Report to https://github.com/galkan/crowbar/issues instead?

What version of Kali is that ? In kali-rolling, crowbar depends on freerdp3-x11 which depends on freerdp-x11. And the file /usr/bin/xfreerdp exists (it's installed by the package freerdp-x11).

Also, the package freerdp-x11 does exist, so your second screenshot is weird.

I think you might be running a outdated installation of Kali Linux (the problem you describe might have existed in some older Kali releases), but if you upgrade your system (sudo apt update && sudo apt full-upgrade) the problem should go away,

Sorry, my bad, fixed that bit now.
Anyway, the actual issue I wanted to report (and hence why I made the incorrect assumption on xfreerdp) is to do with the rdp functionality.

Crowbar does not detect valid credentials. I've had a look.
The xfreerdp command behind the scenes is rdp_cmd = "%s /v:%s /port:%s /u:%s /p:%s /cert-ignore -clipboard +auth-only " % (
self.xfreerdp_path, ip, port, user, password)

However, on a standard kali build, the resolved command results in this error, although the credentials are valid and the desktop does connect :

[03:59:34:070] [84947:00014bd5] [ERROR][com.freerdp.core] - [freerdp_connect_begin]: Authentication only, exit status 1

As crowbar obviously checks for exit status 0, this means it never identifies valid creds. Someone else flagged the issue here but their proposed fix doesn't seem to solve the problem for me: https://github.com/galkan/crowbar/pull/78. Seems to do with domain/local issue.

More detailed error/screenshots:

[03:59:34:070] [84947:00014bd5] [ERROR][com.freerdp.core] - [freerdp_connect_begin]: Authentication only, exit status 1

This website doesn't like screenshots of the error or full command so semi-redacted here:

krb5_parse_name (Configuration file does not specify default realm [-1765328160])

[03:59:34:070] [84947:00014bd5] [ERROR][com.freerdp.core] - [freerdp_connect_begin]: Authentication only, exit status 1

I haven't reported this upstream because the upstream code hasn't been updated for six years. Most people use hydra, so my view is either fix or drop the tool as a whole.

Don't think kali team is maintaining code of others...

@kali-bug report
My view here is that the current crowbar implementation is fundamentally wrong and producing misleading results. If someone is genuinely using it without being aware of the bug, they could just incorrectly assume none of the password attempts were valid, when the rdp service may actually be using a weak password. Admittedly mitigated by the fact that most people will use hydra or not be brute forcing rdp anyway and likely trying smb.

I think there are two options if we're agreed that leaving the current package in place is not appropriate.

1. Remove the package in the same way I believe some packages not updated for python3 were removed.
2. I can try and fork the code and fix the issue, and maintain going forward, but would kali even be willing to use that code? (Maintainer of current code has not been active since 2017/18 (albeit one commit in 2021 to remove some files)).

I don't know, don't care. Just wanted to saying that they (Kali team) usually don't maintain others code so that other options could be checked :-)

I'm not against taking a look at it, however, I'd need a way to reproduce it. I never used crowbar. What is it that needs to run on the target machine in order to reproduce the issue ? Is there such a machine publicly avail for tests ?

@kali-bugreport We don't usually maintain others code, it's true, but at the same time we try to keep legacy software working (and there's a lot of legacy stuff in Kali). I'd rather try to keep this one working if it's not too much work.

@arnaudr you can use any vanilla Windows machine for this as long as RDP is enabled (which should be out of the box). So as long as you have a Windows VM/box with a local user that you know the password for, that would work. I used the HTB Academy Password Attacks module and target the machine in the module that teaches RDP password cracking, but that's probably not classed as publicly available. Let me know if you need something more readily available and I'll do some digging.

I think there are probably a lot of edge cases, like I haven't even thought about testing domain users (which probably isn't even classed as an edge case), but I think I'd settle for now for getting local users working.

@baggers I don't have any Windows machine avail. But I can setup a Linux VM with xrdp enabled, I suppose it's roughly equivalent.