RDP not working as expected

[humidnhefty]

The RDP Password spray works but produces a lot of junk in between for some reason. This doesn't happen for smb or winrm

Any assistance would be highly appreciated!

[XiaoliChan]

This is the bug with python 3.12 with async

[humidnhefty]

This is the bug with python 3.12 with async

Any fix you came across?

[XiaoliChan]

Any fix you came across?

Not, maybe something needs to change in aardwolf

Reference:

• asyncio warnings and errors triggered by stressful code python/cpython#109490

[mpgn]

He is using 3.11, strange but cannot reproduce on my side

[XiaoliChan]

Wired, I downgrade to python 3.11.5 and I still get same issues

[muelli]

I'm also having problems:

└─$ poetry run NetExec rdp 192.168.192.7{0,5} -u jeff -p 'P4a55w0rd!'
Exception ignored in: <function StreamWriter.__del__ at 0x7ff8d7d9c2c0>
Traceback (most recent call last):
  File "/usr/lib/python3.11/asyncio/streams.py", line 395, in __del__
  File "/usr/lib/python3.11/asyncio/streams.py", line 343, in close
  File "/usr/lib/python3.11/asyncio/selector_events.py", line 860, in close
  File "/usr/lib/python3.11/asyncio/base_events.py", line 761, in call_soon
  File "/usr/lib/python3.11/asyncio/base_events.py", line 519, in _check_closed
RuntimeError: Event loop is closed
Exception ignored in: <function StreamWriter.__del__ at 0x7ff8d7d9c2c0>
Traceback (most recent call last):
  File "/usr/lib/python3.11/asyncio/streams.py", line 395, in __del__
  File "/usr/lib/python3.11/asyncio/streams.py", line 343, in close
  File "/usr/lib/python3.11/asyncio/selector_events.py", line 860, in close
  File "/usr/lib/python3.11/asyncio/base_events.py", line 761, in call_soon
  File "/usr/lib/python3.11/asyncio/base_events.py", line 519, in _check_closed
RuntimeError: Event loop is closed

[Marshall-Hallenbeck]

@humidnhefty @XiaoliChan @muelli Does this happen consistently for you or randomly? Also can you provide output with the --debug flag so we can see what's going on in the background? Right now I can't reproduce this,

[muelli]

This is 100% reproducible:

