enum_trusts not working

[ronen1n]

enum_trusts not working on several DCs

.\nxc.exe ldap us-dc -u us\studentuser55 -p 7fySHxncnPQS3vrW -M enum_trusts

SMB         192.168.1.2     445    US-DC            [*] Windows 10.0 Build 17763 x64 (name:US-DC) (domain:us.techcorp.local) (signing:True) (SMBv1:False)
LDAP        192.168.1.2     389    US-DC            [+] us\studentuser55:7fySHxncnPQS3vrW
[02:47:14] ERROR    Exception while calling proto_flow() on target 192.168.1.2: Error in searchRequest -> referral: 0000202B: RefErr: DSID-0310084A, data 0, 1     connection.py:123
                    access points
                        ref 1: 'us'
                                                                                                                                                                                    
                    ╭──────────────────────────────────────────────────── Traceback (most recent call last) ─────────────────────────────────────────────────────╮
                    │ in __init__:121                                                                                                                            │
                    │                                                                                                                                            │
                    │ in proto_flow:171                                                                                                                          │
                    │                                                                                                                                            │
                    │ in call_modules:225                                                                                                                        │
                    │                                                                                                                                            │
                    │ C:\Users\STUDEN~1\AppData\Local\Temp\_MEI38962\nxc\modules\trust.py:25 in on_login                                                         │
                    │                                                                                                                                            │
                    │   22 │   │   attributes = ["flatName", "trustPartner", "trustDirection", "trustAttributes"]                                                │
                    │   23 │   │                                                                                                                                 │
                    │   24 │   │   context.log.debug(f"Search Filter={search_filter}")                                                                           │
                    │ ❱ 25 │   │   resp = connection.ldapConnection.search(searchBase=domain_dn,                                                                 │
                    │      searchFilter=search_filter, attributes=attributes, sizeLimit=0)                                                                       │
                    │   26 │   │                                                                                                                                 │
                    │   27 │   │   trusts = []                                                                                                                   │
                    │   28 │   │   context.log.debug(f"Total of records returned {len(resp)}")                                                                   │
                    │                                                                                                                                            │
                    │ in search:402                                                                                                                              │
                    ╰────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
                    LDAPSearchError: Error in searchRequest -> referral: 0000202B: RefErr: DSID-0310084A, data 0, 1 access points
                            ref 1: 'us'

NetExec info

• OS: Windows server 2019
• Version of nxc: 1.1.0

[NeffIsBack]

Hi, thanks for the bug report. Is there any specific reason to use the us (I guess this is the NetBIOS domain name?) for logging in? Does this also happen with the fqdn?

[ronen1n]

Hi, thanks for the bug report. Is there any specific reason to use the us (I guess this is the NetBIOS domain name?) for logging in? Does this also happen with the fqdn?

My bad. It works without the US.
Thanks

[NeffIsBack]

Still a good finding, with #150 it should work even with the NetBIOS domain name.

[NeffIsBack]

Connect to their DC and query the trust :)