fix(smb/sccm): pass kdcHost/dc_ip to dploot Target so --sccm wmi doesn't hang over Kerberos

[Goultarde]

Description

I found this while running --sccm wmi against a hardened AD lab (Kerberos-only, no NTLM).

--sccm wmi hangs indefinitely after "Looting SCCM Credentials through wmi" when authenticating with Kerberos (-k/--use-kcache).

Root cause: smb.sccm() builds the dploot Target without dc_ip/kdcHost. dploot's SCCMTriage.wmi_collect_sccm_secrets() opens a fresh DCOMConnection(..., kdcHost=self.target.dc_ip). With dc_ip=None and doKerberos=True, impacket cannot locate the KDC for the DCOM service ticket and blocks. The SMB masterkey stage works fine because it reuses the already-authenticated nxc session (upgrade_to_dploot_connection), so only the fresh DCOM connection is affected. The user-supplied --kdcHost is stored in self.kdcHost but was never propagated to the dploot Target.

Fix: pass kdcHost=self.kdcHost and dc_ip=self.kdcHost in Target.create() inside sccm() (dc_ip is the parameter actually read by DCOMConnection). I also added kdcHost=self.kdcHost in dpapi() for consistency, even though it doesn't open a DCOM connection.

Only affects the Kerberos path. NTLM is unaffected (both parameters stay None, no behavior change).

I used Claude Code to help diagnose the root cause (tracing the freeze through dploot's SCCMTriage/DCOMConnection code). I reviewed and validated the diff myself and reproduced/confirmed the fix against a real target.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Deprecation of feature or functionality
• This change requires a documentation update
• This requires a third party update (such as Impacket, Dploot, lsassy, etc)
• This PR was created with the assistance of AI (Claude Code, used for root-cause diagnosis and drafting the patch; reviewed and tested manually)

Setup guide for the review

To reproduce the bug: target a domain-joined Windows host with SCCM/MECM client secrets present, authenticate with Kerberos (-k or --use-kcache, optionally --kdcHost <dc_ip>), and run --sccm wmi. Without the fix, the command hangs indefinitely right after "Looting SCCM Credentials through wmi". With the fix applied, it completes and returns NAA/Task Sequence/Collection Variable secrets.

Tested with:

• Python 3.14 (pipx venv), NetExec on main (commit ff198407)
• impacket 0.14.0.dev, dploot 3.2.2
• Attacker: Linux (Nihil)
• Target: Windows 11 22H2 domain member, AD domain with a DC hosting the KDC

Screenshots (if appropriate):

Before :

After :

Checklist:

• I have ran Ruff against my changes (poetry: poetry run ruff check ., use --fix to automatically fix what it can)
• I have added or updated the tests/e2e_commands.txt file if necessary (new modules or features are required to be added to the e2e tests)
• If reliant on changes of third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
• I have linked relevant sources that describes the added technique (blog posts, documentation, etc)
• I have performed a self-review of my own code (not an AI review)
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)

[NeffIsBack]

Thanks for the bug fix PR! I'll look into it soon.