Method _resolve_dc_hostname

NetworkHound.py:257–357

Try to resolve DC IP to NetBIOS hostname for proper Kerberos SPN Tries multiple methods: 1. SMB connection (TCP 445/139) - most reliable with proxychains 2. DNS PTR query (TCP if available) 3. nmblookup (UDP 137) - fallback

(self, ip_address)

        self.entries = []  # Store last search results
    
    def _resolve_dc_hostname(self, ip_address):
        """Try to resolve DC IP to NetBIOS hostname for proper Kerberos SPN
        
        Tries multiple methods:
        1. SMB connection (TCP 445/139) - most reliable with proxychains
        2. DNS PTR query (TCP if available)
        3. nmblookup (UDP 137) - fallback
        """
        
        # Method 1: SMB Connection (TCP - works with proxychains!)
        try:
            from impacket.smbconnection import SMBConnection
            logger.debug(f"Trying SMB connection to {ip_address} for name resolution...")
            
            # Try anonymous SMB connection
            smb = SMBConnection(ip_address, ip_address, timeout=10)
            try:
                smb.login('', '')  # Anonymous/null session
            except:
                # If anonymous fails, that's OK - we might still get the name
                pass
            
            server_name = smb.getServerName()
            if server_name and server_name != ip_address:
                logger.debug(f"SMB resolved {ip_address} -> {server_name}")
                try:
                    smb.logoff()
                except:
                    pass
                return server_name
            
            try:
                smb.logoff()
            except:
                pass
                
        except Exception as e:
            logger.debug(f"SMB name resolution failed: {e}")
        
        # Method 2: DNS PTR query (TCP)
        try:
            import dns.resolver
            import dns.reversename
            import dns.query
            import dns.message
            
            logger.debug(f"Trying DNS PTR query for {ip_address}...")
            
            # Create reverse DNS name
            addr = dns.reversename.from_address(ip_address)
            
            # Use DC/target as DNS server (more appropriate for internal network)
            dns_server = self.impacket_auth.target if hasattr(self, 'impacket_auth') else ip_address
            
            # Try TCP first (works better with proxychains)
            try:
                query = dns.message.make_query(addr, 'PTR')
                response = dns.query.tcp(query, dns_server, timeout=5)