Reconnaissance tool designed to assist with discovery of potential foothold hosts(beachhead hosts). Discovery is performed via net RPC calls over SMB (TCP445) protocol.
Tool will perform rapid discovery of local group memberships across Windows AD-joined systems. Requires valid active directory credentials- userland.
beachrpcgo -- golang tool that wraps around Linux "net" and "pth-net" binaries. Through RPC calls (SAMRPC protocol over SMB TCP 445) tool allows a low privileged user to enumerate the users and group memberships from the local Security Accounts Manager (SAM) database. Supports local and domain authentication.
Usage:
beachrpcgo [command]
Available Commands:
help Help about any command
localadmins query members of local admins group
rdpmembers query members of remote desktop users group
version Display version info and quit
Mandatory flags:
-d, --domain string FQ domain name (e.g. contoso.com or localhost)
-u, --username string Username
-p, --password string Password plaintext or NT hash
Optional flags:
--delay int Delay in ms between each attempt- single thread if set
-t, --threads int Threads to use (default 10)
-o, --out string Save results out to csv file (e.g. out.csv)
-h, --help help for beachrpcgo
-v, --verbose
Use "beachrpcgo [command] --help" for more information about a command.
go run main.go localadmins -d localhost -u User1 -p Password123 445.open
echo 10.0.0.104 | go run main.go localadmins -d localhost -u User1 -p Password123 -
go run main.go localadmins -d localhost -u User1 -p Password123 445.open -o outla.csv
go run main.go rdpmembers -d localhost -u User2 -p Password123 -o outrdp.csv -v 445.open
example tool output, results in CSV format [IP, domain, username]
Version: dev (n/a) - 11/10/99 - authdd
2020/11/10 16:38:20 > Using ->($$>(:0 -->
2020/11/10 16:38:20 > Domain: localhost
2020/11/10 16:38:20 > User: User1
2020/11/10 16:38:20 > Pass: Password123
2020/11/10 16:38:20 > NT Hash: 58a478135a93ac3bf058a5ea0e8fdb71
2020/11/10 16:38:21 > 10.0.0.104,DESKTOP-MSH9,Administrator
2020/11/10 16:38:21 > 10.0.0.104,DESKTOP-MSH9,user1
2020/11/10 16:38:21 > 10.0.0.104,DESKTOP-MSH9,user2
2020/11/10 16:38:21 > Done! in 0.420 seconds
Parse output to show IPs of machines where "Domain Users" group can RDP:
cat outrdp.csv | grep Domain\ Users
to download golang environment in debian linux sudo apt install golang
compile without including debugging (reduces the binary size by 30%~~ish)
go build -ldflags "-w -s" -o beachrpcgo main.go
./beachrpcgo -h
to specify binary architecture when compiling
GOOS="linux" GOARCH="amd64" go build main.go
beachrpcgo has a dependency on net (tool for administration of Samba and remote CIFS servers) and pth-net. tested on kali linux.
To download the patched pth kali tools which use password hashes as authentication input apt install passing-the-hash -y
Latest compiled version can be downloaded from releases here
wget https://github.com/addenial/beachrpcgo/releases/download/latest/beachrpcgo -O beachrpcgo
chmod +x beachrpcgo
./beachrpcgo help
versja edukacyjna golang goroutine lekkie nici przez środowisko uruchomieniowe Go shoutouts to ropnop for amaze code github.com/ropnop/kerbrute/