Skip to content

Support custom NetBIOS domain names - #3

Open
Joytide wants to merge 1 commit into
synacktiv:masterfrom
Joytide:master
Open

Joytide wants to merge 1 commit into
synacktiv:masterfrom
Joytide:master

Conversation

@Joytide

@Joytide Joytide commented Sep 7, 2026

Copy link
Copy Markdown

Description

The screenshot below shows the issue I ran into: LDAP GPC retrieval was working, but the embedded SMB server was unable to establish the Netlogon secure channel and kept returning:

PR1

The issue was that the AD domain's NetBIOS name did not match the first part of its DNS name.

In my case:

DNS domain:     corp.com
NetBIOS domain: CORPCOM

OUned currently does not pass DOMAIN_NB_NAME when creating Scapy's NTLMSSP_DOMAIN, so Scapy falls back to:

DOMAIN_FQDN.split(".")[0].upper()[:15]

In the example above, it will assumes CORP instead of the actual CORPCOM, which causes the Netlogon authentication to fail.

Changes

This PR adds an optional domain-netbios setting:

# Required if domain=corp.com but nETBIOSName=CORPCOM (default is CORP)
#domain-netbios=corpcom

When set, it's passed to Scapy as DOMAIN_NB_NAME.

When it's not set, it simply passes None and Scapy keeps its current fallback behavior.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant