{"action":"created","issue":{"url":"https://api.github.com/repos/byt3bl33d3r/CrackMapExec/issues/114","repository_url":"https://api.github.com/repos/byt3bl33d3r/CrackMapExec","labels_url":"https://api.github.com/repos/byt3bl33d3r/CrackMapExec/issues/114/labels{/name}","comments_url":"https://api.github.com/repos/byt3bl33d3r/CrackMapExec/issues/114/comments","events_url":"https://api.github.com/repos/byt3bl33d3r/CrackMapExec/issues/114/events","html_url":"https://github.com/byt3bl33d3r/CrackMapExec/issues/114","id":157281004,"number":114,"title":"Tracebacks when deleting local users","user":{"login":"juushya","id":4639200,"avatar_url":"https://avatars.githubusercontent.com/u/4639200?v=3","gravatar_id":"","url":"https://api.github.com/users/juushya","html_url":"https://github.com/juushya","followers_url":"https://api.github.com/users/juushya/followers","following_url":"https://api.github.com/users/juushya/following{/other_user}","gists_url":"https://api.github.com/users/juushya/gists{/gist_id}","starred_url":"https://api.github.com/users/juushya/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/juushya/subscriptions","organizations_url":"https://api.github.com/users/juushya/orgs","repos_url":"https://api.github.com/users/juushya/repos","events_url":"https://api.github.com/users/juushya/events{/privacy}","received_events_url":"https://api.github.com/users/juushya/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-05-27T20:03:00Z","updated_at":"2016-06-05T19:06:41Z","closed_at":null,"body":"Using the current CME version.\r\n\r\nAs a Domain Admin, when using CME to delete a local user, the following tracebacks happen:\r\n\r\n```\r\nTraceback 1:\r\n\r\n05-27-2016 14:51:20 CME          1.2.3.4:445 VICTIM-BOX1        [*] Windows Server 2008 R2 Enterprise 7601 Service Pack 1 (name:VICTIM-BOX1) (domain:DOMAIN)\r\n05-27-2016 14:51:20 CME          1.2.3.4:445 VICTIM-BOX1        [+] DOMAIN\\newdomainuser:password (Pwn3d!)\r\nTraceback (most recent call last):\r\n  File \"/usr/local/lib/python2.7/dist-packages/gevent/greenlet.py\", line 534, in run\r\n    result = self._run(*self.args, **self.kwargs)\r\n  File \"/opt/CME/core/connector.py\", line 125, in connector\r\n    output = connection.execute(args.command, get_output=get_output, method=args.exec_method)\r\n  File \"/opt/CME/core/connection.py\", line 219, in execute\r\n    exec_method = WMIEXEC(self.host, self.username, self.password, self.domain, self.conn, self.hash, self.args.share)\r\n  File \"/opt/CME/core/execmethods/wmiexec.py\", line 39, in __init__\r\n    iInterface = self.__dcom.CoCreateInstanceEx(wmi.CLSID_WbemLevel1Login,wmi.IID_IWbemLevel1Login)\r\n  File \"/usr/local/lib/python2.7/dist-packages/impacket/dcerpc/v5/dcomrt.py\", line 1053, in CoCreateInstanceEx\r\n    iInterface = scm.RemoteCreateInstance(clsid, iid)\r\n  File \"/usr/local/lib/python2.7/dist-packages/impacket/dcerpc/v5/dcomrt.py\", line 1711, in RemoteCreateInstance\r\n    self.__portmap.bind(IID_IRemoteSCMActivator)\r\n  File \"/usr/local/lib/python2.7/dist-packages/impacket/dcerpc/v5/rpcrt.py\", line 1012, in bind\r\n    bindResp = MSRPCBindAck(str(resp))\r\n  File \"/usr/local/lib/python2.7/dist-packages/impacket/dcerpc/v5/rpcrt.py\", line 748, in __init__\r\n    MSRPCHeader.__init__(self,data,alignment)\r\n  File \"/usr/local/lib/python2.7/dist-packages/impacket/dcerpc/v5/rpcrt.py\", line 635, in __init__\r\n    Structure.__init__(self,data, alignment)\r\n  File \"/usr/local/lib/python2.7/dist-packages/impacket/structure.py\", line 82, in __init__\r\n    self.fromString(data)\r\n  File \"/usr/local/lib/python2.7/dist-packages/impacket/dcerpc/v5/rpcrt.py\", line 762, in fromString\r\n    Structure.fromString(self,data)\r\n  File \"/usr/local/lib/python2.7/dist-packages/impacket/structure.py\", line 147, in fromString\r\n    self[field[0]] = self.unpack(field[1], data[:size], dataClassOrCode = dataClassOrCode, field = field[0])\r\n  File \"/usr/local/lib/python2.7/dist-packages/impacket/structure.py\", line 302, in unpack\r\n    return self.unpack(two[0],data)\r\n  File \"/usr/local/lib/python2.7/dist-packages/impacket/structure.py\", line 356, in unpack\r\n    return unpack(format, data)[0]\r\nerror: ('unpack requires a string argument of length 2', \"When unpacking field 'max_tfrag | <H=0 | ''[:2]'\")\r\n<Greenlet at 0x3809370: connector('1.2.3.4', Namespace(command='net user newlocaluser /del', cre, <core.database.CMEDatabase instance at 0x387f1b8>, None, None, None)> failed with error\r\n\r\n05-27-2016 14:51:20 [*] KTHXBYE!