Skip to content

Commit 1b4081e

Browse files
committed
Simplify code and formatting
1 parent 5ccf0d3 commit 1b4081e

1 file changed

Lines changed: 5 additions & 18 deletions

File tree

nxc/modules/powershell_history.py

Lines changed: 5 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
import traceback
22
import os
3-
from impacket.examples.secretsdump import RemoteOperations
3+
44

55
class NXCModule:
66
"""Module by @357384n"""
@@ -14,23 +14,9 @@ class NXCModule:
1414
def options(self, context, module_options):
1515
"""To export all the history you can add the following option: -o export=enable"""
1616
context.log.info(f"Received module options: {module_options}")
17-
self.export = module_options.get('EXPORT', 'disable').lower()
17+
self.export = module_options.get("EXPORT", "disable").lower()
1818
context.log.info(f"Option export set to: {self.export}")
1919

20-
def execute_command(self, connection, command):
21-
"""Execute a command on the remote system and return the output."""
22-
output = connection.execute(command, True)
23-
return output
24-
25-
def get_powershell_history(self, connection):
26-
"""Get the PowerShell history for all users."""
27-
history_paths_command = 'powershell.exe "type C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadLine\\ConsoleHost_history.txt"'
28-
try:
29-
history_output = self.execute_command(connection, history_paths_command)
30-
return history_output.split('\n')
31-
except Exception as e:
32-
raise Exception(f"Could not retrieve PowerShell history: {e}")
33-
3420
def analyze_history(self, history):
3521
"""Analyze PowerShell history for sensitive information."""
3622
sensitive_keywords = [
@@ -50,7 +36,8 @@ def on_admin_login(self, context, connection):
5036
"""Main function to retrieve and analyze PowerShell history."""
5137
try:
5238
context.log.info("Retrieving PowerShell history...")
53-
history = self.get_powershell_history(connection)
39+
command = 'powershell.exe "type C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadLine\\ConsoleHost_history.txt"'
40+
history = connection.execute(command, True).split("\n")
5441
if history:
5542
sensitive_commands = self.analyze_history(history)
5643
if sensitive_commands:
@@ -64,7 +51,7 @@ def on_admin_login(self, context, connection):
6451

6552
# Check if export is enabled
6653
context.log.info(f"Export option is set to: {self.export}")
67-
if self.export == 'enable':
54+
if self.export == "enable":
6855
host = connection.host # Assuming 'host' contains the target IP or hostname
6956
filename = f"{host}.powershell_history.txt"
7057
context.log.info(f"Export enabled, writing history to {filename}")

0 commit comments

Comments
 (0)