TypeError crash when NETBIOS connection to host times out

[seihtam]

Started by running (which finished without problems): python sccmhunter.py find -u '<user>' -p '<pass>' -d '<domain>' -dc-ip <dc_ip>

Then I ran the smb command. Before the crash it correctly searched mulitple distribution points for PXEBoot variable files without errors. Then it got a timeout on one server and crashed with this error:

python sccmhunter.py smb -u '<user>' -p '<pass>' -d '<domain>' -dc-ip <dc_ip> -save
SCCMHunter v2.0.0 by @unsigned_sh0rt

<SNIP>

[13:28:57] INFO     [-] The NETBIOS connection with the remote host timed out.                                                                                                                                                                
╭──────────────────────────────────────────────────────────────────────────────────────────────────── Traceback (most recent call last) ─────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ /home/kali/tools/sccmhunter/lib/commands/smb.py:28 in main                                                                                                                                                                                 │
│                                                                                                                                                                                                                                            │
│   25 │   smbhunter = SMB(username=username, password=password, domain=domain, dc_ip=dc_ip,lda                                                                                                                                              │
│   26 │   │   │   │   │   │   │   kerberos=kerberos, no_pass=no_pass, hashes=hashes, aes=aes,                                                                                                                                               │
│   27 │   │   │   │   │   │   │    save=save, logs_dir=logs_dir)                                                                                                                                                                            │
│ ❱ 28 │   smbhunter.run()                                                                                                                                                                                                                   │
│   29                                                                                                                                                                                                                                       │
│   30                                                                                                                                                                                                                                       │
│   31                                                                                                                                                                                                                                       │
│                                                                                                                                                                                                                                            │
│ /home/kali/tools/sccmhunter/lib/attacks/smb.py:50 in run                                                                                                                                                                                   │
│                                                                                                                                                                                                                                            │
│    47 │   │   #TODO add check to be sure FIND module was run                                                                                                                                                                               │
│    48 │   │   self.check_siteservers()                                                                                                                                                                                                     │
│    49 │   │   self.check_managementpoints()                                                                                                                                                                                                │
│ ❱  50 │   │   self.check_distributionpoints()                                                                                                                                                                                              │
│    51 │   │   self.check_computers()                                                                                                                                                                                                       │
│    52 │   │   self.conn.close()                                                                                                                                                                                                            │
│    53                                                                                                                                                                                                                                      │
│                                                                                                                                                                                                                                            │
│ /home/kali/tools/sccmhunter/lib/attacks/smb.py:214 in check_distributionpoints                                                                                                                                                             │
│                                                                                                                                                                                                                                            │
│   211 │   │   │   │   hostname = i[0]                                                                                                                                                                                                      │
│   212 │   │   │   │   conn = self.smb_connection(hostname)                                                                                                                                                                                 │
│   213 │   │   │   │   if conn:                                                                                                                                                                                                             │
│ ❱ 214 │   │   │   │   │   signing, site_code, siteserv, distp, wsus, wdspxe, sccmpxe = self.sm                                                                                                                                             │
│   215 │   │   │   │   │   #Hostname, SigningStatus, SCCM, WDS                                                                                                                                                                              │
│   216 │   │   │   │   │   cursor.execute(f'''Update PXEDistributionPoints SET SigningStatus=?,                                                                                                                                             │
│   217 │   │   │   │   │   │   │   │   (str(signing), str(sccmpxe), str(wdspxe), hostname))                                                                                                                                                 │
╰────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
TypeError: cannot unpack non-iterable NoneType object

Version 2.0.0 (798635c).

[seihtam]

Made a hackish fix and ran the smb command again. This time I didn't encounter a timeout. Some of the distribution points I tested was hosted in other countries so a timeout seems entirely possible.

Besides fixing the bug it would be good to have a way to set the connection timeout with a command line parameter.

[seihtam]

Encountered the same issue here:

sccmhunter/lib/attacks/smb.py

Line 242 in 6a54157

signing, site_code, siteserv, distp, wsus, wdspxe, sccmpxe = self.smb_hunter(hostname, conn)

So this will need to be handled everywhere self.smb_hunter is used.