Compare commits

...
Author SHA1 Message Date
Marshall Hallenbeck e1991cf265 deprecate: remove multiple hosts warning 2025-07-13 15:48:07 -04:00
115 changed files with 100 additions and 211 deletions

No files matched your search

+1 -2
View File
@@ -14,8 +14,7 @@ class NXCModule:
description = "Find PKI Enrollment Services in Active Directory and Certificate Templates Names"
supported_protocols = ["ldap"]
opsec_safe = True
multiple_hosts = True
def __init__(self, context=None, module_options=None):
self.context = context
self.module_options = module_options
+1 -2
View File
@@ -17,8 +17,7 @@ class NXCModule:
description = "Adds or deletes a domain computer"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = False
def options(self, context, module_options):
"""
add-computer: Specify add-computer to call the module using smb
+1 -2
View File
@@ -9,8 +9,7 @@ class NXCModule:
description = "Search for aws credentials files."
supported_protocols = ["ssh", "smb", "winrm"]
opsec_safe = True
multiple_hosts = True
def __init__(self):
self.search_path_linux = "'/home/' '/tmp/'"
self.search_path_win = "'C:\\Users\\', 'C:\\ProgramData\\AWSCLI\\', 'C:\\Temp\\'"
+1 -2
View File
@@ -14,8 +14,7 @@ class NXCModule:
description = "Exploit user in backup operator group to dump NTDS @mpgn_x64"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def __init__(self, context=None, module_options=None):
self.context = context
self.module_options = module_options
+1 -2
View File
@@ -80,8 +80,7 @@ class NXCModule:
description = "Check if vulnerable to bad successor attack (DMSA)"
supported_protocols = ["ldap"]
opsec_safe = True
multiple_hosts = True
def __init__(self):
self.context = None
self.module_options = None
+1 -2
View File
@@ -10,8 +10,7 @@ class NXCModule:
description = "Enumerating BitLocker Status on target(s) If it is enabled or disabled."
supported_protocols = ["smb", "wmi"]
opsec_safe = True
multiple_hosts = True
def __init__(self, context=None, module_options=None):
self.context = context
self.module_options = module_options
+1 -2
View File
@@ -13,8 +13,7 @@ class NXCModule:
description = "Change or reset user passwords via various protocols"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = False
def options(self, context, module_options):
"""
Required (one of):
+1 -2
View File
@@ -12,8 +12,7 @@ class NXCModule:
description = "Module to check if the Target is vulnerable to any coerce vulns. Set LISTENER IP for coercion."
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def __init__(self, context=None, module_options=None):
self.context = context
self.module_options = module_options
+1 -2
View File
@@ -200,8 +200,7 @@ class NXCModule:
description = "Read and backup the Discretionary Access Control List of objects. Be careful, this module cannot read the DACLS recursively, see more explanation in the options."
supported_protocols = ["ldap"]
opsec_safe = True
multiple_hosts = False
def __init__(self, context=None, module_options=None):
self.context = context
self.module_options = module_options
+1 -2
View File
@@ -3,8 +3,7 @@ class NXCModule:
description = "[REMOVED] Module to check if the DC is vulnerable to DFSCoerce, credit to @filip_dragovic/@Wh04m1001 and @topotam"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def __init__(self, context=None, module_options=None):
self.context = context
self.module_options = module_options
+1 -2
View File
@@ -11,8 +11,7 @@ class NXCModule:
description = "Remotely dump Dpapi hash based on masterkeys"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def options(self, context, module_options):
"""OUTPUTFILE Output file to write hashes"""
self.outputfile = None
+1 -2
View File
@@ -13,8 +13,7 @@ class NXCModule:
description = "Drop a searchConnector-ms file on each writable share"
supported_protocols = ["smb"]
opsec_safe = False
multiple_hosts = True
def options(self, context, module_options):
"""
Technique discovered by @DTMSecurity and @domchell to remotely coerce an host to start WebClient service.
-1
View File
@@ -28,7 +28,6 @@ class NXCModule:
description = "Tries to activate the EFSR service by creating a file with the encryption attribute on some available share."
supported_protocols = ["smb"]
opsec_safe = True # Does the module touch disk?
multiple_hosts = True # Does the module support multiple hosts?
excluded_shares = ["SYSVOL"]
def options(self, context: Context, module_options: dict[str, str]):
+1 -2
View File
@@ -13,8 +13,7 @@ class NXCModule:
description = "Uses Empire's RESTful API to generate a launcher for the specified listener and executes it"
supported_protocols = ["smb", "mssql"]
opsec_safe = True
multiple_hosts = True
def options(self, context, module_options):
"""
LISTENER Listener name to generate the launcher for
+1 -2
View File
@@ -8,8 +8,7 @@ class NXCModule:
description = "Enable or disable xp_cmdshell in MSSQL Server"
supported_protocols = ["mssql"]
opsec_safe = False
multiple_hosts = True
def __init__(self):
self.mssql_conn = None
self.context = None
+1 -2
View File
@@ -13,8 +13,7 @@ class NXCModule:
description = "Find the Entra ID sync server"
supported_protocols = ["ldap"]
opsec_safe = True
multiple_hosts = True
def __init__(self):
self.context = None
self.module_options = None
+1 -2
View File
@@ -19,8 +19,7 @@ class NXCModule:
description = "Gathers information on all endpoint protection solutions installed on the the remote host(s) via LsarLookupNames (no privilege needed)"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def __init__(self, context=None, module_options=None):
self.context = context
self.module_options = module_options
-1
View File
@@ -25,7 +25,6 @@ class NXCModule:
description = "Anonymously uses RPC endpoints to hunt for ADCS CAs"
supported_protocols = ["smb"] # Example: ['smb', 'mssql']
opsec_safe = True # Does the module touch disk?
multiple_hosts = True # Does it make sense to run this module on multiple hosts at a time?
def __init__(self, context=None, module_options=None):
self.context = context
+1 -2
View File
@@ -13,8 +13,7 @@ class NXCModule:
description = "Uses WMI to dump DNS from an AD DNS Server"
supported_protocols = ["smb", "wmi"]
opsec_safe = True
multiple_hosts = True
def __init__(self, context=None, module_options=None):
self.context = context
self.module_options = module_options
+1 -2
View File
@@ -8,8 +8,7 @@ class NXCModule:
description = "Enumerate users with impersonation privileges"
supported_protocols = ["mssql"]
opsec_safe = True
multiple_hosts = True
def __init__(self):
self.mssql_conn = None
self.context = None
+1 -2
View File
@@ -8,8 +8,7 @@ class NXCModule:
description = "Enumerate linked SQL Servers and their login configurations."
supported_protocols = ["mssql"]
opsec_safe = True
multiple_hosts = True
def __init__(self):
self.mssql_conn = None
self.context = None
+1 -2
View File
@@ -8,8 +8,7 @@ class NXCModule:
description = "Enumerate SQL Server logins (SQL, Domain, Local users)"
supported_protocols = ["mssql"]
opsec_safe = True
multiple_hosts = True
def __init__(self):
self.mssql_conn = None
self.context = None
+1 -2
View File
@@ -10,8 +10,7 @@ class NXCModule:
description = "[REMOVED] Extract all Trust Relationships, Trusting Direction, and Trust Transitivity"
supported_protocols = ["ldap"]
opsec_safe = True
multiple_hosts = True
def options(self, context, module_options):
pass
+1 -2
View File
@@ -14,7 +14,6 @@ class NXCModule:
description = "Extracting Credentials From Windows Logs (Event ID: 4688 and SYSMON)"
supported_protocols = ["smb"] # Example: ['smb', 'mssql']
opsec_safe = True # Does the module touch disk?
multiple_hosts = True # Does it make sense to run this module on multiple hosts at a time?
def __init__(self):
self.context = None
@@ -68,7 +67,7 @@ class NXCModule:
line_stripped = line.replace("/add", "") \
.replace("/active:yes", "") \
.replace("/delete", "") \
.replace("/domain", "") \
.replace("/domain", "")
# Remove command lines that were executed with nxc
line_stripped = re.sub(r"1> \\Windows\\Temp\\[\w]{6} 2>&1", "", line_stripped)
-1
View File
@@ -10,7 +10,6 @@ class NXCModule:
description = "I do something"
supported_protocols = [] # Example: ['smb', 'mssql']
opsec_safe = True # Does the module touch disk?
multiple_hosts = True # Does it make sense to run this module on multiple hosts at a time?
def __init__(self):
self.context = None
+1 -2
View File
@@ -8,8 +8,7 @@ class NXCModule:
description = "Execute commands on a SQL Server linked server"
supported_protocols = ["mssql"]
opsec_safe = False
multiple_hosts = False
def __init__(self):
self.mssql_conn = None
self.context = None
+1 -2
View File
@@ -17,8 +17,7 @@ class NXCModule:
description = "Finds computers in the domain via the provided text"
supported_protocols = ["ldap"]
opsec_safe = True
multiple_hosts = False
def options(self, context, module_options):
"""
find-computer: Specify find-computer to call the module
+1 -2
View File
@@ -13,8 +13,7 @@ class NXCModule:
description = "[REMOVED] Dump credentials from Firefox"
supported_protocols = ["smb"]
opsec_safe = True # Does the module touch disk?
multiple_hosts = True # Does it make sense to run this module on multiple hosts at a time?
def options(self, context, module_options):
"""
[REMOVED] use the --dpapi flag instead of the module firefox.
-1
View File
@@ -14,7 +14,6 @@ class NXCModule:
description = "Get description of the users. May contained password"
supported_protocols = ["ldap"]
opsec_safe = True # Does the module touch disk?
multiple_hosts = True # Does it make sense to run this module on multiple hosts at a time?
def options(self, context, module_options):
"""
+1 -2
View File
@@ -10,8 +10,7 @@ class NXCModule:
description = "Get the info field of all users. May contain password"
supported_protocols = ["ldap"]
opsec_safe = True
multiple_hosts = True
def options(self, context, module_options):
"""FILTER Apply the FILTER (grep-like) (default: '')"""
self.FILTER = ""
+1 -2
View File
@@ -85,8 +85,7 @@ class NXCModule:
description = "Query all DNS records with the corresponding IP from the domain."
supported_protocols = ["ldap"]
opsec_safe = True
multiple_hosts = True
def options(self, context, module_options):
"""
ALL Get DNS and IP (default: false)
+1 -2
View File
@@ -13,8 +13,7 @@ class NXCModule:
description = "Get unixUserPassword attribute from all users in ldap"
supported_protocols = ["ldap"]
opsec_safe = True
multiple_hosts = True
def options(self, context, module_options):
"""
"""
+1 -2
View File
@@ -13,8 +13,7 @@ class NXCModule:
description = "Get userPassword attribute from all users in ldap"
supported_protocols = ["ldap"]
opsec_safe = True
multiple_hosts = True
def options(self, context, module_options):
"""
"""
+1 -2
View File
@@ -12,8 +12,7 @@ class NXCModule:
description = "Searches the domain controller for registry.xml to find autologon information and returns the username and password."
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def options(self, context, module_options):
""" """
+1 -2
View File
@@ -15,8 +15,7 @@ class NXCModule:
description = "Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences."
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def options(self, context, module_options):
""" """
+1 -2
View File
@@ -14,8 +14,7 @@ class NXCModule:
description = "Extracts privileges assigned via GPOs and resolves SIDs via LDAP."
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
WELL_KNOWN_SIDS = {
"S-1-0": "Null Authority",
"S-1-0-0": "Nobody",
+1 -1
View File
@@ -14,7 +14,7 @@ class NXCModule:
description = "[REMOVED] Retrieves all the members within a Group"
supported_protocols = ["ldap"]
opsec_safe = True
multiple_hosts = False
primaryGroupID = ""
answers = []
+1 -2
View File
@@ -16,8 +16,7 @@ class NXCModule:
description = "Query the groups to which a user belongs."
supported_protocols = ["ldap"]
opsec_safe = True
multiple_hosts = True
def options(self, context, module_options):
"""USER Choose a username to query group membership"""
self.user = ""
+1 -2
View File
@@ -15,8 +15,7 @@ class NXCModule:
description = "Get lsass dump using handlekatz64 and parse the result with pypykatz"
supported_protocols = ["smb"]
opsec_safe = False
multiple_hosts = True
def options(self, context, module_options):
r"""
TMP_DIR Path where process dump should be saved on target system (default: C:\\Windows\\Temp\\)
+1 -2
View File
@@ -131,8 +131,7 @@ class NXCModule:
description = "Dump lsass recursively from a given hash using BH to find local admins"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def __init__(self, context=None, module_options=None):
self.context = context
self.module_options = module_options
+1 -2
View File
@@ -10,8 +10,7 @@ class NXCModule:
description = "Performs a registry query on the VM to lookup its HyperV Host"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def __init__(self, context=None, module_options=None):
self.context = context
self.module_options = module_options
+1 -2
View File
@@ -9,8 +9,7 @@ class NXCModule:
description = "Checks for credentials in IIS Application Pool configuration files using appcmd.exe"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def __init__(self):
pass
+1 -2
View File
@@ -15,8 +15,7 @@ class NXCModule:
description = "List and impersonate tokens to run command as locally logged on users"
supported_protocols = ["smb"]
opsec_safe = True # could be flagged
multiple_hosts = True
def options(self, context, module_options):
"""
TOKEN // Token id to usurp
+1 -2
View File
@@ -8,8 +8,7 @@ class NXCModule:
description = "Checks for AlwaysInstallElevated"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def options(self, context, module_options):
""" """
+1 -2
View File
@@ -14,8 +14,7 @@ class NXCModule:
description = "This module helps you to identify hosts that have additional active interfaces"
supported_protocols = ["smb", "wmi"]
opsec_safe = True
multiple_hosts = True
def options(self, context, module_options):
"""DIFFERENT show only ip address if different from target ip (Default: False)"""
self.pivot = module_options.get("DIFFERENT", "false").lower() in ["true", "1"]
-1
View File
@@ -13,7 +13,6 @@ class NXCModule:
description = "Search for KeePass-related files and process."
supported_protocols = ["smb"]
opsec_safe = True # only legitimate commands are executed on the remote host (search process and files)
multiple_hosts = True
def __init__(self):
self.search_type = "ALL"
+1 -2
View File
@@ -25,8 +25,7 @@ class NXCModule:
# some EDR like Trend Micro flag base64-encoded powershell as malicious
# the option PSH_EXEC_METHOD can be used to avoid such execution, and will drop scripts on the target
opsec_safe = False
multiple_hosts = False
def __init__(self):
# module options
self.action = None
+1 -2
View File
@@ -18,8 +18,7 @@ class NXCModule:
description = "Retrieves all LAPS passwords which the account has read permissions for."
supported_protocols = ["ldap"]
opsec_safe = True
multiple_hosts = False
def options(self, context, module_options):
"""COMPUTER Computer name or wildcard ex: WIN-S10, WIN-* etc. Default: *"""
self.computer = None
+1 -2
View File
@@ -26,8 +26,7 @@ class NXCModule:
description = "[REMOVED] Checks whether LDAP signing and channel binding are required and / or enforced"
supported_protocols = ["ldap"]
opsec_safe = True
multiple_hosts = True
def options(self, context, module_options):
"""No options available."""
+1 -2
View File
@@ -8,8 +8,7 @@ class NXCModule:
description = "Enable or disable xp_cmdshell on a linked MSSQL server"
supported_protocols = ["mssql"]
opsec_safe = False
multiple_hosts = False
def __init__(self):
self.action = None
self.linked_server = None
+1 -2
View File
@@ -8,8 +8,7 @@ class NXCModule:
description = "Run xp_cmdshell commands on a linked SQL server"
supported_protocols = ["mssql"]
opsec_safe = False
multiple_hosts = False
def __init__(self):
self.linked_server = None
self.command = None
+1 -2
View File
@@ -17,8 +17,7 @@ class NXCModule:
description = "Dump lsass and parse the result remotely with lsassy"
supported_protocols = ["smb"]
opsec_safe = True # writes temporary files, and it's possible for them to not be deleted
multiple_hosts = True
def __init__(self, context=None, module_options=None):
self.context = context
self.module_options = module_options
+1 -2
View File
@@ -20,8 +20,7 @@ class NXCModule:
description = "Retrieves the MachineAccountQuota domain-level attribute"
supported_protocols = ["ldap"]
opsec_safe = True
multiple_hosts = False
def on_login(self, context, connection):
context.log.display("Getting the MachineAccountQuota")
result = connection.search("(objectClass=*)", ["ms-DS-MachineAccountQuota"])
+1 -2
View File
@@ -7,8 +7,7 @@ class NXCModule:
description = "Remotely dump domain user credentials via an ADCS and a KDC"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def options(self, context, module_options):
r"""
CA Certificate Authority Name (CA_SERVER\CA_NAME)
+1 -2
View File
@@ -11,8 +11,7 @@ class NXCModule:
description = "Downloads the Meterpreter stager and injects it into memory"
supported_protocols = ["smb", "mssql"]
opsec_safe = True
multiple_hosts = True
def __init__(self, context=None, module_options=None):
self.rand = None
self.srvport = None
+1 -2
View File
@@ -10,8 +10,7 @@ class NXCModule:
description = "Remotely dump MobaXterm credentials via RemoteRegistry or NTUSER.dat export"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def options(self, context, module_options):
""" """
+1 -2
View File
@@ -27,8 +27,7 @@ class NXCModule:
description = "Dump mRemoteNG Passwords in AppData and in Desktop / Documents folders (digging recursively in them) "
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def __init__(self, context=None, module_options=None):
self.false_positive = (
".",
+1 -2
View File
@@ -55,8 +55,7 @@ class NXCModule:
description = "MS17-010 - EternalBlue - NOT TESTED OUTSIDE LAB ENVIRONMENT"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def options(self, context, module_options):
""" """
self.logger = context.log
+1 -2
View File
@@ -12,8 +12,7 @@ class NXCModule:
description = "Dump MSOL cleartext password from the localDB on the Azure AD-Connect Server"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def __init__(self, context=None, module_options=None):
self.use_embedded = None
self.MSOL_PS1 = None
+1 -2
View File
@@ -8,8 +8,7 @@ class NXCModule:
description = "Execute arbitrary SQL commands on the target MSSQL server"
supported_protocols = ["mssql"]
opsec_safe = True
multiple_hosts = True
def __init__(self):
self.mssql_conn = None
self.context = None
+1 -2
View File
@@ -24,8 +24,7 @@ class NXCModule:
description = "Enumerate and exploit MSSQL privileges"
supported_protocols = ["mssql"]
opsec_safe = True
multiple_hosts = True
def __init__(self):
self.admin_privs = None
self.current_user = None
+1 -2
View File
@@ -17,8 +17,7 @@ class NXCModule:
description = "Get lsass dump using nanodump and parse the result with pypykatz"
supported_protocols = ["smb", "mssql"]
opsec_safe = False
multiple_hosts = True
def __init__(self, context=None, module_options=None):
self.connection = None
self.dir_result = None
+1 -2
View File
@@ -13,8 +13,7 @@ class NXCModule:
description = "Check if the DC is vulnerable to CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def options(self, context, module_options):
""" """
+1 -1
View File
@@ -12,7 +12,7 @@ class NXCModule:
description = "Extracts notepad++ unsaved files."
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
false_positive = [".", "..", "desktop.ini", "Public", "Default", "Default User", "All Users", ".NET v4.5", ".NET v4.5 Classic"]
def options(self, context, module_options):
+1 -2
View File
@@ -29,8 +29,7 @@ class NXCModule:
description = "Extracts content from Windows Notepad tab state binary files."
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def __init__(self, context=None):
self.context = context
self.false_positive = [".", "..", "desktop.ini", "Public", "Default", "Default User", "All Users", ".NET v4.5", ".NET v4.5 Classic"]
-1
View File
@@ -20,7 +20,6 @@ class NXCModule:
description = "Dump NTDS with ntdsutil"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = False
def options(self, context, module_options):
"""
+1 -2
View File
@@ -14,8 +14,7 @@ class NXCModule:
description = "Detect if lmcompatibilitylevel on the target is set to lower than 3 (which means ntlmv1 is enabled)"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def options(self, context, module_options):
self.output = "NTLMv1 allowed on: {} - LmCompatibilityLevel = {}"
+1 -2
View File
@@ -14,8 +14,7 @@ class NXCModule:
description = "Extract all obsolete operating systems from LDAP"
supported_protocols = ["ldap"]
opsec_safe = True
multiple_hosts = True
def ldap_time_to_datetime(self, ldap_time):
"""Convert an LDAP timestamp to a datetime object."""
if ldap_time == "0": # Account for never-set passwords
+1 -2
View File
@@ -3,8 +3,7 @@ class NXCModule:
description = "[REMOVED] Module to check if the DC is vulnerable to PetitPotam, credit to @topotam"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def options(self, context, module_options):
"""
LISTENER IP of your listener
-1
View File
@@ -15,7 +15,6 @@ class NXCModule:
description = "Run command as logged on users via Process Injection"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def options(self, context, module_options):
r"""
+1 -1
View File
@@ -12,7 +12,7 @@ class NXCModule:
description = "Extracts PowerShell history for all users and looks for sensitive commands."
