Cannot query MSCluster namespaces

[Mysteoa]

I have been trying to make a script to query MSCluster properties like Active node, cluster Disk usage and others.
Every time I would get WBEM_E_ACCESS_DENIED (2147749891) error, but I know that the account is configured properly. I have already test it and it works remotely with powershell and Impacket. Furthermore, I can't find any Windows Event log errors in Security or WMI-Activities.

I tryed using the example script with this query "SELECT Name FROM MSCluster_Cluster" from "root/mscluster".
This is the Traceback from it :

Traceback (most recent call last):
File "/home/support/./plugins/query_aiowmi_custom.py", line 93, in
asyncio.run(main())
File "/usr/lib/python3.10/asyncio/runners.py", line 44, in run
return loop.run_until_complete(main)
File "/usr/lib/python3.10/asyncio/base_events.py", line 649, in run_until_complete
return future.result()
File "/home/support/./plugins/query_aiowmi_custom.py", line 36, in main
async with query.context(conn, service) as qc:
File "/opt/python-virtualenv/aiowmi/lib/python3.10/site-packages/aiowmi/qcontext.py", line 53, in aenter
await self.start()
File "/opt/python-virtualenv/aiowmi/lib/python3.10/site-packages/aiowmi/qcontext.py", line 85, in start
message = rpc_response.get_message(self._proto)
File "/opt/python-virtualenv/aiowmi/lib/python3.10/site-packages/aiowmi/rpc/response.py", line 106, in get_message
raise wbem_exception(errcode)
aiowmi.exceptions.WbemExAccessDenied: WBEM_E_ACCESS_DENIED (2147749891)

I'm running this on Ubuntu 22 using virtualenv. I tested this against Windows Server 2016 Cluster.

Is there a way to set to always run Authentication Level as RPC_C_AUTHN_LEVEL_PKT_PRIVACY? I'm wondering if this could be the issues as it is required by the namespace "root/mscluster" .

[joente]

You need to query another namespace like this:

Query('SELECT Caption FROM Win32_ComputerSystem', namespace='root/mscluster')

[Mysteoa]

For testing purposes I used the example script with only changing the query to :

Query('SELECT Name,State FROM mscluster_node', namespace='root/mscluster')

This is the output I get when I try to run it:

`[D 260320 12:31:01 protocol:48] Connection made: CLUSTER_IP:135
[D 260320 12:31:01 remote_create_instance_response:67] Selected binding: ('CLUSTER_IP', 24158)
[D 260320 12:31:01 protocol:48] Connection made: CLUSTER_IP:24158

###############################################################################

Start Query: SELECT Name,State FROM mscluster_node

###############################################################################

done in 0.017679929733276367
[D 260320 12:31:01 protocol:54] Connection lost CLUSTER_IP:24158
[D 260320 12:31:01 protocol:54] Connection lost CLUSTER_IP:135
Traceback (most recent call last):
File "/home/support/./check_aiowmi_cluster.py", line 92, in
asyncio.run(main())
File "/usr/lib/python3.10/asyncio/runners.py", line 44, in run
return loop.run_until_complete(main)
File "/usr/lib/python3.10/asyncio/base_events.py", line 649, in run_until_complete
return future.result()
File "/home/support/./check_aiowmi_cluster.py", line 35, in main
async with query.context(conn, service) as qc:
File "/opt/python-virtualenv/aiowmi/lib/python3.10/site-packages/aiowmi/qcontext.py", line 49, in aenter
await self.start()
File "/opt/python-virtualenv/aiowmi/lib/python3.10/site-packages/aiowmi/qcontext.py", line 81, in start
message = rpc_response.get_message(self._proto)
File "/opt/python-virtualenv/aiowmi/lib/python3.10/site-packages/aiowmi/rpc/response.py", line 113, in get_message
raise wbem_exception(errcode)
aiowmi.exceptions.WbemExAccessDenied: WBEM_E_ACCESS_DENIED (2147749891)`

This was run on Ubuntu 22 with aiowmi v1.1.1 installed in virtualenv environment.
The account used for connecting has been tested and it does work if I run the same query from Powershell or use impacket module.

[joente]

Is there a way to set to always run Authentication Level as RPC_C_AUTHN_LEVEL_PKT_PRIVACY? I'm wondering if this could be the issues as it is required by the namespace "root/mscluster" .

The auth level is RPC_C_AUTHN_LEVEL_PKT_PRIVACY (6). See negotiate_ntlm() and/or negotiate_kerberos()