mirror of
https://github.com/Pennyw0rth/NetExec.git
synced 2026-11-08 17:38:43 -10:00
Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
e1991cf265 |
No files matched your search
+1
-2
@@ -14,8 +14,7 @@ class NXCModule:
|
||||
description = "Find PKI Enrollment Services in Active Directory and Certificate Templates Names"
|
||||
supported_protocols = ["ldap"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self, context=None, module_options=None):
|
||||
self.context = context
|
||||
self.module_options = module_options
|
||||
|
||||
@@ -17,8 +17,7 @@ class NXCModule:
|
||||
description = "Adds or deletes a domain computer"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = False
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
"""
|
||||
add-computer: Specify add-computer to call the module using smb
|
||||
|
||||
@@ -9,8 +9,7 @@ class NXCModule:
|
||||
description = "Search for aws credentials files."
|
||||
supported_protocols = ["ssh", "smb", "winrm"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self):
|
||||
self.search_path_linux = "'/home/' '/tmp/'"
|
||||
self.search_path_win = "'C:\\Users\\', 'C:\\ProgramData\\AWSCLI\\', 'C:\\Temp\\'"
|
||||
|
||||
@@ -14,8 +14,7 @@ class NXCModule:
|
||||
description = "Exploit user in backup operator group to dump NTDS @mpgn_x64"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self, context=None, module_options=None):
|
||||
self.context = context
|
||||
self.module_options = module_options
|
||||
|
||||
@@ -80,8 +80,7 @@ class NXCModule:
|
||||
description = "Check if vulnerable to bad successor attack (DMSA)"
|
||||
supported_protocols = ["ldap"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self):
|
||||
self.context = None
|
||||
self.module_options = None
|
||||
|
||||
@@ -10,8 +10,7 @@ class NXCModule:
|
||||
description = "Enumerating BitLocker Status on target(s) If it is enabled or disabled."
|
||||
supported_protocols = ["smb", "wmi"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self, context=None, module_options=None):
|
||||
self.context = context
|
||||
self.module_options = module_options
|
||||
|
||||
@@ -13,8 +13,7 @@ class NXCModule:
|
||||
description = "Change or reset user passwords via various protocols"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = False
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
"""
|
||||
Required (one of):
|
||||
|
||||
@@ -12,8 +12,7 @@ class NXCModule:
|
||||
description = "Module to check if the Target is vulnerable to any coerce vulns. Set LISTENER IP for coercion."
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self, context=None, module_options=None):
|
||||
self.context = context
|
||||
self.module_options = module_options
|
||||
|
||||
@@ -200,8 +200,7 @@ class NXCModule:
|
||||
description = "Read and backup the Discretionary Access Control List of objects. Be careful, this module cannot read the DACLS recursively, see more explanation in the options."
|
||||
supported_protocols = ["ldap"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = False
|
||||
|
||||
|
||||
def __init__(self, context=None, module_options=None):
|
||||
self.context = context
|
||||
self.module_options = module_options
|
||||
|
||||
@@ -3,8 +3,7 @@ class NXCModule:
|
||||
description = "[REMOVED] Module to check if the DC is vulnerable to DFSCoerce, credit to @filip_dragovic/@Wh04m1001 and @topotam"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self, context=None, module_options=None):
|
||||
self.context = context
|
||||
self.module_options = module_options
|
||||
|
||||
@@ -11,8 +11,7 @@ class NXCModule:
|
||||
description = "Remotely dump Dpapi hash based on masterkeys"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
"""OUTPUTFILE Output file to write hashes"""
|
||||
self.outputfile = None
|
||||
|
||||
@@ -13,8 +13,7 @@ class NXCModule:
|
||||
description = "Drop a searchConnector-ms file on each writable share"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = False
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
"""
|
||||
Technique discovered by @DTMSecurity and @domchell to remotely coerce an host to start WebClient service.
|
||||
|
||||
@@ -28,7 +28,6 @@ class NXCModule:
|
||||
description = "Tries to activate the EFSR service by creating a file with the encryption attribute on some available share."
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True # Does the module touch disk?
|
||||
multiple_hosts = True # Does the module support multiple hosts?
|
||||
excluded_shares = ["SYSVOL"]
|
||||
|
||||
def options(self, context: Context, module_options: dict[str, str]):
|
||||
|
||||
@@ -13,8 +13,7 @@ class NXCModule:
|
||||
description = "Uses Empire's RESTful API to generate a launcher for the specified listener and executes it"
|
||||
supported_protocols = ["smb", "mssql"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
"""
|
||||
LISTENER Listener name to generate the launcher for
|
||||
|
||||
@@ -8,8 +8,7 @@ class NXCModule:
|
||||
description = "Enable or disable xp_cmdshell in MSSQL Server"
|
||||
supported_protocols = ["mssql"]
|
||||
opsec_safe = False
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self):
|
||||
self.mssql_conn = None
|
||||
self.context = None
|
||||
|
||||
@@ -13,8 +13,7 @@ class NXCModule:
|
||||
description = "Find the Entra ID sync server"
|
||||
supported_protocols = ["ldap"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self):
|
||||
self.context = None
|
||||
self.module_options = None
|
||||
|
||||
@@ -19,8 +19,7 @@ class NXCModule:
|
||||
description = "Gathers information on all endpoint protection solutions installed on the the remote host(s) via LsarLookupNames (no privilege needed)"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self, context=None, module_options=None):
|
||||
self.context = context
|
||||
self.module_options = module_options
|
||||
|
||||
@@ -25,7 +25,6 @@ class NXCModule:
|
||||
description = "Anonymously uses RPC endpoints to hunt for ADCS CAs"
|
||||
supported_protocols = ["smb"] # Example: ['smb', 'mssql']
|
||||
opsec_safe = True # Does the module touch disk?
|
||||
multiple_hosts = True # Does it make sense to run this module on multiple hosts at a time?
|
||||
|
||||
def __init__(self, context=None, module_options=None):
|
||||
self.context = context
|
||||
|
||||
@@ -13,8 +13,7 @@ class NXCModule:
|
||||
description = "Uses WMI to dump DNS from an AD DNS Server"
|
||||
supported_protocols = ["smb", "wmi"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self, context=None, module_options=None):
|
||||
self.context = context
|
||||
self.module_options = module_options
|
||||
|
||||
@@ -8,8 +8,7 @@ class NXCModule:
|
||||
description = "Enumerate users with impersonation privileges"
|
||||
supported_protocols = ["mssql"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self):
|
||||
self.mssql_conn = None
|
||||
self.context = None
|
||||
|
||||
@@ -8,8 +8,7 @@ class NXCModule:
|
||||
description = "Enumerate linked SQL Servers and their login configurations."
|
||||
supported_protocols = ["mssql"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self):
|
||||
self.mssql_conn = None
|
||||
self.context = None
|
||||
|
||||
@@ -8,8 +8,7 @@ class NXCModule:
|
||||
description = "Enumerate SQL Server logins (SQL, Domain, Local users)"
|
||||
supported_protocols = ["mssql"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self):
|
||||
self.mssql_conn = None
|
||||
self.context = None
|
||||
|
||||
@@ -10,8 +10,7 @@ class NXCModule:
|
||||
description = "[REMOVED] Extract all Trust Relationships, Trusting Direction, and Trust Transitivity"
|
||||
supported_protocols = ["ldap"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
pass
|
||||
|
||||
|
||||
@@ -14,7 +14,6 @@ class NXCModule:
|
||||
description = "Extracting Credentials From Windows Logs (Event ID: 4688 and SYSMON)"
|
||||
supported_protocols = ["smb"] # Example: ['smb', 'mssql']
|
||||
opsec_safe = True # Does the module touch disk?
|
||||
multiple_hosts = True # Does it make sense to run this module on multiple hosts at a time?
|
||||
|
||||
def __init__(self):
|
||||
self.context = None
|
||||
@@ -68,7 +67,7 @@ class NXCModule:
|
||||
line_stripped = line.replace("/add", "") \
|
||||
.replace("/active:yes", "") \
|
||||
.replace("/delete", "") \
|
||||
.replace("/domain", "") \
|
||||
.replace("/domain", "")
|
||||
# Remove command lines that were executed with nxc
|
||||
line_stripped = re.sub(r"1> \\Windows\\Temp\\[\w]{6} 2>&1", "", line_stripped)
|
||||
|
||||
|
||||
@@ -10,7 +10,6 @@ class NXCModule:
|
||||
description = "I do something"
|
||||
supported_protocols = [] # Example: ['smb', 'mssql']
|
||||
opsec_safe = True # Does the module touch disk?
|
||||
multiple_hosts = True # Does it make sense to run this module on multiple hosts at a time?
|
||||
|
||||
def __init__(self):
|
||||
self.context = None
|
||||
|
||||
@@ -8,8 +8,7 @@ class NXCModule:
|
||||
description = "Execute commands on a SQL Server linked server"
|
||||
supported_protocols = ["mssql"]
|
||||
opsec_safe = False
|
||||
multiple_hosts = False
|
||||
|
||||
|
||||
def __init__(self):
|
||||
self.mssql_conn = None
|
||||
self.context = None
|
||||
|
||||
@@ -17,8 +17,7 @@ class NXCModule:
|
||||
description = "Finds computers in the domain via the provided text"
|
||||
supported_protocols = ["ldap"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = False
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
"""
|
||||
find-computer: Specify find-computer to call the module
|
||||
|
||||
@@ -13,8 +13,7 @@ class NXCModule:
|
||||
description = "[REMOVED] Dump credentials from Firefox"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True # Does the module touch disk?
|
||||
multiple_hosts = True # Does it make sense to run this module on multiple hosts at a time?
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
"""
|
||||
[REMOVED] use the --dpapi flag instead of the module firefox.
|
||||
|
||||
@@ -14,7 +14,6 @@ class NXCModule:
|
||||
description = "Get description of the users. May contained password"
|
||||
supported_protocols = ["ldap"]
|
||||
opsec_safe = True # Does the module touch disk?
|
||||
multiple_hosts = True # Does it make sense to run this module on multiple hosts at a time?
|
||||
|
||||
def options(self, context, module_options):
|
||||
"""
|
||||
|
||||
@@ -10,8 +10,7 @@ class NXCModule:
|
||||
description = "Get the info field of all users. May contain password"
|
||||
supported_protocols = ["ldap"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
"""FILTER Apply the FILTER (grep-like) (default: '')"""
|
||||
self.FILTER = ""
|
||||
|
||||
@@ -85,8 +85,7 @@ class NXCModule:
|
||||
description = "Query all DNS records with the corresponding IP from the domain."
|
||||
supported_protocols = ["ldap"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
"""
|
||||
ALL Get DNS and IP (default: false)
|
||||
|
||||
@@ -13,8 +13,7 @@ class NXCModule:
|
||||
description = "Get unixUserPassword attribute from all users in ldap"
|
||||
supported_protocols = ["ldap"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
"""
|
||||
"""
|
||||
|
||||
@@ -13,8 +13,7 @@ class NXCModule:
|
||||
description = "Get userPassword attribute from all users in ldap"
|
||||
supported_protocols = ["ldap"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
"""
|
||||
"""
|
||||
|
||||
@@ -12,8 +12,7 @@ class NXCModule:
|
||||
description = "Searches the domain controller for registry.xml to find autologon information and returns the username and password."
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
""" """
|
||||
|
||||
|
||||
@@ -15,8 +15,7 @@ class NXCModule:
|
||||
description = "Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences."
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
""" """
|
||||
|
||||
|
||||
@@ -14,8 +14,7 @@ class NXCModule:
|
||||
description = "Extracts privileges assigned via GPOs and resolves SIDs via LDAP."