\r\n```\r\n\r\n```\r\nTraceback 2:\r\n05-27-2016 14:49:22 CME          2.3.4.5:445 VICTIM-BOX2          [*] Windows Server 2003 R2 3790 Service Pack 2 (name:VICTIM-BOX2) (domain:DOMAIN)\r\n05-27-2016 14:49:22 CME          2.3.4.5:445 VICTIM-BOX2          [+] DOMAIN\\newdomainuser:password (Pwn3d!)\r\nTraceback (most recent call last):\r\n  File \"/usr/local/lib/python2.7/dist-packages/gevent/greenlet.py\", line 534, in run\r\n    result = self._run(*self.args, **self.kwargs)\r\n  File \"/opt/CME/core/connector.py\", line 125, in connector\r\n    output = connection.execute(args.command, get_output=get_output, method=args.exec_method)\r\n  File \"/opt/CME/core/connection.py\", line 219, in execute\r\n    exec_method = WMIEXEC(self.host, self.username, self.password, self.domain, self.conn, self.hash, self.args.share)\r\n  File \"/opt/CME/core/execmethods/wmiexec.py\", line 39, in __init__\r\n    iInterface = self.__dcom.CoCreateInstanceEx(wmi.CLSID_WbemLevel1Login,wmi.IID_IWbemLevel1Login)\r\n  File \"/usr/local/lib/python2.7/dist-packages/impacket/dcerpc/v5/dcomrt.py\", line 1053, in CoCreateInstanceEx\r\n    iInterface = scm.RemoteCreateInstance(clsid, iid)\r\n  File \"/usr/local/lib/python2.7/dist-packages/impacket/dcerpc/v5/dcomrt.py\", line 1711, in RemoteCreateInstance\r\n    self.__portmap.bind(IID_IRemoteSCMActivator)\r\n  File \"/usr/local/lib/python2.7/dist-packages/impacket/dcerpc/v5/rpcrt.py\", line 1012, in bind\r\n    bindResp = MSRPCBindAck(str(resp))\r\n  File \"/usr/local/lib/python2.7/dist-packages/impacket/dcerpc/v5/rpcrt.py\", line 748, in __init__\r\n    MSRPCHeader.__init__(self,data,alignment)\r\n  File \"/usr/local/lib/python2.7/dist-packages/impacket/dcerpc/v5/rpcrt.py\", line 635, in __init__\r\n    Structure.__init__(self,data, alignment)\r\n  File \"/usr/local/lib/python2.7/dist-packages/impacket/structure.py\", line 82, in __init__\r\n    self.fromString(data)\r\n  File \"/usr/local/lib/python2.7/dist-packages/impacket/dcerpc/v5/rpcrt.py\", line 762, in fromString\r\n    Structure.fromString(self,data)\r\n  File \"/usr/local/lib/python2.7/dist-packages/impacket/structure.py\", line 147, in fromString\r\n    self[field[0]] = self.unpack(field[1], data[:size], dataClassOrCode = dataClassOrCode, field = field[0])\r\n  File \"/usr/local/lib/python2.7/dist-packages/impacket/structure.py\", line 302, in unpack\r\n    return self.unpack(two[0],data)\r\n  File \"/usr/local/lib/python2.7/dist-packages/impacket/structure.py\", line 356, in unpack\r\n    return unpack(format, data)[0]\r\nerror: ('unpack requires a string argument of length 2', \"When unpacking field 'max_tfrag | <H=0 | ''[:2]'\")\r\n<Greenlet at 0x1d58370: connector('10.65.2.12', Namespace(command='net user newlocaluser /del', cre, <core.database.CMEDatabase instance at 0x1dce1b8>, None, None, None)> failed with error\r\n\r\n05-27-2016 14:49:22 [*] KTHXBYE!\r\n\r\n```\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/byt3bl33d3r/CrackMapExec/issues/comments/223831010","html_url":"https://github.com/byt3bl33d3r/CrackMapExec/issues/114#issuecomment-223831010","issue_url":"https://api.github.com/repos/byt3bl33d3r/CrackMapExec/issues/114","id":223831010,"user":{"login":"juushya","id":4639200,"avatar_url":"https://avatars.githubusercontent.com/u/4639200?v=3","gravatar_id":"","url":"https://api.github.com/users/juushya","html_url":"https://github.com/juushya","followers_url":"https://api.github.com/users/juushya/followers","following_url":"https://api.github.com/users/juushya/following{/other_user}","gists_url":"https://api.github.com/users/juushya/gists{/gist_id}","starred_url":"https://api.github.com/users/juushya/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/juushya/subscriptions","organizations_url":"https://api.github.com/users/juushya/orgs","repos_url":"https://api.github.com/users/juushya/repos","events_url":"https://api.github.com/users/juushya/events{/privacy}","received_events_url":"https://api.github.com/users/juushya/received_events","type":"User","site_admin":false},"created_at":"2016-06-05T19:06:41Z","updated_at":"2016-06-05T19:06:41Z","body":"Sure.\r\n\r\n./crackmapexec.py 1.2.3.4 -d DOMAIN -u domainadmin -p password -x 'net user newlocaluser /del'"}}
{"actor":{"display_login":"juushya"}}