Fixing KDC_ERR_S_UNKNOWN_PRINCIPAL in case of NTLM restriction for WS2025 - #1347
Fixing KDC_ERR_S_UNKNOWN_PRINCIPAL in case of NTLM restriction for WS2025#1347XedSama wants to merge 2 commits into
Conversation
|
I think it’s best not to use the |
| self.logger.debug("NTLM not supported") | ||
|
|
||
| aggressive_check = bool(self.args.generate_hosts_file or self.args.generate_krb5_file) | ||
| aggressive_check = bool(self.args.generate_hosts_file or self.args.generate_krb5_file or self.kerberos) |
There was a problem hiding this comment.
i don't understand or self.kerberos ?
There was a problem hiding this comment.
The aggressive check was only enabled when the --generate-krb5-file and --generate-hosts-file arguments were used. I think it should also be enabled when the -k/--kerberos argument is used.
There was a problem hiding this comment.
It's a deliberate choice to avoid noise and agressive check, it's even more important behind a proxychains
There was a problem hiding this comment.
I hadn’t actually taken Proxychains into account. As for the noise, I’m well aware of it, but it seems less of a problem to me than having to wait for a response after the 2-second rate limit. However, I think we could use the _is_dc_via_kerberos function first, before the _is_dc_via_rpc function, as the former is less noisy than the latter.
There was a problem hiding this comment.
i see your point, but it could be the subject of another pr, let me check
There was a problem hiding this comment.
Nice ! I'll edit my PR to take this in account and not make a duplicate
There was a problem hiding this comment.
Not sure what would be a good solution to accurately detect that NTLM is disabled for rate-limited WS2025. Adding increase_auth_timeout() works like a charm but it make the null probe at least 2s long, which seems very hard to accept.
|
Hey everyone, what's the state of this PR? Was the original issue solved by #1351? |
|
Not entirely, as it is still not possible to determine with certainty whether NTLM is disabled when rate limiting is in place. I won’t be able to work on it this week, but I plan to get back to it as soon as possible. |
|
Sounds good. Ima turn it into a draft then so I see that this is not ready for a review then. Just press the "ready for review" button if I should take a look at it. |
3 participants
Description
This PR resolves issue #1312 by adding support for the rate-limiting introduced by WS2025 to the
enum_host_infoand_is_dc_via_smbfunctions.During the null auth at the start of the
enum_host_infofunction, theNetBIOSTimeoutexception is not handled correctly. Whilst thenull_authvariable is correctly set toFalse, this is not the case forno_ntlm, which distorts the detection later in the function.The
ntlm_probe_failedvariable effectively detects whether rate limiting is in place; it also reroutes the_is_dc_via_smbfunction and setsno_ntlmtotrue.Finally, the aggressive check conditions for DC detection have been extended to include the use of the Kerberos flag (-k), which, in the case of rate-limiting and the NTLM protocol being disabled, still ensures accurate detection.
The quality of the PR is somewhat questionable in my opinion, but after testing, it seems to work quite well and does not introduce any regressions.
Type of change
Insert an "x" inside the brackets for relevant items (do not delete options)
Setup guide for the review
Server : Windows Server 2025
Additional :
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" /v RestrictReceivingNTLMTraffic /t REG_DWORD /d 2 /fto disable NTLM trafficScreenshots (if appropriate):
Checklist:
Insert an "x" inside the brackets for completed and relevant items (do not delete options)
poetry run ruff check ., use--fixto automatically fix what it can)tests/e2e_commands.txtfile if necessary (new modules or features are required to be added to the e2e tests)