poetry run NetExec --debug  rdp 192.168.191.145  -u 'Administrator'  -p 'admin'               
[18:42:11] DEBUG    Passed args: Namespace(threads=100, timeout=None, netexec.py:99
                    jitter=None, no_progress=False, verbose=False,                 
                    debug=True, version=False, protocol='rdp',                     
                    target=['192.168.191.145'], cred_id=[],                        
                    username=['Administrator'], password=['admin'],                
                    ignore_pw_decoding=False, kerberos=False,                      
                    no_bruteforce=False, continue_on_success=False,                
                    use_kcache=False, log=None, aesKey=None,                       
                    kdcHost=None, gfail_limit=None, ufail_limit=None,              
                    fail_limit=None, module=None, module_options=[],               
                    list_modules=False, show_module_options=False,                 
                    server='https', server_host='0.0.0.0',                         
                    server_port=None, connectback_host=None, hash=[],              
                    port=3389, rdp_timeout=5, nla_screenshot=False,                
                    domain=None, local_auth=False, screenshot=False,               
                    screentime=10, res='1024x768')                                 
           DEBUG    Protocol: rdp                                    netexec.py:155
           DEBUG    Protocol Path:                                   netexec.py:158
                    /home/kali/NetExec/nxc/protocols/rdp.py                        
           DEBUG    Protocol DB Path:                                netexec.py:160
                    /home/kali/NetExec/nxc/protocols/rdp/database.py               
           DEBUG    symmetric using "pyCryptodomex" for "DES"        __init__.py:55
           DEBUG    symmetric using "pyCryptodomex" for "TDES"       __init__.py:55
           DEBUG    symmetric using "pyCryptodomex" for "AES"        __init__.py:55
           DEBUG    symmetric using "pyCryptodomex" for "RC4"        __init__.py:55
           DEBUG    Protocol Object: <class 'protocol.rdp'>          netexec.py:163
           DEBUG    Protocol DB Object: <class 'protocol.database'>  netexec.py:165
           DEBUG    DB Path:                                         netexec.py:168
                    /home/kali/.nxc/workspaces/default/rdp.db                      
           DEBUG    Using selector: EpollSelector             selector_events.py:54
           DEBUG    Creating ThreadPoolExecutor                       netexec.py:56
           DEBUG    Creating thread for <class 'protocol.rdp'>        netexec.py:59
           INFO     Socket info: host=192.168.191.145,             connection.py:95
                    hostname=192.168.191.145, kerberos=False                       
           DEBUG    Kicking off proto_flow                        connection.py:155
           DEBUG    Using selector: EpollSelector             selector_events.py:54
           DEBUG    Using selector: EpollSelector             selector_events.py:54
           DEBUG    Using selector: EpollSelector             selector_events.py:54
           DEBUG    Using selector: EpollSelector             selector_events.py:54
Exception ignored in: <function StreamWriter.__del__ at 0x7fa4c61b0400>
Traceback (most recent call last):
  File "/usr/lib/python3.11/asyncio/streams.py", line 396, in __del__
    self.close()
  File "/usr/lib/python3.11/asyncio/streams.py", line 343, in close
    return self._transport.close()
           ^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/asyncio/selector_events.py", line 860, in close
    self._loop.call_soon(self._call_connection_lost, None)
  File "/usr/lib/python3.11/asyncio/base_events.py", line 761, in call_soon
    self._check_closed()
  File "/usr/lib/python3.11/asyncio/base_events.py", line 519, in _check_closed
    raise RuntimeError('Event loop is closed')
RuntimeError: Event loop is closed
Exception ignored in: <function StreamWriter.__del__ at 0x7fa4c61b0400>
Traceback (most recent call last):
  File "/usr/lib/python3.11/asyncio/streams.py", line 396, in __del__
    self.close()
  File "/usr/lib/python3.11/asyncio/streams.py", line 343, in close
    return self._transport.close()
           ^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/asyncio/selector_events.py", line 860, in close
    self._loop.call_soon(self._call_connection_lost, None)
  File "/usr/lib/python3.11/asyncio/base_events.py", line 761, in call_soon
    self._check_closed()
  File "/usr/lib/python3.11/asyncio/base_events.py", line 519, in _check_closed
    raise RuntimeError('Event loop is closed')
RuntimeError: Event loop is closed
Exception ignored in: <function StreamWriter.__del__ at 0x7fa4c61b0400>
Traceback (most recent call last):
  File "/usr/lib/python3.11/asyncio/streams.py", line 396, in __del__
    self.close()
  File "/usr/lib/python3.11/asyncio/streams.py", line 343, in close
    return self._transport.close()
           ^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/asyncio/selector_events.py", line 860, in close
    self._loop.call_soon(self._call_connection_lost, None)
  File "/usr/lib/python3.11/asyncio/base_events.py", line 761, in call_soon
    self._check_closed()
  File "/usr/lib/python3.11/asyncio/base_events.py", line 519, in _check_closed
    raise RuntimeError('Event loop is closed')
RuntimeError: Event loop is closed
[18:42:12] DEBUG    hashlib using "pure" for "md4"                    hashlib.py:32
           DEBUG    hmac using "builtin" for "md5"                       hmac.py:42
           DEBUG    hmac using "builtin" for "md5"                       hmac.py:42
           DEBUG    hmac using "builtin" for "md5"                       hmac.py:42
           DEBUG    hmac using "builtin" for "md5"                       hmac.py:42
           DEBUG    hashlib using "builtin" for "md5"                 hashlib.py:37
           DEBUG    hashlib using "builtin" for "md5"                 hashlib.py:37
           DEBUG    hashlib using "builtin" for "md5"                 hashlib.py:37
           DEBUG    hashlib using "builtin" for "md5"                 hashlib.py:37
           DEBUG    hmac using "builtin" for "md5"                       hmac.py:42
           DEBUG    hmac using "builtin" for "md5"                       hmac.py:42
RDP         192.168.191.145 3389   OSCP             [*] Windows 10 or Windows Server 2016 Build 19041 (name:OSCP) (domain:oscp) (nla:True)
           INFO     RDP         192.168.191.145 3389   OSCP           logger.py:159
                    [*] Windows 10 or Windows Server 2016 Build 19041              
                    (name:OSCP) (domain:oscp) (nla:True)                           
           DEBUG    Using selector: EpollSelector             selector_events.py:54
           DEBUG    hashlib using "pure" for "md4"                    hashlib.py:32
           DEBUG    hmac using "builtin" for "md5"                       hmac.py:42
           DEBUG    hmac using "builtin" for "md5"                       hmac.py:42
           DEBUG    hmac using "builtin" for "md5"                       hmac.py:42
           DEBUG    hmac using "builtin" for "md5"                       hmac.py:42
           DEBUG    hashlib using "builtin" for "md5"                 hashlib.py:37
           DEBUG    hashlib using "builtin" for "md5"                 hashlib.py:37
           DEBUG    hashlib using "builtin" for "md5"                 hashlib.py:37
           DEBUG    hashlib using "builtin" for "md5"                 hashlib.py:37
           DEBUG    hmac using "builtin" for "md5"                       hmac.py:42
           DEBUG    hmac using "builtin" for "md5"                       hmac.py:42
RDP         192.168.191.145 3389   OSCP             [-] oscp\Administrator:admin (STATUS_LOGON_FAILURE)
           INFO     RDP         192.168.191.145 3389   OSCP           logger.py:159
                    [-] oscp\Administrator:admin                                   
                    (STATUS_LOGON_FAILURE)                                         
Exception ignored in: <function StreamWriter.__del__ at 0x7fa4c61b0400>
Traceback (most recent call last):
  File "/usr/lib/python3.11/asyncio/streams.py", line 396, in __del__
    self.close()
  File "/usr/lib/python3.11/asyncio/streams.py", line 343, in close
    return self._transport.close()
           ^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/asyncio/selector_events.py", line 860, in close
    self._loop.call_soon(self._call_connection_lost, None)
  File "/usr/lib/python3.11/asyncio/base_events.py", line 761, in call_soon
    self._check_closed()
  File "/usr/lib/python3.11/asyncio/base_events.py", line 519, in _check_closed
    raise RuntimeError('Event loop is closed')
RuntimeError: Event loop is closed
Exception ignored in: <function StreamWriter.__del__ at 0x7fa4c61b0400>
Traceback (most recent call last):
  File "/usr/lib/python3.11/asyncio/streams.py", line 396, in __del__
    self.close()
  File "/usr/lib/python3.11/asyncio/streams.py", line 343, in close
    return self._transport.close()
           ^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/asyncio/selector_events.py", line 860, in close
    self._loop.call_soon(self._call_connection_lost, None)
  File "/usr/lib/python3.11/asyncio/base_events.py", line 761, in call_soon
    self._check_closed()
  File "/usr/lib/python3.11/asyncio/base_events.py", line 519, in _check_closed
    raise RuntimeError('Event loop is closed')
RuntimeError: Event loop is closed
                                             

[NeffIsBack]

@muelli can you give us your exact OS and python version this is happening on? For poetry you can get that info by running poetry env info

[muelli]

This is a Kali:

$ lsb_release -a                           
No LSB modules are available.
Distributor ID: Kali
Description:    Kali GNU/Linux Rolling
Release:        2022.4
Codename:       kali-rolling
$

└─$ poetry env info

Virtualenv
Python:         3.11.6
Implementation: CPython
Path:           /home/kali/.cache/pypoetry/virtualenvs/netexec-zhbX2mAx-py3.11
Executable:     /home/kali/.cache/pypoetry/virtualenvs/netexec-zhbX2mAx-py3.11/bin/python                                                                             
Valid:          True

System
Platform:   linux
OS:         posix
Python:     3.11.6
Path:       /usr
Executable: /usr/bin/python3.11
                                                                                   

[Marshall-Hallenbeck]

@muelli what version of Windows is the target host?

[muelli]

None. It doesn't matter.
having an open nc listener is enough to upset the async.io library:

[Marshall-Hallenbeck]

I'm running 3.11.4 in my poetry env on Kali and this does not happen on any hosts in my lab, or if I just open a netcat listener.

@muelli what version of pywinrm is installed in your environment?