Use SMBv1 in connection info to get hostname from smbv1

Author: NeffIsBack

nxc/modules/maq.py

@@ -26,7 +26,7 @@ def options(self, context, module_options):
     def on_login(self, context, connection):
         context.log.display("Getting the MachineAccountQuota")
 
-        ldap_response = connection.search("(objectClass=*)", ["ms-DS-MachineAccountQuota"])
+        ldap_response = connection.search("(ms-DS-MachineAccountQuota=*)", ["ms-DS-MachineAccountQuota"])
         entries = parse_result_attributes(ldap_response)
 
         if not entries:

nxc/protocols/smb.py

@@ -154,10 +154,7 @@ def get_os_arch(self):
                 dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
             dce.connect()
             try:
-                dce.bind(
-                    MSRPC_UUID_PORTMAP,
-                    transfer_syntax=("71710533-BEBA-4937-8319-B5DBEF9CCC36", "1.0"),
-                )
+                dce.bind(MSRPC_UUID_PORTMAP, transfer_syntax=("71710533-BEBA-4937-8319-B5DBEF9CCC36", "1.0"))
             except DCERPCException as e:
                 if str(e).find("syntaxes_not_supported") >= 0:
                     dce.disconnect()
@@ -174,6 +171,10 @@ def enum_host_info(self):
         self.local_ip = self.conn.getSMBServer().get_socket().getsockname()[0]
         self.is_host_dc()
 
+        # Create SMBv1 connection to get host info, connection will be reinitiated on login
+        if not self.args.no_smbv1:
+            self.smbv1 = self.create_smbv1_conn()
+
         try:
             self.conn.login("", "")
             self.null_auth = True
@@ -274,10 +275,6 @@ def enum_host_info(self):
         except Exception as e:
             self.logger.debug(f"Error logging off system: {e}")
 
-        # Check smbv1
-        if not self.args.no_smbv1:
-            self.smbv1 = self.create_smbv1_conn(check=True)
-
         try:
             self.db.add_host(
                 self.host,
@@ -603,8 +600,6 @@ def create_conn_obj(self):
         Tries to create a connection object to the target host.
         On first try, it will try to create a SMBv3 connection.
         On further tries, it will remember which SMB version is supported and create a connection object accordingly.
-
-        :param no_smbv1: If True, it will not try to create a SMBv1 connection
         """
         # Initial negotiation
         if self.smbv3 is None: