Connection string parse

[CedBau]

Hello everyone

As far as I'm concerned NTLM is used for the WinRM connection. I feel like the username isn't parsed correctly if the string contains a slash, e. g. this.domain\username@host. Is there a way around it?

[chris-rock]

HI @CedBau

It would be great if you could share the powershell command that you use so that we can see how you connect to the machine. To make sure we do not have a cli parsing issue, you can also use an inventory file:

apiVersion: v1
kind: Inventory
spec:
  assets:
    - id: windows-with-password
      connections:
        - host: 192.168.178.20
          backend: winrm
          credentials:
            - user: chris
              password: password

and then use

cnspec scan --inventory-file winrm_inventory.yml 

[CedBau]

Here's how I attempt to make the connection:

cnspec scan winrm MyComputer\[email protected]:5985

The POST method for the authentication then looks like this (according to whireshark):
...User: MyDomain\LocalUser
instead of MyComputer\LocalUser

The Machines are Domain joined, Microsoft suggests the following: "If connecting to a remote target computer using a local account, then the account should be prefixed with the computer name. For example, myComputer\myUsername."

If I don't prefix LocalUser then the POST method is the same ...User: MyDomain\LocalUser

cnspec is run in a Ubuntu 22.04 Dockercontainer for automation purposes.

[chris-rock]

Currently I have no domain-joined Windows machine available to reproduce the issue. Based on the discussion I saw at ansible/ansible#13416 it sounds like winrm requires kerberos authentication for domain authentication. At this point we only support NTLM authentication for Winrm.

As an immediate alternative, I propose the use of openssh for Windows. cnquery and cnspec have great support for this.

[CedBau]

correct, that's why I try to connect with a local user. The HTTP POST for NTLM Authentication however indicates, that a domain user is used:

POST /wsman HTTP/1.1 , NTLMSSP_AUTH, User: Domain\LocalUser
If I'm not mistaken it should be:
POST /wsman HTTP/1.1 , NTLMSSP_AUTH, User: LocalMachine\LocalUser or just
POST /wsman HTTP/1.1 , NTLMSSP_AUTH, User: LocalUser

[chris-rock]

Have you used the inventory file I shared above? That is just passing in the username and password and does not do the cli input parsing. If that works we can see if the issue is the cli argument parser or something else.

[CedBau]

With the inventory file I'm unable to specify that HTTP transport should be used or I haven't figured out how i can do that. I tried it like this:

assets:
- id: windows-with-password
connections:
- host: 192.168.178.20:5985
backend: winrm
credentials:
- user: chris
password: password

[chris-rock]

Got ya. This should do it:

WINRM_DISABLE_HTTPS=true cnspec scan --inventory-file winrm_inventory.yml 

[CedBau]

Thanks for your efforts. The Problem sadly persists. I'm just not able to specify the "domain" that should be used for the connection, like mentioned earlier it should be the "LocalMachine". Here my setup to explain it in detail:

Scan Asset: testwin2022-1.mydomain--> Domain Joined
Local User: localuser1
Domain User: domainuser1

Here's how PowerShell handles the authorization. The following command is executed:
New-PSSession -ComputerName testwin2022-1.mydomain -Credential (Get-Credential) -Authentication Negotiate

The following credentials are entered:
User: testwin2022-1\localuser1
Password for user testwin2022-1\localuser1: ****************

Which leads to the following authorization:

POST /wsman/ HTTP/1.1 , NTLMSSP_AUTH, User: \localuser1
HTTP/1.1 200

On the other hand, if I use cnspec, the HTTP POST looks like this:

POST /wsman/ HTTP/1.1 , NTLMSSP_AUTH, User: MYDOMAIN\localuser1
HTTP/1.1 401

Here's the inventory-file I used:

apiVersion: v1
kind: Inventory
spec:
assets:
- id: windows-with-password
connections:
- host: testwin2022-1.mydomain
port: 5985
backend: winrm
credentials:
- user: \localuser1
password: MyPassword

I've tried multiple things for the user, e. g. testwin2022-1\localuser1, localuser1@testwin2022-1, testwin2022-1\\localuser1 and so forth.

I even tried to specify a domain key for the credentials like:
domain: testwin2022-1

If I use the Domain User, everything works as expected:

POST /wsman/ HTTP/1.1 , NTLMSSP_AUTH, User: MYDOMAIN\domainuser1
HTTP/1.1 200

[chris-rock]

Thank you. I'll try to reproduce this. Seems like you are using a Windows 2022 with Domain. Can you share how you have configured Winrm so that it is easier to reproduce the same?

[CedBau]

Sorry for the delayed answer. I used the following winrm config: winrmconfig.txt

[CedBau]

Hi @chris-rock
Do you have an update regarding this issue?
Thanks in advance.