First state of an smb enum feature

nxc/connection.py

@@ -85,8 +85,6 @@ def get_host_addr_info(target, force_ipv6, dns_server, dns_tcp, dns_timeout):
 def requires_admin(func):
     def _decorator(self, *args, **kwargs):
         if self.admin_privs is False:
-            if hasattr(self.args, "exec_method") and self.args.exec_method == "mmcexec":
-                return func(self, *args, **kwargs)
             return None
         return func(self, *args, **kwargs)
 
@@ -148,7 +146,6 @@ class connection:
         self.kdcHost = self.args.kdcHost
         self.port = self.args.port
         self.local_ip = None
-        self.dns_server = self.args.dns_server
 
         # DNS resolution
         dns_result = self.resolver(target)
@@ -544,7 +541,7 @@ class connection:
 
         if hasattr(self.args, "laps") and self.args.laps:
             self.logger.debug("Trying to authenticate using LAPS")
-            username[0], secret[0], domain[0] = laps_search(self, username, secret, cred_type, domain, self.dns_server)
+            username[0], secret[0], domain[0], ntlm_hash = laps_search(self, username, secret, cred_type, domain)
             cred_type = ["plaintext"]
             if not (username[0] or secret[0] or domain[0]):
                 return False

nxc/modules/add-computer.py

@@ -102,9 +102,8 @@ class NXCModule:
             None
         """
         string_binding = epm.hept_map(self.__host, samr.MSRPC_UUID_SAMR, protocol="ncacn_np")
-        string_binding = string_binding.replace(self.__host, self.__kdcHost) if self.__kdcHost is not None else string_binding
 
-        rpc_transport = transport.DCERPCTransportFactory(string_binding)
+        rpc_transport = transport.DCERPCTransportFactory(string_binding.replace(self.__host, self.__kdcHost))
         rpc_transport.setRemoteHost(self.__host)
 
         if hasattr(rpc_transport, "set_credentials"):

nxc/modules/bitlocker.py

@@ -1,131 +0,0 @@
-import re
-from impacket.dcerpc.v5.dcom import wmi
-from impacket.dcerpc.v5.dtypes import NULL
-from impacket.dcerpc.v5.dcomrt import DCOMConnection
-from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_LEVEL_PKT_PRIVACY
-
-class NXCModule:
-    name = "bitlocker"
-    description = "Enumerating BitLocker Status on target(s) If it is enabled or disabled."
-    supported_protocols = ["smb", "wmi"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def __init__(self, context=None, module_options=None):
-        self.context = context
-        self.module_options = module_options
-
-    def options(self, context, module_options):
-        """ 
-        USAGE:
-        
-        NetExec smb <IP> -u <username> -p <password> -M bitlocker
-        NetExec wmi <IP> -u <username> -p <password> -M bitlocker (Better option to use on real life.)
-        """
-
-    def on_admin_login(self, context, connection):
-        if context.protocol == "smb":
-            bitlocker_smb = BitLockerSMB(context, connection)
-            bitlocker_smb.check_bitlocker_status()
-        elif context.protocol == "wmi":
-            bitlocker_wmi = BitLockerWMI(context, connection)
-            bitlocker_wmi.check_bitlocker_status()
-
-
-class BitLockerSMB:
-    def __init__(self, context, connection):
-        self.context = context
-        self.connection = connection
-
-    def check_bitlocker_status(self):
-        # PowerShell command to check BitLocker volumes status.
-        check_bitlocker_command_str = 'powershell.exe "Get-BitLockerVolume | Select-Object MountPoint, EncryptionMethod, ProtectionStatus"'
-
-        try:
-            # Executing the PowerShell command to get BitLocker volumes status.
-            check_bitlocker_command_str_output = self.connection.execute(check_bitlocker_command_str, True)
-            
-            if "'Get-BitLockerVolume' is not recognized" in check_bitlocker_command_str_output:
-                self.context.log.fail("BitLockerVolume not found on target.")
-                return
-
-            # Splitting the output into lines.
-            lines = str(check_bitlocker_command_str_output).splitlines()
-            data_lines = [line for line in lines if re.match(r"\w:", line)]
-            
-            for line in data_lines:
-                # Checking every line for starting with drive
-                if line[1] == ":": 
-                    parts = line.split()
-                    MountPoint, EncryptionMethod, protection_status = parts[0], parts[1], parts[2]
-
-                    # Checking if BitLocker is enabled.
-                    if protection_status == "On":
-                        self.context.log.highlight(f"BitLocker is enabled on drive {MountPoint} (Encryption Method: {EncryptionMethod})")
-                    else:
-                        self.context.log.highlight(f"BitLocker is disabled on drive {MountPoint}")
-        except Exception as e:
-            self.context.log.exception(f"Exception occurred: {e}")
-
-
-class BitLockerWMI:
-    def __init__(self, context, connection):
-        self.context = context
-        self.connection = connection
-
-    def check_bitlocker_status(self):
-        try:
-            # Create a DCOM connection
-            dcom_conn = DCOMConnection(
-                self.connection.host,
-                self.connection.username,
-                self.connection.password,
-                self.connection.domain,
-                self.connection.lmhash,
-                self.connection.nthash,
-                oxidResolver=True,
-                doKerberos=self.connection.kerberos,
-                kdcHost=self.connection.kdcHost)
-                
-            try:
-                # CoCreateInstanceEx for WMI login
-                i_interface = dcom_conn.CoCreateInstanceEx(wmi.CLSID_WbemLevel1Login, wmi.IID_IWbemLevel1Login)
-                iWbemLevel1Login = wmi.IWbemLevel1Login(i_interface)
-
-                # Specify the namespace for BitLocker
-                bitlockerNamespace = "root\\CIMv2\\Security\\MicrosoftVolumeEncryption"
-                
-                # NTLM login for WMI
-                iWbemServices = iWbemLevel1Login.NTLMLogin(bitlockerNamespace, NULL, NULL)
-
-                # Set authentication level
-                iWbemServices.get_dce_rpc().set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY)
-
-                # Query to get BitLocker status
-                classQuery = "SELECT DriveLetter, ProtectionStatus, EncryptionMethod FROM Win32_EncryptableVolume"
-                iEnumWbemClassObject = iWbemServices.ExecQuery(classQuery)
-                encryptionTypeMapping = {0: "None", 1: "AES_256_WITH_DIFFUSER", 2: "AES_256_WITH_DIFFUSER", 3: "AES_128", 4: "AES_256", 5: "HARDWARE_ENCRYPTION", 6: "XTS_AES_128", 7: "XTS_AES_256"}
-                
-                try:
-                    while True:
-                        iWbemClassObject = iEnumWbemClassObject.Next(0xffffffff, 1)
-                        encryptionMethod = int(iWbemClassObject[0].EncryptionMethod)
-                        if iWbemClassObject[0].ProtectionStatus == 1:
-                            self.context.log.highlight(f"BitLocker is enabled on drive {iWbemClassObject[0].DriveLetter} (Encryption Method: {encryptionTypeMapping.get(encryptionMethod, 'Unknown')})")
-                        else:
-                            if encryptionMethod == 0:  # Should be 0 if disabled
-                                self.context.log.highlight(f"BitLocker is disabled on drive {iWbemClassObject[0].DriveLetter}")
-                except Exception:
-                    pass  # Using pass because if try to log or printing, getting "WMI Session Error: code: 0x1 - WBEM_S_FALSE"
-
-                # Release resources
-                iWbemLevel1Login.RemRelease()
-                iWbemServices.RemRelease()
-                dcom_conn.disconnect()
-            except Exception as e:
-                if "WBEM_E_INVALID_NAMESPACE" in str(e):
-                    self.context.log.fail("BitLockerNamespace not found on target.")
-                    dcom_conn.disconnect()
-        except Exception as e:
-            self.context.log.error(f"Error occurred during BitLocker check: {e}")
-            dcom_conn.disconnect()

nxc/modules/enum_av.py

@@ -358,27 +358,6 @@ conf = {
                 {"name": "sophoslivequery_*", "processes": [""]}
             ]
         },
-        {
-            "name": "Trellix Endpoint Detection and Response (EDR)",
-            "services": [
-                {"name": "McAfee Endpoint Security Platform Service", "description": "Trellix Core Service"},
-                {"name": "mfemactl", "description": "Trellix Management Service"},
-                {"name": "mfemms", "description": "McAfee Management Service"},
-                {"name": "mfefire", "description": "Trellix Firewall Core Service"},
-                {"name": "masvc", "description": "Trellix Agent Service"},
-                {"name": "macmnsvc", "description": "Trellix Agent Common Service"},
-                {"name": "mfetp", "description": "Trellix Endpoint Threat Prevention Service"},
-                {"name": "mfewc", "description": "Trellix Endpoint Security Web Control Service"}, 
-                {"name": "mfeaack", "description": "Trellix Anti-Malware Core Service"}
-            ],
-            "pipes": [
-                {"name": "TrellixEDR_Pipe_*", "processes": ["McAfeeEDR.exe"]},
-                {"name": "mfemactl_*", "processes": ["mfemactl.exe"]},
-                {"name": "mfefire_*", "processes": ["mfefire.exe"]},
-                {"name": "McAfeeAgent_Pipe_*", "processes": ["McAfeeAgent.exe"]},
-                {"name": "mfetp_*", "processes": ["mfetp.exe"]}
-            ]
-        },
         {
             "name": "Trend Micro Endpoint Security",
             "services": [

nxc/modules/enum_share_acls.py

@@ -0,0 +1,365 @@
+# Module by @syl
+# https://twitter.com/5yrull
+# S-1-5-21-3750225908-897271529-2201778708-1103
+# 'S-1-5-21-3750225908-897271529-2201778708'
+# (Pdb) resp = lsad.hLsarQueryInformationPolicy2(dce, policyHandle, lsad.POLICY_INFORMATION_CLASS.PolicyAccountDomainInformation)
+# (Pdb) domainSid = resp['PolicyInformation']['PolicyAccountDomainInfo']['DomainSid'].formatCanonical()
+# (Pdb) domainSid
+# 'S-1-5-21-3750225908-897271529-2201778708'
+# (Pdb) lsat.hLsarLookupSids(dce, policyHandle, ['S-1-5-21-3750225908-897271529-2201778708-1103'],lsat.LSAP_LOOKUP_LEVEL.LsapLookupWksta)
+# <impacket.dcerpc.v5.lsat.LsarLookupSidsResponse object at 0x7f041cba9d50>
+# (Pdb) resp = lsat.hLsarLookupSids(dce, policyHandle, ['S-1-5-21-3750225908-897271529-2201778708-1103'],lsat.LSAP_LOOKUP_LEVEL.LsapLookupWksta)
+# (Pdb) resp
+# <impacket.dcerpc.v5.lsat.LsarLookupSidsResponse object at 0x7f041cba9de0>
+# (Pdb) resp.__dict__
+# {'_isNDR64': False, 'fields': {'ReferencedDomains': <impacket.dcerpc.v5.lsat.PLSAPR_REFERENCED_DOMAIN_LIST object at 0x7f041cba9ea0>, 'TranslatedNames': <impacket.dcerpc.v5.lsat.LSAPR_TRANSLATED_NAMES object at 0x7f041cba9450>, 'MappedCount': <impacket.dcerpc.v5.ndr.NDRULONG object at 0x7f041cba9270>, 'ErrorCode': <impacket.dcerpc.v5.ndr.NDRULONG object at 0x7f041cba8460>}}
+# (Pdb) resp.TranslatedNames
+# *** AttributeError: 'LsarLookupSidsResponse' object has no attribute 'TranslatedNames'
+# (Pdb) resp["TranslatedNames"]
+# <impacket.dcerpc.v5.lsat.LSAPR_TRANSLATED_NAMES object at 0x7f041cba9450>
+# (Pdb) resp["TranslatedNames"].__dict__
+# {'_isNDR64': False, 'fields': {'Entries': <impacket.dcerpc.v5.ndr.NDRULONG object at 0x7f041cba9960>, 'Names': <impacket.dcerpc.v5.lsat.PLSAPR_TRANSLATED_NAME_ARRAY object at 0x7f041cba9a80>}}
+# (Pdb) resp["TranslatedNames"]["Names"]
+# [<impacket.dcerpc.v5.lsat.LSAPR_TRANSLATED_NAME object at 0x7f041cba8a60>]
+# (Pdb) resp["TranslatedNames"]["Names"][0].__dict_
+# *** AttributeError: 'LSAPR_TRANSLATED_NAME' object has no attribute '__dict_'
+# (Pdb) resp["TranslatedNames"]["Names"][0].__dict__
+# {'_isNDR64': False, 'fields': {'Use': <impacket.dcerpc.v5.samr.SID_NAME_USE object at 0x7f041cba8c70>, 'Name': <impacket.dcerpc.v5.dtypes.RPC_UNICODE_STRING object at 0x7f041cba8be0>, 'DomainIndex': <impacket.dcerpc.v5.ndr.NDRLONG object at 0x7f041cba8ca0>}}
+# (Pdb) resp["TranslatedNames"]["Names"][0]["name"]
+# *** KeyError: 'name'
+# (Pdb) resp["TranslatedNames"]["Names"][0]["Name"]
+# 'George.Hotz'
+# (Pdb) 
+
+from impacket.smbconnection import SessionError
+from impacket.dcerpc.v5 import transport, lsat, lsad
+from impacket.dcerpc.v5.samr import SID_NAME_USE
+from impacket.dcerpc.v5.dtypes import MAXIMUM_ALLOWED
+from impacket.dcerpc.v5.rpcrt import DCERPCException
+from winacl.dtyp.security_descriptor import SECURITY_DESCRIPTOR
+from winacl.functions.constants import SE_OBJECT_TYPE
+from winacl.dtyp.ace import FILE_ACCESS_MASK
+from termcolor import colored
+
+def get_dce_from_smb(conn):
+    string_binding = rf"ncacn_np:{conn.remoteName}[\pipe\lsarpc]"
+    rpctransport = transport.DCERPCTransportFactory(string_binding)
+    rpctransport.set_dport(conn.port)
+    rpctransport.setRemoteHost(conn.host)
+    rpctransport.set_credentials(conn.username, conn.password, conn.domain, conn.lmhash, conn.nthash)
+    return rpctransport.get_dce_rpc()
+
+def lookup_sid(dce, sid):
+    dce.connect()
+    dce.bind(lsat.MSRPC_UUID_LSAT)
+    policy_response = lsad.hLsarOpenPolicy2(dce, MAXIMUM_ALLOWED | lsat.POLICY_LOOKUP_NAMES)
+    policy_handle = policy_response["PolicyHandle"]
+    sid_response = lsat.hLsarLookupSids(dce, policy_handle, [sid],lsat.LSAP_LOOKUP_LEVEL.LsapLookupWksta)
+    sid_name = sid_response["TranslatedNames"]["Names"][0]["Name"]
+    dce.disconnect()
+    return sid_name
+
+AVAILABLE_FILTERS = ["ace_mask", "ace_sid", "owner", "group"]
+READ_CONTROL = 0x00020000
+FILE_SHARE_READ = 0x00000001
+FILE_NON_DIRECTORY_FILE = 0x00000040
+FILE_DIRECTORY_FILE = 0x00000001
+IMPERSONATION = 0x00000002
+
+class SMBACLEnumerator:
+    
+    AVAILABLE_FILTERS = ["ace_mask", "ace_sid", "owner", "group"]
+    
+    def __init__(self, connection, context, module_options) -> None:
+        self.connection = connection
+        self.smb_connection = connection.conn
+        self.context = context
+        self.module_options = module_options
+        self.filters = self.parse_filters(self.module_options)
+        self.shares = self.get_shares()
+        
+    def get_shares(self):
+        shares = self.connection.shares()
+    
+    def parse_filters(self, options: dict) -> dict:
+        ...
+        
+    def get_security_descriptor() -> None:
+        ...
+
+# def get_security_descriptor(file, smb_connection, context, share_name, file_path, filters=None):
+#     """
+#     Retrieve the security descriptor of a file on a share.
+
+#     Parameters
+#     ----------
+#         file: File object.
+#         smb_connection: SMB connection instance.
+#         context: Context for logging.
+#         share_name: Name of the SMB share.
+#         file_path: Path of the file.
+#         filters: Optional filters for security descriptor components.
+
+#     Returns
+#     -------
+#         None: If the file does not meet the filter criteria.
+#     """
+#     file_full_path = file_path + file.get_longname()
+#     tree_id = smb_connection.connectTree(share_name)
+#     file_id = create_file(smb_connection, tree_id, file_full_path)
+
+#     try:
+#         security_descriptor = smb_connection._SMBConnection.query_sec_info(tree_id, file_id)
+#         security_descriptor_obj = parse_security_descriptor(security_descriptor)
+
+#         if filters and not passes_filters(security_descriptor_obj, filters):
+#             return
+
+#         log_security_descriptor(context, file_full_path, security_descriptor_obj)
+#     except SessionError as e:
+#         context.log.debug(e)
+
+
+# def create_file(smb_connection, tree_id, file_full_path):
+#     """Create a file in the SMB share and return its ID."""
+#     return smb_connection.createFile(
+#         tree_id,
+#         file_full_path,
+#         desiredAccess=READ_CONTROL,
+#         shareMode=FILE_SHARE_READ,
+#         creationOption=FILE_NON_DIRECTORY_FILE,
+#         creationDisposition=FILE_DIRECTORY_FILE,
+#         fileAttributes=0,
+#         impersonationLevel=IMPERSONATION,
+#     )
+
+
+# def parse_security_descriptor(security_descriptor):
+#     """Parse the security descriptor from bytes to an object."""
+#     return SECURITY_DESCRIPTOR.from_bytes(
+#         security_descriptor, object_type=SE_OBJECT_TYPE.SE_FILE_OBJECT
+#     )
+
+
+# def passes_filters(security_descriptor_obj, filters):
+#     """
+#     Check if the security descriptor object passes the given filter criteria.
+
+#     Parameters
+#     ----------
+#         security_descriptor_obj: The security descriptor object.
+#         filters: Dictionary of filter criteria.
+
+#     Returns
+#     -------
+#         bool: True if the descriptor passes all filters, False otherwise.
+#     """
+#     for filter_type, values in filters.items():
+#         if filter_type == "owner" and str(security_descriptor_obj.Owner) not in values:
+#             return False
+#         if filter_type == "group" and str(security_descriptor_obj.Group) not in values:
+#             return False
+#         if filter_type == "ace_sid":
+#             sids = [str(ace.Sid) for ace in security_descriptor_obj.Dacl.aces]
+#             if not any(sid in sids for sid in values):
+#                 return False
+#         if filter_type == "ace_mask":
+#             masks = [FILE_ACCESS_MASK(ace.Mask).name for ace in security_descriptor_obj.Dacl.aces]
+#             if not any(mask in masks for mask in values):
+#                 return False
+#     return True
+
+
+def log_security_descriptor(context, file_path, descriptor_obj):
+    """
+    Log details about the security descriptor.
+
+    Parameters
+    ----------
+        context: Context for logging.
+        file_path: Path of the file.
+        descriptor_obj: The security descriptor object.
+    """
+    context.log.success(file_path)
+    context.log.highlight(f"\t Owner: {descriptor_obj.Owner}")
+    context.log.highlight(f"\t Group: {descriptor_obj.Group}")
+    context.log.highlight(f"\t SACL: {descriptor_obj.Sacl}")
+
+    if descriptor_obj.Dacl is not None:
+        context.log.highlight(f"\t ACEs[{len(descriptor_obj.Dacl.aces)}]: ")
+        for ace in descriptor_obj.Dacl.aces:
+            ace_str = str(ace)
+            if "\r\n" in ace_str:
+                ace_formatted = ace_str.split("\r\n")[:-1]
+                for line in ace_formatted:
+                    context.log.highlight(f"\t\t {line}")
+                context.log.highlight("\t\t " + len(ace_formatted[0]) * "=")
+            else:
+                context.log.highlight(f"\t\t {ace_str}")
+
+def get_security_descriptor(conn, file, smb_connection, context, share_name, file_path, filters=None):
+    """Retrieving the security descriptor of a certain file on a share"""
+    tree_id = smb_connection.connectTree(share_name)
+    dce = get_dce_from_smb(conn)
+    desired_access = 0x00020000 # READ_CONTROL
+    share_mode = 0x00000001 # FILE_SHARE_READ
+    create_options = 0x00000040 # FILE_NON_DIRECTORY_FILE
+    file_attrs = 0
+    create_disposition = 0x00000001 # FILE_DIRECTORY_FILE
+    file_full_path = file_path + file.get_longname()
+    try:
+        file_id = smb_connection.createFile(
+            tree_id,
+            file_full_path,
+            desiredAccess=desired_access,
+            shareMode=share_mode,
+            creationOption=create_options,
+            creationDisposition=create_disposition,
+            fileAttributes=file_attrs,
+            impersonationLevel=0x00000002, # Impersonation
+        )
+        
+        security_descriptor = smb_connection._SMBConnection.query_sec_info(tree_id, file_id)
+        security_descriptor_obj = SECURITY_DESCRIPTOR.from_bytes(
+            security_descriptor, object_type=SE_OBJECT_TYPE.SE_FILE_OBJECT
+        )
+
+        if filters:
+            for _filter, values in filters.items():
+                if _filter == "owner" and str(security_descriptor_obj.Owner) not in values:
+                    return
+                if _filter == "group" and str(security_descriptor_obj.Group) not in values:
+                    return
+                if _filter == "ace_sid":
+                    sids = [str(_ace.Sid) for _ace in security_descriptor_obj.Dacl.aces]
+                    for sid in values:
+                        if sid in sids:
+                            continue
+                        else:
+                            return
+                if _filter == "ace_mask":
+                    masks = [FILE_ACCESS_MASK(_ace.Mask).name for _ace in security_descriptor_obj.Dacl.aces]
+                    for mask in values:
+                        if mask in masks:
+                            continue
+                        else:
+                            return
+
+        context.log.success(file_full_path)
+        # Also get the user's group to mark it as Owned
+        # smb_connection._SMBConnection._SMB__userName
+        username = smb_connection._SMBConnection._SMB__userName
+        
+        owner = lookup_sid(dce, str(security_descriptor_obj.Owner))
+        if owner == username:
+            owner = owner + colored("Pwn3d!", "red")
+        group = lookup_sid(dce, str(security_descriptor_obj.Group))
+        context.log.highlight(f"\t Owner: {owner}")
+        context.log.highlight(f"\t Group: {group}")
+        context.log.highlight(f"\t SACL: {security_descriptor_obj.Sacl}")
+        
+        if security_descriptor_obj.Dacl is not None:
+            context.log.highlight("\t ACEs:")
+            for ace in security_descriptor_obj.Dacl.aces:
+                ace_sid_name = lookup_sid(dce, str(ace.Sid))
+                mask_formatted = FILE_ACCESS_MASK(ace.Mask).name
+                if mask_formatted is None:
+                    continue
+                owned = colored(" (Own3d!)", "red") if ace_sid_name == username else ""
+                context.log.highlight(f"\t\t {ace_sid_name} - {mask_formatted}{owned}")
+    except SessionError as e:
+        context.log.debug(e)
+
+def enumerate_files(conn, smb_connection, share_name, current_path, context, filters=None):
+    """Recursive function that enumerates the directories"""
+    try:
+        print(f"{smb_connection=} {share_name=} {current_path=}")
+        file_list = smb_connection.listPath(share_name, current_path + "*")
+        for file in file_list:
+            if (
+                file.is_directory()
+                and not file.is_system()
+                and file.get_longname() not in [".", ".."]
+            ):
+                next_path = current_path + file.get_longname() + "/"
+                context.log.debug(f"Trying to enumrate files in {next_path}")
+                enumerate_files(conn, smb_connection, share_name, next_path, context, filters)
+            if not file.is_directory() and not file.is_system():
+                context.log.debug(f"File Found {file.get_longname()}")
+                get_security_descriptor(conn, file, smb_connection, context, share_name, current_path, filters)
+    except SessionError as e:
+        context.log.error(e)
+
+
+class NXCModule:
+    """
+    A module to enumerate the ACLs of the files in a share.
+
+    Module by @syl, thanks to @Skelsec and @NeffIsBack
+    """
+    name = "enum_share_acls"
+    description = ""
+    supported_protocols = ["smb"]
+    opsec_safe = False
+    multiple_hosts = True
+
+    def __init__(self, context=None, module_options=None):
+        self.context = context
+        self.module_options = module_options
+        self.server = None
+        self.file_path = None
+        self.lnk_path = None
+        self.lnk_name = None
+        self.cleanup = None
+
+    def options(self, context, module_options):
+        """
+        group-mem: Specify group-mem to call the module
+        GROUP: Specify the GROUP option to query for that group's members
+        Usage:
+            nxc smb 127.0.0.1 -u administrator -p 'Password123!' -M enum_share_acls -o FILTER="ace_mask=FILE_ALL_ACCESS,ace_sid=S-1-5-32-544"
+            nxc smb 127.0.0.1 -u administrator -p 'Password123!' -M enum_share_acls -o FILTER="ace_mask=FILE_ALL_ACCESS|READ_CONTROL,ace_sid=S-1-5-32-544"
+            nxc smb 127.0.0.1 -u administrator -p 'Password123!' -M enum_share_acls -o FILTER="owner=S-1-5-32-544"
+        """
+        self.FILTER = None
+        if "FILTER" in module_options:
+            self.FILTER = module_options["FILTER"]
+
+    def parse_filters(self):
+        parsed_filters = self.FILTER.split(",")
+        filters_dict = {}
+        masks = [m.name for m in FILE_ACCESS_MASK]
+        for _filter in parsed_filters:
+            
+            splitted_filter = _filter.split("=")
+
+            if splitted_filter[0] not in AVAILABLE_FILTERS:
+                return None, f"{_filter} filter isn't available, please choose between {AVAILABLE_FILTERS}"
+            
+            for __filter in AVAILABLE_FILTERS:
+                if __filter in _filter:
+                    filters_dict[__filter] = splitted_filter[1]
+                    if "|" in filters_dict[__filter]:
+                        filters_dict[__filter] = filters_dict[__filter].split("|")
+                    else:
+                        filters_dict[__filter] = [splitted_filter[1],]
+
+        # Verify the filters
+        if "ace_mask" in filters_dict:
+            for mask_name in filters_dict["ace_mask"]:
+                if mask_name not in masks:
+                    return None, f"{mask_name} ace_mask isn't valid, please choose between {mask_name}"
+        return filters_dict, None
+    
+    def on_login(self, context, connection):
+        shares = connection.shares()
+        smb_connection = connection.conn
+        filters = None
+        if self.FILTER:
+            filters, err = self.parse_filters()
+            if err is not None:
+                context.log.error(err)
+        for share in shares:
+            share_name = share["name"]
+            context.log.display(f"Enumerating ACLs on share: {share_name}")
+            enumerate_files(connection, smb_connection, share_name, "/", context, filters)

nxc/modules/handlekatz.py

@@ -7,7 +7,7 @@ import re
 import sys
 
 from nxc.helpers.bloodhound import add_user_bh
-from pypykatz.pypykatz import pypykatz
+import pypykatz
 
 
 class NXCModule:

nxc/modules/ioxidresolver.py

@@ -1,11 +1,10 @@
 # Credit to https://airbus-cyber-security.com/fr/the-oxid-resolver-part-1-remote-enumeration-of-network-interfaces-without-any-authentication/
 # Airbus CERT
 # module by @mpgn_x64
-# updated by @NeffIsBack
 
 from ipaddress import ip_address
 from impacket.dcerpc.v5 import transport
-from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_LEVEL_NONE, DCERPCException
+from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_LEVEL_NONE
 from impacket.dcerpc.v5.dcomrt import IObjectExporter
 
 
@@ -14,31 +13,31 @@ class NXCModule:
     description = "This module helps you to identify hosts that have additional active interfaces"
     supported_protocols = ["smb", "wmi"]
     opsec_safe = True
-    multiple_hosts = True
+    multiple_hosts = False
 
     def options(self, context, module_options):
-        """No module options"""
+        """ """
 
     def on_login(self, context, connection):
-        try:
-            rpctransport = transport.DCERPCTransportFactory(f"ncacn_ip_tcp:{connection.host}")
-            rpctransport.setRemoteHost(connection.host)
+        authLevel = RPC_C_AUTHN_LEVEL_NONE
 
-            portmap = rpctransport.get_dce_rpc()
-            portmap.set_auth_level(RPC_C_AUTHN_LEVEL_NONE)
-            portmap.connect()
+        stringBinding = r"ncacn_ip_tcp:%s" % connection.host
+        rpctransport = transport.DCERPCTransportFactory(stringBinding)
+        rpctransport.setRemoteHost(connection.host)
 
-            objExporter = IObjectExporter(portmap)
-            bindings = objExporter.ServerAlive2()
+        portmap = rpctransport.get_dce_rpc()
+        portmap.set_auth_level(authLevel)
+        portmap.connect()
 
-            context.log.debug(f"Retrieving network interface of {connection.host}")
+        objExporter = IObjectExporter(portmap)
+        bindings = objExporter.ServerAlive2()
 
-            for binding in bindings:
-                NetworkAddr = binding["aNetworkAddr"]
-                try:
-                    ip_address(NetworkAddr[:-1])
-                    context.log.highlight(f"Address: {NetworkAddr}")
-                except Exception as e:
-                    context.log.debug(e)
-        except DCERPCException as e:
-            context.log.error(f"DCERPCException error: {e}")
+        context.log.debug("[*] Retrieving network interface of " + connection.host)
+
+        for binding in bindings:
+            NetworkAddr = binding["aNetworkAddr"]
+            try:
+                ip_address(NetworkAddr[:-1])
+                context.log.highlight("Address: " + NetworkAddr)
+            except Exception as e:
+                context.log.debug(e)

nxc/modules/laps.py

@@ -45,12 +45,12 @@ class NXCModule:
                 values = {str(attr["type"]).lower(): attr["vals"][0] for attr in computer["attributes"]}
                 if "mslaps-encryptedpassword" in values:
                     msMCSAdmPwd = values["mslaps-encryptedpassword"]
-                    d = LAPSv2Extract(bytes(msMCSAdmPwd), connection.username if connection.username else "", connection.password if connection.password else "", connection.domain, connection.nthash if connection.nthash else "", connection.kerberos, connection.kdcHost, 339, connection.dns_server)
+                    d = LAPSv2Extract(bytes(msMCSAdmPwd), connection.username if connection.username else "", connection.password if connection.password else "", connection.domain, connection.nthash if connection.nthash else "", connection.kerberos, connection.kdcHost, 339)
                     try:
                         data = d.run()
                     except Exception as e:
-                        context.log.fail(str(e))
-                        continue
+                        self.logger.fail(str(e))
+                        return
                     r = json.loads(data)
                     laps_computers.append((str(values["samaccountname"]), r["n"], str(r["p"])))
                 elif "mslaps-password" in values:

nxc/modules/pso.py

@@ -53,7 +53,7 @@ class NXCModule:
         for attrs in resp:
             if not isinstance(attrs, ldapasn1_impacket.SearchResultEntry):
                 continue
-            policyName, description, passwordLength, passwordhistorylength, lockoutThreshold, observationWindow, lockoutDuration, complexity, minPassAge, maxPassAge, reverseibleEncryption, precedence, policyApplies = ("",) * 13
+            policyName, description, passwordLength, passwordhistorylength, lockoutThreshold, obersationWindow, lockoutDuration, complexity, minPassAge, maxPassAge, reverseibleEncryption, precedence, policyApplies = ("",) * 13
             for attr in attrs["attributes"]:
                 if str(attr["type"]) == "name":
                     policyName = attr["vals"][0]

nxc/modules/security-questions.py

@@ -1,134 +0,0 @@
-from impacket.dcerpc.v5 import samr, transport
-from impacket.nt_errors import STATUS_MORE_ENTRIES
-from impacket.dcerpc.v5.rpcrt import DCERPCException
-from json import loads
-from traceback import format_exc as traceback_format_exc
-
-class NXCModule:
-    """
-    Module by Adamkadaban: @Adamkadaban
-    Based on research from @0gtweet (@gtworek)
-
-    Much of this code was copied from add_computer.py
-    Reference: https://hackback.zip/2024/05/08/Remotely-Dumping-Windows-Security-Questions-With-Impacket.html
-    """
-
-    name = "security-questions"
-    description = "Gets security questions and answers for users on computer"
-    supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def options(self, context, module):
-        pass
-
-    def on_admin_login(self, context, connection):
-        self.__domain = connection.domain
-        self.__domainNetbios = connection.domain
-        self.__kdcHost = connection.hostname + "." + connection.domain
-        self.__target = self.__kdcHost
-        self.__username = connection.username
-        self.__password = connection.password
-        self.__targetIp = connection.host
-        self.__port = context.smb_server_port
-        self.__aesKey = context.aesKey
-        self.__hashes = context.hash
-        self.__doKerberos = connection.kerberos
-        self.__nthash = ""
-        self.__lmhash = ""
-
-        if context.hash and ":" in context.hash[0]:
-            hashList = context.hash[0].split(":")
-            self.__nthash = hashList[-1]
-            self.__lmhash = hashList[0]
-        elif context.hash and ":" not in context.hash[0]:
-            self.__nthash = context.hash[0]
-            self.__lmhash = "00000000000000000000000000000000"
-
-        self.getSAMRResetInfo(context)
-
-    def getSAMRResetInfo(self, context):
-        string_binding = f"ncacn_np:{self.__targetIp}[\\pipe\\samr]"
-        rpc_transport = transport.DCERPCTransportFactory(string_binding)
-        rpc_transport.set_dport(445)
-        rpc_transport.setRemoteHost(self.__targetIp)
-
-        if hasattr(rpc_transport, "set_credentials"):
-            # This method exists only for selected protocol sequences.
-            rpc_transport.set_credentials(self.__username, self.__password, self.__domain, self.__lmhash,
-                                         self.__nthash, self.__aesKey)
-        rpc_transport.set_kerberos(self.__doKerberos, self.__kdcHost)
-
-        try:
-            dce = rpc_transport.get_dce_rpc()
-            dce.connect()
-            dce.bind(samr.MSRPC_UUID_SAMR)
-
-            # obtain server handle for samr connection
-            resp = samr.hSamrConnect(dce)
-            server_handle = resp["ServerHandle"]
-
-            resp = samr.hSamrEnumerateDomainsInSamServer(dce, server_handle)
-            domains = resp["Buffer"]["Buffer"]
-
-            resp = samr.hSamrLookupDomainInSamServer(dce, server_handle, domains[0]["Name"])
-
-            # obtain domain handle for samr connection
-            resp = samr.hSamrOpenDomain(dce, serverHandle=server_handle, domainId=resp["DomainId"])
-            domain_handle = resp["DomainHandle"]
-
-            status = STATUS_MORE_ENTRIES
-            enumeration_context = 0
-
-            # try to iterate through users in domain entries for connection
-            while status == STATUS_MORE_ENTRIES:
-                try:
-                    resp = samr.hSamrEnumerateUsersInDomain(dce, domain_handle, enumerationContext=enumeration_context)
-                except DCERPCException as e:
-                    if str(e).find("STATUS_MORE_ENTRIES") < 0:
-                        raise 
-                    resp = e.get_packet()
-
-                for user in resp["Buffer"]["Buffer"]:
-                    try:
-                        context.log.info(f"Querying security questions for User: {user['Name']}")
-                        # request SAMR ID 30
-                        # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/6b0dff90-5ac0-429a-93aa-150334adabf6
-                        r = samr.hSamrOpenUser(dce, domain_handle, samr.MAXIMUM_ALLOWED, user["RelativeId"])
-                        info = samr.hSamrQueryInformationUser2(dce, r["UserHandle"], samr.USER_INFORMATION_CLASS.UserResetInformation)
-
-                        reset_data = info["Buffer"]["Reset"]["ResetData"]
-                        if reset_data == b"":
-                            continue
-                        reset_data = loads(reset_data)
-                        questions = reset_data["questions"]
-
-                        if len(questions) == 0:
-                            context.log.highlight(f"User {user['Name']} has no security questions")
-                        else:
-                            for qna in questions:
-                                question = qna["question"]
-                                answer = qna["answer"]
-                                context.log.highlight(f"{user['Name']} - {question}: {answer}")
-
-                        samr.hSamrCloseHandle(dce, r["UserHandle"])
-                    except samr.DCERPCException as e:
-                        if "STATUS_INVALID_INFO_CLASS" in str(e):
-                            context.log.debug(f"Failed to query security questions for User: {user['Name']}: {e!s}")
-                            continue
-                        else:
-                            context.log.fail(f"Failed to query security questions for User: {user['Name']}: {e!s}")
-                            context.log.debug(traceback_format_exc())
-                enumeration_context = resp["EnumerationContext"]
-                status = resp["ErrorCode"]
-
-        except Exception as e:
-            context.log.fail(f"Error: {e}")
-            context.log.debug(traceback_format_exc())
-
-        finally:
-            if domain_handle is not None:
-                samr.hSamrCloseHandle(dce, domain_handle)
-            if server_handle is not None:
-                samr.hSamrCloseHandle(dce, server_handle)
-            dce.disconnect()

nxc/modules/spider_plus.py

@@ -8,7 +8,6 @@ from nxc.paths import TMP_PATH
 from nxc.protocols.smb.remotefile import RemoteFile
 from impacket.smb3structs import FILE_READ_DATA
 from impacket.smbconnection import SessionError
-from impacket.nmb import NetBIOSTimeout
 
 
 CHUNK_SIZE = 4096
@@ -53,7 +52,17 @@ def get_list_from_option(opt):
 
 
 class SMBSpiderPlus:
-    def __init__(self, smb, logger, download_flag, stats_flag, exclude_exts, exclude_filter, max_file_size, output_folder):
+    def __init__(
+        self,
+        smb,
+        logger,
+        download_flag,
+        stats_flag,
+        exclude_exts,
+        exclude_filter,
+        max_file_size,
+        output_folder,
+    ):
         self.smb = smb
         self.host = self.smb.conn.getRemoteHost()
         self.max_connection_attempts = 5
@@ -75,7 +84,6 @@ class SMBSpiderPlus:
             "num_files_unmodified": 0,
             "num_files_updated": 0,
         }
-        self.connection_attempts = 1  # we connect once initially
         self.download_flag = download_flag
         self.stats_flag = stats_flag
         self.exclude_filter = exclude_filter
@@ -90,14 +98,15 @@ class SMBSpiderPlus:
         """Performs a series of reconnection attempts, up to `self.max_connection_attempts`, with a 3-second delay between each attempt.
         It renegotiates the session by creating a new connection object and logging in again.
         """
-        for i in range(self.connection_attempts, self.max_connection_attempts + 1):
+        for i in range(1, self.max_connection_attempts + 1):
             self.logger.display(f"Reconnection attempt #{i}/{self.max_connection_attempts} to server.")
+
+            # Renegotiate the session
             time.sleep(3)
-            self.logger.display("Creating new connection object and trying to login...")
             self.smb.create_conn_obj()
             self.smb.login()
-            self.connection_attempts += 1
             return True
+
         return False
 
     def list_path(self, share, subfolder):
@@ -105,18 +114,21 @@ class SMBSpiderPlus:
         filelist = []
         try:
             # Get file list for the current folder
-            filelist = self.smb.conn.listPath(share, f"{subfolder}*")
+            filelist = self.smb.conn.listPath(share, subfolder + "*")
+
         except SessionError as e:
-            self.logger.debug(f"Failed listing files on share '{share}'' in folder '{subfolder}': {e}")
+            self.logger.debug(f'Failed listing files on share "{share}" in folder "{subfolder}".')
+            self.logger.debug(str(e))
+
             if "STATUS_ACCESS_DENIED" in str(e):
-                self.logger.debug(f'Cannot list files in folder "{subfolder}"')
+                self.logger.debug(f'Cannot list files in folder "{subfolder}".')
+
             elif "STATUS_OBJECT_PATH_NOT_FOUND" in str(e):
-                self.logger.debug(f"The folder {subfolder} does not exist")
+                self.logger.debug(f"The folder {subfolder} does not exist.")
+
             elif self.reconnect():
                 filelist = self.list_path(share, subfolder)
-        except NetBIOSTimeout:
-            self.logger.debug("Received a NetBIOSTimeout, moving on....")
-            return []
+
         return filelist
 
     def get_remote_file(self, share, path):
@@ -234,7 +246,6 @@ class SMBSpiderPlus:
         # - It's a file then we apply the checks
         for result in filelist:
             next_filedir = result.get_longname()
-            # "ServiceProfiles", "assembly", "Boot", "CbsTemp", "Fonts", "Installer", "Microsoft.NET"
             if next_filedir in [".", ".."]:
                 continue
             next_fullpath = folder + next_filedir

nxc/protocols/ldap.py

@@ -172,12 +172,12 @@ class ldap(connection):
                     self.logger.debug(f"ldap_connection: {ldap_connection}")
             except SysCallError as e:
                 if proto == "ldaps":
-                    self.logger.fail(f"LDAPs connection to {ldap_url} failed - {e}")
+                    self.logger.debug(f"LDAPs connection to {ldap_url} failed - {e}")
                     # https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/enable-ldap-over-ssl-3rd-certification-authority
-                    self.logger.fail("Even if the port is open, LDAPS may not be configured")
+                    self.logger.debug("Even if the port is open, LDAPS may not be configured")
                 else:
-                    self.logger.fail(f"LDAP connection to {ldap_url} failed: {e}")
-                exit(1)
+                    self.logger.debug(f"LDAP connection to {ldap_url} failed: {e}")
+                return [None, None, None]
 
             resp = ldap_connection.search(
                 scope=ldapasn1_impacket.Scope("baseObject"),
@@ -1419,7 +1419,6 @@ class ldap(connection):
             auth.get_tgt()
         if self.args.use_kcache:
             self.logger.highlight("Using kerberos auth from ccache")
-            auth.load_ccache()
 
         timestamp = datetime.now().strftime("%Y-%m-%d_%H%M%S") + "_"
         bloodhound = BloodHound(ad, self.hostname, self.host, self.port)

nxc/protocols/ldap/laps.py

@@ -1,3 +1,5 @@
+import binascii
+import hashlib
 from json import loads
 from pyasn1.codec.der import decoder
 from pyasn1_modules import rfc5652
@@ -35,13 +37,12 @@ class LDAPConnect:
     def proto_logger(self, host, port, hostname):
         self.logger = NXCAdapter(extra={"protocol": "LDAP", "host": host, "port": port, "hostname": hostname})
 
-    def kerberos_login(self, domain, username, password="", ntlm_hash="", aesKey="", kdcHost="", useCache=False, dns_server=""):
+    def kerberos_login(self, domain, username, password="", ntlm_hash="", aesKey="", kdcHost="", useCache=False):
         lmhash = ""
         nthash = ""
 
-        if kdcHost is None or domain not in kdcHost:
-            self.logger.fail("Please provide the FQDN of the domain controller with --kdcHost")
-            exit(1)
+        if kdcHost is None:
+            kdcHost = domain
 
         # This checks to see if we didn't provide the LM Hash
         if ntlm_hash and ntlm_hash.find(":") != -1:
@@ -53,13 +54,12 @@ class LDAPConnect:
         baseDN = ""
         domainParts = domain.split(".")
         for i in domainParts:
-            baseDN += f"DC={i},"
+            baseDN += f"dc={i},"
         # Remove last ','
         baseDN = baseDN[:-1]
 
         try:
-            self.logger.info(f"Connecting to ldap://{kdcHost} - {baseDN} - {domain} [1]")
-            ldap_connection = ldap_impacket.LDAPConnection(f"ldap://{kdcHost}", baseDN, dns_server if dns_server else domain)
+            ldap_connection = ldap_impacket.LDAPConnection(f"ldap://{kdcHost}", baseDN)
             ldap_connection.kerberosLogin(
                 username,
                 password,
@@ -78,7 +78,7 @@ class LDAPConnect:
             if str(e).find("strongerAuthRequired") >= 0:
                 # We need to try SSL
                 try:
-                    ldap_connection = ldap_impacket.LDAPConnection(f"ldaps://{kdcHost}", baseDN, dns_server if dns_server else domain)
+                    ldap_connection = ldap_impacket.LDAPConnection(f"ldaps://{kdcHost}", baseDN)
                     ldap_connection.login(
                         username,
                         password,
@@ -105,14 +105,18 @@ class LDAPConnect:
                     color="magenta" if error_code in ldap_error_status else "red",
                 )
             return False
+
         except OSError:
             self.logger.debug(f"{domain}\\{username}:{password if password else ntlm_hash} {'Error connecting to the domain, please add option --kdcHost with the FQDN of the domain controller'}")
             return False
         except KerberosError as e:
-            self.logger.fail(f"{domain}\\{username}:{password if password else ntlm_hash} {e!s}", color="red")
+            self.logger.fail(
+                f"{domain}\\{username}:{password if password else ntlm_hash} {e!s}",
+                color="red",
+            )
             return False
 
-    def auth_login(self, domain, username, password, ntlm_hash, dns_server):
+    def auth_login(self, domain, username, password, ntlm_hash):
         lmhash = ""
         nthash = ""
 
@@ -131,7 +135,7 @@ class LDAPConnect:
         base_dn = base_dn[:-1]
 
         try:
-            ldap_connection = ldap_impacket.LDAPConnection(f"ldap://{domain}", base_dn, dns_server if dns_server else domain)
+            ldap_connection = ldap_impacket.LDAPConnection(f"ldap://{domain}", base_dn, domain)
             ldap_connection.login(username, password, domain, lmhash, nthash)
 
             # Connect to LDAP
@@ -144,7 +148,7 @@ class LDAPConnect:
             if str(e).find("strongerAuthRequired") >= 0:
                 # We need to try SSL
                 try:
-                    ldap_connection = ldap_impacket.LDAPConnection(f"ldaps://{domain}", base_dn, dns_server if dns_server else domain)
+                    ldap_connection = ldap_impacket.LDAPConnection(f"ldaps://{domain}", base_dn, domain)
                     ldap_connection.login(username, password, domain, lmhash, nthash)
                     self.logger.extra["protocol"] = "LDAPS"
                     self.logger.extra["port"] = "636"
@@ -169,7 +173,7 @@ class LDAPConnect:
 
 
 class LAPSv2Extract:
-    def __init__(self, data, username, password, domain, ntlm_hash, do_kerberos, kdcHost, port, dns_server):
+    def __init__(self, data, username, password, domain, ntlm_hash, do_kerberos, kdcHost, port):
         if ntlm_hash.find(":") != -1:
             self.lmhash, self.nthash = ntlm_hash.split(":")
         else:
@@ -183,7 +187,6 @@ class LAPSv2Extract:
         self.do_kerberos = do_kerberos
         self.kdcHost = kdcHost
         self.logger = None
-        self.dns_server = dns_server
         self.proto_logger(self.domain, port, self.domain)
 
     def proto_logger(self, host, port, hostname):
@@ -215,7 +218,7 @@ class LAPSv2Extract:
             gke = kds_cache[key_id["RootKeyId"]]
         else:
             # Connect on RPC over TCP to MS-GKDI to call opnum 0 GetKey
-            string_binding = hept_map(destHost=self.domain if not self.dns_server else self.dns_server, remoteIf=MSRPC_UUID_GKDI, protocol="ncacn_ip_tcp")
+            string_binding = hept_map(destHost=self.domain, remoteIf=MSRPC_UUID_GKDI, protocol="ncacn_ip_tcp")
             rpc_transport = transport.DCERPCTransportFactory(string_binding)
             if hasattr(rpc_transport, "set_credentials"):
                 rpc_transport.set_credentials(username=self.username, password=self.password, domain=self.domain, lmhash=self.lmhash, nthash=self.nthash)
@@ -260,7 +263,7 @@ class LAPSv2Extract:
         return plaintext[:-18].decode("utf-16le")
 
 
-def laps_search(self, username, password, cred_type, domain, dns_server):
+def laps_search(self, username, password, cred_type, domain):
     prev_protocol = self.logger.extra["protocol"]
     prev_port = self.logger.extra["port"]
     self.logger.extra["protocol"] = "LDAP"
@@ -271,7 +274,7 @@ def laps_search(self, username, password, cred_type, domain, dns_server):
     if self.kerberos:
         if self.kdcHost is None:
             self.logger.fail("Add --kdcHost parameter to use laps with kerberos")
-            return None, None, None
+            return None, None, None, None
 
         connection = ldapco.kerberos_login(
             domain[0],
@@ -280,7 +283,6 @@ def laps_search(self, username, password, cred_type, domain, dns_server):
             password[0] if cred_type[0] == "hash" else "",
             kdcHost=self.kdcHost,
             aesKey=self.aesKey,
-            dns_server=dns_server
         )
     else:
         connection = ldapco.auth_login(
@@ -288,12 +290,11 @@ def laps_search(self, username, password, cred_type, domain, dns_server):
             username[0] if username else "",
             password[0] if cred_type[0] == "plaintext" else "",
             password[0] if cred_type[0] == "hash" else "",
-            dns_server
         )
     if not connection:
         self.logger.fail(f"LDAP connection failed with account {username[0]}")
 
-        return None, None, None
+        return None, None, None, None
 
     search_filter = "(&(objectCategory=computer)(|(msLAPS-EncryptedPassword=*)(ms-MCS-AdmPwd=*)(msLAPS-Password=*))(name=" + self.hostname + "))"
     attributes = [
@@ -324,14 +325,13 @@ def laps_search(self, username, password, cred_type, domain, dns_server):
                     password[0] if cred_type[0] == "hash" else "",
                     self.kerberos,
                     self.kdcHost,
-                    339,
-                    dns_server
+                    339
                 )
                 try:
                     data = d.run()
                 except Exception as e:
                     self.logger.fail(str(e))
-                    return None, None, None
+                    return None, None, None, None
                 r = loads(data)
                 msMCSAdmPwd = r["p"]
                 username_laps = r["n"]
@@ -346,17 +346,21 @@ def laps_search(self, username, password, cred_type, domain, dns_server):
         self.logger.debug(f"Host: {sAMAccountName:<20} Password: {msMCSAdmPwd} {self.hostname}")
     else:
         self.logger.fail(f"msMCSAdmPwd or msLAPS-Password is empty or account cannot read LAPS property for {self.hostname}")
-        return None, None, None
+        return None, None, None, None
 
     if msMCSAdmPwd == "":
         self.logger.fail(f"msMCSAdmPwd or msLAPS-Password is empty or account cannot read LAPS property for {self.hostname}")
-        return None, None, None
+        return None, None, None, None
+
+    hash_ntlm = None
+    if cred_type[0] == "hash":
+        hash_ntlm = hashlib.new("md4", msMCSAdmPwd.encode("utf-16le")).digest()
+        hash_ntlm = binascii.hexlify(hash_ntlm).decode()
 
     username = username_laps if username_laps else self.args.laps
     password = msMCSAdmPwd
     domain = self.hostname
     self.args.local_auth = True
-    self.args.kerberos = False
     self.logger.extra["protocol"] = prev_protocol
     self.logger.extra["port"] = prev_port
-    return username, password, domain
+    return username, password, domain, hash_ntlm

nxc/protocols/ldap/proto_args.py

@@ -11,7 +11,7 @@ def proto_args(parser, parents):
     dgroup.add_argument("-d", metavar="DOMAIN", dest="domain", type=str, default=None, help="domain to authenticate to")
     dgroup.add_argument("--local-auth", action="store_true", help="authenticate locally to each target")
 
-    egroup = ldap_parser.add_argument_group("Retrieve hash on the remote DC", "Options to get hashes from Kerberos")
+    egroup = ldap_parser.add_argument_group("Retrevie hash on the remote DC", "Options to get hashes from Kerberos")
     egroup.add_argument("--asreproast", help="Output AS_REP response to crack with hashcat to file")
     egroup.add_argument("--kerberoasting", help="Output TGS ticket to crack with hashcat to file")
 
@@ -26,13 +26,13 @@ def proto_args(parser, parents):
     vgroup.add_argument("--get-sid", action="store_true", help="Get domain sid")
     vgroup.add_argument("--active-users", nargs="*", help="Get Active Domain Users Accounts")
 
-    ggroup = ldap_parser.add_argument_group("Retrieve gmsa on the remote DC", "Options to play with gmsa")
+    ggroup = ldap_parser.add_argument_group("Retrevie gmsa on the remote DC", "Options to play with gmsa")
     ggroup.add_argument("--gmsa", action="store_true", help="Enumerate GMSA passwords")
     ggroup.add_argument("--gmsa-convert-id", help="Get the secret name of specific gmsa or all gmsa if no gmsa provided")
     ggroup.add_argument("--gmsa-decrypt-lsa", help="Decrypt the gmsa encrypted value from LSA")
 
     bgroup = ldap_parser.add_argument_group("Bloodhound Scan", "Options to play with Bloodhoud")
     bgroup.add_argument("--bloodhound", action="store_true", help="Perform a Bloodhound scan")
-    bgroup.add_argument("-c", "--collection", default="Default", help="Which information to collect. Supported: Group, LocalAdmin, Session, Trusts, Default, DCOnly, DCOM, RDP, PSRemote, LoggedOn, Container, ObjectProps, ACL, All. You can specify more than one by separating them with a comma")
+    bgroup.add_argument("-c", "--collection", default="Collection", help="Which information to collect. Supported: Group, LocalAdmin, Session, Trusts, Default, DCOnly, DCOM, RDP, PSRemote, LoggedOn, Container, ObjectProps, ACL, All. You can specify more than one by separating them with a comma")
 
     return parser

nxc/protocols/rdp.py

@@ -109,7 +109,7 @@ class rdp(connection):
     def print_host_info(self):
         nla = colored(f"nla:{self.nla}", host_info_colors[3], attrs=["bold"]) if self.nla else colored(f"nla:{self.nla}", host_info_colors[2], attrs=["bold"])
         if self.domain is None:
-            self.logger.display(f"Probably old, doesn't not support HYBRID or HYBRID_EX ({nla})")
+            self.logger.display("Probably old, doesn't not support HYBRID or HYBRID_EX ({nla})")
         else:
             self.logger.display(f"{self.server_os} (name:{self.hostname}) (domain:{self.domain}) ({nla})")
         return True
@@ -181,7 +181,7 @@ class rdp(connection):
                     credentials=self.auth,
                 )
                 asyncio.run(self.connect_rdp())
-                if proto.value == SUPP_PROTOCOLS.RDP or proto.value == SUPP_PROTOCOLS.SSL or proto.value == SUPP_PROTOCOLS.SSL | SUPP_PROTOCOLS.RDP:
+                if str(proto) == "SUPP_PROTOCOLS.RDP" or str(proto) == "SUPP_PROTOCOLS.SSL" or str(proto) == "SUPP_PROTOCOLS.SSL|SUPP_PROTOCOLS.RDP":
                     self.nla = False
                     return
             except Exception:

nxc/protocols/smb.py

@@ -14,7 +14,7 @@ from impacket.examples.secretsdump import (
     NTDSHashes,
 )
 from impacket.nmb import NetBIOSError, NetBIOSTimeout
-from impacket.dcerpc.v5 import transport, lsat, lsad, scmr, rrp
+from impacket.dcerpc.v5 import transport, lsat, lsad, scmr
 from impacket.dcerpc.v5.rpcrt import DCERPCException
 from impacket.dcerpc.v5.transport import DCERPCTransportFactory, SMBTransport
 from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE
@@ -34,6 +34,7 @@ from nxc.helpers.misc import gen_random_string, validate_ntlm
 from nxc.logger import NXCAdapter
 from nxc.protocols.smb.firefox import FirefoxTriage
 from nxc.protocols.smb.kerberos import kerberos_login_with_S4U
+from nxc.protocols.smb.smb_share import SMB_Share_Enumeration
 from nxc.servers.smb import NXCSMBServer
 from nxc.protocols.smb.wmiexec import WMIEXEC
 from nxc.protocols.smb.atexec import TSCH_EXEC
@@ -215,7 +216,6 @@ class smb(connection):
             if "STATUS_NOT_SUPPORTED" in str(e):
                 # no ntlm supported
                 self.no_ntlm = True
-                self.logger.debug("NTLM not supported")
 
         # self.domain is the attribute we authenticate with
         # self.targetDomain is the attribute which gets displayed as host domain
@@ -225,20 +225,8 @@ class smb(connection):
             if not self.targetDomain:   # Not sure if that can even happen but now we are safe
                 self.targetDomain = self.hostname
         else:
-            # If we can't authenticate with NTLM and the target is supplied as a FQDN we must parse it
-            try:
-                import socket
-                socket.inet_aton(self.host)
-                self.logger.debug("NTLM authentication not available! Authentication will fail without a valid hostname and domain name")
-                self.hostname = self.host
-                self.targetDomain = self.host
-            except OSError:
-                if self.host.count(".") >= 1:
-                    self.hostname = self.host.split(".")[0]
-                    self.targetDomain = ".".join(self.host.split(".")[1:])
-                else:
-                    self.hostname = self.host
-                    self.targetDomain = self.host
+            self.hostname = self.host
+            self.targetDomain = self.hostname
 
         self.domain = self.targetDomain if not self.args.domain else self.args.domain
 
@@ -249,14 +237,10 @@ class smb(connection):
         # As of June 2024 Samba will always report the version as "Windows 6.1", apparently due to a bug https://stackoverflow.com/a/67577401/17395725
         # Together with the reported build version "0" by Samba we can assume that it is a Samba server. Windows should always report a build version > 0
         # Also only on Windows we should get an OS arch as for that we would need MSRPC
-        try:
-            self.server_os = self.conn.getServerOS()
-            self.server_os_major = self.conn.getServerOSMajor()
-            self.server_os_minor = self.conn.getServerOSMinor()
-            self.server_os_build = self.conn.getServerOSBuild()
-        except KeyError:
-            self.logger.debug("Error getting server information...")
-
+        self.server_os = self.conn.getServerOS()
+        self.server_os_major = self.conn.getServerOSMajor()
+        self.server_os_minor = self.conn.getServerOSMinor()
+        self.server_os_build = self.conn.getServerOSBuild()
         if "Windows 6.1" in self.server_os and self.server_os_build == 0 and self.os_arch == 0:
             self.server_os = "Unix - Samba"
         elif self.server_os_build == 0 and self.os_arch == 0:
@@ -276,24 +260,21 @@ class smb(connection):
         self.os_arch = self.get_os_arch()
         self.output_filename = os.path.expanduser(f"~/.nxc/logs/{self.hostname}_{self.host}_{datetime.now().strftime('%Y-%m-%d_%H%M%S')}".replace(":", "-"))
 
-        try:
-            self.db.add_host(
-                self.host,
-                self.hostname,
-                self.domain,
-                self.server_os,
-                self.smbv1,
-                self.signing,
-            )
-        except Exception as e:
-            self.logger.debug(f"Error adding host {self.host} into db: {e!s}")
+        self.db.add_host(
+            self.host,
+            self.hostname,
+            self.domain,
+            self.server_os,
+            self.smbv1,
+            self.signing,
+        )
 
         try:
             # DCs seem to want us to logoff first, windows workstations sometimes reset the connection
             self.conn.logoff()
         except Exception as e:
             self.logger.debug(f"Error logging off system: {e}")
-
+        
         # DCOM connection with kerberos needed
         self.remoteName = self.host if not self.kerberos else f"{self.hostname}.{self.domain}"
 
@@ -417,11 +398,11 @@ class smb(connection):
             self.logger.debug(f"{self.is_guest=}")
             if "Unix" not in self.server_os:
                 self.check_if_admin()
-
             self.logger.debug(f"Adding credential: {domain}/{self.username}:{self.password}")
             self.db.add_credential("plaintext", domain, self.username, self.password)
             user_id = self.db.get_credential("plaintext", domain, self.username, self.password)
             host_id = self.db.get_hosts(self.host)[0].id
+
             self.db.add_loggedin_relation(user_id, host_id)
 
             out = f"{domain}\\{self.username}:{process_secret(self.password)} {self.mark_guest()}{self.mark_pwned()}"
@@ -431,7 +412,14 @@ class smb(connection):
                 add_user_bh(self.username, self.domain, self.logger, self.config)
             if self.admin_privs:
                 self.logger.debug(f"Adding admin user: {self.domain}/{self.username}:{self.password}@{self.host}")
-                self.db.add_admin_user("plaintext", domain, self.username, self.password, self.host, user_id=user_id)
+                self.db.add_admin_user(
+                    "plaintext",
+                    domain,
+                    self.username,
+                    self.password,
+                    self.host,
+                    user_id=user_id,
+                )
                 add_user_bh(f"{self.hostname}$", domain, self.logger, self.config)
 
             # check https://github.com/byt3bl33d3r/CrackMapExec/issues/321
@@ -482,10 +470,9 @@ class smb(connection):
             self.logger.debug(f"{self.is_guest=}")
             if "Unix" not in self.server_os:
                 self.check_if_admin()
-
-            self.db.add_credential("hash", domain, self.username, self.hash)
-            user_id = self.db.get_credential("hash", domain, self.username, self.hash)
+            user_id = self.db.add_credential("hash", domain, self.username, self.hash)
             host_id = self.db.get_hosts(self.host)[0].id
+
             self.db.add_loggedin_relation(user_id, host_id)
 
             out = f"{domain}\\{self.username}:{process_secret(self.hash)} {self.mark_guest()}{self.mark_pwned()}"
@@ -586,9 +573,6 @@ class smb(connection):
                 self.admin_privs = True
             except scmr.DCERPCException:
                 self.admin_privs = False
-            except Exception as e:
-                self.logger.fail(f"Error checking if user is admin on {self.host}: {e}")
-                self.admin_privs = False
 
     def gen_relay_list(self):
         if self.server_os.lower().find("windows") != -1 and self.signing is False:
@@ -724,21 +708,20 @@ class smb(connection):
             except UnicodeDecodeError:
                 self.logger.debug("Decoding error detected, consider running chcp.com at the target, map the result with https://docs.python.org/3/library/codecs.html#standard-encodings")
                 output = output.decode("cp437")
-
+                
             self.logger.debug(f"Raw Output: {output}")
             output = "\n".join([ll.rstrip() for ll in output.splitlines() if ll.strip()])
             self.logger.debug(f"Cleaned Output: {output}")
-
+            
             if "This script contains malicious content" in output:
                 self.logger.fail("Command execution blocked by AMSI")
                 return None
 
-            if (self.args.execute or self.args.ps_execute):
+            if (self.args.execute or self.args.ps_execute) and output:
                 self.logger.success(f"Executed command via {current_method}")
-                if output:
-                    output_lines = StringIO(output).readlines()
-                    for line in output_lines:
-                        self.logger.highlight(line.strip())
+                output_lines = StringIO(output).readlines()
+                for line in output_lines:
+                    self.logger.highlight(line.strip())
             return output
         else:
             self.logger.fail(f"Execute command failed with {current_method}")
@@ -750,39 +733,38 @@ class smb(connection):
         if not payload:
             self.logger.error("No command to execute specified!")
             return None
-
+        
         response = []
         obfs = obfs if obfs else self.args.obfs
         encode = encode if encode else not self.args.no_encode
         force_ps32 = force_ps32 if force_ps32 else self.args.force_ps32
         get_output = True if not self.args.no_output else get_output
-
+                
         self.logger.debug(f"Starting ps_execute(): {payload=} {get_output=} {methods=} {force_ps32=} {obfs=} {encode=}")
         amsi_bypass = self.args.amsi_bypass[0] if self.args.amsi_bypass else None
         self.logger.debug(f"AMSI Bypass: {amsi_bypass}")
-
+        
         if os.path.isfile(payload):
             self.logger.debug(f"File payload set: {payload}")
             with open(payload) as commands:
                 response = [self.execute(create_ps_command(c.strip(), force_ps32=force_ps32, obfs=obfs, custom_amsi=amsi_bypass, encode=encode), get_output, methods) for c in commands]
         else:
             response = [self.execute(create_ps_command(payload, force_ps32=force_ps32, obfs=obfs, custom_amsi=amsi_bypass, encode=encode), get_output, methods)]
-
+            
         self.logger.debug(f"ps_execute response: {response}")
         return response
 
     def shares(self):
+        if self.args.shares != True:
+            smb_enumeration = SMB_Share_Enumeration(self, self.conn)
+            return smb_enumeration.enumerate_path(self.args.shares)
+
         temp_dir = ntpath.normpath("\\" + gen_random_string())
         permissions = []
 
         try:
             self.logger.debug(f"domain: {self.domain}")
             user_id = self.db.get_user(self.domain.upper(), self.username)[0][0]
-        except IndexError as e:
-            if self.kerberos:
-                pass
-            else:
-                self.logger.fail(f"IndexError: {e!s}")
         except Exception as e:
             error = get_error_string(e)
             self.logger.fail(f"Error getting user: {error}")
@@ -857,74 +839,6 @@ class smb(connection):
             self.logger.highlight(f"{name:<15} {','.join(perms):<15} {remark}")
         return permissions
 
-    def interfaces(self):
-        """
-        Retrieve the list of network interfaces info (Name, IP Address, Subnet Mask, Default Gateway) from remote Windows registry'
-        Made by: @Sant0rryu, @NeffIsBack
-        """
-        try:
-            remoteOps = RemoteOperations(self.conn, False)
-            remoteOps.enableRegistry()
-
-            if remoteOps._RemoteOperations__rrp:
-                reg_handle = rrp.hOpenLocalMachine(remoteOps._RemoteOperations__rrp)["phKey"]
-                key_handle = rrp.hBaseRegOpenKey(remoteOps._RemoteOperations__rrp, reg_handle, "SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces")["phkResult"]
-                sub_key_list = rrp.hBaseRegQueryInfoKey(remoteOps._RemoteOperations__rrp, key_handle)["lpcSubKeys"]
-                sub_keys = [rrp.hBaseRegEnumKey(remoteOps._RemoteOperations__rrp, key_handle, i)["lpNameOut"][:-1] for i in range(sub_key_list)]
-
-                self.logger.highlight(f"{'-Name-':<11} | {'-IP Address-':<15} | {'-SubnetMask-':<15} | {'-Gateway-':<15} | -DHCP-")
-                for sub_key in sub_keys:
-                    interface = {}
-                    try:
-                        interface_key = f"SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces\\{sub_key}"
-                        interface_handle = rrp.hBaseRegOpenKey(remoteOps._RemoteOperations__rrp, reg_handle, interface_key)["phkResult"]
-
-                        # Retrieve Interace Name
-                        interface_name_key = f"SYSTEM\\ControlSet001\\Control\\Network\\{{4D36E972-E325-11CE-BFC1-08002BE10318}}\\{sub_key}\\Connection"
-                        interface_name_handle = rrp.hBaseRegOpenKey(remoteOps._RemoteOperations__rrp, reg_handle, interface_name_key)["phkResult"]
-                        interface_name = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, interface_name_handle, "Name")[1].rstrip("\x00")
-                        interface["Name"] = str(interface_name)
-                        if "Kernel" in interface_name:
-                            continue
-
-                        # Retrieve DHCP
-                        try:
-                            dhcp_enabled = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, interface_handle, "EnableDHCP")[1]
-                        except DCERPCException:
-                            dhcp_enabled = False
-                        interface["DHCP"] = bool(dhcp_enabled)
-
-                        # Retrieve IPAddress
-                        try:
-                            ip_address = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, interface_handle, "DhcpIPAddress" if dhcp_enabled else "IPAddress")[1].rstrip("\x00").replace("\x00", ", ")
-                        except DCERPCException:
-                            ip_address = None
-                        interface["IPAddress"] = ip_address if ip_address else None
-
-                        # Retrieve SubnetMask
-                        try:
-                            subnetmask = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, interface_handle, "SubnetMask")[1].rstrip("\x00").replace("\x00", ", ")
-                        except DCERPCException:
-                            subnetmask = None
-                        interface["SubnetMask"] = subnetmask if subnetmask else None
-
-                        # Retrieve DefaultGateway
-                        try:
-                            default_gateway = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, interface_handle, "DhcpDefaultGateway")[1].rstrip("\x00").replace("\x00", ", ")
-                        except DCERPCException:
-                            default_gateway = None
-                        interface["DefaultGateway"] = default_gateway if default_gateway else None
-
-                        self.logger.highlight(f"{interface['Name']:<11} | {interface['IPAddress']!s:<15} | {interface['SubnetMask']!s:<15} | {interface['DefaultGateway']!s:<15} | {interface['DHCP']}")
-
-                    except DCERPCException as e:
-                        self.logger.info(f"Failed to retrieve the network interface info for {sub_key}: {e!s}")
-
-            with contextlib.suppress(Exception):
-                remoteOps.finish()
-        except DCERPCException as e:
-            self.logger.error(f"Failed to connect to the target: {e!s}")
-
     def get_dc_ips(self):
         dc_ips = [dc[1] for dc in self.db.get_domain_controllers(domain=self.domain)]
         if not dc_ips:
@@ -1393,7 +1307,7 @@ class smb(connection):
                 self.logger.success(f"Created file {src} on \\\\{self.args.share}\\{dst}")
             except Exception as e:
                 self.logger.fail(f"Error writing file to share {self.args.share}: {e}")
-
+    
     def put_file(self):
         for src, dest in self.args.put_file:
             self.put_file_single(src, dest)
@@ -1416,6 +1330,7 @@ class smb(connection):
         for src, dest in self.args.get_file:
             self.get_file_single(src, dest)
 
+
     def enable_remoteops(self):
         try:
             self.remote_ops = RemoteOperations(self.conn, self.kerberos, self.kdcHost)
@@ -1498,7 +1413,7 @@ class smb(connection):
         except Exception as e:
             self.logger.debug(f"Could not upgrade connection: {e}")
             return
-
+        
         try:
             self.logger.display("Collecting Machine masterkeys, grab a coffee and be patient...")
             masterkeys_triage = MasterkeysTriage(
@@ -1513,7 +1428,7 @@ class smb(connection):
         if len(masterkeys) == 0:
             self.logger.fail("No masterkeys looted")
             return
-
+        
         self.logger.success(f"Got {highlight(len(masterkeys))} decrypted masterkeys. Looting SCCM Credentials through {self.args.sccm}")
         try:
             # Collect Chrome Based Browser stored secrets
@@ -1703,6 +1618,7 @@ class smb(connection):
                     "Google Refresh Token",
                 )
 
+
         if dump_cookies and cookies:
             self.logger.display("Start Dumping Cookies")
             for cookie in cookies:
@@ -1890,4 +1806,4 @@ class smb(connection):
         NTDS.finish()
 
     def mark_guest(self):
-        return highlight(f"{highlight('(Guest)')}" if self.is_guest else "")
+        return highlight(f"{highlight('(Guest)')}" if self.is_guest else "")

nxc/protocols/smb/mmcexec.py

@@ -103,8 +103,7 @@ class MMCEXEC:
         )
         try:
             iInterface = self.__dcom.CoCreateInstanceEx(string_to_bin("49B2791A-B1AE-4C90-9B8E-E860BA07F889"), IID_IDispatch)
-        except Exception as e:
-            self.logger.info(f"Got Exception while connecting with DCOM: {e}")
+        except Exception:
             # Make it force break function
             self.__dcom.disconnect()
         flag, self.__stringBinding = dcom_FirewallChecker(iInterface, self.__remoteHost, self.__timeout)

nxc/protocols/smb/proto_args.py

@@ -33,8 +33,7 @@ def proto_args(parser, parents):
     cred_gathering_group.add_argument("--user", dest="userntds", type=str, help="Dump selected user from DC")
 
     mapping_enum_group = smb_parser.add_argument_group("Mapping/Enumeration", "Options for Mapping/Enumerating")
-    mapping_enum_group.add_argument("--shares", action="store_true", help="enumerate shares and access")
-    mapping_enum_group.add_argument("--interfaces", action="store_true", help="enumerate network interfaces")
+    mapping_enum_group.add_argument("--shares", nargs="?", default=False, const=True, help="enumerate shares and access")
     mapping_enum_group.add_argument("--no-write-check", action="store_true", help="Skip write check on shares (avoid leaving traces when missing delete permissions)")
     mapping_enum_group.add_argument("--filter-shares", nargs="+", help="Filter share by access, option 'read' 'write' or 'read,write'")
     mapping_enum_group.add_argument("--sessions", action="store_true", help="enumerate active sessions")

nxc/protocols/smb/samruser.py

@@ -133,13 +133,12 @@ class UserSamrDump:
                 # set these for the while loop
                 enumerationContext = enumerate_users_resp["EnumerationContext"]
                 status = enumerate_users_resp["ErrorCode"]
-        self.logger.display(f"Enumerated {users:d} local users: {domain_name}")
+        self.print_user_info(users, domain_name)
         self.dce.disconnect()
 
     def get_user_info(self, domain_handle, user_ids):
         self.logger.debug(f"Getting user info for users: {user_ids}")
-        self.logger.highlight(f"{'-Username-':<30}{'-Last PW Set-':<20}{'-BadPW-':<8}{'-Description-':<60}")
-        users = 0
+        users = []
 
         for user in user_ids:
             self.logger.debug(f"Calling hSamrOpenUser for RID {user}")
@@ -162,11 +161,19 @@ class UserSamrDump:
             last_pw_set = old_large_int_to_datetime(user_info["PasswordLastSet"])
             if last_pw_set == "1601-01-01 00:00:00":
                 last_pw_set = "<never>"
-            users += + 1
-            self.logger.highlight(f"{user_name:<30}{last_pw_set:<20}{bad_pwd_count:<8}{user_description} ")
+            users.append({"name": user_name, "description": user_description, "bad_pwd_count": bad_pwd_count, "last_pw_set": last_pw_set})
+
             samr.hSamrCloseHandle(self.dce, open_user_resp["UserHandle"])
         return users
 
