greenbone / openvas-smb

SMB module for OpenVAS Scanner
GNU General Public License v2.0
47 stars 47 forks source link

Error Failed to parse dcerpc binding 'ncacn_ip_tcp:FQDN[sign]q' #86

Open guillaumechardin opened 9 months ago

guillaumechardin commented 9 months ago

Hello, I use wmic compiled on master branch (v 23/01/2024).

I use this command : wmiclient --delimiter=, -U -d 9 monitoring@localdomain.local --password="secretpass" //server.localdomain.local[sign] "SELECT size,freespace FROM win32_logicaldisk"

here full debug output :

wmiclient --delimiter=, -U -d 9 monitoring@localdomain.local--password="secretpass" //server.localdomain.local[sign] "SELECT size,freespace FROM win32_logicaldisk" 
[/root/openvas-smb/samba/param/loadparm.c:597:init_globals()] Initialising global parameters
[/root/openvas-smb/samba/param/loadparm.c:2474:lp_load()] lp_load: refreshing parameters from /usr/local/etc/openvas/openvas-smb.conf
[/root/openvas-smb/samba/param/params.c:523:OpenConfFile()] params.c:OpenConfFile() - Unable to open configuration file "/usr/local/etc/openvas/openvas-smb.conf":
        No such file or directory
[/root/openvas-smb/samba/param/loadparm.c:2483:lp_load()] pm_process() returned No
[/root/openvas-smb/samba/param/loadparm.c:1354:lp_add_hidden()] adding hidden service IPC$
[/root/openvas-smb/samba/param/loadparm.c:1354:lp_add_hidden()] adding hidden service ADMIN$
[/root/openvas-smb/samba/auth/credentials/credentials_krb5.c:177:cli_credentials_set_ccache()] failed to get principal from default ccache: No such file or directory: get-principal lstat(/tmp/krb5cc_0)
[/root/openvas-smb/samba/auth/gensec/gensec.c:1234:gensec_register()] GENSEC backend 'spnego' registered
[/root/openvas-smb/samba/auth/gensec/gensec.c:1234:gensec_register()] GENSEC backend 'schannel' registered
[/root/openvas-smb/samba/auth/auth.c:452:auth_register()] AUTH backend 'sam' registered
[/root/openvas-smb/samba/auth/auth.c:452:auth_register()] AUTH backend 'sam_ignoredomain' registered
[/root/openvas-smb/samba/auth/auth.c:452:auth_register()] AUTH backend 'name_to_ntstatus' registered
[/root/openvas-smb/samba/auth/auth.c:452:auth_register()] AUTH backend 'fixed_challenge' registered
[/root/openvas-smb/samba/auth/auth.c:452:auth_register()] AUTH backend 'winbind_samba3' registered
[/root/openvas-smb/samba/auth/auth.c:452:auth_register()] AUTH backend 'winbind' registered
[/root/openvas-smb/samba/auth/auth.c:452:auth_register()] AUTH backend 'anonymous' registered
[/root/openvas-smb/samba/auth/gensec/gensec.c:1234:gensec_register()] GENSEC backend 'krb5' registered
[/root/openvas-smb/samba/auth/gensec/gensec.c:1211:gensec_register()] gensec subsystem fake_gssapi_krb5 is disabled
[/root/openvas-smb/samba/auth/gensec/gensec.c:1234:gensec_register()] GENSEC backend 'ntlmssp' registered
[/root/openvas-smb/samba/auth/gensec/gensec.c:1211:gensec_register()] gensec subsystem gssapi_spnego is disabled
[/root/openvas-smb/samba/auth/gensec/gensec.c:1234:gensec_register()] GENSEC backend 'gssapi_krb5' registered
[/root/openvas-smb/samba/auth/gensec/gensec.c:1234:gensec_register()] GENSEC backend 'gssapi_krb5_sasl' registered
[/root/openvas-smb/samba/lib/com/dcom/main.c:520:dcom_determine_rpc_binding()] Failed to parse dcerpc binding 'ncacn_ip_tcp:server.localdomain.local[sign]A'
[/root/openvas-smb/wmi/wmic.c:216:main()] ERROR: Login to remote object.
NTSTATUS: NT_STATUS_INVALID_INFO_CLASS - Invalid information class

When I change the FQDN to server IP address, wmic behave as expected and run without error :

wmiclient --delimiter=, -U -d 1 monitoring@localdomain.local--password="secretpass" //10.10.0.13[sign] "SELECT size,freespace FROM win32_logicaldisk"
[/root/openvas-smb/samba/param/params.c:523:OpenConfFile()] params.c:OpenConfFile() - Unable to open configuration file "/usr/local/etc/openvas/openvas-smb.conf":
        No such file or directory
[/root/openvas-smb/samba/lib/com/dcom/main.c:1177:bind_new_pipe()] /root/openvas-smb/samba/lib/com/dcom/main.c:1177: dcom_get_pipe: host=10.10.0.13, similar=10.10.0.13[53874]
[/root/openvas-smb/wmi/wmic.c:216:main()] OK   : Login to remote object.
[/root/openvas-smb/wmi/wmic.c:220:main()] OK   : WMI query execute.
[/root/openvas-smb/wmi/wmic.c:223:main()] OK   : Reset result of WMI query.
[/root/openvas-smb/wmi/wmic.c:232:main()] OK   : Retrieve result data.
CLASS: Win32_LogicalDisk
DeviceID,FreeSpace,Size
C:,60860735488,128202043392
D:,0,0

Any idea to fix the ncacn_ip_tcp:server.localdomain.local[sign]A' error ? Or what cause this ? Note that this issue occur one some server only.

Thanks.