You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
When running nxc smb ... --groups, passing an NT hash via -H will
result in a usage error, despite that being supported for other
subcommands like --users.
This is due to the Pywerview library's behavior when given an NT hash by
itself - it expects to find LM:NT, not simply NT. This is not called for
most nxc smb ... commands, but is for --groups. The CLI utility
bundled with Pywerview compensates by prepending a dummy LM: before
calling the library, but NetExec does not do so. Using options such as --users,
takes a different code path that does not reference the block of code in requester.py
that is used for --groups.
The following was tested with NetExec 1.3.0 (NeedForSpeed - Kali Linux)
and PywerView 0.3.3.
To Reproduce
Steps to reproduce the behavior:
Command: netexec smb <TARGET> -u <USERNAME> -H <HASH> --groups
Resulted in:
SMB <IP REDACTED> 445 <HOST REDACTED> [-] Error enumerating domain group using dc ip <IP REDACTED>: NTLM needs domain\username and a password
Expected behavior
The command should successfully enumerate groups as it does when enumerating users
(i.e. --users).
NetExec info
OS: Kali
Version of nxc: NetExec 1.3.0 (NeedForSpeed - Kali Linux)
Additional context
A workaround for the problem is to supply a generic LM hash or random
combination of hex characters 32 bytes in length before the NT hash.
Both of the following commands results in successful enumeration of groups:
This works because connection.py validates the NTLM hash by looking at the length.
As another workaround, we can do similar to what Pywerview's own CLI does,
by checking each provided hash argument; if it is a plain single hash,
prepend a dummy LM: to the string. With this in
place, --users and other methods still work fine (they will use the NT half of an LM:NT argument), and --groups works as well.
A proof-of-concept fix will be submitted as a PR.
The text was updated successfully, but these errors were encountered:
kreed-kl
added a commit
to kreed-kl/NetExec
that referenced
this issue
Feb 10, 2025
Describe the bug
When running
nxc smb ... --groups
, passing an NT hash via-H
willresult in a usage error, despite that being supported for other
subcommands like
--users
.This is due to the Pywerview library's behavior when given an NT hash by
itself - it expects to find LM:NT, not simply NT. This is not called for
most
nxc smb ...
commands, but is for--groups
. The CLI utilitybundled with Pywerview compensates by prepending a dummy
LM:
beforecalling the library, but NetExec does not do so. Using options such as
--users
,takes a different code path that does not reference the block of code in
requester.py
that is used for
--groups
.The following was tested with NetExec 1.3.0 (NeedForSpeed - Kali Linux)
and PywerView 0.3.3.
To Reproduce
Steps to reproduce the behavior:
Command:
netexec smb <TARGET> -u <USERNAME> -H <HASH> --groups
Resulted in:
Expected behavior
The command should successfully enumerate groups as it does when enumerating users
(i.e.
--users
).NetExec info
Additional context
A workaround for the problem is to supply a generic LM hash or random
combination of hex characters 32 bytes in length before the NT hash.
Both of the following commands results in successful enumeration of groups:
nxc smb <TARGET> -u "Administrator" -H "aad3b435b51404eeaad3b435b51404ee:<NTHASH>" --groups"
nxc smb <TARGET> -u "Administrator" -H "abcdabcdabcdabcdabcdabcdabcdabcd:<NTHASH>" --groups
This works because
connection.py
validates the NTLM hash by looking at the length.As another workaround, we can do similar to what Pywerview's own CLI does,
by checking each provided hash argument; if it is a plain single hash,
prepend a dummy
LM:
to the string. With this inplace,
--users
and other methods still work fine (they will use theNT
half of anLM:NT
argument), and--groups
works as well.A proof-of-concept fix will be submitted as a PR.
The text was updated successfully, but these errors were encountered: