Fix get-unixUserPassword/get-userPassword modules which sometimes does not retrieve all users with these attributes

Author: NeffIsBack

nxc/modules/get-unixUserPassword.py

@@ -1,6 +1,7 @@
 from impacket.ldap import ldapasn1 as ldapasn1_impacket
 from impacket.ldap import ldap as ldap_impacket
 from nxc.logger import nxc_logger
+from nxc.parsers.ldap_results import parse_result_attributes
 
 
 class NXCModule:
@@ -20,7 +21,7 @@ def options(self, context, module_options):
         """
 
     def on_login(self, context, connection):
-        searchFilter = "(objectclass=user)"
+        searchFilter = "(unixUserPassword=*)"
 
         try:
             context.log.debug(f"Search Filter={searchFilter}")
@@ -37,27 +38,10 @@ def on_login(self, context, connection):
                 nxc_logger.debug(e)
                 return False
 
-        answers = []
-        context.log.debug(f"Total of records returned {len(resp)}")
-        for item in resp:
-            if isinstance(item, ldapasn1_impacket.SearchResultEntry) is not True:
-                continue
-            sAMAccountName = ""
-            unixUserPassword = []
-            try:
-                for attribute in item["attributes"]:
-                    if str(attribute["type"]) == "sAMAccountName":
-                        sAMAccountName = str(attribute["vals"][0])
-                    elif str(attribute["type"]) == "unixUserPassword":
-                        unixUserPassword = [str(i) for i in attribute["vals"]]
-                if sAMAccountName != "" and len(unixUserPassword) > 0:
-                    answers.append([sAMAccountName, unixUserPassword])
-            except Exception as e:
-                context.log.debug("Exception:", exc_info=True)
-                context.log.debug(f"Skipping item, cannot process due to error {e!s}")
-        if len(answers) > 0:
+        if resp:
+            resp_parsed = parse_result_attributes(resp)
             context.log.success("Found following users: ")
-            for answer in answers:
-                context.log.highlight(f"User: {answer[0]} unixUserPassword: {answer[1]}")
+            for user in resp_parsed:
+                context.log.highlight(f"User: {user['sAMAccountName']} unixUserPassword: {user['unixUserPassword']}")
         else:
             context.log.fail("No unixUserPassword Found")

nxc/modules/get-userPassword.py

@@ -1,6 +1,7 @@
 from impacket.ldap import ldapasn1 as ldapasn1_impacket
 from impacket.ldap import ldap as ldap_impacket
 from nxc.logger import nxc_logger
+from nxc.parsers.ldap_results import parse_result_attributes
 
 
 class NXCModule:
@@ -20,7 +21,7 @@ def options(self, context, module_options):
         """
 
     def on_login(self, context, connection):
-        searchFilter = "(objectclass=user)"
+        searchFilter = "(userPassword=*)"
 
         try:
             context.log.debug(f"Search Filter={searchFilter}")
@@ -37,27 +38,10 @@ def on_login(self, context, connection):
                 nxc_logger.debug(e)
                 return False
 
-        answers = []
-        context.log.debug(f"Total of records returned {len(resp)}")
-        for item in resp:
-            if isinstance(item, ldapasn1_impacket.SearchResultEntry) is not True:
-                continue
-            sAMAccountName = ""
-            userPassword = []
-            try:
-                for attribute in item["attributes"]:
-                    if str(attribute["type"]) == "sAMAccountName":
-                        sAMAccountName = str(attribute["vals"][0])
-                    elif str(attribute["type"]) == "userPassword":
-                        userPassword = [str(i) for i in attribute["vals"]]
-                if sAMAccountName != "" and len(userPassword) > 0:
-                    answers.append([sAMAccountName, userPassword])
-            except Exception as e:
-                context.log.debug("Exception:", exc_info=True)
-                context.log.debug(f"Skipping item, cannot process due to error {e!s}")
-        if len(answers) > 0:
+        if resp:
+            resp_parsed = parse_result_attributes(resp)
             context.log.success("Found following users: ")
-            for answer in answers:
-                context.log.highlight(f"User: {answer[0]} userPassword: {answer[1]}")
+            for user in resp_parsed:
+                context.log.highlight(f"User: {user['sAMAccountName']} unixUserPassword: {user['userPassword']}")
         else:
-            context.log.fail("No userPassword Found")
+            context.log.fail("No unixUserPassword Found")