Skip to content

fix(registry): lowercase target_hosts_by_hostname lookups - #8

Open
WaiZ0 wants to merge 1 commit into
SpecterOps:mainfrom
WaiZ0:fix/registry-hostname-case-lookup
Open

fix(registry): lowercase target_hosts_by_hostname lookups#8
WaiZ0 wants to merge 1 commit into
SpecterOps:mainfrom
WaiZ0:fix/registry-hostname-case-lookup

Conversation

@WaiZ0

@WaiZ0 WaiZ0 commented Aug 24, 2026

Copy link
Copy Markdown

Found in the same GOAD SCCM lab session as the companion SMB fix
(#7), once that fix let
RemoteRegistry actually connect to every host: the phase then crashed
on every single one instead.

target_hosts_by_hostname is keyed by lowercased hostname (context.py); five
lookups in registry.py used the target/probe hostname as-is instead. Two
index the dict directly and raise KeyError on a case mismatch, killing the
whole RemoteRegistry phase for that host.

Adds a regression test with mismatched casing, which the existing fixture's
always-lowercase TARGET constant could never exercise.

target_hosts_by_hostname is documented and populated as keyed by
lowercased canonical hostname (context.py), and mssql.py already
looks it up correctly via target.lower(). Five lookups in registry.py
looked it up with the target/probe hostname as-is instead, which is
whatever case the host was actually discovered in (e.g. LDAP name-
pattern matches return the AD computer's own casing, "MECM.sccm.lab").

Two of those five (get_ntlm_settings, get_mssql_settings) index the
dict directly and raise KeyError on a case mismatch, killing the
entire RemoteRegistry phase for that target -- including the site-
code and component-server reads later in the same generator, which
are the low-privilege-readable keys that identify a host as an SCCM
site server / SQL server. Confirmed against a live lab where a fixed
SMB auth bug let RemoteRegistry connect on every host for the first
time, and every single one immediately crashed here.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant