diff --git a/scripts/smb-brute.nse b/scripts/smb-brute.nse
index 515c8518c..d3aa935b3 100644
--- a/scripts/smb-brute.nse
+++ b/scripts/smb-brute.nse
@@ -380,6 +380,24 @@ function is_positive_result(hostinfo, result)
return true
end
+---Determines whether or not a login was "bad". A bad login is one where an account becomes locked out.
+--
+--@param hostinfo The hostinfo table.
+--@param result The result code.
+--@return true if the password used for logging in was correct, false otherwise. Keep
+-- in mind that this doesn't imply the login was successful (only results.SUCCESS indicates that), rather
+-- that the password was valid.
+
+function is_bad_result(hostinfo, result)
+ -- If result is LOCKED, it's always bad.
+ if(result == results.ACCOUNT_LOCKED or result == results.ACCOUNT_LOCKED_NOW) then
+ return true
+ end
+
+ -- Otherwise, it's good
+ return false
+end
+
---Count the number of one bits in a binary representation of the given number. This is used for case-sensitive
-- checks.
--
@@ -937,30 +955,29 @@ local function go(host)
--io.write(string.format("%s:%s\n", username, password))
local result = check_login(hostinfo, username, password, get_type(hostinfo))
- if(is_positive_result(hostinfo, result)) then
+ -- Check if the username was locked out
+ if(is_bad_result(hostinfo, result)) then
+ -- Add it to the list of locked usernames
+ hostinfo['locked_usernames'][username] = true
- -- First, the special case -- a lockout occurred (bad news!)
- if(result == results.ACCOUNT_LOCKED) then
- -- Add it to the list of locked usernames
- hostinfo['locked_usernames'][username] = true
-
- -- Unless the user requested to keep going, stop the check
- if(not(nmap.registry.args.smblockout == 1 or nmap.registry.args.smblockout == "true")) then
- -- Mark it as found, which is technically true
- status, err = found_account(hostinfo, username, nil, results.ACCOUNT_LOCKED_NOW)
- if(status == false) then
- return err
- end
-
- -- Let the user know that it went badly
- stdnse.print_debug(1, "smb-brute: '%s' became locked out; stopping", username)
-
- return true, hostinfo['accounts'], hostinfo['locked_usernames']
- else
- stdnse.print_debug(1, "smb-brute: '%s' became locked out; continuing", username)
+ -- Unless the user requested to keep going, stop the check
+ if(not(nmap.registry.args.smblockout == 1 or nmap.registry.args.smblockout == "true")) then
+ -- Mark it as found, which is technically true
+ status, err = found_account(hostinfo, username, nil, results.ACCOUNT_LOCKED_NOW)
+ if(status == false) then
+ return err
end
- end
+ -- Let the user know that it went badly
+ stdnse.print_debug(1, "smb-brute: '%s' became locked out; stopping", username)
+
+ return true, hostinfo['accounts'], hostinfo['locked_usernames']
+ else
+ stdnse.print_debug(1, "smb-brute: '%s' became locked out; continuing", username)
+ end
+ end
+
+ if(is_positive_result(hostinfo, result)) then
-- Reset the connection
stdnse.print_debug(2, "smb-brute: Found an account; resetting connection")
status, err = restart_session(hostinfo)