From 1784d55baef313e430c4c6f52aaf1b2dbe54ec32 Mon Sep 17 00:00:00 2001 From: Marshall Hallenbeck Date: Mon, 13 Nov 2023 12:34:45 -0500 Subject: [PATCH 1/3] fix(smb errors): getErrorString only returns one item, not a tuple; fixes #117 --- nxc/protocols/smb.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/nxc/protocols/smb.py b/nxc/protocols/smb.py index bc3d681f..156074fe 100755 --- a/nxc/protocols/smb.py +++ b/nxc/protocols/smb.py @@ -439,7 +439,7 @@ class smb(connection): used_ccache = f" through S4U with {username}" self.logger.fail(f"{domain}\\{self.username}{used_ccache} {e}") except (SessionError, Exception) as e: - error, desc = e.getErrorString() + error = e.getErrorString() used_ccache = " from ccache" if useCache else f":{process_secret(kerb_pass)}" if self.args.delegate: used_ccache = f" through S4U with {username}" @@ -500,7 +500,7 @@ class smb(connection): self.create_conn_obj() return True except SessionError as e: - error, desc = e.getErrorString() + error = e.getErrorString() self.logger.fail( f'{domain}\\{self.username}:{process_secret(self.password)} {error} {f"({desc})" if self.args.verbose else ""}', color="magenta" if error in smb_error_status else "red", @@ -563,7 +563,7 @@ class smb(connection): self.create_conn_obj() return True except SessionError as e: - error, desc = e.getErrorString() + error = e.getErrorString() self.logger.fail( f"{domain}\\{self.username}:{process_secret(self.hash)} {error} {f'({desc})' if self.args.verbose else ''}", color="magenta" if error in smb_error_status else "red", @@ -920,7 +920,7 @@ class smb(connection): for disk in disks: self.logger.highlight(disk.disk) except Exception as e: - error, desc = e.getErrorString() + error = e.getErrorString() self.logger.fail( f"Error enumerating disks: {error}", color="magenta" if error in smb_error_status else "red", From 761cf715d06ced889109ffcf0ca789e1384f1d6e Mon Sep 17 00:00:00 2001 From: Marshall Hallenbeck Date: Mon, 13 Nov 2023 12:47:28 -0500 Subject: [PATCH 2/3] fix(ms17-010): better error handling to catch invalid SMB responses wduring check --- nxc/modules/ms17-010.py | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/nxc/modules/ms17-010.py b/nxc/modules/ms17-010.py index a16c7856..3ea9435a 100644 --- a/nxc/modules/ms17-010.py +++ b/nxc/modules/ms17-010.py @@ -62,10 +62,15 @@ class NXCModule: self.logger = context.log def on_login(self, context, connection): - if self.check(connection.host): - context.log.highlight("VULNERABLE") - context.log.highlight("Next step: https://www.rapid7.com/db/modules/exploit/windows/smb/ms17_010_eternalblue/") - + try: + if self.check(connection.host): + context.log.highlight("VULNERABLE") + context.log.highlight("Next step: https://www.rapid7.com/db/modules/exploit/windows/smb/ms17_010_eternalblue/") + except ConnectionResetError as e: + context.log.debug(f"Error connecting to host when checking for MS17-010: {e!s}") + except ValueError as e: + if str(e) == "Buffer size too small (0 instead of at least 32 bytes)": + context.log.debug("Buffer size too small, which means the response was not the expected size") def generate_smb_proto_payload(self, *protos): @@ -476,7 +481,7 @@ class NXCModule: # 0xC0000022 - STATUS_ACCESS_DENIED if nt_status == b"\x05\x02\x00\xc0": - self.logger.highlight(f"[+] [{ip}] is likely VULNERABLE to MS17-010! ({native_os.decode()})") + self.logger.highlight(f"[+] {ip} is likely VULNERABLE to MS17-010! ({native_os.decode()})") # vulnerable to MS17-010, check for DoublePulsar infection raw_proto = self.trans2_request(tree_id, process_id, user_id, multiplex_id) @@ -491,8 +496,8 @@ class NXCModule: key = self.calculate_doublepulsar_xor_key(smb.signature) self.logger.highlight(f"Host is likely INFECTED with DoublePulsar! - XOR Key: {key.decode()}") elif nt_status in (b"\x08\x00\x00\xc0", b"\x22\x00\x00\xc0"): - self.logger.fail(f"[-] [{ip}] does NOT appear vulnerable") + self.logger.fail(f"{ip} does NOT appear vulnerable") else: - self.logger.fail(f"[-] [{ip}] Unable to detect if this host is vulnerable") + self.logger.fail(f"{ip} Unable to detect if this host is vulnerable") client.close() From 9b619b86aa8841657f8c318682e7c3b4b85f5221 Mon Sep 17 00:00:00 2001 From: Marshall Hallenbeck Date: Mon, 13 Nov 2023 13:42:45 -0500 Subject: [PATCH 3/3] Revert "fix(smb errors): getErrorString only returns one item, not a tuple; fixes #117" This reverts commit 1784d55baef313e430c4c6f52aaf1b2dbe54ec32. --- nxc/protocols/smb.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/nxc/protocols/smb.py b/nxc/protocols/smb.py index 156074fe..bc3d681f 100755 --- a/nxc/protocols/smb.py +++ b/nxc/protocols/smb.py @@ -439,7 +439,7 @@ class smb(connection): used_ccache = f" through S4U with {username}" self.logger.fail(f"{domain}\\{self.username}{used_ccache} {e}") except (SessionError, Exception) as e: - error = e.getErrorString() + error, desc = e.getErrorString() used_ccache = " from ccache" if useCache else f":{process_secret(kerb_pass)}" if self.args.delegate: used_ccache = f" through S4U with {username}" @@ -500,7 +500,7 @@ class smb(connection): self.create_conn_obj() return True except SessionError as e: - error = e.getErrorString() + error, desc = e.getErrorString() self.logger.fail( f'{domain}\\{self.username}:{process_secret(self.password)} {error} {f"({desc})" if self.args.verbose else ""}', color="magenta" if error in smb_error_status else "red", @@ -563,7 +563,7 @@ class smb(connection): self.create_conn_obj() return True except SessionError as e: - error = e.getErrorString() + error, desc = e.getErrorString() self.logger.fail( f"{domain}\\{self.username}:{process_secret(self.hash)} {error} {f'({desc})' if self.args.verbose else ''}", color="magenta" if error in smb_error_status else "red", @@ -920,7 +920,7 @@ class smb(connection): for disk in disks: self.logger.highlight(disk.disk) except Exception as e: - error = e.getErrorString() + error, desc = e.getErrorString() self.logger.fail( f"Error enumerating disks: {error}", color="magenta" if error in smb_error_status else "red",