aiosmb icon indicating copy to clipboard operation
aiosmb copied to clipboard

Bug: authentication failure due to bad spn

Open nurfed1 opened this issue 1 year ago • 0 comments

Hi,

I think I found a bug while testing your library in my lab. For example using the following command: asmbshareenum -v --url 'smb2+ntlm-password://nurfed.lab\lowpriv:[email protected]'

In the windows event log, I can see that logon succeeds but afterwards there's an 5168 File Share failure event containing the following:

Spn check for SMB/SMB2 fails.
	
...

SPN:	
	SPN Name:		cifs/[email protected]
	Error Code:		0xC0000022`

When I modify the code at connection.py#L683 to remove the @nurfed.lab part from the SPN, this does not happen and authentication is successful.

After some digging this seems to be related to Microsoft network server: Server SPN target name validation level.

Looking at other implementations, I think the correct might SPN format would be service/hostname, but since I'm not 100% I'd rather create an issue instead of a pull request. Also, I'm not sure what would be the place to address this in the code. It seems the minikerberos KerberosSPN class does expect the @domain part in the SPN.

nurfed1 avatar Oct 26 '23 18:10 nurfed1