From 02bdbef712d518e95bd04a1212980c3e349ebbbc Mon Sep 17 00:00:00 2001
From: Alexander Neff <alex99.neff@gmx.de>
Date: Sat, 23 Dec 2023 16:46:34 +0100
Subject: [PATCH] Fix host domain display output when specifying domain in smb

---
 nxc/protocols/smb.py | 29 ++++++++++++++++++-----------
 1 file changed, 18 insertions(+), 11 deletions(-)

diff --git a/nxc/protocols/smb.py b/nxc/protocols/smb.py
index bc3d681f..40d46a76 100755
--- a/nxc/protocols/smb.py
+++ b/nxc/protocols/smb.py
@@ -214,8 +214,23 @@ class smb(connection):
                 # no ntlm supported
                 self.no_ntlm = True
 
-        self.domain = self.conn.getServerDNSDomainName() if not self.no_ntlm else self.args.domain
-        self.hostname = self.conn.getServerName() if not self.no_ntlm else self.host
+        # self.domain is the attribute we authenticate with
+        # self.targetDomain is the attribute which gets displayed as host domain
+        if not self.no_ntlm:
+            self.hostname = self.conn.getServerName()
+            self.targetDomain = self.conn.getServerDNSDomainName()
+            if not self.targetDomain:   # Not sure if that can even happen but now we are safe
+                self.targetDomain = self.hostname
+        else:
+            self.hostname = self.host
+            self.targetDomain = self.hostname
+
+        self.domain = self.targetDomain if not self.args.domain else self.args.domain
+
+        if self.args.local_auth:
+            self.domain = self.hostname
+            self.targetDomain = self.hostname
+
         self.server_os = self.conn.getServerOS()
         self.logger.extra["hostname"] = self.hostname
 
@@ -230,9 +245,6 @@ class smb(connection):
         self.os_arch = self.get_os_arch()
         self.output_filename = os.path.expanduser(f"~/.nxc/logs/{self.hostname}_{self.host}_{datetime.now().strftime('%Y-%m-%d_%H%M%S')}".replace(":", "-"))
 
-        if not self.domain:
-            self.domain = self.hostname
-
         self.db.add_host(
             self.host,
             self.hostname,
@@ -248,11 +260,6 @@ class smb(connection):
         except Exception as e:
             self.logger.debug(f"Error logging off system: {e}")
 
-        if self.args.domain:
-            self.domain = self.args.domain
-        if self.args.local_auth:
-            self.domain = self.hostname
-
     def laps_search(self, username, password, ntlm_hash, domain):
         self.logger.extra["protocol"] = "LDAP"
         self.logger.extra["port"] = "389"
@@ -348,7 +355,7 @@ class smb(connection):
     def print_host_info(self):
         signing = colored(f"signing:{self.signing}", host_info_colors[0], attrs=["bold"]) if self.signing else colored(f"signing:{self.signing}", host_info_colors[1], attrs=["bold"])
         smbv1 = colored(f"SMBv1:{self.smbv1}", host_info_colors[2], attrs=["bold"]) if self.smbv1 else colored(f"SMBv1:{self.smbv1}", host_info_colors[3], attrs=["bold"])
-        self.logger.display(f"{self.server_os}{f' x{self.os_arch}' if self.os_arch else ''} (name:{self.hostname}) (domain:{self.domain}) ({signing}) ({smbv1})")
+        self.logger.display(f"{self.server_os}{f' x{self.os_arch}' if self.os_arch else ''} (name:{self.hostname}) (domain:{self.targetDomain}) ({signing}) ({smbv1})")
         if self.args.laps:
             return self.laps_search(self.args.username, self.args.password, self.args.hash, self.domain)
         return True