From 4d148dae1c2042f7c01e52b44eb184556b03082b Mon Sep 17 00:00:00 2001 From: aconite33 Date: Wed, 29 Apr 2026 10:34:31 -0600 Subject: [PATCH] fix: use target FQDN directly for Kerberos SPN when host contains a dot Reconstructing the remote name as {netbios_hostname}.{targetDomain} produces the wrong SPN when a host's DNS suffix differs from the AD domain name (e.g. host.aepsc.com registered in AD vs the constructed host.corp.aepsc.com), resulting in KDC_ERR_S_PRINCIPAL_UNKNOWN. Use self.host directly when it is already an FQDN, matching Impacket's smbclient behaviour. --- nxc/protocols/smb.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/nxc/protocols/smb.py b/nxc/protocols/smb.py index 38e816373f..b1f83d49ea 100755 --- a/nxc/protocols/smb.py +++ b/nxc/protocols/smb.py @@ -282,7 +282,8 @@ def enum_host_info(self): self.logger.debug(f"Error adding host {self.host} into db: {e!s}") # DCOM connection with kerberos needed - self.remoteName = self.host if not self.kerberos else f"{self.hostname}.{self.targetDomain}" + # When the target is already an FQDN, use it directly so the SPN matches the host's AD registration (e.g. host.aepsc.com, not host.corp.aepsc.com). + self.remoteName = self.host if (not self.kerberos or "." in self.host) else f"{self.hostname}.{self.targetDomain}" # using kdcHost is buggy on impacket when using trust relation between ad so we kdcHost must stay to none if targetdomain is not equal to domain if not self.kdcHost and self.domain and self.domain == self.targetDomain: