Changing fallback to hash login for unicode errors

Add New Ldap Flag --active-users

nxc/modules/ms17-010.py

@@ -62,10 +62,15 @@ class NXCModule:
         self.logger = context.log
 
     def on_login(self, context, connection):
-        if self.check(connection.host):
-            context.log.highlight("VULNERABLE")
-            context.log.highlight("Next step: https://www.rapid7.com/db/modules/exploit/windows/smb/ms17_010_eternalblue/")
-
+        try:
+            if self.check(connection.host):
+                context.log.highlight("VULNERABLE")
+                context.log.highlight("Next step: https://www.rapid7.com/db/modules/exploit/windows/smb/ms17_010_eternalblue/")
+        except ConnectionResetError as e:
+            context.log.debug(f"Error connecting to host when checking for MS17-010: {e!s}")
+        except ValueError as e:
+            if str(e) == "Buffer size too small (0 instead of at least 32 bytes)":
+                context.log.debug("Buffer size too small, which means the response was not the expected size")
 
 
     def generate_smb_proto_payload(self, *protos):
@@ -476,7 +481,7 @@ class NXCModule:
         # 0xC0000022 - STATUS_ACCESS_DENIED
 
         if nt_status == b"\x05\x02\x00\xc0":
-            self.logger.highlight(f"[+] [{ip}] is likely VULNERABLE to MS17-010! ({native_os.decode()})")
+            self.logger.highlight(f"[+] {ip} is likely VULNERABLE to MS17-010! ({native_os.decode()})")
 
             # vulnerable to MS17-010, check for DoublePulsar infection
             raw_proto = self.trans2_request(tree_id, process_id, user_id, multiplex_id)
@@ -491,8 +496,8 @@ class NXCModule:
                 key = self.calculate_doublepulsar_xor_key(smb.signature)
                 self.logger.highlight(f"Host is likely INFECTED with DoublePulsar! - XOR Key: {key.decode()}")
         elif nt_status in (b"\x08\x00\x00\xc0", b"\x22\x00\x00\xc0"):
-            self.logger.fail(f"[-] [{ip}] does NOT appear vulnerable")
+            self.logger.fail(f"{ip} does NOT appear vulnerable")
         else:
-            self.logger.fail(f"[-] [{ip}] Unable to detect if this host is vulnerable")
+            self.logger.fail(f"{ip} Unable to detect if this host is vulnerable")
 
         client.close()

nxc/protocols/ldap.py

@@ -831,6 +831,34 @@ class ldap(connection):
                 self.logger.fail("Exception:", exc_info=True)
                 self.logger.fail(f"Skipping item, cannot process due to error {e}")
 
+    def active_users(self):
+        # Building the search filter
+        search_filter = "(sAMAccountType=805306368)" if self.username != "" else "(objectclass=*)"
+        attributes = ["sAMAccountName", "userAccountControl"]
+
+        resp = self.search(search_filter, attributes, sizeLimit=0)
+        if resp:
+            for item in resp:
+                if isinstance(item, ldapasn1_impacket.SearchResultEntry) is not True:
+                    continue
+                sAMAccountName = ""
+                userAccountControl = ""
+                try:
+                    if self.username == "":
+                        self.logger.highlight(f"{item['objectName']}")
+                    else:
+                        for attribute in item["attributes"]:
+                            if str(attribute["type"]) == "sAMAccountName":
+                                sAMAccountName = str(attribute["vals"][0])
+                            elif str(attribute["type"]) == "userAccountControl":
+                                userAccountControl = int(attribute["vals"][0])
+                                account_disabled = userAccountControl & 2
+                        if not account_disabled: 
+                            self.logger.highlight(f"{sAMAccountName}")
+                except Exception as e:
+                    self.logger.debug(f"Skipping item, cannot process due to error {e}")
+            return
+
     def asreproast(self):
         if self.password == "" and self.nthash == "" and self.kerberos is False:
             return False

nxc/protocols/ldap/proto_args.py

@@ -24,6 +24,7 @@ def proto_args(parser, std_parser, module_parser):
     vgroup.add_argument("--groups", action="store_true", help="Enumerate domain groups")
     vgroup.add_argument("--dc-list", action="store_true", help="Enumerate Domain Controllers")
     vgroup.add_argument("--get-sid", action="store_true", help="Get domain sid")
+    vgroup.add_argument("--active-users", action="store_true", help="Get Active Domain Users Accounts")
 
     ggroup = ldap_parser.add_argument_group("Retrevie gmsa on the remote DC", "Options to play with gmsa")
     ggroup.add_argument("--gmsa", action="store_true", help="Enumerate GMSA passwords")

nxc/protocols/smb.py

@@ -464,9 +464,11 @@ class smb(connection):
             try:
                 self.conn.login(self.username, self.password, domain)
             except UnicodeEncodeError:
-                self.logger.error(f"UnicodeEncodeError on: '{self.username}:{self.password}'. Trying again with a different encoding...")
+                self.logger.error(f"UnicodeEncodeError on: '{self.username}:{self.password}'. Falling back to hash login.")
                 self.create_conn_obj()
-                self.conn.login(self.username, self.password.encode().decode("latin-1"), domain)
+                import hashlib
+                nt_hash = hashlib.new("md4", self.password.encode("utf-16le")).hexdigest()
+                return self.hash_login(domain, username, nt_hash)
 
             self.check_if_admin()
             self.logger.debug(f"Adding credential: {domain}/{self.username}:{self.password}")

tests/e2e_test.py

@@ -108,6 +108,7 @@ def run_e2e_tests(args):
 
         while tasks:
             task = tasks.pop(0)
+            console.log(f"Running command: {task!s}")
             result = subprocess.Popen(
                 str(task),
                 shell=True,
@@ -129,7 +130,8 @@ def run_e2e_tests(args):
             if args.errors:
                 raw_text = text.decode("utf-8")
                 if "error" in raw_text.lower() or "failure" in raw_text.lower():
-                    console.log(f"[bold red] Error Detected: {raw_text}")
+                    console.log("[bold red]Error Detected:")
+                    console.log(f"{raw_text}")
 
             if args.verbose:
                 # this prints sorta janky, but it does its job