Repository navigation
Fix Kerberos auth, target-file mounts, and DNS hangs in Docker run - #127
Merged
aconite33 merged 1 commit intoOct 13, 2026
Conversation
- manspider.sh: mount the invoking user's real home directory read-only so absolute target-file and ccache paths resolve inside the container, mount cwd at /work so relative target-list files resolve too, and pass through KRB5CCNAME/krb5.conf when present on the host. Still pulls the published blacklanternsecurity/manspider image by default; set MANSPIDER_LOCAL_BUILD=1 to instead build and run from this checkout's source (e.g. when testing local patches before they're released). - manspider.py: validate Kerberos ccache availability up front with a clear error instead of failing silently deep in impacket, and add -K/--ccache to point at a specific ccache file directly (bypasses sudo stripping KRB5CCNAME, and overrides any existing KRB5CCNAME). - smb.py/util.py: add run_with_timeout() and use it around SMBConnection() and kerberosLogin() -- impacket's own timeout= kwarg only bounds the TCP connect/recv phase, not DNS resolution (socket.getaddrinfo()), so an unreachable/garbage target could hang for minutes with no indication anything was wrong. Also stop re-attempting Kerberos on the guest/null session fallback, and warn (rather than silently swallow) when a target-list file can't be opened. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
aconite33
merged commit Oct 13, 2026
b80a9da
into
blacklanternsecurity:feature/classification-dfs-certs-json
9 of 10 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Retargets the changes from #126 onto
feature/classification-dfs-certs-jsoninstead ofmaster.#126 was merged into
masterby mistake and has since been backed out there (revert commit671ff72). This PR brings the same fix onto the feature branch, where it was intended to land. Same head branch and commit (ab4aa08) — no changes to the original work.Original work by @Sw3d1shPh1sh.
What it does
-K/--ccacheto point directly at a ccache file (setsKRB5CCNAMEfor the run), with clearer error messages and validation of file-backed caches (leavingKEYRING:/DIR:/MEMORY:/API:types to krb5).Merges cleanly into the feature branch (verified).