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
WELL_KNOWN_SIDS = {
|
||||
"S-1-0": "Null Authority",
|
||||
"S-1-0-0": "Nobody",
|
||||
|
||||
@@ -14,7 +14,7 @@ class NXCModule:
|
||||
description = "[REMOVED] Retrieves all the members within a Group"
|
||||
supported_protocols = ["ldap"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = False
|
||||
|
||||
primaryGroupID = ""
|
||||
answers = []
|
||||
|
||||
|
||||
@@ -16,8 +16,7 @@ class NXCModule:
|
||||
description = "Query the groups to which a user belongs."
|
||||
supported_protocols = ["ldap"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
"""USER Choose a username to query group membership"""
|
||||
self.user = ""
|
||||
|
||||
@@ -15,8 +15,7 @@ class NXCModule:
|
||||
description = "Get lsass dump using handlekatz64 and parse the result with pypykatz"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = False
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
r"""
|
||||
TMP_DIR Path where process dump should be saved on target system (default: C:\\Windows\\Temp\\)
|
||||
|
||||
@@ -131,8 +131,7 @@ class NXCModule:
|
||||
description = "Dump lsass recursively from a given hash using BH to find local admins"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self, context=None, module_options=None):
|
||||
self.context = context
|
||||
self.module_options = module_options
|
||||
|
||||
@@ -10,8 +10,7 @@ class NXCModule:
|
||||
description = "Performs a registry query on the VM to lookup its HyperV Host"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self, context=None, module_options=None):
|
||||
self.context = context
|
||||
self.module_options = module_options
|
||||
|
||||
+1
-2
@@ -9,8 +9,7 @@ class NXCModule:
|
||||
description = "Checks for credentials in IIS Application Pool configuration files using appcmd.exe"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self):
|
||||
pass
|
||||
|
||||
|
||||
@@ -15,8 +15,7 @@ class NXCModule:
|
||||
description = "List and impersonate tokens to run command as locally logged on users"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True # could be flagged
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
"""
|
||||
TOKEN // Token id to usurp
|
||||
|
||||
@@ -8,8 +8,7 @@ class NXCModule:
|
||||
description = "Checks for AlwaysInstallElevated"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
""" """
|
||||
|
||||
|
||||
@@ -14,8 +14,7 @@ class NXCModule:
|
||||
description = "This module helps you to identify hosts that have additional active interfaces"
|
||||
supported_protocols = ["smb", "wmi"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
"""DIFFERENT show only ip address if different from target ip (Default: False)"""
|
||||
self.pivot = module_options.get("DIFFERENT", "false").lower() in ["true", "1"]
|
||||
|
||||
@@ -13,7 +13,6 @@ class NXCModule:
|
||||
description = "Search for KeePass-related files and process."
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True # only legitimate commands are executed on the remote host (search process and files)
|
||||
multiple_hosts = True
|
||||
|
||||
def __init__(self):
|
||||
self.search_type = "ALL"
|
||||
|
||||
@@ -25,8 +25,7 @@ class NXCModule:
|
||||
# some EDR like Trend Micro flag base64-encoded powershell as malicious
|
||||
# the option PSH_EXEC_METHOD can be used to avoid such execution, and will drop scripts on the target
|
||||
opsec_safe = False
|
||||
multiple_hosts = False
|
||||
|
||||
|
||||
def __init__(self):
|
||||
# module options
|
||||
self.action = None
|
||||
|
||||
+1
-2
@@ -18,8 +18,7 @@ class NXCModule:
|
||||
description = "Retrieves all LAPS passwords which the account has read permissions for."
|
||||
supported_protocols = ["ldap"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = False
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
"""COMPUTER Computer name or wildcard ex: WIN-S10, WIN-* etc. Default: *"""
|
||||
self.computer = None
|
||||
|
||||
@@ -26,8 +26,7 @@ class NXCModule:
|
||||
description = "[REMOVED] Checks whether LDAP signing and channel binding are required and / or enforced"
|
||||
supported_protocols = ["ldap"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
"""No options available."""
|
||||
|
||||
|
||||
@@ -8,8 +8,7 @@ class NXCModule:
|
||||
description = "Enable or disable xp_cmdshell on a linked MSSQL server"
|
||||
supported_protocols = ["mssql"]
|
||||
opsec_safe = False
|
||||
multiple_hosts = False
|
||||
|
||||
|
||||
def __init__(self):
|
||||
self.action = None
|
||||
self.linked_server = None
|
||||
|
||||
@@ -8,8 +8,7 @@ class NXCModule:
|
||||
description = "Run xp_cmdshell commands on a linked SQL server"
|
||||
supported_protocols = ["mssql"]
|
||||
opsec_safe = False
|
||||
multiple_hosts = False
|
||||
|
||||
|
||||
def __init__(self):
|
||||
self.linked_server = None
|
||||
self.command = None
|
||||
|
||||
@@ -17,8 +17,7 @@ class NXCModule:
|
||||
description = "Dump lsass and parse the result remotely with lsassy"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True # writes temporary files, and it's possible for them to not be deleted
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self, context=None, module_options=None):
|
||||
self.context = context
|
||||
self.module_options = module_options
|
||||
|
||||
+1
-2
@@ -20,8 +20,7 @@ class NXCModule:
|
||||
description = "Retrieves the MachineAccountQuota domain-level attribute"
|
||||
supported_protocols = ["ldap"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = False
|
||||
|
||||
|
||||
def on_login(self, context, connection):
|
||||
context.log.display("Getting the MachineAccountQuota")
|
||||
result = connection.search("(objectClass=*)", ["ms-DS-MachineAccountQuota"])
|
||||
|
||||
@@ -7,8 +7,7 @@ class NXCModule:
|
||||
description = "Remotely dump domain user credentials via an ADCS and a KDC"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
r"""
|
||||
CA Certificate Authority Name (CA_SERVER\CA_NAME)
|
||||
|
||||
@@ -11,8 +11,7 @@ class NXCModule:
|
||||
description = "Downloads the Meterpreter stager and injects it into memory"
|
||||
supported_protocols = ["smb", "mssql"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self, context=None, module_options=None):
|
||||
self.rand = None
|
||||
self.srvport = None
|
||||
|
||||
@@ -10,8 +10,7 @@ class NXCModule:
|
||||
description = "Remotely dump MobaXterm credentials via RemoteRegistry or NTUSER.dat export"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
""" """
|
||||
|
||||
|
||||
@@ -27,8 +27,7 @@ class NXCModule:
|
||||
description = "Dump mRemoteNG Passwords in AppData and in Desktop / Documents folders (digging recursively in them) "
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self, context=None, module_options=None):
|
||||
self.false_positive = (
|
||||
".",
|
||||
|
||||
@@ -55,8 +55,7 @@ class NXCModule:
|
||||
description = "MS17-010 - EternalBlue - NOT TESTED OUTSIDE LAB ENVIRONMENT"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
""" """
|
||||
self.logger = context.log
|
||||
|
||||
+1
-2
@@ -12,8 +12,7 @@ class NXCModule:
|
||||
description = "Dump MSOL cleartext password from the localDB on the Azure AD-Connect Server"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self, context=None, module_options=None):
|
||||
self.use_embedded = None
|
||||
self.MSOL_PS1 = None
|
||||
|
||||
@@ -8,8 +8,7 @@ class NXCModule:
|
||||
description = "Execute arbitrary SQL commands on the target MSSQL server"
|
||||
supported_protocols = ["mssql"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self):
|
||||
self.mssql_conn = None
|
||||
self.context = None
|
||||
|
||||
@@ -24,8 +24,7 @@ class NXCModule:
|
||||
description = "Enumerate and exploit MSSQL privileges"
|
||||
supported_protocols = ["mssql"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self):
|
||||
self.admin_privs = None
|
||||
self.current_user = None
|
||||
|
||||
@@ -17,8 +17,7 @@ class NXCModule:
|
||||
description = "Get lsass dump using nanodump and parse the result with pypykatz"
|
||||
supported_protocols = ["smb", "mssql"]
|
||||
opsec_safe = False
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self, context=None, module_options=None):
|
||||
self.connection = None
|
||||
self.dir_result = None
|
||||
|
||||
@@ -13,8 +13,7 @@ class NXCModule:
|
||||
description = "Check if the DC is vulnerable to CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
""" """
|
||||
|
||||
|
||||
@@ -12,7 +12,7 @@ class NXCModule:
|
||||
description = "Extracts notepad++ unsaved files."
