Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

-n breaks when using IPs instead of hostnames #161

Open
cmprmsd opened this issue Oct 25, 2024 · 3 comments
Open

-n breaks when using IPs instead of hostnames #161

cmprmsd opened this issue Oct 25, 2024 · 3 comments

Comments

@cmprmsd
Copy link
Contributor

cmprmsd commented Oct 25, 2024

When specifying one host or a list of hosts the share enumeration works fine and treewalker tasks get started.
When you use IPs instead of hostnames the shares get enumerated (Talking about SYSVOL and NETLOGON here) (-v debug shows the shares), but the [Share] output that confirms the read access does not show up and the treewalker tasks will not be not started.

I'm trying to understand the issue and provide a fix, but you have better knowledge of the code and might know the solution already. 😁

@cmprmsd
Copy link
Contributor Author

cmprmsd commented Oct 25, 2024

For other Shares than SYSVOL and NETLOGON the [Share] green entry is listed also when passing an IP e.g.

[Share] Green   \\192.168.56.10\CertEnroll      R

For the call with ip and hostname I see the Treewalker creation when the share is not a SYSVOL or NETLOGON share:

[Trace] Creating a TreeWalker task for \\sevenkingdoms.local\CertEnroll
[Trace] Creating a TreeWalker task for \\192.168.56.10\CertEnroll

@cmprmsd
Copy link
Contributor Author

cmprmsd commented Oct 25, 2024

I merged the Exception handling to output all Exceptions in IsShareReadable within ShareFinder.cs (not ShareClassifier.cs)
and noticed that I cannot access the SYSVOL and NETLOGON shares via IP and get an access denied.

[Trace] Unhandled exception in IsShareReadable() for share path: \\192.168.56.11\NETLOGON Full Exception:System.IO.IOException: Access Denied

I guess it is no Snaffler issue then but more some annoying "AD/DNS thing"... T_T

@cmprmsd
Copy link
Contributor Author

cmprmsd commented Oct 25, 2024

yups...
I verified this with different new shares.
NETLOGON and SYSVOL both use DFS, which relies on DNS. So specifying IP addresses won't work.
Implementing a reverse resolver before checking the share access will help.

I added reverse DNS entries in hope that Windows and DFS will handle the reverse lookup itself but that seems not to be the case in my lab at least.

@l0ss What would you suggest on this problem? It only affects DFS shares, but an internal reverse lookup upfront for each target IP in -n's target list would be worth a try.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant