fox-it/dissect.target

SMB loader crashes on startup when using unprivileged accounts

Closed this issue · 2 comments

SMB loader crashes on startup when using low-privileged accounts. This issue occurs due to the fact that the SMB registry plugin assumes the current user has the privileges to do so, in turn resulting in a DCERPCException and SessionError.

$ target-shell 'smb://user@REDACTED?nt=REDACTED' 
2023-12-01T12:13:32.712774Z [error    ] .: Failed to load target with loader SmbLoader('.') [dissect.target.target] 
Traceback (most recent call last):
  File "venv/lib/python3.10/site-packages/dissect/target/target.py", line 408, in _load
    ldr.map(target)
  File "venv/lib/python3.10/site-packages/dissect/target/loaders/smb.py", line 172, in map
    target.add_plugin(SmbRegistry(target, self._conn), check_compatible=False)
  File "venv/lib/python3.10/site-packages/dissect/target/loaders/smb.py", line 186, in __init__
    super().__init__(target)
  File "venv/lib/python3.10/site-packages/dissect/target/plugins/os/windows/registry.py", line 84, in __init__
    self._init_registry()
  File "venv/lib/python3.10/site-packages/dissect/target/loaders/smb.py", line 193, in _init_registry
    self._check_service_status()
  File "venv/lib/python3.10/site-packages/dissect/target/loaders/smb.py", line 222, in _check_service_status
    manager_handle = scmr.hROpenSCManagerW(self._svcctl)["lpScHandle"]
  File "venv/lib/python3.10/site-packages/impacket/dcerpc/v5/scmr.py", line 1335, in hROpenSCManagerW
    return dce.request(openSCManager)
  File "venv/lib/python3.10/site-packages/impacket/dcerpc/v5/rpcrt.py", line 880, in request
    raise exception
impacket.dcerpc.v5.rpcrt.DCERPCException: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied 

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "venv/lib/python3.10/site-packages/dissect/target/target.py", line 287, in open_all
    target = cls._load(sub_entry, ldr)
  File "venv/lib/python3.10/site-packages/dissect/target/target.py", line 413, in _load
    raise TargetError(f"Failed to load target: {path}", cause=e)
dissect.target.exceptions.TargetError: Failed to load target: .
Traceback (most recent call last):
  File "venv/bin/target-shell", line 8, in <module>
    sys.exit(main())
  File "venv/lib/python3.10/site-packages/dissect/target/tools/utils.py", line 250, in wrapper
    return func(*args, **kwargs)
  File "venv/lib/python3.10/site-packages/dissect/target/tools/shell.py", line 1216, in main
    open_shell(args.targets, args.python, args.registry)
  File "venv/lib/python3.10/site-packages/dissect/target/tools/shell.py", line 1122, in open_shell
    targets = list(Target.open_all(targets))
  File "venv/lib/python3.10/site-packages/dissect/target/target.py", line 307, in open_all
    raise TargetError(f"Failed to find any loader for targets: {paths}")
dissect.target.exceptions.TargetError: Failed to find any loader for targets: ['smb://user@REDACTED?nt=REDACTED']
Exception ignored in: <function SmbRegistry.__del__ at 0x7fadd1305bd0>
Traceback (most recent call last):
  File "venv/lib/python3.10/site-packages/dissect/target/loaders/smb.py", line 219, in __del__
    self._winreg.disconnect()
AttributeError: 'NoneType' object has no attribute 'disconnect'

Thank you for finding this, could you make a PR for it?

@Miauwkeru PR ready to go #466 with an additional bug fix