Common NetExec (nxc) Kerberos errors and quick fixes

popular_nxc_errors.md

Popular NetExec (nxc) Errors

STATUS_NOT_SUPPORTED

Error:

10.129.232.168\f.frizzle:Jenni_Luvs_Magic23 STATUS_NOT_SUPPORTED

Solution 1: Add -k flag to authenticate through Kerberos

Example:

nxc smb 10.129.232.168 -u f.frizzle -p 'Jenni_Luvs_Magic23' -k

Solution 2: generate krb5 and add it to work with all other programs

netexec smb $IP --generate-krb5-file krb5.conf
sudo cp krb5.conf /etc/krb5.conf

---

KDC_ERR_WRONG_REALM

Error:

[-] 10.129.232.168\w.Webservice:Jenni_Luvs_Magic23 KDC_ERR_WRONG_REALM

Solution: Use the hostname instead of the IP address

Example:

# Wrong
nxc smb 10.129.232.168 -u w.Webservice -p 'Jenni_Luvs_Magic23' -k

# Correct
nxc smb frizzdc.frizz.htb -u w.Webservice -p 'Jenni_Luvs_Magic23' -k

---

KRB_AP_ERR_SKEW

Error:

[-] frizz.htb\user:password KRB_AP_ERR_SKEW

Solution: Synchronize time with the Domain Controller

Commands:

# Sync time with DC
sudo ntpdate -u 10.129.232.168

# If issues persist, restart time services
sudo systemctl restart systemd-timesyncd.service
sudo timedatectl set-ntp no
sudo timedatectl set-ntp yes

---

Name or service not known

Error:

[-] frizzdc\f.frizzle:Jenni_Luvs_Magic23 [Errno Connection error (FRIZZDC:88)] [Errno -2] Name or service not known

Solution: Use the full FQDN in /etc/hosts and nxc command

Add to /etc/hosts:

10.129.232.168  frizzdc.frizz.htb frizzdc

Example:

# Wrong - domain only
nxc smb frizz.htb -u f.frizzle -p 'Jenni_Luvs_Magic23' -k

# Correct - full DC hostname
nxc smb frizzdc.frizz.htb -u f.frizzle -p 'Jenni_Luvs_Magic23' -k