Improved zero logon exploiter to fail on failed domain controller name fetch.

This commit is contained in:
VakarisZ 2021-02-25 16:20:52 +02:00
parent 67fd1712b5
commit e9b84ff86d
2 changed files with 17 additions and 8 deletions

View File

@ -48,3 +48,7 @@ class VersionServerConnectionError(Exception):
class FindingWithoutDetailsError(Exception):
""" Raise when pulling events for a finding, but get none """
class DomainControllerNameFetchError(FailedExploitationError):
""" Raise on failed attemt to extract domain controller's name """

View File

@ -4,6 +4,9 @@ from typing import Optional
import nmb.NetBIOS
from impacket.dcerpc.v5 import nrpc, rpcrt
from common.common_consts.timeouts import SHORT_REQUEST_TIMEOUT, MEDIUM_REQUEST_TIMEOUT
from common.utils.exceptions import DomainControllerNameFetchError
LOG = logging.getLogger(__name__)
@ -18,14 +21,16 @@ def _get_dc_name(dc_ip: str) -> str:
"""
Gets NetBIOS name of the Domain Controller (DC).
"""
try:
nb = nmb.NetBIOS.NetBIOS()
name = nb.queryIPForName(
ip=dc_ip
) # returns either a list of NetBIOS names or None
return name[0] if name else ""
except BaseException as ex:
LOG.info(f"Exception: {ex}")
nb = nmb.NetBIOS.NetBIOS()
name = nb.queryIPForName(
ip=dc_ip,
timeout=MEDIUM_REQUEST_TIMEOUT
) # returns either a list of NetBIOS names or None
if name:
return name[0]
else:
raise DomainControllerNameFetchError("Couldn't get domain controller's name, maybe it's on external network?")
def is_exploitable(zerologon_exploiter_object) -> (bool, Optional[rpcrt.DCERPC_v5]):