[Bug]: SMB share enumeration fails because SMB3 encryption capability is treated as encryption-required

[CroatianApoxyomenos]

ADscan version

11.0.0

Host OS

Kali 2026.1

Docker version

No response

Command and sanitized output

ADscan SMB share enumeration against a target advertising SMB3 encryption support.

Relevant command/test:

`docker exec <container> /opt/adscan/venv/bin/python3 -c '<SMB connection test>'`

Observed:

LOGIN: True None
dialect: NegotiateDialects.SMB311
encryption_required: True
SupportsEncryption: False

Subsequent IPC$/SRVSVC operations failed:

SMBConnectionTerminated: 10.129.12.17 Status: NTStatus.CONNECTION_ABORTED

Example:

Creating SMB connection
SMB LOGIN: True None
Opening/binding SRVSVC
SRVSVC EXCEPTION: Exception('Connection closed')

Direct SMB authentication succeeded, but IPC$/srvsvc access and share enumeration failed.

The target advertises SMB encryption capabilities but does not require SMB encryption.

Expected behavior

SMB encryption being advertised by the server should not be interpreted as SMB encryption being required.

The SMB3 NEGOTIATE response should distinguish:

• SupportsEncryption = True when the server advertises encryption capabilities.
• encryption_required = True only when encryption is actually required.

After successful authentication, ADscan should be able to connect to IPC$, bind to SRVSVC, and enumerate SMB shares normally when the server supports but does not require SMB encryption.

I verified this by changing the aiosmb NEGOTIATE handling so that the encryption capability sets SupportsEncryption rather than encryption_required.

After the change:

LOGIN: True None
encryption_required: False
SupportsEncryption: True
OPEN_PIPE: True None
SRVSVC CONNECT/BIND: OK

Share enumeration then successfully returned ADMIN$, C$, IPC$, IT, NETLOGON, and SYSVOL.

Lab or environment context

Tested in the Hack The Box (HTB) DanglingTree lab environment.

Target:
10.129.12.17

The issue was reproduced using ADscan's bundled aiosmb implementation.

Initial SMB connection test:

docker exec <container> /opt/adscan/venv/bin/python3 -c '
import asyncio
from aiosmb.commons.connection.factory import SMBConnectionFactory

async def main():
    conn = SMBConnectionFactory.from_url(
        "smb+ntlm-password://ADscan:@10.129.12.17"
    ).get_connection()

    try:
        ok, err = await conn.login()
        print("LOGIN:", ok, repr(err))
        print("encryption_required =", conn.encryption_required)
        print("SupportsEncryption  =", conn.SupportsEncryption)

        tree, err = await conn.tree_connect(r"\\10.129.12.17\IT")
        print("TREE CONNECT IT:", tree)
        print("ERROR:", repr(err))
    finally:
        try:
            await conn.disconnect()
        except Exception:
            pass

asyncio.run(main())
'

Before the fix, authentication succeeded but SMB operations subsequently failed with:

SMBConnectionTerminated: 10.129.12.17 Status: NTStatus.CONNECTION_ABORTED

The target negotiated SMB 3.1.1 and advertised encryption capabilities.

I also tested the IPC$/srvsvc path directly:

docker exec <container> /opt/adscan/venv/bin/python3 -c '
import asyncio
from aiosmb.commons.connection.factory import SMBConnectionFactory
from aiosmb.commons.interfaces.file import SMBFile

async def main():
    conn = SMBConnectionFactory.from_url(
        "smb+ntlm-password://ADscan:@10.129.12.17"
    ).get_connection()

    try:
        ok, err = await conn.login()
        print("LOGIN:", ok, repr(err))

        pipe = SMBFile.from_uncpath(r"\\10.129.12.17\IPC$\srvsvc")
        ok, err = await pipe.open_pipe(conn, "rw")
        print("OPEN_PIPE:", ok, repr(err))

        if ok:
            print("tree_id:", pipe.tree_id)
            print("file_id:", pipe.file_id)
            await pipe.close()
    finally:
        try:
            await conn.disconnect()
        except Exception:
            pass

asyncio.run(main())
'

After changing the encryption capability handling so that advertised encryption sets SupportsEncryption=True rather than encryption_required=True, the same environment produced:

LOGIN: True None
encryption_required: False
SupportsEncryption: True
OPEN_PIPE: True None

Used command for changing the encryption capability:

docker exec <container> sh -c "python3 - <<'PY'
p='/opt/adscan/venv/lib/python3.13/site-packages/aiosmb/connection.py'

with open(p, 'r') as f:
    s = f.read()

old1 = '''if NegotiateCapabilities.ENCRYPTION in rply.command.Capabilities:
                            self.encryption_required = True
                            self.CipherId = SMB2Cipher.AES_128_CCM'''

new1 = '''if NegotiateCapabilities.ENCRYPTION in rply.command.Capabilities:
                            self.SupportsEncryption = True
                            self.CipherId = SMB2Cipher.AES_128_CCM'''

old2 = '''if negctx.ContextType == SMB2ContextType.ENCRYPTION_CAPABILITIES:
                                    self.encryption_required = True
                                    self.CipherId = negctx.Ciphers[0]'''

new2 = '''if negctx.ContextType == SMB2ContextType.ENCRYPTION_CAPABILITIES:
                                    self.SupportsEncryption = True
                                    self.CipherId = negctx.Ciphers[0]'''

if old1 not in s or old2 not in s:
    raise SystemExit('Expected encryption blocks not found')

s = s.replace(old1, new1, 1)
s = s.replace(old2, new2, 1)

with open(p, 'w') as f:
    f.write(s)

print('PATCH APPLIED')
PY"

SRVSVC then successfully connected/bound and share enumeration returned:

ADMIN$
C$
IPC$
IT
NETLOGON
SYSVOL

This was reproduced and verified entirely within the authorized HTB DanglingTree lab.