Fingerprinting Windows 11 Hosts Reports as Windows 10

[johnmarosi]

Describe the bug
The program reports hosts running Windows 11 as Windows 10.

To Reproduce
Steps to reproduce the behavior i.e.:
Command: netexec smb [IP]
Resulted in:
``
└─# nxc smb 10.1.11.8
SMB 10.1.11.8 445 JM-SURFACE [*] Windows 10.0 Build 26100 x64 (name:JM-SURFACE) (domain:JM-SURFACE) (signing:True) (SMBv1:False)

Expected behavior
Should report Windows 11 (Build 26100 Googles as:
Windows 10.0 Build 26100 is associated with Windows 11, version 24H2, not Windows 10. Here are some key points about this build:"

NetExec info

• OS: Kali
• Version of nxc: 1.3.0
• Installed from: pipx install git+https://github.com/Pennyw0rth/NetExec

[NeffIsBack]

Yep thanks for the report.
Impacket just hasn't updated the build number list yet. Gonna PR the new build numbers when i have time

[Marshall-Hallenbeck]

@NeffIsBack does it fall back to Win10 or is it fully Impacket just reporting the wrong version? In other words can we just report "Unknown Windows" or do we have to rely fully on Impacket

[NeffIsBack]

@NeffIsBack does it fall back to Win10 or is it fully Impacket just reporting the wrong version? In other words can we just report "Unknown Windows" or do we have to rely fully on Impacket

Kinda. If no matching build number is found it does something like "Win {os.major_version}.{os.minor_version}". And since Win10 that was always "Win 10.0"

[NeffIsBack]

Should be fixed with fortra/impacket#1874