From 5983b86b52f85e78b17457f47fd2ba5c92df7871 Mon Sep 17 00:00:00 2001
From: termanix <50464194+termanix@users.noreply.github.com>
Date: Tue, 25 Jun 2024 18:51:32 +0300
Subject: [PATCH 1/3] Small Bug Fix on Listing SMB Shares with Kerberos Auth

This is a bug I came across while working with Kerberos on another project.  If the information of the user in the ticket is not in the database, it gives an index error cause of user_id is empty. I thought about adding the ticket information as user_id, but since it wouldn't have any meaning when it expired, I proceeded with pass.


Signed-off-by: termanix <50464194+termanix@users.noreply.github.com>
---
 nxc/protocols/smb.py | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/nxc/protocols/smb.py b/nxc/protocols/smb.py
index b793a2a2..8bc72eee 100755
--- a/nxc/protocols/smb.py
+++ b/nxc/protocols/smb.py
@@ -763,6 +763,11 @@ class smb(connection):
         try:
             self.logger.debug(f"domain: {self.domain}")
             user_id = self.db.get_user(self.domain.upper(), self.username)[0][0]
+        except IndexError as e:
+            if self.use_kcache:
+                pass
+            else
+                self.logger.fail(f"IndexError: {str(e)}")
         except Exception as e:
             error = get_error_string(e)
             self.logger.fail(f"Error getting user: {error}")

From 9f3a77c2abe5dfbde451187fe3ead30fa6d0bfde Mon Sep 17 00:00:00 2001
From: Alexander Neff <alex99.neff@gmx.de>
Date: Tue, 2 Jul 2024 10:26:58 -0400
Subject: [PATCH 2/3] Fix missing colon

---
 nxc/protocols/smb.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nxc/protocols/smb.py b/nxc/protocols/smb.py
index 8bc72eee..66a92e44 100755
--- a/nxc/protocols/smb.py
+++ b/nxc/protocols/smb.py
@@ -766,7 +766,7 @@ class smb(connection):
         except IndexError as e:
             if self.use_kcache:
                 pass
-            else
+            else:
                 self.logger.fail(f"IndexError: {str(e)}")
         except Exception as e:
             error = get_error_string(e)

From 64e78fd7cd85c113f9d9c566cd8d380cb15eedef Mon Sep 17 00:00:00 2001
From: Alexander Neff <alex99.neff@gmx.de>
Date: Tue, 2 Jul 2024 10:56:59 -0400
Subject: [PATCH 3/3] Fixing shares function with kerberos and minor database
 stuff

---
 nxc/protocols/smb.py | 20 +++++++-------------
 1 file changed, 7 insertions(+), 13 deletions(-)

diff --git a/nxc/protocols/smb.py b/nxc/protocols/smb.py
index 66a92e44..e027c236 100755
--- a/nxc/protocols/smb.py
+++ b/nxc/protocols/smb.py
@@ -397,11 +397,11 @@ class smb(connection):
             self.logger.debug(f"{self.is_guest=}")
             if "Unix" not in self.server_os:
                 self.check_if_admin()
+
             self.logger.debug(f"Adding credential: {domain}/{self.username}:{self.password}")
             self.db.add_credential("plaintext", domain, self.username, self.password)
             user_id = self.db.get_credential("plaintext", domain, self.username, self.password)
             host_id = self.db.get_hosts(self.host)[0].id
-
             self.db.add_loggedin_relation(user_id, host_id)
 
             out = f"{domain}\\{self.username}:{process_secret(self.password)} {self.mark_guest()}{self.mark_pwned()}"
@@ -411,14 +411,7 @@ class smb(connection):
                 add_user_bh(self.username, self.domain, self.logger, self.config)
             if self.admin_privs:
                 self.logger.debug(f"Adding admin user: {self.domain}/{self.username}:{self.password}@{self.host}")
-                self.db.add_admin_user(
-                    "plaintext",
-                    domain,
-                    self.username,
-                    self.password,
-                    self.host,
-                    user_id=user_id,
-                )
+                self.db.add_admin_user("plaintext", domain, self.username, self.password, self.host, user_id=user_id)
                 add_user_bh(f"{self.hostname}$", domain, self.logger, self.config)
 
             # check https://github.com/byt3bl33d3r/CrackMapExec/issues/321
@@ -469,9 +462,10 @@ class smb(connection):
             self.logger.debug(f"{self.is_guest=}")
             if "Unix" not in self.server_os:
                 self.check_if_admin()
-            user_id = self.db.add_credential("hash", domain, self.username, self.hash)
-            host_id = self.db.get_hosts(self.host)[0].id
 
+            self.db.add_credential("hash", domain, self.username, self.hash)
+            user_id = self.db.get_credential("hash", domain, self.username, self.hash)
+            host_id = self.db.get_hosts(self.host)[0].id
             self.db.add_loggedin_relation(user_id, host_id)
 
             out = f"{domain}\\{self.username}:{process_secret(self.hash)} {self.mark_guest()}{self.mark_pwned()}"
@@ -764,10 +758,10 @@ class smb(connection):
             self.logger.debug(f"domain: {self.domain}")
             user_id = self.db.get_user(self.domain.upper(), self.username)[0][0]
         except IndexError as e:
-            if self.use_kcache:
+            if self.kerberos:
                 pass
             else:
-                self.logger.fail(f"IndexError: {str(e)}")
+                self.logger.fail(f"IndexError: {e!s}")
         except Exception as e:
             error = get_error_string(e)
             self.logger.fail(f"Error getting user: {error}")