We must connect to the DC instead of the target because we can only enumerate domain groups on the DC

Author: NeffIsBack

nxc/modules/presence.py

@@ -19,11 +19,11 @@ def on_admin_login(self, context, connection):
         admin_users = []
 
         try:
-            string_binding = fr"ncacn_np:{connection.host}[\pipe\samr]"
+            string_binding = fr"ncacn_np:{connection.kdcHost}[\pipe\samr]"
             context.log.debug(f"Using string binding: {string_binding}")
 
             rpctransport = transport.DCERPCTransportFactory(string_binding)
-            rpctransport.setRemoteHost(connection.host)
+            rpctransport.setRemoteHost(connection.kdcHost)
             rpctransport.set_credentials(
                 connection.username,
                 connection.password,