byt3bl33d3r / CrackMapExec

A swiss army knife for pentesting networks
BSD 2-Clause "Simplified" License
8.38k stars 1.64k forks source link

smb/rid-brute MAX_RID handled as string #204

Closed JelmerDeHen closed 6 years ago

JelmerDeHen commented 7 years ago

Hello! When enumerating users by bruteforcing RID's it crashes with specified MAX_RID.

$ cme smb ip -u user -p pw -d domain --rid-brute 1000
...
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/gevent/greenlet.py", line 536, in run
    result = self._run(*self.args, **self.kwargs)
  File "/usr/lib/python2.7/site-packages/crackmapexec-4.0.0.dev0-py2.7.egg/cme/protocols/smb.py", line 108, in __init__
    connection.__init__(self, args, db, host)
  File "/usr/lib/python2.7/site-packages/crackmapexec-4.0.0.dev0-py2.7.egg/cme/connection.py", line 39, in __init__
    self.proto_flow()
  File "/usr/lib/python2.7/site-packages/crackmapexec-4.0.0.dev0-py2.7.egg/cme/connection.py", line 75, in proto_flow
    self.call_cmd_args()
  File "/usr/lib/python2.7/site-packages/crackmapexec-4.0.0.dev0-py2.7.egg/cme/connection.py", line 82, in call_cmd_args
    getattr(self, k)()
  File "/usr/lib/python2.7/site-packages/crackmapexec-4.0.0.dev0-py2.7.egg/cme/protocols/smb.py", line 747, in rid_brute
    for j in range(maxRid/SIMULTANEOUS+1):
TypeError: unsupported operand type(s) for /: 'str' and 'int'

I fixed it locally by int casting during assignment.

/usr/lib/python2.7/site-packages/crackmapexec-4.0.0.dev0-py2.7.egg/cme/protocols/smb.py:702
            maxRid = int(self.args.rid_brute)
JelmerDeHen commented 7 years ago
    for pattern in self.pattern:                   
TypeError: 'NoneType' object is not iterable     

^ here is a different crash when --spider without a --pattern, simple fix through --pattern '.'.

byt3bl33d3r commented 6 years ago

Should be fixed now. Thanks!