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
false_positive = [".", "..", "desktop.ini", "Public", "Default", "Default User", "All Users", ".NET v4.5", ".NET v4.5 Classic"]
sensitive_keywords = [
"password", "passw", "secret", "credential", "key",
+1 -2
View File
@@ -17,8 +17,7 @@ class NXCModule:
description = "Identify pre-created computer accounts, save the results to a file, and obtain TGTs for each"
supported_protocols = ["ldap"]
opsec_safe = True
multiple_hosts = False
def options(self, context, module_options):
pass
+1 -2
View File
@@ -16,8 +16,7 @@ class NXCModule:
description = "Traces Domain and Enterprise Admin presence in the target over SMB"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def options(self, context, module_options):
"""There are no module options."""
-1
View File
@@ -3,7 +3,6 @@ class NXCModule:
description = "[REMOVED] Module to check if the Target is vulnerable to PrinterBug. Set LISTENER IP for coercion."
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def __init__(self, context=None, module_options=None):
self.context = context
+1 -2
View File
@@ -23,8 +23,7 @@ class NXCModule:
description = "Check if host vulnerable to printnightmare"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def __init__(self, context=None, module_options=None):
self.context = context
self.module_options = module_options
+1 -2
View File
@@ -16,8 +16,7 @@ class NXCModule:
description = "Get lsass dump using procdump64 and parse the result with pypykatz"
supported_protocols = ["smb"]
opsec_safe = True # not really
multiple_hosts = True
def options(self, context, module_options):
r"""
TMP_DIR Path where process dump should be saved on target system (default: C:\\Windows\\Temp\\)
+1 -2
View File
@@ -12,8 +12,7 @@ class NXCModule:
description = "Module to get the Fine Grained Password Policy/PSOs"
supported_protocols = ["ldap"]
opsec_safe = True
multiple_hosts = False
def __init__(self, context=None, module_options=None):
self.context = context
self.module_options = module_options
+1 -2
View File
@@ -18,8 +18,7 @@ class NXCModule:
description = "Query the registry for users who saved ssh private keys in PuTTY. Download the private keys if found."
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def __init__(self):
self.context = None
self.module_options = None
+1 -2
View File
@@ -10,8 +10,7 @@ class NXCModule:
description = "Remotely dump Remote Desktop Connection Manager (sysinternals) credentials"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def options(self, context, module_options):
""" """
+1 -2
View File
@@ -16,8 +16,7 @@ class NXCModule:
description = "Enables/Disables RDP"
supported_protocols = ["smb", "wmi"]
opsec_safe = True
multiple_hosts = True
def __init__(self, context=None, module_options=None):
self.context = context
self.module_options = module_options
+1 -1
View File
@@ -10,7 +10,7 @@ class NXCModule:
description = "Extracts recently modified files"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
false_positive = [".", "..", "desktop.ini", "Public", "Default", "Default User", "All Users", ".NET v4.5", ".NET v4.5 Classic"]
def options(self, context, module_options):
+1 -2
View File
@@ -14,8 +14,7 @@ class NXCModule:
description = "Lists and exports users' recycle bins"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def options(self, context, module_options):
"""No options available"""
+1 -2
View File
@@ -8,8 +8,7 @@ class NXCModule:
description = "Performs a registry query on the machine"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def __init__(self, context=None, module_options=None):
self.context = context
self.module_options = module_options
+1 -2
View File
@@ -13,8 +13,7 @@ class NXCModule:
description = "Collect autologon credential stored in the registry"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def __init__(self, context=None, module_options=None):
self.context = context
self.module_options = module_options
+1 -2
View File
@@ -8,8 +8,7 @@ class NXCModule:
description = "Enable or disable remote UAC"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def __init__(self, context=None, module_options=None):
self.context = context
self.module_options = module_options
+1 -2
View File
@@ -26,8 +26,7 @@ class NXCModule:
description = "Check if host vulnerable to CVE-2019-1040"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = False
def __init__(self, context=None, module_options=None):
self.context = context
