diff --git a/nxc/protocols/smb.py b/nxc/protocols/smb.py index ba0646331..e90acf055 100755 --- a/nxc/protocols/smb.py +++ b/nxc/protocols/smb.py @@ -581,7 +581,8 @@ def check_if_admin(self): try: # 0xF003F - SC_MANAGER_ALL_ACCESS # http://msdn.microsoft.com/en-us/library/windows/desktop/ms685981(v=vs.85).aspx - scmr.hROpenSCManagerW(dce, f"{self.host}\x00", "ServicesActive\x00", 0xF003F) + scmrobj = scmr.hROpenSCManagerW(dce, f"{self.host}\x00", "ServicesActive\x00", 0xF003F) + scmr.hREnumServicesStatusW(dce, scmrobj["lpScHandle"]) self.logger.debug(f"User is admin on {self.host}!") self.admin_privs = True except scmr.DCERPCException: