byt3bl33d3r / CrackMapExec

A swiss army knife for pentesting networks
BSD 2-Clause "Simplified" License
8.37k stars 1.64k forks source link

Kerberos authentication fails because of inability to specify "kdcHost" argument #524

Closed Alh4zr3d closed 2 years ago

Alh4zr3d commented 2 years ago

Describe the bug Using CrackMapExec with the -k argument for Kerberos authentication fails, complaining of "missing positional argument kdcHost", even when a KDC FQDN is supplied through the --kdcHost parameter.

To Reproduce Steps to reproduce the behavior:

  1. Attempt to authenticate via Kerberos.

Expected behavior The --kdcHost parameter is expected to actually work and pass the provided value to the kerberos_login() function in the code.

Screenshots

proxychains4 crackmapexec smb 10.10.6.117 -k --kdcHost dc01.vipr.lab
[proxychains] config file found: /pentest/tools/redshell/proxychains_redshell.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
SMB         10.10.6.117     445    DC01             [*] Windows Server 2016 Standard 14393 x64 (name:DC01) (domain:vipr.lab) (signing:True) (SMBv1:True)
Traceback (most recent call last):
  File "/usr/bin/crackmapexec", line 8, in <module>
    sys.exit(main())
  File "/usr/lib/python3/dist-packages/cme/crackmapexec.py", line 254, in main
    asyncio.run(
  File "/usr/lib/python3.9/asyncio/runners.py", line 44, in run
    return loop.run_until_complete(main)
  File "/usr/lib/python3.9/asyncio/base_events.py", line 642, in run_until_complete
    return future.result()
  File "/usr/lib/python3/dist-packages/cme/crackmapexec.py", line 102, in start_threadpool
    await asyncio.gather(*jobs)
  File "/usr/lib/python3/dist-packages/cme/crackmapexec.py", line 68, in run_protocol
    await asyncio.wait_for(
  File "/usr/lib/python3.9/asyncio/tasks.py", line 442, in wait_for
    return await fut
  File "/usr/lib/python3.9/concurrent/futures/thread.py", line 58, in run
    result = self.fn(*self.args, **self.kwargs)
  File "/usr/lib/python3/dist-packages/cme/protocols/smb.py", line 125, in __init__
    connection.__init__(self, args, db, host)
  File "/usr/lib/python3/dist-packages/cme/connection.py", line 62, in __init__
    self.proto_flow()
  File "/usr/lib/python3/dist-packages/cme/connection.py", line 98, in proto_flow
    if self.login() or (self.username == '' and self.password == ''):
  File "/usr/lib/python3/dist-packages/cme/connection.py", line 163, in login
    if self.kerberos_login(self.aesKey, self.kdcHost): return True
TypeError: kerberos_login() missing 1 required positional argument: 'kdcHost'

Crackmapexec info

Additional context Add any other context about the problem here.

Alh4zr3d commented 2 years ago

Still not sure what the issue was, but upgrading from 5.2.2 to 5.2.3 and installing via a virtualenv seems to have corrected the issue. I'll close it here. Sorry to be a pest!

mpgn commented 2 years ago

Yep I fix this problem on v5.2.3 :)

https://github.com/byt3bl33d3r/CrackMapExec/commit/bc137a005c03b3d4d3ec8fda2603141ad7eacdb9