S3cur3Th1sSh1t / WinPwn

Automation for internal Windows Penetrationtest / AD-Security
BSD 3-Clause "New" or "Revised" License
3.34k stars 518 forks source link

Error when Search for vulnerable Domain Systems - RBCD via Petitpotam + LDAP relay #25

Closed PentesterTN closed 3 years ago

PentesterTN commented 3 years ago

Hey, it's me again :) ,I got this message when choosing the option 22. Search for vulnerable Domain Systems - RBCD via Petitpotam + LDAP relay I'm using the offline module

Below the error message: field : Cannot bind argument to parameter 'Type' because it is null. At line:12806 char:31

field : Cannot bind argument to parameter 'Type' because it is null. At line:12839 char:21

Start DAV RPC Scan for Windows Servers only (alternatively we can scan all Servers + Clients but this can take a while)? (yes/no): yes Searching for active Servers in the domain, this can take a while depending on the domain size Exception calling "GetNames" with "1" argument(s): "Value cannot be null. Parameter name: enumType" At line:3716 char:9

horsier : Cannot validate argument on parameter 'ValidateSet'. The argument is null or empty. Provide an argument that is not null or empty, and then try the command again. At line:3720 char:46

The right operand of '-as' must be a type. At line:1897 char:17

The right operand of '-as' must be a type. At line:1904 char:17

The right operand of '-as' must be a type. At line:1897 char:17

The right operand of '-as' must be a type. At line:1904 char:17

The right operand of '-as' must be a type. At line:1897 char:17

The right operand of '-as' must be a type. At line:1904 char:17

The right operand of '-as' must be a type. At line:1897 char:17

The right operand of '-as' must be a type. At line:1904 char:17

The right operand of '-as' must be a type. At line:1897 char:17

The right operand of '-as' must be a type. At line:1904 char:17

The right operand of '-as' must be a type. At line:1897 char:17

The right operand of '-as' must be a type. At line:1904 char:17

The right operand of '-as' must be a type. At line:1897 char:17

The right operand of '-as' must be a type. At line:1904 char:17

The right operand of '-as' must be a type. At line:1897 char:17

The right operand of '-as' must be a type. At line:1904 char:17

The right operand of '-as' must be a type. At line:1897 char:17

The right operand of '-as' must be a type. At line:1904 char:17

The right operand of '-as' must be a type. At line:1897 char:17

The right operand of '-as' must be a type. At line:1904 char:17

The right operand of '-as' must be a type. At line:1897 char:17

The right operand of '-as' must be a type. At line:1904 char:17

The right operand of '-as' must be a type. At line:1897 char:17

The right operand of '-as' must be a type. At line:1904 char:17

The right operand of '-as' must be a type. At line:1897 char:17

The right operand of '-as' must be a type. At line:1904 char:17

The right operand of '-as' must be a type. At line:1897 char:17

The right operand of '-as' must be a type. At line:1904 char:17

The right operand of '-as' must be a type. At line:1897 char:17

The right operand of '-as' must be a type. At line:1904 char:17

S3cur3Th1sSh1t commented 3 years ago

The first issue was an Powerview compatibility issue. I'm using at least two different Powerview Versions with different functions in WinPwn. When Loading the first Powerview Version and loading the seccond one afterwards some functions are broken because they are overwritten.

I think, that this has the same cause. But the function only loads $viewdevobfs, so I think you did other checks before that loaded the other PowerView version into memory.

To verify this - can you run only this one check from a new Powershell process? This should not result in the same behaviour.

PentesterTN commented 3 years ago

you're absolutely correct, it worked now when I only run it, thanks, I will close this now.