PowerView fails when attempting to login with a computer account

[JeffTheDev00]

Problem : Powerview fails when attempting to connect with a computer account

Output :

powerview 'test-domain/client01$@10.10.10.10' --use-ldap --dc-ip 10.10.10.10 -H <ntlm hash here>                      
[2023-12-15 01:48:59] LDAP Signing NOT Enforced!
Traceback (most recent call last):
  File "/usr/local/bin/powerview", line 33, in <module>
    sys.exit(load_entry_point('powerview==0.5.1', 'console_scripts', 'powerview')())
  File "/usr/local/lib/python3.10/dist-packages/powerview-0.5.1-py3.10.egg/powerview/__init__.py", line 38, in main
    powerview = PowerView(conn, args)
  File "/usr/local/lib/python3.10/dist-packages/powerview-0.5.1-py3.10.egg/powerview/powerview.py", line 77, in __init__
    self.is_admincount = bool(self.get_domainuser(identity=self.username, properties=["adminCount"])[0]["attributes"]["adminCount"])
IndexError: list index out of range

Explanation : It seems that that the adminCount attribute cannot be found in ldap when connecting with a computer account. Likely because computer accounts do not have this attribute set which causes the script to fail as its not able to find the value and can't proceed without it.

Temporary Resolution : It seems that removing the following lines fixes the issue for now.

[aniqfakhrul]

Thanks for pointing this out. This us because powerview checks current user admin status by querying adminCount attribute which is not the case for computer accounts. We'll fix this. Thanks again

[JeffTheDev00]

Happy to help!

[JeffTheDev00]

Btw, it seems like this code from last week's commit fixes it(I was using an older commit myself) :

 try:
            curUserDetails = self.get_domainuser(identity=self.username, properties=["adminCount","memberOf"])[0]

            userGroup = curUserDetails.get("attributes").get("memberOf")
            if isinstance(userGroup, str):
                groups.append(userGroup)
            elif isinstance(userGroup, list):
                groups = userGroup 

            for group in groups:
                if "CN=Domain Admins".casefold() in group.casefold():
                    self.is_domainadmin = True
                    break

            if self.is_domainadmin:
                logging.info(f"User {self.username} is a Domain Admin")
            else:
                self.is_admincount = bool(curUserDetails["attributes"]["adminCount"])
                if self.is_admincount:
                    logging.info(f"User {self.username} has adminCount attribute set to 1. Might be admin somewhere somehow :)")
        except:
            logging.debug("Failed to check user admin status")

[aniqfakhrul]

Have you tried if it works with computer account?

[JeffTheDev00]

Nope haven't tried it yet, will give it a shot in a bit! Gonna have to spin up a dc real quick

[JeffTheDev00]

Just tested it and yep, can confirm that it does indeed work :

┌─[parrot@parrot]─[~/dev/powerview.py]                                                                                                                                                                             
└──╼ [★]$ python3 powerview.py 'test-domain/client01$@ip' --use-ldap --dc-ip someip -H somehash                                                                                  
[2024-01-08 18:12:08] LDAP Signing NOT Enforced!                                                                                                                                                                   
(LDAP)-[someip]-[test-domain\client01$]                                                                                                                                                                           
PV > get-domain                                                                                                                                                                                                    
objectClass                                     : top                                                                                                                                                              
                                                  domain                                                                                                                                                           
                                                  domainDNS 

[aniqfakhrul]

Thats good to know. I'll do some code cleaning to handle the errors.