Current master: Indexing SMB shares triggers stacktrace on exit and on export to CSV #775

sandervandegeijn · 2023-04-23T09:25:25Z

Describe the bug
Indexed 2500+ hosts successfully, then it gives the stack trace below. This happens after the last host in the list. Command executed:

crackmapexec smb hosts.up -u user -p pass --shares

hosts.up contains one ip per line.

Traceback (most recent call last):
  File "/usr/local/bin/crackmapexec", line 8, in <module>
    sys.exit(main())
             ^^^^^^
  File "/usr/local/lib/python3.11/site-packages/cme/crackmapexec.py", line 257, in main
    asyncio.run(
  File "/usr/local/lib/python3.11/asyncio/runners.py", line 190, in run
    return runner.run(main)
           ^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/asyncio/runners.py", line 118, in run
    return self._loop.run_until_complete(task)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/asyncio/base_events.py", line 653, in run_until_complete
    return future.result()
           ^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/cme/crackmapexec.py", line 105, in start_threadpool
    await asyncio.gather(*jobs)
  File "/usr/local/lib/python3.11/site-packages/cme/crackmapexec.py", line 69, in run_protocol
    await asyncio.wait_for(
  File "/usr/local/lib/python3.11/asyncio/tasks.py", line 442, in wait_for
    return await fut
           ^^^^^^^^^
  File "/usr/local/lib/python3.11/concurrent/futures/thread.py", line 58, in run
    result = self.fn(*self.args, **self.kwargs)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/cme/protocols/smb.py", line 143, in __init__
    connection.__init__(self, args, db, host)
  File "/usr/local/lib/python3.11/site-packages/cme/connection.py", line 65, in __init__
    self.proto_flow()
  File "/usr/local/lib/python3.11/site-packages/cme/connection.py", line 101, in proto_flow
    if self.login() or (self.username == '' and self.password == ''):
       ^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/cme/connection.py", line 300, in login
    elif self.plaintext_login(self.domain, user, password): return True
         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/cme/protocols/smb.py", line 450, in plaintext_login
    self.conn.login(self.username, self.password, domain)
  File "/usr/local/lib/python3.11/site-packages/impacket/smbconnection.py", line 276, in login
    return self._SMBConnection.login(user, password, domain, lmhash, nthash, ntlmFallback)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/impacket/smb.py", line 3494, in login
    self.login_extended(user, password, domain, lmhash, nthash, use_ntlmv2 = True)
  File "/usr/local/lib/python3.11/site-packages/impacket/smb.py", line 3402, in login_extended
    type3, exportedSessionKey = ntlm.getNTLMSSPType3(auth, respToken['ResponseToken'], user, password, domain, lmhash, nthash, use_ntlmv2 = use_ntlmv2)
                                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/impacket/ntlm.py", line 634, in getNTLMSSPType3
    ntResponse, lmResponse, sessionBaseKey = computeResponse(ntlmChallenge['flags'], ntlmChallenge['challenge'],
                                             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/impacket/ntlm.py", line 42, in computeResponse
    return computeResponseNTLMv2(flags, serverChallenge, clientChallenge, serverName, domain, user, password,
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/impacket/ntlm.py", line 907, in computeResponseNTLMv2
    av_pairs = AV_PAIRS(serverName)
               ^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/impacket/ntlm.py", line 210, in __init__
    self.fromString(data)
  File "/usr/local/lib/python3.11/site-packages/impacket/ntlm.py", line 233, in fromString
    fType = struct.unpack('<H',tInfo[:struct.calcsize('<H')])[0]
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

The shares seem to be in the database, so I tried to export it:

cmedb (default)(smb) > export shares detailed shares.csv

Traceback (most recent call last):
  File "/usr/local/bin/cmedb", line 8, in <module>
    sys.exit(main())
             ^^^^^^
  File "/usr/local/lib/python3.11/site-packages/cme/cmedb.py", line 400, in main
    cmedbnav = CMEDBMenu(config_path)
               ^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/cme/cmedb.py", line 300, in __init__
    self.do_proto(self.db)
  File "/usr/local/lib/python3.11/site-packages/cme/cmedb.py", line 326, in do_proto
    proto_menu.cmdloop()
  File "/usr/local/lib/python3.11/cmd.py", line 138, in cmdloop
    stop = self.onecmd(line)
           ^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/cmd.py", line 217, in onecmd
    return func(arg)
           ^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/cme/cmedb.py", line 137, in do_export
    entry.append(self.db.get_computers(share[1])[0][2])
                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^
IndexError: list index out of range

To Reproduce
Steps to reproduce the behavior:
see above

Expected behavior
Don't trigger the error

Screenshots
If applicable, add screenshots to help explain your problem.

Crackmapexec info
Master [d2ea13f]
Built a docker container from the Docker file on RHEL7.

Additional context

The text was updated successfully, but these errors were encountered:

sandervandegeijn · 2023-04-27T19:02:56Z

Don't know if this is the same error:

SMB         10.1.1.1      445    SERVER        [-] Connection Error: The NETBIOS connection with the remote host timed out.
Traceback (most recent call last):
  File "/usr/local/bin/cme", line 8, in <module>
    sys.exit(main())
             ^^^^^^
  File "/usr/local/lib/python3.11/site-packages/cme/crackmapexec.py", line 257, in main
    asyncio.run(
  File "/usr/local/lib/python3.11/asyncio/runners.py", line 190, in run
    return runner.run(main)
           ^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/asyncio/runners.py", line 118, in run
    return self._loop.run_until_complete(task)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/asyncio/base_events.py", line 653, in run_until_complete
    return future.result()
           ^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/cme/crackmapexec.py", line 105, in start_threadpool
    await asyncio.gather(*jobs)
  File "/usr/local/lib/python3.11/site-packages/cme/crackmapexec.py", line 69, in run_protocol
    await asyncio.wait_for(
  File "/usr/local/lib/python3.11/asyncio/tasks.py", line 442, in wait_for
    return await fut
           ^^^^^^^^^
  File "/usr/local/lib/python3.11/concurrent/futures/thread.py", line 58, in run
    result = self.fn(*self.args, **self.kwargs)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/cme/protocols/smb.py", line 143, in __init__
    connection.__init__(self, args, db, host)
  File "/usr/local/lib/python3.11/site-packages/cme/connection.py", line 65, in __init__
    self.proto_flow()
  File "/usr/local/lib/python3.11/site-packages/cme/connection.py", line 101, in proto_flow
    if self.login() or (self.username == '' and self.password == ''):
       ^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/cme/connection.py", line 300, in login
    elif self.plaintext_login(self.domain, user, password): return True
         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/cme/protocols/smb.py", line 450, in plaintext_login
    self.conn.login(self.username, self.password, domain)
  File "/usr/local/lib/python3.11/site-packages/impacket/smbconnection.py", line 278, in login
    return self._SMBConnection.login(user, password, domain, lmhash, nthash)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/impacket/smb3.py", line 952, in login
    packetID = self.sendSMB(packet)
               ^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/impacket/smb3.py", line 455, in sendSMB
    self._NetBIOSSession.send_packet(data)
  File "/usr/local/lib/python3.11/site-packages/impacket/nmb.py", line 912, in send_packet
    self._sock.sendall(p.rawData())
BrokenPipeError: [Errno 32] Broken pipe

Marshall-Hallenbeck · 2023-04-28T13:38:17Z

@ict-one-nl is there anyway you can share the data of the last share line? I can guess what the issue is, but without the actual data (or a representation of the data, filtered to protect sensitive information) it's hard to be exact.

sandervandegeijn · 2023-05-16T13:05:14Z

Sorry for the slow response - been on holiday and forgot afterwards. What data would you need? I'll see if I can make it happen.

Marshall-Hallenbeck · 2023-05-16T13:08:24Z

@ict-one-nl that's alright. Would it be possible for you to run cmedb and check if the host it is trying to print a share for actually exists in the CME DB?

sandervandegeijn · 2023-05-27T19:23:51Z

I'm having difficulty to pinpoint the data where it hurts, to diagnose I need to do this locally but that would alert the SOC. I'll try to have another go next week during business hours if I find the time. Did come across another stack trace.

ERROR:asyncio:Exception in callback BaseSelectorEventLoop._add_reader(0, <bound method...rt fd=0 idle>>)
handle: <Handle BaseSelectorEventLoop._add_reader(0, <bound method...rt fd=0 idle>>)>
Traceback (most recent call last):
  File "/usr/local/lib/python3.11/asyncio/selector_events.py", line 265, in _add_reader
    key = self._selector.get_key(fd)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/selectors.py", line 192, in get_key
    raise KeyError("{!r} is not registered".format(fileobj)) from None
KeyError: '0 is not registered'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/lib/python3.11/asyncio/events.py", line 80, in _run
    self._context.run(self._callback, *self._args)
  File "/usr/local/lib/python3.11/asyncio/selector_events.py", line 267, in _add_reader
    self._selector.register(fd, selectors.EVENT_READ,
  File "/usr/local/lib/python3.11/selectors.py", line 359, in register
    self._selector.register(key.fd, poller_events)
PermissionError: [Errno 1] Operation not permitted

NeffIsBack · 2023-05-27T19:41:42Z

Do you have access to the sponsored version? There will soon be a fix for the export.
The crash is likely caused when an error occures while adding a host to the database. Therefore the export of the shares crashes when trying to access the corresponding (missing) host.

The new error seems to be caused by an external package, not sure if we can do something about it. But the sponsored version has better error handling over all, maybe that helps.

sandervandegeijn · 2023-05-31T12:16:06Z

Not yet... I'm considering it, need to get approval (working for a university). That's just a question of pressing the buy link on https://porchetta.industries/subscriptions?selected=year right? :)

mpgn · 2023-05-31T13:34:00Z

We will push the private version soon on the public repo if you want to wait

sandervandegeijn · 2023-05-31T14:13:41Z

Will the public and the private version merge? Not that we're not willing to pay, two separate things :)

mpgn · 2023-05-31T14:16:20Z

yes, it will be merged together

sandervandegeijn · 2023-05-31T14:23:44Z

Okay, will retest after the merge. :)

sandervandegeijn changed the title ~~Current master: Indexing SMB shares triggers stacktrace after last host~~ Current master: Indexing SMB shares triggers stacktrace on exit and on export to CSV Apr 23, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Current master: Indexing SMB shares triggers stacktrace on exit and on export to CSV #775

Current master: Indexing SMB shares triggers stacktrace on exit and on export to CSV #775

sandervandegeijn commented Apr 23, 2023 •

edited

sandervandegeijn commented Apr 27, 2023

Marshall-Hallenbeck commented Apr 28, 2023

sandervandegeijn commented May 16, 2023

Marshall-Hallenbeck commented May 16, 2023

sandervandegeijn commented May 27, 2023

NeffIsBack commented May 27, 2023

sandervandegeijn commented May 31, 2023 •

edited

mpgn commented May 31, 2023

sandervandegeijn commented May 31, 2023

mpgn commented May 31, 2023

sandervandegeijn commented May 31, 2023

Current master: Indexing SMB shares triggers stacktrace on exit and on export to CSV #775

Current master: Indexing SMB shares triggers stacktrace on exit and on export to CSV #775

Comments

sandervandegeijn commented Apr 23, 2023 • edited

sandervandegeijn commented Apr 27, 2023

Marshall-Hallenbeck commented Apr 28, 2023

sandervandegeijn commented May 16, 2023

Marshall-Hallenbeck commented May 16, 2023

sandervandegeijn commented May 27, 2023

NeffIsBack commented May 27, 2023

sandervandegeijn commented May 31, 2023 • edited

mpgn commented May 31, 2023

sandervandegeijn commented May 31, 2023

mpgn commented May 31, 2023

sandervandegeijn commented May 31, 2023

sandervandegeijn commented Apr 23, 2023 •

edited

sandervandegeijn commented May 31, 2023 •

edited