{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10560","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10560/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10560/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10560/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/10560","id":355621308,"node_id":"MDExOlB1bGxSZXF1ZXN0MjEyMTA3NDMy","number":10560,"title":"ms17_010_eternalblue: use SMBDomain value when provided instead of ignoring it","user":{"login":"cnotin","id":550823,"node_id":"MDQ6VXNlcjU1MDgyMw==","avatar_url":"https://avatars0.githubusercontent.com/u/550823?v=4","gravatar_id":"","url":"https://api.github.com/users/cnotin","html_url":"https://github.com/cnotin","followers_url":"https://api.github.com/users/cnotin/followers","following_url":"https://api.github.com/users/cnotin/following{/other_user}","gists_url":"https://api.github.com/users/cnotin/gists{/gist_id}","starred_url":"https://api.github.com/users/cnotin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cnotin/subscriptions","organizations_url":"https://api.github.com/users/cnotin/orgs","repos_url":"https://api.github.com/users/cnotin/repos","events_url":"https://api.github.com/users/cnotin/events{/privacy}","received_events_url":"https://api.github.com/users/cnotin/received_events","type":"User","site_admin":false},"labels":[{"id":213102939,"node_id":"MDU6TGFiZWwyMTMxMDI5Mzk=","url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/enhancement","name":"enhancement","color":"5319e7","default":true},{"id":103436014,"node_id":"MDU6TGFiZWwxMDM0MzYwMTQ=","url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420","default":false}],"state":"open","locked":false,"assignee":{"login":"bwatters-r7","id":17987018,"node_id":"MDQ6VXNlcjE3OTg3MDE4","avatar_url":"https://avatars3.githubusercontent.com/u/17987018?v=4","gravatar_id":"","url":"https://api.github.com/users/bwatters-r7","html_url":"https://github.com/bwatters-r7","followers_url":"https://api.github.com/users/bwatters-r7/followers","following_url":"https://api.github.com/users/bwatters-r7/following{/other_user}","gists_url":"https://api.github.com/users/bwatters-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/bwatters-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bwatters-r7/subscriptions","organizations_url":"https://api.github.com/users/bwatters-r7/orgs","repos_url":"https://api.github.com/users/bwatters-r7/repos","events_url":"https://api.github.com/users/bwatters-r7/events{/privacy}","received_events_url":"https://api.github.com/users/bwatters-r7/received_events","type":"User","site_admin":false},"assignees":[{"login":"bwatters-r7","id":17987018,"node_id":"MDQ6VXNlcjE3OTg3MDE4","avatar_url":"https://avatars3.githubusercontent.com/u/17987018?v=4","gravatar_id":"","url":"https://api.github.com/users/bwatters-r7","html_url":"https://github.com/bwatters-r7","followers_url":"https://api.github.com/users/bwatters-r7/followers","following_url":"https://api.github.com/users/bwatters-r7/following{/other_user}","gists_url":"https://api.github.com/users/bwatters-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/bwatters-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bwatters-r7/subscriptions","organizations_url":"https://api.github.com/users/bwatters-r7/orgs","repos_url":"https://api.github.com/users/bwatters-r7/repos","events_url":"https://api.github.com/users/bwatters-r7/events{/privacy}","received_events_url":"https://api.github.com/users/bwatters-r7/received_events","type":"User","site_admin":false}],"milestone":null,"comments":2,"created_at":"2018-08-30T14:50:39Z","updated_at":"2018-09-11T22:30:14Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/10560","html_url":"https://github.com/rapid7/metasploit-framework/pull/10560","diff_url":"https://github.com/rapid7/metasploit-framework/pull/10560.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/10560.patch"},"body":"This fixes the fact that the SMBDomain option value is currently ignored.\r\n\r\nThis happens when the MSF user provides SMBUser, SMBPass and SMBDomain for a domain user (when running against a domain-joined computer). Since the SMBDomain is ingored, then it generates an authentication request for \".\\user\" being the local user, instead of the domain one. It fails in most cases (except if there is a local user with the same password of course).\r\n\r\n## Verification\r\n\r\n- [ ] Start `msfconsole`\r\n- [ ] `use exploits/windows/smb/ms17_010_eternalblue`\r\n- [ ] `set SMBUser MyUser`\r\n- [ ] `set SMBPass MyPassword`\r\n- [ ] `set SMBDomain MyDomain`\r\n- [ ] `set RHOST <target>`\r\n- [ ] `run`\r\n- [ ] **Verify** with Wireshark that the NTLMSSP_AUTH packet contains specifies the \"MyDomain\\MyUser\" instead of \".\\MyUser\"\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/420448053","html_url":"https://github.com/rapid7/metasploit-framework/pull/10560#issuecomment-420448053","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10560","id":420448053,"node_id":"MDEyOklzc3VlQ29tbWVudDQyMDQ0ODA1Mw==","user":{"login":"bwatters-r7","id":17987018,"node_id":"MDQ6VXNlcjE3OTg3MDE4","avatar_url":"https://avatars3.githubusercontent.com/u/17987018?v=4","gravatar_id":"","url":"https://api.github.com/users/bwatters-r7","html_url":"https://github.com/bwatters-r7","followers_url":"https://api.github.com/users/bwatters-r7/followers","following_url":"https://api.github.com/users/bwatters-r7/following{/other_user}","gists_url":"https://api.github.com/users/bwatters-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/bwatters-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bwatters-r7/subscriptions","organizations_url":"https://api.github.com/users/bwatters-r7/orgs","repos_url":"https://api.github.com/users/bwatters-r7/repos","events_url":"https://api.github.com/users/bwatters-r7/events{/privacy}","received_events_url":"https://api.github.com/users/bwatters-r7/received_events","type":"User","site_admin":false},"created_at":"2018-09-11T22:30:14Z","updated_at":"2018-09-11T22:30:14Z","author_association":"CONTRIBUTOR","body":"This appears to do exactly what it is supposed to do, but whenever I test with this, it fails.  I imagine this is likely because something updated when I made my Win2K8R2 servers DCs, but I wanted to check.  I keep getting `[!] 192.168.134.151:445 - ETERNALBLUE overwrite returned unexpected status code (0xC0000022)!` when I run this after elevating the VMs."}}
{"actor":{"display_login":"bwatters-r7"}}