+    def print_user_info(self, users, domain_name):
+        self.logger.display(f"Enumerated {len(users):d} local users: {domain_name}")
+        self.logger.highlight(f"{'-Username-':<30}{'-Last PW Set-':<20}{'-BadPW-':<8}{'-Description-':<60}")
+        for user in users:
+            self.logger.debug(f"Full user info: {user}")
+            self.logger.highlight(f"{user['name']:<30}{user['last_pw_set']:<20}{user['bad_pwd_count']:<8}{user['description']} ")
+
+
 def old_large_int_to_datetime(large_int):
     combined = (large_int["HighPart"] << 32) | large_int["LowPart"]
     timestamp_seconds = combined / 10**7

nxc/protocols/smb/smb_share.py

@@ -0,0 +1,144 @@
+from nxc.protocols import smb
+from impacket.smbconnection import SMBConnection, SessionError
+from impacket.smb import SharedFile
+from impacket.dcerpc.v5 import transport, lsat, lsad
+from winacl.dtyp.security_descriptor import SECURITY_DESCRIPTOR
+from winacl.functions.constants import SE_OBJECT_TYPE
+from winacl.dtyp.ace import FILE_ACCESS_MASK
+from impacket.dcerpc.v5.dtypes import MAXIMUM_ALLOWED
+from termcolor import colored
+from typing import List
+
+
+class SMB_Share_Enumeration:
+    def __init__(self, nxc_conn: smb, smb_conn: SMBConnection):
+        self.nxc_conn = nxc_conn
+        self.smb_conn = smb_conn
+        self.logger = nxc_conn.logger
+
+    def enumerate_path(self, path: str):
+        self.share = path.split(":")[0]
+        self.path = path.split(":")[1]
+        self.shares = [share["shi1_netname"][:-1] for share in self.nxc_conn.conn.listShares()]
+        if self.share not in self.shares:
+            self.logger.fail(f"Share {self.share} not found")
+            return
+        else:
+            self.logger.display(f"Enumerating ACLs on share: {self.share}")
+            self.enumerate_files(self.share, self.path, recursive=True)
+
+    def enumerate_files(self, share, path: str, recursive: bool = False):
+        """Recursive function that enumerates the directories"""
+        self.logger.debug(f"Trying to enumrate files in {path}")
+        if path[-2:] not in ["\\", "/"]:
+            path += "/"
+        path.replace("\\", "/")
+        try:
+            file_list: List[SharedFile] = self.smb_conn.listPath(share, path + "*")
+            for file in file_list:
+                if (
+                    file.is_directory()
+                    and not file.is_system()
+                    and file.get_longname() not in [".", ".."]
+                    and recursive
+                ):
+                    next_path = path + file.get_longname() + "/"
+                    self.enumerate_files(share, next_path, recursive=True)
+                if not file.is_directory() and not file.is_system():
+                    self.logger.debug(f"File Found {file.get_longname()}")
+                    self.get_security_descriptor(file, share, path)
+        except SessionError as e:
+            self.logger.error(e)
+
+
+    def get_security_descriptor(self, file, share, path, filters=None):
+        """Retrieving the security descriptor of a certain file on a share"""
+        tree_id = self.smb_conn.connectTree(share)
+        dce = self.get_dce_from_smb()
+        desired_access = 0x00020000 # READ_CONTROL
+        share_mode = 0x00000001 # FILE_SHARE_READ
+        create_options = 0x00000040 # FILE_NON_DIRECTORY_FILE
+        file_attrs = 0
+        create_disposition = 0x00000001 # FILE_DIRECTORY_FILE
+        file_full_path = path + file.get_longname()
+        try:
+            file_id = self.smb_conn.createFile(
+                tree_id,
+                file_full_path,
+                desiredAccess=desired_access,
+                shareMode=share_mode,
+                creationOption=create_options,
+                creationDisposition=create_disposition,
+                fileAttributes=file_attrs,
+                impersonationLevel=0x00000002, # Impersonation
+            )
+            
+            security_descriptor = self.smb_conn._SMBConnection.query_sec_info(tree_id, file_id)
+            security_descriptor_obj = SECURITY_DESCRIPTOR.from_bytes(
+                security_descriptor, object_type=SE_OBJECT_TYPE.SE_FILE_OBJECT
+            )
+
+            if filters:
+                for _filter, values in filters.items():
+                    if _filter == "owner" and str(security_descriptor_obj.Owner) not in values:
+                        return
+                    if _filter == "group" and str(security_descriptor_obj.Group) not in values:
+                        return
+                    if _filter == "ace_sid":
+                        sids = [str(_ace.Sid) for _ace in security_descriptor_obj.Dacl.aces]
+                        for sid in values:
+                            if sid in sids:
+                                continue
+                            else:
+                                return
+                    if _filter == "ace_mask":
+                        masks = [FILE_ACCESS_MASK(_ace.Mask).name for _ace in security_descriptor_obj.Dacl.aces]
+                        for mask in values:
+                            if mask in masks:
+                                continue
+                            else:
+                                return
+
+            self.logger.success(file_full_path)
+            # Also get the user's group to mark it as Owned
+            # self.smb_conn._SMBConnection._SMB__userName
+            username = self.smb_conn._SMBConnection._SMB__userName
+            
+            owner = self.lookup_sid(dce, str(security_descriptor_obj.Owner))
+            if owner == username:
+                owner = owner + colored("Pwn3d!", "red")
+            group = self.lookup_sid(dce, str(security_descriptor_obj.Group))
+            self.logger.highlight(f"\t Owner: {owner}")
+            self.logger.highlight(f"\t Group: {group}")
+            self.logger.highlight(f"\t SACL: {security_descriptor_obj.Sacl}")
+            
+            if security_descriptor_obj.Dacl is not None:
+                self.logger.highlight("\t ACEs:")
+                for ace in security_descriptor_obj.Dacl.aces:
+                    ace_sid_name = self.lookup_sid(dce, str(ace.Sid))
+                    mask_formatted = FILE_ACCESS_MASK(ace.Mask).name
+                    if mask_formatted is None:
+                        continue
+                    owned = colored(" (Own3d!)", "red") if ace_sid_name == username else ""
+                    self.logger.highlight(f"\t\t {ace_sid_name} - {mask_formatted}{owned}")
+        except SessionError as e:
+            self.logger.debug(e)
+
+    def get_dce_from_smb(self):
+        string_binding = rf"ncacn_np:{self.nxc_conn.remoteName}[\pipe\lsarpc]"
+        rpctransport = transport.DCERPCTransportFactory(string_binding)
+        rpctransport.set_dport(self.nxc_conn.port)
+        rpctransport.setRemoteHost(self.nxc_conn.host)
+        rpctransport.set_credentials(self.nxc_conn.username, self.nxc_conn.password, self.nxc_conn.domain, self.nxc_conn.lmhash, self.nxc_conn.nthash)
+        return rpctransport.get_dce_rpc()
+
+    def lookup_sid(self, dce, sid):
+        dce.connect()
+        dce.bind(lsat.MSRPC_UUID_LSAT)
+        policy_response = lsad.hLsarOpenPolicy2(dce, MAXIMUM_ALLOWED | lsat.POLICY_LOOKUP_NAMES)
+        policy_handle = policy_response["PolicyHandle"]
+        sid_response = lsat.hLsarLookupSids(dce, policy_handle, [sid],lsat.LSAP_LOOKUP_LEVEL.LsapLookupWksta)
+        sid_name = sid_response["TranslatedNames"]["Names"][0]["Name"]
+        dce.disconnect()
+        return sid_name
+    

pyproject.toml

@@ -41,7 +41,7 @@ argcomplete = "^3.1.4"
 asyauth = ">=0.0.20"
 beautifulsoup4 = ">=4.11,<5"
 bloodhound = "^1.7.2"
-dploot = "^2.7.4"
+dploot = "^2.7.1"
 dsinternals = "^1.2.4"
 impacket =  { git = "https://github.com/fortra/impacket.git" }
 lsassy = ">=3.1.11"
@@ -64,6 +64,7 @@ rich = "^13.3.5"
 sqlalchemy = "^2.0.4"
 termcolor = ">=2.4.0"
 terminaltables = "^3.1.0"
+winacl = "^0.1.9"
 xmltodict = "^0.13.0"
 
 [tool.poetry.group.dev.dependencies]

tests/e2e_commands.txt

@@ -62,7 +62,6 @@ netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -L
 netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M add-computer -o NAME="BADPC" PASSWORD="Password1"
 netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M add-computer -o NAME="BADPC" PASSWORD="Password2" CHANGEPW=True
 netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M add-computer -o NAME="BADPC" DELETE=True
-netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M bitlocker
 netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M dfscoerce
 netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M drop-sc
 netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M drop-sc -o CLEANUP=True
@@ -82,7 +81,6 @@ netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M imperson
 netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M iis
 netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M install_elevated
 netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M ioxidresolver
-netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M security-questions
 # currently hanging indefinitely - TODO: look into this
 #netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M keepass_discover
 #netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M keepass_trigger -o ACTION=ALL USER=LOGIN_USERNAME KEEPASS_CONFIG_PATH="C:\\Users\\LOGIN_USERNAME\\AppData\\Roaming\\KeePass\\KeePass.config.xml"
@@ -155,7 +153,6 @@ netexec wmi TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M enum_dns
 netexec wmi TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M get_netconnections
 #netexec wmi TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M rdp -o ACTION=enable
 #netexec wmi TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M rdp -o ACTION=disable
-netexec wmi TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M bitlocker
 ##### LDAP
 netexec {DNS} ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS
 netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --users