fix(smb): stop truncating the NTLM domain on bare-username auth - #7
Open
WaiZ0 wants to merge 1 commit into
Open
Conversation
_split_user_domain fell back to default_domain.split(".")[0] (e.g.
"sccm.lab" -> "sccm") when the operator supplies a bare username with
no DOMAIN\ or user@domain prefix. A DC accepts the truncated form
because it is self-authoritative, but a member server's Netlogon
pass-through can reject it -- confirmed against a live lab where the
same credentials succeeded via netexec (full DNS domain) and failed
via this client (truncated domain) against every non-DC host.
Delegate to the shared split_user_domain (openhound_collector_common,
already used by wmi.py) instead of the private duplicate, which does
not truncate. Also stops truncating the domain on the null-session
fallback for consistency.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Found while validating this collector's SCCM Hierarchy TAKEOVER-1 detection against a GOAD
SCCM lab, as a domain user. I'm a bad user and did not read the doc:
-uneedsdomain\usernameand I just supplied the username, like many other tools allow.
The bare-username case is still an explicit, reachable fallback in
_split_user_domain, not arejected input. It fell back to
default_domain.split(".")[0](e.g. "sccm.lab" -> "sccm"),assuming a domain's NetBIOS name is always its DNS domain's first label. That assumption can be
wrong, and is wrong in this lab: its real NetBIOS name is
SCCMLAB.http_auth.pyhas documented, since this repo's first commit, that smb_sso.py importssplit_user_domainfrom there -- it never did;_split_user_domainwas a separate, buggyduplicate moved verbatim from collectors/registry.py instead.
Delegates to the shared
split_user_domain(openhound_collector_common, already used bywmi.py).