|
2 | 2 | from impacket.dcerpc.v5 import samr, epm, transport |
3 | 3 | from impacket.dcerpc.v5.rpcrt import DCERPCException |
4 | 4 |
|
| 5 | + |
5 | 6 | class NXCModule: |
6 | 7 | """ |
7 | 8 | Module for changing or resetting user passwords |
@@ -30,7 +31,7 @@ def options(self, context, module_options): |
30 | 31 | If STATUS_PASSWORD_MUST_CHANGE or STATUS_PASSWORD_EXPIRED (Change password for current user) |
31 | 32 | netexec smb <DC_IP> -u username -p oldpass -M change-password -o OLDPASS='oldpass' NEWPASS='newpass' |
32 | 33 | netexec smb <DC_IP> -u username -H oldnthash -M change-password -o OLDNTHASH='oldnthash' NEWPASS='newpass' |
33 | | - |
| 34 | +
|
34 | 35 | If want to change other user's password (with forcechangepassword priv or admin rights) |
35 | 36 | netexec smb <DC_IP> -u username -p password -M change-password -o USER='target_user' NEWPASS='target_user_newpass' |
36 | 37 | netexec smb <DC_IP> -u username -p password -M change-password -o USER='target_user' NEWNTHASH='target_user_newnthash' |
@@ -85,14 +86,13 @@ def authenticate(self, context, connection, protocol, anonymous=False): |
85 | 86 | def on_login(self, context, connection): |
86 | 87 | target_username = self.target_user or connection.username |
87 | 88 | target_domain = connection.domain |
88 | | - |
| 89 | + |
89 | 90 | # If OLDPASS or OLDHASH are not specified, default to the credentials used for authentication. |
90 | 91 | if not self.oldpass: |
91 | 92 | self.oldpass = connection.password |
92 | 93 | if not self.oldhash: |
93 | 94 | self.oldhash = connection.nthash |
94 | | - |
95 | | - |
| 95 | + |
96 | 96 | new_lmhash, new_nthash = "", "" |
97 | 97 |
|
98 | 98 | # Parse new hash values if provided |
@@ -156,7 +156,7 @@ def mustchangePassword(self, target_username, targetDomain, oldPassword, newPass |
156 | 156 | # Change password using old and new plaintext passwords |
157 | 157 | samr.hSamrUnicodeChangePasswordUser2(self.dce, "\x00", target_username, oldPassword, newPassword, "", "") |
158 | 158 | self.context.log.success(f"Successfully changed password for {target_username}") |
159 | | - elif newPassword and oldPwdHashNT: |
| 159 | + elif newPassword and oldPwdHashNT: |
160 | 160 | # Change password using hash for authentication |
161 | 161 | samr.hSamrUnicodeChangePasswordUser2(self.dce, "\x00", target_username, oldPassword, newPassword, "", oldPwdHashNT) |
162 | 162 | self.context.log.success(f"Successfully changed password for {target_username}") |
|
0 commit comments