NetExec icon indicating copy to clipboard operation
NetExec copied to clipboard

Fix reason code - was not displaying

Open godylockz opened this issue 1 year ago • 2 comments

Fix reason code - so it consistently displays.

Kept getting [-] on valid RDP credentials and couldn't figure out why. Is netexec not compatible with Credential Security Support Provider (CredSSP) / Network Level Authentication (NLA): ?

Xfreerdp worked, but only when setting tls-seclevel:0 flag.

/bin/xfreerdp /u:james /p:test /v:172.16.0.2 /cert-ignore /tls-seclevel:0

Before:

nxc rdp 172.16.0.2 -u james -p test
RDP         172.16.0.2      3389   DC               [*] Windows 8.1 or Windows Server 2012 R2 Build 9600 (name:DC) (domain:test.com) (nla:True)
RDP         172.16.0.2      3389   DC               [-] test.com\james:greenday

After:

nxc rdp 172.16.0.2 -u james -p test
RDP         172.16.0.2      3389   DC               [*] Windows 8.1 or Windows Server 2012 R2 Build 9600 (name:DC) (domain:test.com) (nla:True)
RDP         172.16.0.2      3389   DC               [-] test.com\james:greenday (CredSSP - Server verification failed!)

godylockz avatar Sep 27 '24 22:09 godylockz

Hey thanks for the PR! Can you explain what was the issue in the code and how this fixes it? Also, how could i reproduce the issue?

NeffIsBack avatar Sep 28 '24 11:09 NeffIsBack

Hey thanks for the PR! Can you explain what was the issue in the code and how this fixes it?

The reason was that the indication of the inconclusive result was not shown. I updated my previous post to show before/after behavior. The reason of the exception was never initialized to the exception so it isn't recognized by the end user.

Also, how could i reproduce the issue?

It can be reproduced by attempting a valid successful login on a Windows Server 2012 with CredSSP enabled.

godylockz avatar Sep 28 '24 14:09 godylockz

Sorry, couldn't get my setup to trigger the error and there are multiple issues with the code now. The variable reason was already used before and now multiple statements does not make sense anymore: image

NeffIsBack avatar Oct 04 '24 19:10 NeffIsBack

Closing this one in favor of #528

NeffIsBack avatar Dec 30 '24 21:12 NeffIsBack