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
false_positive = [".", "..", "desktop.ini", "Public", "Default", "Default User", "All Users", ".NET v4.5", ".NET v4.5 Classic"]
|
||||
|
||||
def options(self, context, module_options):
|
||||
|
||||
@@ -29,8 +29,7 @@ class NXCModule:
|
||||
description = "Extracts content from Windows Notepad tab state binary files."
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self, context=None):
|
||||
self.context = context
|
||||
self.false_positive = [".", "..", "desktop.ini", "Public", "Default", "Default User", "All Users", ".NET v4.5", ".NET v4.5 Classic"]
|
||||
|
||||
@@ -20,7 +20,6 @@ class NXCModule:
|
||||
description = "Dump NTDS with ntdsutil"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = False
|
||||
|
||||
def options(self, context, module_options):
|
||||
"""
|
||||
|
||||
@@ -14,8 +14,7 @@ class NXCModule:
|
||||
description = "Detect if lmcompatibilitylevel on the target is set to lower than 3 (which means ntlmv1 is enabled)"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
self.output = "NTLMv1 allowed on: {} - LmCompatibilityLevel = {}"
|
||||
|
||||
|
||||
@@ -14,8 +14,7 @@ class NXCModule:
|
||||
description = "Extract all obsolete operating systems from LDAP"
|
||||
supported_protocols = ["ldap"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def ldap_time_to_datetime(self, ldap_time):
|
||||
"""Convert an LDAP timestamp to a datetime object."""
|
||||
if ldap_time == "0": # Account for never-set passwords
|
||||
|
||||
@@ -3,8 +3,7 @@ class NXCModule:
|
||||
description = "[REMOVED] Module to check if the DC is vulnerable to PetitPotam, credit to @topotam"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
"""
|
||||
LISTENER IP of your listener
|
||||
|
||||
@@ -15,7 +15,6 @@ class NXCModule:
|
||||
description = "Run command as logged on users via Process Injection"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
def options(self, context, module_options):
|
||||
r"""
|
||||
|
||||
@@ -12,7 +12,7 @@ class NXCModule:
|
||||
description = "Extracts PowerShell history for all users and looks for sensitive commands."
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
false_positive = [".", "..", "desktop.ini", "Public", "Default", "Default User", "All Users", ".NET v4.5", ".NET v4.5 Classic"]
|
||||
sensitive_keywords = [
|
||||
"password", "passw", "secret", "credential", "key",
|
||||
|
||||
@@ -17,8 +17,7 @@ class NXCModule:
|
||||
description = "Identify pre-created computer accounts, save the results to a file, and obtain TGTs for each"
|
||||
supported_protocols = ["ldap"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = False
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
pass
|
||||
|
||||
|
||||
@@ -16,8 +16,7 @@ class NXCModule:
|
||||
description = "Traces Domain and Enterprise Admin presence in the target over SMB"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
"""There are no module options."""
|
||||
|
||||
|
||||
@@ -3,7 +3,6 @@ class NXCModule:
|
||||
description = "[REMOVED] Module to check if the Target is vulnerable to PrinterBug. Set LISTENER IP for coercion."
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
def __init__(self, context=None, module_options=None):
|
||||
self.context = context
|
||||
|
||||
@@ -23,8 +23,7 @@ class NXCModule:
|
||||
description = "Check if host vulnerable to printnightmare"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self, context=None, module_options=None):
|
||||
self.context = context
|
||||
self.module_options = module_options
|
||||
|
||||
@@ -16,8 +16,7 @@ class NXCModule:
|
||||
description = "Get lsass dump using procdump64 and parse the result with pypykatz"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True # not really
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
r"""
|
||||
TMP_DIR Path where process dump should be saved on target system (default: C:\\Windows\\Temp\\)
|
||||
|
||||
+1
-2
@@ -12,8 +12,7 @@ class NXCModule:
|
||||
description = "Module to get the Fine Grained Password Policy/PSOs"
|
||||
supported_protocols = ["ldap"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = False
|
||||
|
||||
|
||||
def __init__(self, context=None, module_options=None):
|
||||
self.context = context
|
||||
self.module_options = module_options
|
||||
|
||||
@@ -18,8 +18,7 @@ class NXCModule:
|
||||
description = "Query the registry for users who saved ssh private keys in PuTTY. Download the private keys if found."
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self):
|
||||
self.context = None
|
||||
self.module_options = None
|
||||
|
||||
@@ -10,8 +10,7 @@ class NXCModule:
|
||||
description = "Remotely dump Remote Desktop Connection Manager (sysinternals) credentials"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
""" """
|
||||
|
||||
|
||||
+1
-2
@@ -16,8 +16,7 @@ class NXCModule:
|
||||
description = "Enables/Disables RDP"
|
||||
supported_protocols = ["smb", "wmi"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self, context=None, module_options=None):
|
||||
self.context = context
|
||||
self.module_options = module_options
|
||||
|
||||
@@ -10,7 +10,7 @@ class NXCModule:
|
||||
description = "Extracts recently modified files"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
false_positive = [".", "..", "desktop.ini", "Public", "Default", "Default User", "All Users", ".NET v4.5", ".NET v4.5 Classic"]
|
||||
|
||||
def options(self, context, module_options):
|
||||
|
||||
@@ -14,8 +14,7 @@ class NXCModule:
|
||||
description = "Lists and exports users' recycle bins"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
"""No options available"""
|
||||
|
||||
|
||||
@@ -8,8 +8,7 @@ class NXCModule:
|
||||
description = "Performs a registry query on the machine"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self, context=None, module_options=None):
|
||||
self.context = context
|
||||
self.module_options = module_options
|
||||
|
||||
@@ -13,8 +13,7 @@ class NXCModule:
|
||||
description = "Collect autologon credential stored in the registry"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self, context=None, module_options=None):
|
||||
self.context = context
|
||||
self.module_options = module_options
|
||||
|
||||
@@ -8,8 +8,7 @@ class NXCModule:
|
||||
description = "Enable or disable remote UAC"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self, context=None, module_options=None):
|
||||
self.context = context
|
||||
self.module_options = module_options
|
||||
|
||||
@@ -26,8 +26,7 @@ class NXCModule:
|
||||
description = "Check if host vulnerable to CVE-2019-1040"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = False
|
||||
|
||||
|
||||
def __init__(self, context=None, module_options=None):
|
||||
self.context = context
|
||||
self.module_options = module_options
|
||||
|
||||
@@ -9,8 +9,7 @@ class NXCModule:
|
||||
description = "Check if the registry value RunAsPPL is set or not"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self, context=None, module_options=None):
|
||||
self.context = context
|
||||
self.module_options = module_options
|
||||
|
||||
+1
-2
@@ -23,8 +23,7 @@ class NXCModule:
|
||||
description = "Find a SCCM infrastructure in the Active Directory"
|
||||
supported_protocols = ["ldap"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self):
|
||||
self.sccm_site_servers = [] # List of dns host names of the SCCM site servers
