Update sccm.py

[alostwarrior]

Bug Description

When the SCCM module is executed with the following option:
-o REC_RESOLVE=TRUE
the module crashes during recursive object resolution.

Root Cause

The resolve_recursive() method builds an LDAP filter using a Distinguished Name (DN) without escaping LDAP special characters. If the DN contains characters that require escaping, the resulting LDAP filter is malformed, causing the LDAP query to fail and the module to terminate unexpectedly.

Steps to Reproduce:

• Run the SCCM module with recursive resolution enabled:
  o REC_RESOLVE=TRUE
• Execute the module against an environment containing objects whose Distinguished Names include characters requiring LDAP filter escaping.
• Observe that the module crashes during recursive resolution.

Expected Behavior

The DN should be properly escaped before being incorporated into the LDAP filter, allowing recursive resolution to complete successfully without errors.

Actual Behavior

The module constructs an invalid LDAP filter, causing the LDAP query to fail and the SCCM module to crash.

Proposed Fix

Escape the Distinguished Name before it is inserted into the LDAP filter within the resolve_recursive() method. This ensures that LDAP filters remain valid regardless of the DN contents and prevents crashes when recursive resolution is enabled.

Note: I have also submitted a pull request with this fix in sccm.py. The changes resolve the issue in my environment, and recursive resolution now works correctly with REC_RESOLVE=TRUE. Please review the implementation and let me know if any modifications are required.

[alostwarrior]

FIX - the resolve_recursive method needs the DN escaped before it goes into the filter

        """Recursively resolve members of a group."""
        try:
            self.context.log.debug(f"Resolving group members recursively for {dn}")
            # Escape LDAP filter special characters in the DN value (RFC 4515)
            safe_dn = (
                dn.replace("\\", "\\5c")
                  .replace("(", "\\28")
                  .replace(")", "\\29")
                  .replace("*", "\\2a")
            )
            # Somehow BaseDN is not working together with the LDAP_MATCHING_RULE_IN_CHAIN
            result = self.connection.ldap_connection.search(
                searchFilter=f"(memberOf:{LDAP_MATCHING_RULE_IN_CHAIN}:={safe_dn})",
                attributes=["sAMAccountName", "distinguishedName", "sAMAccountType"],
            )

            result = parse_result_attributes(result)
            for res in result:
                self.group_objects[dn]["children"].append({
                    "sAMAccountName": res["sAMAccountName"],
                    "distinguishedName": res["distinguishedName"],
                    "sAMAccountType": res["sAMAccountType"],
                })

        except LDAPSearchError as e:
            self.context.log.error(f"Error resolving group members: {e}")````

[NeffIsBack]

Thanks for the bug report!

Can you provide a DN that would crash the query so I can try it out? Although, I think search query escaping should probably be done in impacket rather than NetExec. Could you post the link to the PR? I don't see it.

[alostwarrior]

Hi Sir, Thanks for your reply. I was testing this in a corporate network, I will provide the PoC the PoC next week when I connect with their network

…

On Sun, 2 Aug 2026 at 1:56 AM, Alex ***@***.***> wrote: *NeffIsBack* left a comment (Pennyw0rth/NetExec#1339) <#1339 (comment)> Thanks for the bug report! Can you provide a DN that would crash the query so I can try it out? Although, I think search query escaping should probably be done in impacket rather than NetExec. Could you post the link to the PR? I don't see it. — Reply to this email directly, view it on GitHub <#1339?email_source=notifications&email_token=AO2Z7BDWRE6QUUSQSQ3TZ4T5HZG75A5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMJVGMZDOMBSGQZKM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-5153270242>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AO2Z7BAS3MQS5A6M3AZX7235HZG75AVCNFSNUABFKJSXA33TNF2G64TZHM3DQOJQGEZTSMBTHNEXG43VMU5TKMBRGY4DSMRTGI42C5QC> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/AO2Z7BEUO7LC7DJ4WRZJP335HZG75A5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMJVGMZDOMBSGQZKM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KUZTPN52GK4S7NFXXG> and Android <https://github.com/notifications/mobile/android/AO2Z7BAF7NY4CF33A52WTSD5HZG75A5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMJVGMZDOMBSGQZKM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA>. Download it today! You are receiving this because you authored the thread.Message ID: ***@***.***>