Kerberos `KDC_ERR_S_PRINCIPAL_UNKNOWN` in Server 2025

[drewmnoel]

Some of the SMB connection behavior of Windows Server 2025 seems to have changed, and it likes to drop the SMB connection if the user is in Protected Users, NTLM is disabled, etc.

Describe the bug
When using NetExec to authenticate with Kerberos to Windows Server 2025 with NTLM disabled, the authentication fails with KDC_ERR_S_PRINCIPAL_UNKNOWN. NetExec clobbers hostname information if the initial SMB connection fails, resulting in SPNs like "cifs/.".

In Windows Server 2025, NetBIOS requests are dropped entirely when NTLM is disabled (via SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\RestrictReceivingNTLMTraffic=2), unlike previous Windows versions that returned STATUS_NOT_SUPPORTED.

During enum_host_info, NetExec catches all exceptions but only processes ones that contain the string STATUS_NOT_SUPPORTED. Specifically, NetBIOSTimeout exceptions are not handled:

NetExec/nxc/protocols/smb.py

Lines 191 to 201 in d1fc6d5

	try:
	self.conn.login("", "")
	self.null_auth = True
	except BrokenPipeError:
	self.logger.fail("Broken Pipe Error while attempting to login")
	except Exception as e:
	self.null_auth = False
	if "STATUS_NOT_SUPPORTED" in str(e):
	# no ntlm supported
	self.no_ntlm = True
	self.logger.debug("NTLM not supported")

When the connection fails, getServerDNSHostName() and getServerName() both return empty, causing the hostname information to be cleared.

NetExec/nxc/protocols/smb.py

Lines 215 to 221 in d1fc6d5

	dns_hostname = self.conn.getServerDNSHostName().upper()
	if dns_hostname and "." in dns_hostname:
	self.hostname = dns_hostname.split(".")[0]
	elif dns_hostname:
	self.hostname = dns_hostname
	else:
	self.hostname = self.conn.getServerName()

To Reproduce

1. On a Windows Server 2025 domain controller, disable incoming NTLM e.g. by:

   HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\RestrictReceivingNTLMTraffic=2
   

2. Attempt to authenticate to the host with Kerberos:

   nxc smb DC.CORP.LOCAL -u Administrator -p "${PW}" -k -d CORP.LOCAL

Expected Behavior
Authentication success, SPN of cifs/DC.CORP.LOCAL in Wireshark, etc

Actual Behavior
KDC_ERR_S_PRINCIPAL_UNKNOWN, SPN of cifs/. in Wireshark.

SMB         DC.CORP.LOCAL    445    NONE             [*]  x64 (name:) (domain:) (signing:True) (SMBv1:None)
SMB         DC.CORP.LOCAL    445    NONE             [-] CORP.LOCAL\Administrator:[..snip..] KDC_ERR_S_PRINCIPAL_UNKNOWN

Screenshot

TGS-REQ

NetExec info

• OS: Kali
• Version of nxc: 1.5.1 - Yippie-Ki-Yay - Kali Linux -
• Installed from: apt, but testing on main shows the same

[drewmnoel]

Anecdotally, moving the no_ntlm assignment out of the conditional resolves the issue, but is probably not the right solution.

NetExec/nxc/protocols/smb.py

Lines 196 to 201 in d1fc6d5

	except Exception as e:
	self.null_auth = False
	if "STATUS_NOT_SUPPORTED" in str(e):
	# no ntlm supported
	self.no_ntlm = True
	self.logger.debug("NTLM not supported")

[NeffIsBack]

Very interesting, thanks a lot for the bug report!
There are probably quite a few things that currently break with the new Windows Server 2025 and we should/need to fix.

[XedSama]

I tried to work on this and I think the fix could be the same as #1342. In enum_host_info, self.conn.login("","") and login("Guest","") are affected by the rate-limiting on NTLM auth, even if NTLM is disabled.

I see two possibles fix :

• Handling the NetBIOSTimeout exception for login("","") and login("Guest","")
• Adding a LDAP resolution in the not self.no_ntlm branch

Don't know which option would be the better, I tried the second option and it worked well but only if I targeted the DC.

[XedSama]

Or we could use directly the auth_timeout function