|
||||
self.sccm_sites = {} # List of SCCM sites with their management points (Sorted by site code)
|
||||
|
||||
@@ -58,8 +58,7 @@ class NXCModule:
|
||||
description = "Remotely execute a scheduled task as a logged on user"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = False
|
||||
|
||||
|
||||
def on_admin_login(self, context, connection):
|
||||
self.logger = context.log
|
||||
|
||||
|
||||
@@ -14,7 +14,6 @@ class NXCModule:
|
||||
description = "Creates and dumps an arbitrary .scf file with the icon property containing a UNC path to the declared SMB server against all writeable shares"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = False
|
||||
multiple_hosts = True
|
||||
|
||||
def __init__(self, context=None, module_options=None):
|
||||
self.context = context
|
||||
|
||||
@@ -18,8 +18,7 @@ class NXCModule:
|
||||
description = "Gets security questions and answers for users on computer"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def options(self, context, module):
|
||||
pass
|
||||
|
||||
|
||||
@@ -3,7 +3,6 @@ class NXCModule:
|
||||
description = "[REMOVED] Module to check if the target is vulnerable to ShadowCoerce, credit to @Shutdown and @topotam"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
def options(self, context, module_options):
|
||||
"""
|
||||
|
||||
@@ -9,8 +9,7 @@ class NXCModule:
|
||||
description = "Enables or disables shadow RDP"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self, context=None, module_options=None):
|
||||
self.context = context
|
||||
self.module_options = module_options
|
||||
|
||||
@@ -15,8 +15,7 @@ class NXCModule:
|
||||
description = "Creates windows shortcuts with the icon attribute containing a URI to the specified server (default SMB) in all shares with write permissions"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = False
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self):
|
||||
self.server = None
|
||||
self.remote_file_path = None
|
||||
|
||||
@@ -16,8 +16,7 @@ class NXCModule:
|
||||
description = "Module to check for the SMB dialect 3.1.1 and compression capability of the host, which is an indicator for the SMBGhost vulnerability (CVE-2020-0796)."
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self, context=None, module_options=None):
|
||||
self.context = context
|
||||
self.module_options = module_options
|
||||
|
||||
@@ -10,7 +10,6 @@ class NXCModule:
|
||||
description = "Downloads screenshots taken by the (new) Snipping Tool."
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
def __init__(self):
|
||||
self.context = None
|
||||
|
||||
@@ -473,7 +473,6 @@ class NXCModule:
|
||||
description = "List files recursively and save a JSON share-file metadata to the 'OUTPUT_FOLDER'. See module options for finer configuration."
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True # Does the module touch disk?
|
||||
multiple_hosts = True # Does the module support multiple hosts?
|
||||
|
||||
def options(self, context, module_options):
|
||||
"""
|
||||
|
||||
@@ -25,8 +25,7 @@ class NXCModule:
|
||||
description = "Detect if print spooler is enabled or not"
|
||||
supported_protocols = ["smb", "wmi"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
|
||||
def __init__(self, context=None, module_options=None):
|
||||
self.context = context
|
||||
self.module_options = module_options
|
||||
|
||||
@@ -37,8 +37,7 @@ class NXCModule:
|
||||
description = "Retrieves the different Sites and Subnets of an Active Directory"
|
||||
supported_protocols = ["ldap"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = False
|
||||
|
||||
|
||||
def on_login(self, context, connection):
|
||||
dn = connection.args.base_dn if connection.args.base_dn else connection.ldap_connection._baseDN
|
||||
|
||||
|
||||
@@ -8,8 +8,7 @@ class NXCModule:
|
||||
description = "Retrieves the cleartext ssoauthcookie from the local Microsoft Teams database, if teams is open we kill all Teams process"
|
||||
supported_protocols = ["smb"]
|
||||
opsec_safe = True
|
||||
multiple_hosts = False
|
||||
|
||||
|
||||
def options(self, context, module_options):
|
||||
""" """
|
||||
|
||||
|
||||
Loaded 100 of 115 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user