22from impacket .dcerpc .v5 import tsts as TSTS
33from impacket .dcerpc .v5 .rpcrt import RPC_C_AUTHN_LEVEL_PKT_PRIVACY
44from contextlib import suppress
5+ import traceback
56
67
78class NXCModule :
@@ -15,9 +16,9 @@ def options(self, context, module_options):
1516 """There are no module options."""
1617
1718 def on_admin_login (self , context , connection ):
18- try :
19- context .log .debug (f"Target NetBIOS Name: { connection .hostname } " )
19+ admin_users = []
2020
21+ try :
2122 string_binding = fr"ncacn_np:{ connection .host } [\pipe\samr]"
2223 context .log .debug (f"Using string binding: { string_binding } " )
2324
@@ -37,32 +38,17 @@ def on_admin_login(self, context, connection):
3738 dce .connect ()
3839 dce .bind (samr .MSRPC_UUID_SAMR )
3940
40- server_handle = samr .hSamrConnect2 (dce )["ServerHandle" ]
41-
42- try :
43- resp = samr .hSamrEnumerateDomainsInSamServer (dce , server_handle )
44- domain = resp ["Buffer" ]["Buffer" ][0 ]["Name" ]
45- except Exception as e :
46- context .log .fail (f"Could not enumerate domains: { e !s} " )
47- return False
48-
49- admin_users = set ()
50- usernames = set ()
51- self .sid_to_user = {} # dictionary mapping sid string to username
52-
5341 try :
42+ server_handle = samr .hSamrConnect2 (dce )["ServerHandle" ]
43+ domain = samr .hSamrEnumerateDomainsInSamServer (dce , server_handle )["Buffer" ]["Buffer" ][0 ]["Name" ]
5444 resp = samr .hSamrLookupDomainInSamServer (dce , server_handle , domain )
5545 domain_sid = resp ["DomainId" ].formatCanonical ()
56- context .log .debug (f"Resolved domain SID for { domain } : { domain_sid } " )
57- except Exception as e :
58- context .log .debug (f"Failed to lookup SID for domain { domain } : { e !s} " )
59- return False
60-
61- try :
6246 domain_handle = samr .hSamrOpenDomain (dce , server_handle , samr .DOMAIN_LOOKUP | samr .DOMAIN_LIST_ACCOUNTS , resp ["DomainId" ])["DomainHandle" ]
47+ context .log .debug (f"Resolved domain SID for { domain } : { domain_sid } " )
6348 except Exception as e :
64- context .log .debug (f"Failed to open domain { domain } : { e !s} " )
65- return False
49+ context .log .fail (f"Failed to open domain { domain } : { e !s} " )
50+ context .log .debug (traceback .format_exc ())
51+ return
6652
6753 admin_rids = {
6854 "Domain Admins" : 512 ,
0 commit comments