{"action":"opened","issue":{"url":"https://api.github.com/repos/CoreSecurity/impacket/issues/158","repository_url":"https://api.github.com/repos/CoreSecurity/impacket","labels_url":"https://api.github.com/repos/CoreSecurity/impacket/issues/158/labels{/name}","comments_url":"https://api.github.com/repos/CoreSecurity/impacket/issues/158/comments","events_url":"https://api.github.com/repos/CoreSecurity/impacket/issues/158/events","html_url":"https://github.com/CoreSecurity/impacket/issues/158","id":154898014,"number":158,"title":"bug in dcomrt connection","user":{"login":"Bella-Jaguar","id":19207182,"avatar_url":"https://avatars.githubusercontent.com/u/19207182?v=3","gravatar_id":"","url":"https://api.github.com/users/Bella-Jaguar","html_url":"https://github.com/Bella-Jaguar","followers_url":"https://api.github.com/users/Bella-Jaguar/followers","following_url":"https://api.github.com/users/Bella-Jaguar/following{/other_user}","gists_url":"https://api.github.com/users/Bella-Jaguar/gists{/gist_id}","starred_url":"https://api.github.com/users/Bella-Jaguar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Bella-Jaguar/subscriptions","organizations_url":"https://api.github.com/users/Bella-Jaguar/orgs","repos_url":"https://api.github.com/users/Bella-Jaguar/repos","events_url":"https://api.github.com/users/Bella-Jaguar/events{/privacy}","received_events_url":"https://api.github.com/users/Bella-Jaguar/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-05-15T08:56:14Z","updated_at":"2016-05-15T08:56:14Z","closed_at":null,"body":"hi\r\n\r\nthere is a bug in the connect method of INTERFACE in dcerpc/v5/dcomrt.py:\r\nWhen choosing the string binding, the method first checks if the target is in the string binding. If the string doesn't contain the target, it assumes its a FQDN address, and takes only the first part (before the first dot) and checks it.\r\n\r\nthe problem is, that when using IP, it could fetch the wrong ip address. for example:\r\nlets say my target has two IP addresses:\r\n192.168.1.100\r\n100.1.1.1\r\n\r\nMy computer's IP address is 100.1.1.2.\r\n\r\nI try to connect to the target using dcomrt, and it returns its hostname and both IPs, where 192.168.1.100 comes first.\r\n\r\nSo when the method checks for the right string binding, it cheks if 100.1.1.1 is in the target, and it isn't.\r\nThen, it takes the first part of the target i used, which is 100, and checks again, and it is (192.168.1.**100**).\r\n\r\nNow, impacket tries to connect to 192.168.1.100, and fails.\r\n\r\nTo fix it, the method should check whether the string binding address is an IP or a hostname, and then check for FQDN only if it's a hostname.\r\n\r\nBella"}}