Fix check admin false positive on certain target (e.g Netapp)

Pennyw0rth · Jul 20, 2024 · 48d6969 · 48d6969
1 parent 398716d
commit 48d6969
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/nxc/protocols/smb.py b/nxc/protocols/smb.py
@@ -581,7 +581,8 @@ def check_if_admin(self):
             try:
                 # 0xF003F - SC_MANAGER_ALL_ACCESS
                 # http://msdn.microsoft.com/en-us/library/windows/desktop/ms685981(v=vs.85).aspx
-                scmr.hROpenSCManagerW(dce, f"{self.host}\x00", "ServicesActive\x00", 0xF003F)
+                scmrobj = scmr.hROpenSCManagerW(dce, f"{self.host}\x00", "ServicesActive\x00", 0xF003F)
+                scmr.hREnumServicesStatusW(dce, scmrobj['lpScHandle'])
                 self.logger.debug(f"User is admin on {self.host}!")
                 self.admin_privs = True
             except scmr.DCERPCException: