Open daniel-cues opened 2 years ago
did this result in \r being placed after usernames in requests by chance? seeing that in wireshark and cant figure out why known valid logins are returning as false negatives
Nevermind found solution to my problem. Add a whitespace after each username or it will send a carriage return following the username (analyzed at packet level with wireshark) and cause logon failures even when password is accurate
it still sends a carriage return username as an attempted logon in following packet but does so seperately. As long as their isn't a username of r on the network it shouldnt cause any lockout issues
The script uses
Without modifying IFS as so (this might be an improper fix though, as far as I'm concerned, the actual way to read lines in bash is with read, as in the password reading part of the script):
This translates into usernames with whitespace in them not being supported. the logs also use "cut -d ' ' ", that would also break with whitespace in the username