.ReadFile("SAM")

    systemHive, _ := registry.Open(systemData)
    samHive, _ := registry.Open(samData)

    bootKey := systemHive.GetBootKey()
    fmt.Printf("[+] Boot key: %x\n", bootKey)

    _ = samHive
    // (see tools/secretsdump/ for the complete implementation)
}