Failure to connect via SMBv1 resulting in failing to attempt authentication.

[albakhtari]

Hello there.

I've got an AD lab built using 3 VMs, 2 workstations (Win 10 Pro) and one DC (Win Server 2022).
However when I want to carry out a pass-the-password attack, the banner of the targeted workstation(s) is printed, but don't get the result of attempted authentication.

The thing is, this operation worked a while back, but since then I changed the network settings on the VMs resulting in the change of their IPs, but that's about it, I don't remember making any other changes to the AD environment.

I get the same error when using the older crackmapexec, and I'm not sure how to go about debugging it.

Furthermore, when I access the DC, or any other share using smbclient, with errors expressing failure on connecting via SMBv1.

When running nxc verbose mode I get the following error:

~$ nxc --verbose smb 192.168.57.9 -u 'Administrator' -u 'P@$$w0rd!' -d 'MASTER.local'
[09:55:01] INFO     Socket info: host=192.168.57.9, hostname=192.168.57.9, kerberos=False, ipv6=False, link-local ipv6=False             connection.py:160
[09:55:02] INFO     Error creating SMBv1 connection to 192.168.57.9: Error while reading from remote                                            smb.py:502
[09:55:03] INFO     Resolved domain: MASTER.local with dns, kdcHost: 224.0.0.1                                                                  smb.py:267
SMB         192.168.57.9    445    MASTER-DC        [*] Windows Server 2022 Build 20348 x64 (name:MASTER-DC) (domain:MASTER.local) (signing:True) (SMBv1:False)

And this is the output from smbclient:

smbclient -L //192.168.57.9/ -U 'MASTER.local/Administrator%P@$$w0rd!'

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        hackme          Disk      
        IPC$            IPC       Remote IPC
        NETLOGON        Disk      Logon server share 
        SYSVOL          Disk      Logon server share 
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 192.168.57.9 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available

I would appreciate any clarifications and/or corrections, thanks a lot.

[NeffIsBack]

Hi, this is really odd. Please open up an issue and also paste the log from the --debug flag

[albakhtari]

Thank you for your swift reply. For some reason, after rebooting all VMs, everything started perfectly fine again الحمد لله
Not sure what did it, but its working now 🤷‍♂️