Crackmapsexec - Output only successful connections?

[Coldfirex]

Howdy!
Is there a way when running crackmapexec checking for null sessions to only output successful connections?
Thanks!

[bongobongoland]

@XiaoliChan help!

[XiaoliChan]

Howdy! Is there a way when running crackmapexec checking for null sessions to only output successful connections? Thanks!

just doing this, this just doing hosts discovery

poetry run crackmapexec smb 192.168.1.0/24

[Coldfirex]

Is poetry required for this function?
I normally just use:
crackmapexec smb 192.168.1.0/24 -u '' -p ''
I dont want the output to list any access denied, etc., just the successful connections.

[XiaoliChan]

Doing without -u '' -p '' is fine :D

[XiaoliChan]

In the program, blank user -u '' always means anonymous in windows.

[XiaoliChan]

poetry is not required in this function

[XiaoliChan]

[Coldfirex]

Maybe I am missing something then. See the screenshot below.
When I don't pass a blank username/password to check for null sessions I dont see if the connection was successful or not. If I do include it then I can see null sessions are not allowed on IT-Apps so I get an access denied. Nul sessions are allowed on COBAD4 however so I get the '+' line, which is what I want to see (not the access denied ones).

[XiaoliChan]

This can't control, some host allow anonymous, some not allow

[XiaoliChan]

maybe you can do something like grep, just use --log /tmp/result and then cat /tmp/result | grep "+"

[Marshall-Hallenbeck]

Hey @Coldfirex. I would suggest grepping the output, or you can use the database tool (I need to re-write it, but you can launch it right now with cmedb). If neither of those options work, you can query the SMB Sqlite DB directly at ~/.cme/workspaces/default/smb.db (if you have created a new workspace, obviously replace it). There is not currently any flag to only show successful logins, etc. We had discussed this before but opted not to implement.