dcerpc

func (*Client) AtExec ¶

func (c *Client) AtExec(command, share string) (*AtExecResult, error)

AtExec executes a Windows command on the target host using the Task Scheduler service over the atsvc named pipe (impacket: atexec.py). A one-shot scheduled task is registered as LocalSystem, executed once, and then deleted. The command's stdout/stderr is captured into %windir%\Temp on the chosen share (default ADMIN$) and read back over SMB. Local admin equivalent rights are required on the target.

All the heavy lifting (task XML, register / run / poll / cleanup) lives in goimpacket's pkg/atexec library; this wrapper only handles the JS-facing validation and the per-execution network policy enforcement.

command - the command line to run (wrapped in cmd.exe /C ... by default). share - writable share to retrieve the output file from (default "ADMIN$").

@example ```javascript const c = new dcerpc.Client('dc01', 'acme.local', 'admin', 'P@ss'); const r = c.AtExec('whoami /all', 'ADMIN$'); log(r.output); ```

func (*Client) Close ¶

func (c *Client) Close()

Close releases the underlying SMB session.

func (*Client) LsaLookupSids ¶

func (c *Client) LsaLookupSids(sids []string) ([]LookupResult, error)

LsaLookupSids resolves an array of SIDs to (domain, name, type) triples against LSARPC (impacket: lookupsid.py).

@example ```javascript const c = new dcerpc.Client('dc01', 'acme.local', 'admin', 'P@ss'); const r = c.LsaLookupSids(['S-1-5-21-...-500']); log(to_json(r)); ```

func (*Client) RpcDump ¶

func (c *Client) RpcDump(ctx context.Context) ([]Endpoint, error)

RpcDump enumerates every RPC endpoint registered with the EPMAPPER over ncacn_ip_tcp/135 (impacket: rpcdump.py).

@example ```javascript const dcerpc = require('nuclei/dcerpc'); const c = new dcerpc.Client('dc01', 'acme.local', 'admin', 'P@ss'); const eps = c.RpcDump(); for (const e of eps) { log(e.UUID + ' ' + e.Annotation); } ```

func (*Client) SamrAddComputer ¶

func (c *Client) SamrAddComputer(name, password string) error

SamrAddComputer creates a new machine account using the supplied password. Useful as the first step in many AD escalations (RBCD / shadow credentials).

@example ```javascript const c = new dcerpc.Client('dc01', 'acme.local', 'admin', 'P@ss'); c.SamrAddComputer('NUCLEI$', 'C0mputerP@ss!'); ```

func (*Client) SamrEnumerateUsers ¶

func (c *Client) SamrEnumerateUsers() ([]DomainUser, error)

SamrEnumerateUsers connects to SAMR and returns every domain user record (impacket: samrdump.py).

@example ```javascript const c = new dcerpc.Client('dc01', 'acme.local', 'admin', 'P@ss'); const users = c.SamrEnumerateUsers(); for (const u of users) { log(u.Name + ' ' + u.RID); } ```

func (*Client) SetHash ¶

func (c *Client) SetHash(hash string)

SetHash enables NTLM pass-the-hash authentication. hash may be the bare NT hash or "<lm>:<nt>".

@example ```javascript const c = new dcerpc.Client('dc01', 'acme.local', 'admin', ”); c.SetHash('aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0'); ```

func (*Client) SetKerberos ¶

func (c *Client) SetKerberos(dcIP string)

SetKerberos switches the client to Kerberos authentication. dcIP optionally pins the KDC IP when DNS is uncooperative.

@example ```javascript const c = new dcerpc.Client('dc01.acme.local', 'acme.local', 'admin', 'P@ss'); c.SetKerberos('10.10.10.10'); ```

func (*Client) SetPort ¶

func (c *Client) SetPort(port int)

SetPort overrides the default SMB port (445).

func (*Client) SmbCat ¶

func (c *Client) SmbCat(share, file string) (string, error)

SmbCat reads the contents of a single file from the given share. The path is interpreted relative to the share root (use forward slashes).

@example ```javascript const c = new dcerpc.Client('dc01', 'acme.local', 'admin', 'P@ss'); const txt = c.SmbCat('backup', 'backup_credentials.txt'); log(txt); ```

func (*Client) SmbExec ¶

func (c *Client) SmbExec(command, share string) (*SmbExecResult, error)

SmbExec executes a Windows command on the target host using the SVCCTL "create + start service" technique (impacket: smbexec.py / psexec.py). The command's stdout/stderr is captured by writing to the chosen share (default C$) and read back over SMB. Local admin equivalent rights are required on the target.

command - the command line to run; for powershell prefix with

`powershell -EncodedCommand <b64utf16>` or use any cmd one-liner.

share - writable share to stage the output file in (default "C$").

@example ```javascript const dcerpc = require('nuclei/dcerpc'); const c = new dcerpc.Client('dc01', 'acme.local', 'admin', 'P@ss'); const r = c.SmbExec('whoami /all', 'C$'); log(r.output); ```

func (*Client) SmbListShares ¶

func (c *Client) SmbListShares() ([]string, error)

SmbListShares enumerates the SMB shares exposed by the target.

@example ```javascript const c = new dcerpc.Client('dc01', 'acme.local', 'admin', 'P@ss'); for (const s of c.SmbListShares()) { log(s); } ```

func (*Client) SmbLs ¶

func (c *Client) SmbLs(share, dir string) ([]FileEntry, error)

func (*Client) WmiExec ¶

func (c *Client) WmiExec(command, share string) (*WmiExecResult, error)

WmiExec executes a Windows command on the target host using DCOM Win32_Process.Create over the WMI IWbemServices interface (impacket: wmiexec.py). The command is launched as a fresh process by the WMI host process and its stdout/stderr is redirected into a temp file on the chosen share (default ADMIN$) which is then read back over SMB. WmiExec is stealthier than SmbExec / AtExec because it does not create a service or a scheduled task, but Win32_Process.Create itself does not return any captured output - the file-tailing roundtrip is required to recover stdout.

The DCOM bootstrap, NTLM/SPNEGO negotiation and Win32_Process.Create call live in goimpacket's pkg/wmiexec library; this wrapper only handles the JS-facing validation, the per-execution network policy enforcement, and wires nuclei's fastdialer into go-msrpc.

command - the command line to run; wrapped in cmd.exe /Q /c by default. share - writable share to retrieve the output file from (default "ADMIN$").

Authentication: NTLM with password or pass-the-hash via SetHash. Kerberos is not yet supported on this code path.

@example ```javascript const c = new dcerpc.Client('dc01', 'acme.local', 'admin', 'P@ss'); const r = c.WmiExec('whoami /all', 'ADMIN$'); log(r.output); ```