Adalanche icon indicating copy to clipboard operation
Adalanche copied to clipboard

Failed to get values for object 5407: unhandled attribute type 28

Open Coldfirex opened this issue 1 year ago • 2 comments

Howdy, Testing out Adalanche and I was unable to use to auto mode or plaintext. I used ADExplorer to create a snapshot and then loaded it into Adalanche.

C:\Users\me\Desktop>adalanche-windows-x64-v2022.8.26.exe collect activedirectory --adexplorerfile=ad-dump.dat 15:31:26.531 INFORMA Adalanche Open Source v2022.8.26 (commit 4c82445), (c) 2020-2022 Lars Karlslund, This program comes with ABSOLUTELY NO WARRANTY 15:31:26.546 INFORMA Collecting objects from AD Explorer snapshot ad-dump.dat ... 15:31:26.546 INFORMA Loading raw AD Explorer snapshot into memory 15:31:26.651 INFORMA Reading header (takes a while) ... 15:31:27.633 ERROR problem collecting Active Directory objects: failed to get values for object 5407: unhandled attribute type 28

Not sure what to try after this.

Any ideas?

Coldfirex avatar Sep 19 '22 20:09 Coldfirex

I've added the missing datatype to the AD Explorer import, not sure why it needs THAT many different kinds of strings. You can try the latest build from this commit just uploaded.

What was the failure with dumping directly?

lkarlslund avatar Sep 19 '22 20:09 lkarlslund

Thanks! I will need to wait until next release as I am not setup to build atm.

C:\Users\me\Desktop>adalanche-windows-x64-v2022.8.26.exe 15:17:37.457 INFORMA Adalanche Open Source v2022.8.26 (commit 4c82445), (c) 2020-2022 Lars Karlslund, This program comes with ABSOLUTELY NO WARRANTY 15:17:37.470 INFORMA No arguments provided, activating 'quick' mode: will do automatic collection from Active Directory, and then analyze. Use command line options to change this behaviour. 15:17:37.484 INFORMA No domain supplied, auto-detecting 15:17:37.484 INFORMA Auto-detected domain as domain.org 15:17:37.490 INFORMA AD controller detected as: ad1.domain.org 15:17:37.651 ERROR problem connecting to AD: LDAP Result Code 49 "Invalid Credentials": 80090346: LdapErr: DSID-0C0906C6, comment: AcceptSecurityContext error, data 80090346, v3839

C:\Users\me\Desktop>adalanche-windows-x64-v2022.8.26.exe collect activedirectory --port 389 --tlsmode NoTLS 15:18:20.259 INFORMA Adalanche Open Source v2022.8.26 (commit 4c82445), (c) 2020-2022 Lars Karlslund, This program comes with ABSOLUTELY NO WARRANTY 15:18:20.272 INFORMA No domain supplied, auto-detecting 15:18:20.272 INFORMA Auto-detected domain as domain.org 15:18:20.276 INFORMA AD controller detected as: ad5.domain.org 15:18:20.348 ERROR problem connecting to AD: LDAP Result Code 49 "Invalid Credentials": 8009030C: LdapErr: DSID-0C0906C6, comment: AcceptSecurityContext error, data 52f, v3839

Coldfirex avatar Sep 19 '22 20:09 Coldfirex

There are always auto built binaries the latest commit under releases :-)

I suspect channel binding requirements for the errors you're getting here.

lkarlslund avatar Sep 20 '22 07:09 lkarlslund

Doh!

Got a little further this time.

PS C:\Users\me\Desktop> .\adalanche-windows-amd64-v2022.8.26-41-gf23d3d7.exe collect activedirectory --adexplorerfile=ad-dump.dat 09:14:46.495 INFORMA Adalanche Open Source v2022.8.26-41-gf23d3d7 (non-release), (c) 2020-2022 Lars Karlslund, This program comes with ABSOLUTELY NO WARRANTY 09:14:46.512 INFORMA Collecting objects from AD Explorer snapshot ad-dump.dat ... 09:14:46.513 INFORMA Loading raw AD Explorer snapshot into memory 09:14:46.674 INFORMA Reading header (takes a while) ... 09:14:47.711 ERROR problem collecting Active Directory objects: failed to get values for object 5407: EOF

On Tue, Sep 20, 2022 at 2:30 AM Lars Karlslund @.***> wrote:

There are always auto built binaries the latest commit under releases :-)

I suspect channel binding requirements for the errors you're getting here.

— Reply to this email directly, view it on GitHub https://github.com/lkarlslund/Adalanche/issues/21#issuecomment-1251953187, or unsubscribe https://github.com/notifications/unsubscribe-auth/AHE44FPKHZW5FLKXA6SJGNTV7FRZRANCNFSM6AAAAAAQQOHA7A . You are receiving this because you authored the thread.Message ID: @.***>

Coldfirex avatar Sep 20 '22 14:09 Coldfirex