self.module_options = module_options
+1 -2
View File
@@ -9,8 +9,7 @@ class NXCModule:
description = "Check if the registry value RunAsPPL is set or not"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def __init__(self, context=None, module_options=None):
self.context = context
self.module_options = module_options
+1 -2
View File
@@ -23,8 +23,7 @@ class NXCModule:
description = "Find a SCCM infrastructure in the Active Directory"
supported_protocols = ["ldap"]
opsec_safe = True
multiple_hosts = True
def __init__(self):
self.sccm_site_servers = [] # List of dns host names of the SCCM site servers
self.sccm_sites = {} # List of SCCM sites with their management points (Sorted by site code)
+1 -2
View File
@@ -58,8 +58,7 @@ class NXCModule:
description = "Remotely execute a scheduled task as a logged on user"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = False
def on_admin_login(self, context, connection):
self.logger = context.log
-1
View File
@@ -14,7 +14,6 @@ class NXCModule:
description = "Creates and dumps an arbitrary .scf file with the icon property containing a UNC path to the declared SMB server against all writeable shares"
supported_protocols = ["smb"]
opsec_safe = False
multiple_hosts = True
def __init__(self, context=None, module_options=None):
self.context = context
+1 -2
View File
@@ -18,8 +18,7 @@ class NXCModule:
description = "Gets security questions and answers for users on computer"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def options(self, context, module):
pass
-1
View File
@@ -3,7 +3,6 @@ class NXCModule:
description = "[REMOVED] Module to check if the target is vulnerable to ShadowCoerce, credit to @Shutdown and @topotam"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def options(self, context, module_options):
"""
+1 -2
View File
@@ -9,8 +9,7 @@ class NXCModule:
description = "Enables or disables shadow RDP"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def __init__(self, context=None, module_options=None):
self.context = context
self.module_options = module_options
+1 -2
View File
@@ -15,8 +15,7 @@ class NXCModule:
description = "Creates windows shortcuts with the icon attribute containing a URI to the specified server (default SMB) in all shares with write permissions"
supported_protocols = ["smb"]
opsec_safe = False
multiple_hosts = True
def __init__(self):
self.server = None
self.remote_file_path = None
+1 -2
View File
@@ -16,8 +16,7 @@ class NXCModule:
description = "Module to check for the SMB dialect 3.1.1 and compression capability of the host, which is an indicator for the SMBGhost vulnerability (CVE-2020-0796)."
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def __init__(self, context=None, module_options=None):
self.context = context
self.module_options = module_options
-1
View File
@@ -10,7 +10,6 @@ class NXCModule:
description = "Downloads screenshots taken by the (new) Snipping Tool."
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = True
def __init__(self):
self.context = None
-1
View File
@@ -473,7 +473,6 @@ class NXCModule:
description = "List files recursively and save a JSON share-file metadata to the 'OUTPUT_FOLDER'. See module options for finer configuration."
supported_protocols = ["smb"]
opsec_safe = True # Does the module touch disk?
multiple_hosts = True # Does the module support multiple hosts?
def options(self, context, module_options):
"""
+1 -2
View File
@@ -25,8 +25,7 @@ class NXCModule:
description = "Detect if print spooler is enabled or not"
supported_protocols = ["smb", "wmi"]
opsec_safe = True
multiple_hosts = True
def __init__(self, context=None, module_options=None):
self.context = context
self.module_options = module_options
+1 -2
View File
@@ -37,8 +37,7 @@ class NXCModule:
description = "Retrieves the different Sites and Subnets of an Active Directory"
supported_protocols = ["ldap"]
opsec_safe = True
multiple_hosts = False
def on_login(self, context, connection):
dn = connection.args.base_dn if connection.args.base_dn else connection.ldap_connection._baseDN
+1 -2
View File
@@ -8,8 +8,7 @@ class NXCModule:
description = "Retrieves the cleartext ssoauthcookie from the local Microsoft Teams database, if teams is open we kill all Teams process"
supported_protocols = ["smb"]
opsec_safe = True
multiple_hosts = False
def options(self, context, module_options):
""" """
Loaded 100 of 115 files, more files were not shown because too many files have changed in this diff. Show more