Merge branch 'main' into neff-asyncio

.gitignore

@@ -3,6 +3,7 @@ hash_spider_default.sqlite3
 *.bak
 *.log
 .venv
+pyvenv.cfg
 .vscode
 .idea
 # Byte-compiled / optimized / DLL files

README.md

@@ -1,4 +1,4 @@
-![Supported Python versions](https://img.shields.io/badge/python-3.7+-blue.svg)
+![Supported Python versions](https://img.shields.io/badge/python-3.8+-blue.svg)
 [![Twitter](https://img.shields.io/twitter/follow/al3xn3ff?label=al3x_n3ff&style=social)](https://twitter.com/intent/follow?screen_name=al3x_n3ff)
 [![Twitter](https://img.shields.io/twitter/follow/_zblurx?label=_zblurx&style=social)](https://twitter.com/intent/follow?screen_name=_zblurx)
 [![Twitter](https://img.shields.io/twitter/follow/MJHallenbeck?label=MJHallenbeck&style=social)](https://twitter.com/intent/follow?screen_name=MJHallenbeck)

netexec.spec

@@ -13,6 +13,12 @@ a = Analysis(
         ('./nxc/modules', 'nxc/modules')
      ],
      hiddenimports=[
+        'aardwolf',
+        'aardwolf.connection',
+        'aardwolf.commons.queuedata.constants',
+        'aardwolf.commons.iosettings',
+        'aardwolf.commons.target',
+        'aardwolf.protocol.x224.constants',
         'impacket.examples.secretsdump',
         'impacket.dcerpc.v5.lsat',
         'impacket.dcerpc.v5.transport',
@@ -65,6 +71,7 @@ a = Analysis(
         'dploot.lib.smb',
         'pyasn1_modules.rfc5652',
         'unicrypto.backends.pycryptodomex',
+        'sspilib.raw._text',
      ],
      hookspath=['./nxc/.hooks'],
      runtime_hooks=[],

nxc/cli.py

@@ -1,6 +1,12 @@
 import argparse
+import argcomplete
 import sys
 from argparse import RawTextHelpFormatter
+from os import listdir
+from os.path import dirname
+from os.path import join as path_join
+import nxc
+from nxc.paths import NXC_PATH
 from nxc.loaders.protocolloader import ProtocolLoader
 from nxc.helpers.logger import highlight
 from nxc.logger import nxc_logger
@@ -41,7 +47,7 @@ def gen_cli_args():
     # we do module arg parsing here so we can reference the module_list attribute below
     module_parser = argparse.ArgumentParser(add_help=False)
     mgroup = module_parser.add_mutually_exclusive_group()
-    mgroup.add_argument("-M", "--module", action="append", metavar="MODULE", help="module to use")
+    mgroup.add_argument("-M", "--module", choices=get_module_names(), action="append", metavar="MODULE", help="module to use")
     module_parser.add_argument("-o", metavar="MODULE_OPTION", nargs="+", default=[], dest="module_options", help="module options")
     module_parser.add_argument("-L", "--list-modules", action="store_true", help="list available modules")
     module_parser.add_argument("--options", dest="show_module_options", action="store_true", help="display module options")
@@ -81,14 +87,28 @@ def gen_cli_args():
     except Exception as e:
         nxc_logger.exception(f"Error loading proto_args from proto_args.py file in protocol folder: {protocol} - {e}")
 
+    argcomplete.autocomplete(parser)
+    args = parser.parse_args()
+
     if len(sys.argv) == 1:
         parser.print_help()
         sys.exit(1)
 
-    args = parser.parse_args()
-
     if args.version:
         print(f"{VERSION} - {CODENAME}")
         sys.exit(1)
 
     return args
+
+
+def get_module_names():
+    """Get module names without initializing them"""
+    modules = []
+    modules_paths = [
+        path_join(dirname(nxc.__file__), "modules"),
+        path_join(NXC_PATH, "modules"),
+    ]
+
+    for path in modules_paths:
+        modules.extend([module[:-3] for module in listdir(path) if module[-3:] == ".py" and module != "example_module.py"])
+    return sorted(modules, key=str.casefold)

nxc/connection.py

@@ -10,6 +10,7 @@ from nxc.config import pwned_label
 from nxc.helpers.logger import highlight
 from nxc.logger import nxc_logger, NXCAdapter
 from nxc.context import Context
+from nxc.protocols.ldap.laps import laps_search
 
 from impacket.dcerpc.v5 import transport
 import sys
@@ -459,6 +460,13 @@ class connection:
                 self.logger.info("Successfully authenticated using Kerberos cache")
                 return True
 
+        if hasattr(self.args, "laps") and self.args.laps:
+            self.logger.debug("Trying to authenticate using LAPS")
+            username[0], secret[0], domain[0], ntlm_hash = laps_search(self, username, secret, cred_type, domain)
+            cred_type = ["plaintext"]
+            if not (username[0] or secret[0] or domain[0]):
+                return False
+
         if not self.args.no_bruteforce:
             for secr_index, secr in enumerate(secret):
                 for user_index, user in enumerate(username):

nxc/loaders/moduleloader.py

@@ -24,6 +24,9 @@ class ModuleLoader:
         if not hasattr(module, "name"):
             self.logger.fail(f"{module_path} missing the name variable")
             module_error = True
+        elif hasattr(module, "name") and module.name != module_path.split("/")[-1].split("\\")[-1][:-3]:
+            self.logger.fail(f"{module_path} filename must match the module name {module.name}")
+            module_error = True
         elif not hasattr(module, "description"):
             self.logger.fail(f"{module_path} missing the description variable")
             module_error = True

nxc/logger.py

@@ -4,7 +4,6 @@ from logging.handlers import RotatingFileHandler
 import os.path
 import sys
 import re
-from nxc.helpers.misc import called_from_cmd_args
 from nxc.console import nxc_console
 from termcolor import colored
 from datetime import datetime
@@ -68,12 +67,6 @@ class NXCAdapter(logging.LoggerAdapter):
 
     def display(self, msg, *args, **kwargs):
         """Display text to console, formatted for nxc"""
-        try:
-            if self.extra and "protocol" in self.extra and not called_from_cmd_args():
-                return
-        except AttributeError:
-            pass
-
         msg, kwargs = self.format(f"{colored('[*]', 'blue', attrs=['bold'])} {msg}", kwargs)
         text = Text.from_ansi(msg)
         nxc_console.print(text, *args, **kwargs)
@@ -81,12 +74,6 @@ class NXCAdapter(logging.LoggerAdapter):
 
     def success(self, msg, color="green", *args, **kwargs):
         """Print some sort of success to the user"""
-        try:
-            if self.extra and "protocol" in self.extra and not called_from_cmd_args():
-                return
-        except AttributeError:
-            pass
-
         msg, kwargs = self.format(f"{colored('[+]', color, attrs=['bold'])} {msg}", kwargs)
         text = Text.from_ansi(msg)
         nxc_console.print(text, *args, **kwargs)
@@ -94,12 +81,6 @@ class NXCAdapter(logging.LoggerAdapter):
 
     def highlight(self, msg, *args, **kwargs):
         """Prints a completely yellow highlighted message to the user"""
-        try:
-            if self.extra and "protocol" in self.extra and not called_from_cmd_args():
-                return
-        except AttributeError:
-            pass
-
         msg, kwargs = self.format(f"{colored(msg, 'yellow', attrs=['bold'])}", kwargs)
         text = Text.from_ansi(msg)
         nxc_console.print(text, *args, **kwargs)
@@ -107,11 +88,6 @@ class NXCAdapter(logging.LoggerAdapter):
 
     def fail(self, msg, color="red", *args, **kwargs):
         """Prints a failure (may or may not be an error) - e.g. login creds didn't work"""
-        try:
-            if self.extra and "protocol" in self.extra and not called_from_cmd_args():
-                return
-        except AttributeError:
-            pass
         msg, kwargs = self.format(f"{colored('[-]', color, attrs=['bold'])} {msg}", kwargs)
         text = Text.from_ansi(msg)
         nxc_console.print(text, *args, **kwargs)

nxc/modules/enum_trusts.py

@@ -17,12 +17,11 @@ class NXCModule:
         pass
 
     def on_login(self, context, connection):
-        domain_dn = ",".join(["DC=" + dc for dc in connection.domain.split(".")])
         search_filter = "(&(objectClass=trustedDomain))"
         attributes = ["flatName", "trustPartner", "trustDirection", "trustAttributes"]
 
         context.log.debug(f"Search Filter={search_filter}")
-        resp = connection.ldapConnection.search(searchBase=domain_dn, searchFilter=search_filter, attributes=attributes, sizeLimit=0)
+        resp = connection.ldapConnection.search(searchFilter=search_filter, attributes=attributes, sizeLimit=0)
 
         trusts = []
         context.log.debug(f"Total of records returned {len(resp)}")

nxc/modules/get-unixUserPassword.py

@@ -0,0 +1,63 @@
+from impacket.ldap import ldapasn1 as ldapasn1_impacket
+from impacket.ldap import ldap as ldap_impacket
+from nxc.logger import nxc_logger
+
+
+class NXCModule:
+    """
+    Get unixUserPassword attribute from all users in ldap
+    Module by @SyzikSecu
+    """
+
+    name = "get-unixUserPassword"
+    description = "Get unixUserPassword attribute from all users in ldap"
+    supported_protocols = ["ldap"]
+    opsec_safe = True
+    multiple_hosts = True
+
+    def options(self, context, module_options):
+        """
+        """
+
+    def on_login(self, context, connection):
+        searchFilter = "(objectclass=user)"
+
+        try:
+            context.log.debug(f"Search Filter={searchFilter}")
+            resp = connection.ldapConnection.search(
+                searchFilter=searchFilter,
+                attributes=["sAMAccountName", "unixUserPassword"],
+                sizeLimit=0,
+            )
+        except ldap_impacket.LDAPSearchError as e:
+            if e.getErrorString().find("sizeLimitExceeded") >= 0:
+                context.log.debug("sizeLimitExceeded exception caught, giving up and processing the data received")
+                resp = e.getAnswers()
+            else:
+                nxc_logger.debug(e)
+                return False
+
+        answers = []
+        context.log.debug(f"Total of records returned {len(resp)}")
+        for item in resp:
+            if isinstance(item, ldapasn1_impacket.SearchResultEntry) is not True:
+                continue
+            sAMAccountName = ""
+            unixUserPassword = []
+            try:
+                for attribute in item["attributes"]:
+                    if str(attribute["type"]) == "sAMAccountName":
+                        sAMAccountName = str(attribute["vals"][0])
+                    elif str(attribute["type"]) == "unixUserPassword":
+                        unixUserPassword = [str(i) for i in attribute["vals"]]
+                if sAMAccountName != "" and len(unixUserPassword) > 0:
+                    answers.append([sAMAccountName, unixUserPassword])
+            except Exception as e:
+                context.log.debug("Exception:", exc_info=True)
+                context.log.debug(f"Skipping item, cannot process due to error {e!s}")
+        if len(answers) > 0:
+            context.log.success("Found following users: ")
+            for answer in answers:
+                context.log.highlight(f"User: {answer[0]} unixUserPassword: {answer[1]}")
+        else:
+            context.log.fail("No unixUserPassword Found")

nxc/modules/get-userPassword.py

@@ -0,0 +1,63 @@
+from impacket.ldap import ldapasn1 as ldapasn1_impacket
+from impacket.ldap import ldap as ldap_impacket
+from nxc.logger import nxc_logger
+
+
+class NXCModule:
+    """
+    Get userPassword attribute from all users in ldap
+    Module by @SyzikSecu
+    """
+
+    name = "get-userPassword"
+    description = "Get userPassword attribute from all users in ldap"
+    supported_protocols = ["ldap"]
+    opsec_safe = True
+    multiple_hosts = True
+
+    def options(self, context, module_options):
+        """
+        """
+
+    def on_login(self, context, connection):
+        searchFilter = "(objectclass=user)"
+
+        try:
+            context.log.debug(f"Search Filter={searchFilter}")
+            resp = connection.ldapConnection.search(
+                searchFilter=searchFilter,
+                attributes=["sAMAccountName", "userPassword"],
+                sizeLimit=0,
+            )
+        except ldap_impacket.LDAPSearchError as e:
+            if e.getErrorString().find("sizeLimitExceeded") >= 0:
+                context.log.debug("sizeLimitExceeded exception caught, giving up and processing the data received")
+                resp = e.getAnswers()
+            else:
+                nxc_logger.debug(e)
+                return False
+
+        answers = []
+        context.log.debug(f"Total of records returned {len(resp)}")
+        for item in resp:
+            if isinstance(item, ldapasn1_impacket.SearchResultEntry) is not True:
+                continue
+            sAMAccountName = ""
+            userPassword = []
+            try:
+                for attribute in item["attributes"]:
+                    if str(attribute["type"]) == "sAMAccountName":
+                        sAMAccountName = str(attribute["vals"][0])
+                    elif str(attribute["type"]) == "userPassword":
+                        userPassword = [str(i) for i in attribute["vals"]]
+                if sAMAccountName != "" and len(userPassword) > 0:
+                    answers.append([sAMAccountName, userPassword])
+            except Exception as e:
+                context.log.debug("Exception:", exc_info=True)
+                context.log.debug(f"Skipping item, cannot process due to error {e!s}")
+        if len(answers) > 0:
+            context.log.success("Found following users: ")
+            for answer in answers:
+                context.log.highlight(f"User: {answer[0]} userPassword: {answer[1]}")
+        else:
+            context.log.fail("No userPassword Found")

nxc/modules/iis.py

@@ -37,7 +37,7 @@ class NXCModule:
             return
 
     def execute_appcmd(self, context, connection):
-        command = "powershell -c 'C:\\windows\\system32\\inetsrv\\appcmd.exe list apppool /@t:*'"
+        command = 'powershell -c "C:\\windows\\system32\\inetsrv\\appcmd.exe list apppool /@t:*"'
         context.log.info("Checking For Hidden Credentials With Appcmd.exe")
         output = connection.execute(command, True)
 

nxc/modules/wcc.py

@@ -588,16 +588,12 @@ class HostChecker:
         subkey_handle = ans["phkResult"]
 
         if valueName is None:
-            _, _, data = get_value(subkey_handle)
+            return get_value(subkey_handle)[2]
         else:
-            found = False
-            for _, name, _data in subkey_values(subkey_handle):
+            for _, name, data in subkey_values(subkey_handle):
                 if name.upper() == valueName.upper():
-                    found = True
-                    break
-            if not found:
-                return DCERPCSessionError(error_code=ERROR_OBJECT_NOT_FOUND)
                     return data
+            return DCERPCSessionError(error_code=ERROR_OBJECT_NOT_FOUND)
 
     # Methods for getting values from SAMR and SCM #
     ################################################

nxc/protocols/ldap/laps.py

@@ -1,3 +1,6 @@
+import binascii
+import hashlib
+from json import loads
 from pyasn1.codec.der import decoder
 from pyasn1_modules import rfc5652
 
@@ -258,3 +261,106 @@ class LAPSv2Extract:
         plaintext = decrypt_plaintext(cek, iv, remaining)
         self.logger.info(plaintext[:-18].decode("utf-16le"))
         return plaintext[:-18].decode("utf-16le")
+
+
+def laps_search(self, username, password, cred_type, domain):
+    prev_protocol = self.logger.extra["protocol"]
+    prev_port = self.logger.extra["port"]
+    self.logger.extra["protocol"] = "LDAP"
+    self.logger.extra["port"] = "389"
+
+    ldapco = LDAPConnect(self.domain, "389", self.domain)
+
+    if self.kerberos:
+        if self.kdcHost is None:
+            self.logger.fail("Add --kdcHost parameter to use laps with kerberos")
+            return None, None, None, None
+
+        connection = ldapco.kerberos_login(
+            domain[0],
+            username[0] if username else "",
+            password[0] if cred_type[0] == "plaintext" else "",
+            password[0] if cred_type[0] == "hash" else "",
+            kdcHost=self.kdcHost,
+            aesKey=self.aesKey,
+        )
+    else:
+        connection = ldapco.auth_login(
+            domain[0],
+            username[0] if username else "",
+            password[0] if cred_type[0] == "plaintext" else "",
+            password[0] if cred_type[0] == "hash" else "",
+        )
+    if not connection:
+        self.logger.fail(f"LDAP connection failed with account {username[0]}")
+
+        return None, None, None, None
+
+    search_filter = "(&(objectCategory=computer)(|(msLAPS-EncryptedPassword=*)(ms-MCS-AdmPwd=*)(msLAPS-Password=*))(name=" + self.hostname + "))"
+    attributes = [
+        "msLAPS-EncryptedPassword",
+        "msLAPS-Password",
+        "ms-MCS-AdmPwd",
+        "sAMAccountName",
+    ]
+    results = connection.search(searchFilter=search_filter, attributes=attributes, sizeLimit=0)
+
+    msMCSAdmPwd = ""
+    sAMAccountName = ""
+    username_laps = ""
+
+    from impacket.ldap import ldapasn1 as ldapasn1_impacket
+
+    results = [r for r in results if isinstance(r, ldapasn1_impacket.SearchResultEntry)]
+    if len(results) != 0:
+        for host in results:
+            values = {str(attr["type"]).lower(): attr["vals"][0] for attr in host["attributes"]}
+            if "mslaps-encryptedpassword" in values:
+                msMCSAdmPwd = values["mslaps-encryptedpassword"]
+                d = LAPSv2Extract(
+                    bytes(msMCSAdmPwd),
+                    username[0] if username else "",
+                    password[0] if cred_type[0] == "plaintext" else "",
+                    domain[0],
+                    password[0] if cred_type[0] == "hash" else "",
+                    self.args.kerberos,
+                    self.args.kdcHost,
+                    339
+                )
+                try:
+                    data = d.run()
+                except Exception as e:
+                    self.logger.fail(str(e))
+                    return None, None, None, None
+                r = loads(data)
+                msMCSAdmPwd = r["p"]
+                username_laps = r["n"]
+            elif "mslaps-password" in values:
+                r = loads(str(values["mslaps-password"]))
+                msMCSAdmPwd = r["p"]
+                username_laps = r["n"]
+            elif "ms-mcs-admpwd" in values:
+                msMCSAdmPwd = str(values["ms-mcs-admpwd"])
+            else:
+                self.logger.fail("No result found with attribute ms-MCS-AdmPwd or msLAPS-Password")
+        self.logger.debug(f"Host: {sAMAccountName:<20} Password: {msMCSAdmPwd} {self.hostname}")
+    else:
+        self.logger.fail(f"msMCSAdmPwd or msLAPS-Password is empty or account cannot read LAPS property for {self.hostname}")
+        return None, None, None, None
+
+    if msMCSAdmPwd == "":
+        self.logger.fail(f"msMCSAdmPwd or msLAPS-Password is empty or account cannot read LAPS property for {self.hostname}")
+        return None, None, None, None
+
+    hash_ntlm = None
+    if cred_type[0] == "hash":
+        hash_ntlm = hashlib.new("md4", msMCSAdmPwd.encode("utf-16le")).digest()
+        hash_ntlm = binascii.hexlify(hash_ntlm).decode()
+
+    username = username_laps if username_laps else self.args.laps
+    password = msMCSAdmPwd
+    domain = self.hostname
+    self.args.local_auth = True
+    self.logger.extra["protocol"] = prev_protocol
+    self.logger.extra["port"] = prev_port
+    return username, password, domain, hash_ntlm

nxc/protocols/smb.py

@@ -1,5 +1,4 @@
 import ntpath
-import hashlib
 import binascii
 import os
 import re
@@ -44,7 +43,6 @@ from nxc.protocols.smb.smbspider import SMBSpider
 from nxc.protocols.smb.passpol import PassPolDump
 from nxc.protocols.smb.samruser import UserSamrDump
 from nxc.protocols.smb.samrfunc import SamrFunc
-from nxc.protocols.ldap.laps import LDAPConnect, LAPSv2Extract
 from nxc.protocols.ldap.gmsa import MSDS_MANAGEDPASSWORD_BLOB
 from nxc.helpers.logger import highlight
 from nxc.helpers.bloodhound import add_user_bh
@@ -65,7 +63,6 @@ from datetime import datetime
 from functools import wraps
 from traceback import format_exc
 import logging
-from json import loads
 from termcolor import colored
 import contextlib
 
@@ -253,104 +250,10 @@ class smb(connection):
         if self.args.local_auth:
             self.domain = self.hostname
 
-    def laps_search(self, username, password, ntlm_hash, domain):
-        self.logger.extra["protocol"] = "LDAP"
-        self.logger.extra["port"] = "389"
-
-        ldapco = LDAPConnect(self.domain, "389", self.domain)
-
-        if self.kerberos:
-            if self.kdcHost is None:
-                self.logger.fail("Add --kdcHost parameter to use laps with kerberos")
-                return False
-
-            connection = ldapco.kerberos_login(
-                domain,
-                username[0] if username else "",
-                password[0] if password else "",
-                ntlm_hash[0] if ntlm_hash else "",
-                kdcHost=self.kdcHost,
-                aesKey=self.aesKey,
-            )
-        else:
-            connection = ldapco.auth_login(
-                domain,
-                username[0] if username else "",
-                password[0] if password else "",
-                ntlm_hash[0] if ntlm_hash else "",
-            )
-        if not connection:
-            self.logger.fail(f"LDAP connection failed with account {username[0]}")
-
-            return False
-
-        search_filter = "(&(objectCategory=computer)(|(msLAPS-EncryptedPassword=*)(ms-MCS-AdmPwd=*)(msLAPS-Password=*))(name=" + self.hostname + "))"
-        attributes = [
-            "msLAPS-EncryptedPassword",
-            "msLAPS-Password",
-            "ms-MCS-AdmPwd",
-            "sAMAccountName",
-        ]
-        results = connection.search(searchFilter=search_filter, attributes=attributes, sizeLimit=0)
-
-        msMCSAdmPwd = ""
-        sAMAccountName = ""
-        username_laps = ""
-
-        from impacket.ldap import ldapasn1 as ldapasn1_impacket
-
-        results = [r for r in results if isinstance(r, ldapasn1_impacket.SearchResultEntry)]
-        if len(results) != 0:
-            for host in results:
-                values = {str(attr["type"]).lower(): attr["vals"][0] for attr in host["attributes"]}
-                if "mslaps-encryptedpassword" in values:
-                    msMCSAdmPwd = values["mslaps-encryptedpassword"]
-                    d = LAPSv2Extract(bytes(msMCSAdmPwd), username[0] if username else "", password[0] if password else "", domain, ntlm_hash[0] if ntlm_hash else "", self.args.kerberos, self.args.kdcHost, 339)
-                    try:
-                        data = d.run()
-                    except Exception as e:
-                        self.logger.fail(str(e))
-                        return None
-                    r = loads(data)
-                    msMCSAdmPwd = r["p"]
-                    username_laps = r["n"]
-                elif "mslaps-password" in values:
-                    r = loads(str(values["mslaps-password"]))
-                    msMCSAdmPwd = r["p"]
-                    username_laps = r["n"]
-                elif "ms-mcs-admpwd" in values:
-                    msMCSAdmPwd = str(values["ms-mcs-admpwd"])
-                else:
-                    self.logger.fail("No result found with attribute ms-MCS-AdmPwd or msLAPS-Password")
-            logging.debug(f"Host: {sAMAccountName:<20} Password: {msMCSAdmPwd} {self.hostname}")
-        else:
-            self.logger.fail(f"msMCSAdmPwd or msLAPS-Password is empty or account cannot read LAPS property for {self.hostname}")
-
-            return False
-
-        self.username = username_laps if username_laps else self.args.laps
-        self.password = msMCSAdmPwd
-
-        if msMCSAdmPwd == "":
-            self.logger.fail(f"msMCSAdmPwd or msLAPS-Password is empty or account cannot read LAPS property for {self.hostname}")
-
-            return False
-        if ntlm_hash:
-            hash_ntlm = hashlib.new("md4", msMCSAdmPwd.encode("utf-16le")).digest()
-            self.hash = binascii.hexlify(hash_ntlm).decode()
-
-        self.args.local_auth = True
-        self.domain = self.hostname
-        self.logger.extra["protocol"] = "SMB"
-        self.logger.extra["port"] = "445"
-        return True
-
     def print_host_info(self):
         signing = colored(f"signing:{self.signing}", host_info_colors[0], attrs=["bold"]) if self.signing else colored(f"signing:{self.signing}", host_info_colors[1], attrs=["bold"])
         smbv1 = colored(f"SMBv1:{self.smbv1}", host_info_colors[2], attrs=["bold"]) if self.smbv1 else colored(f"SMBv1:{self.smbv1}", host_info_colors[3], attrs=["bold"])
         self.logger.display(f"{self.server_os}{f' x{self.os_arch}' if self.os_arch else ''} (name:{self.hostname}) (domain:{self.domain}) ({signing}) ({smbv1})")
-        if self.args.laps:
-            return self.laps_search(self.args.username, self.args.password, self.args.hash, self.domain)
         return True
 
     def kerberos_login(self, domain, username, password="", ntlm_hash="", aesKey="", kdcHost="", useCache=False):
@@ -363,7 +266,6 @@ class smb(connection):
         nthash = ""
 
         try:
-            if not self.args.laps:
             self.password = password
             self.username = username
             # This checks to see if we didn't provide the LM Hash
@@ -403,9 +305,6 @@ class smb(connection):
             used_ccache = " from ccache" if useCache else f":{process_secret(kerb_pass)}"
             if self.args.delegate:
                 used_ccache = f" through S4U with {username}"
-            else:
-                self.plaintext_login(self.hostname, username, password)
-                return True
 
             out = f"{self.domain}\\{self.username}{used_ccache} {self.mark_pwned()}"
             self.logger.success(out)
@@ -456,17 +355,11 @@ class smb(connection):
         # Re-connect since we logged off
         self.create_conn_obj()
         try:
-            if not self.args.laps:
             self.password = password
             self.username = username
             self.domain = domain
 
-            try:
             self.conn.login(self.username, self.password, domain)
-            except UnicodeEncodeError:
-                self.logger.error(f"UnicodeEncodeError on: '{self.username}:{self.password}'. Trying again with a different encoding...")
-                self.create_conn_obj()
-                self.conn.login(self.username, self.password.encode().decode("latin-1"), domain)
 
             self.check_if_admin()
             self.logger.debug(f"Adding credential: {domain}/{self.username}:{self.password}")
@@ -521,7 +414,7 @@ class smb(connection):
         lmhash = ""
         nthash = ""
         try:
-            if not self.args.laps:
+            self.domain = domain
             self.username = username
             # This checks to see if we didn't provide the LM Hash
             if ntlm_hash.find(":") != -1:
@@ -534,10 +427,6 @@ class smb(connection):
                 self.lmhash = lmhash
             if nthash:
                 self.nthash = nthash
-            else:
-                nthash = self.hash
-
-            self.domain = domain
 
             self.conn.login(self.username, "", domain, lmhash, nthash)
 

nxc/protocols/smb/firefox.py

@@ -4,6 +4,7 @@ from hashlib import pbkdf2_hmac, sha1
 import hmac
 import json
 import ntpath
+from os import remove
 import sqlite3
 import tempfile
 from Cryptodome.Cipher import AES, DES3
@@ -121,7 +122,10 @@ class FirefoxTriage:
         ]
 
     def get_key(self, key4_data, master_password=b""):
-        fh = tempfile.NamedTemporaryFile()
+        # Instead of disabling "delete" and removing the file manually,
+        # in the future (py3.12) we could use "delete_on_close=False" as a cleaner solution
+        # Related issue: #134
+        fh = tempfile.NamedTemporaryFile(delete=False)
         fh.write(key4_data)
         fh.seek(0)
         db = sqlite3.connect(fh.name)
@@ -149,7 +153,12 @@ class FirefoxTriage:
                     self.logger.debug(e)
                     fh.close()
                     return b""
+        db.close()
         fh.close()
+        try:
+            remove(fh.name)
+        except Exception as e:
+            self.logger.error(f"Error removing temporary file: {e}")
 
     def is_master_password_correct(self, key_data, master_password=b""):
         try:

nxc/protocols/winrm.py

@@ -1,5 +1,3 @@
-import binascii
-import hashlib
 import os
 import requests
 import urllib3
@@ -19,12 +17,12 @@ from nxc.config import process_secret
 from nxc.connection import connection
 from nxc.helpers.bloodhound import add_user_bh
 from nxc.helpers.misc import gen_random_string
-from nxc.protocols.ldap.laps import LDAPConnect, LAPSv2Extract
 from nxc.logger import NXCAdapter
 
 
 urllib3.disable_warnings()
 
+
 class winrm(connection):
     def __init__(self, args, db, host):
         self.domain = None
@@ -35,17 +33,20 @@ class winrm(connection):
         self.lmhash = ""
         self.nthash = ""
         self.ssl = False
+        self.auth_type = None
 
         connection.__init__(self, args, db, host)
 
     def proto_logger(self):
+        # Reason why default is SMB/445, because default is enumerate over SMB.
+        # For more details, please check the function "print_host_info" 
         logging.getLogger("pypsrp").disabled = True
         logging.getLogger("pypsrp.wsman").disabled = True
         self.logger = NXCAdapter(
             extra={
-                "protocol": "WINRM",
+                "protocol": "SMB",
                 "host": self.host,
-                "port": "5985",
+                "port": "445",
                 "hostname": self.hostname,
             }
         )
@@ -96,96 +97,17 @@ class winrm(connection):
 
         self.output_filename = os.path.expanduser(f"~/.nxc/logs/{self.hostname}_{self.host}_{datetime.now().strftime('%Y-%m-%d_%H%M%S')}".replace(":", "-"))
 
-    def laps_search(self, username, password, ntlm_hash, domain):
-        ldapco = LDAPConnect(self.domain, "389", self.domain)
-
-        if self.kerberos:
-            if self.kdcHost is None:
-                self.logger.fail("Add --kdcHost parameter to use laps with kerberos")
-                return False
-
-            connection = ldapco.kerberos_login(
-                domain,
-                username[0] if username else "",
-                password[0] if password else "",
-                ntlm_hash[0] if ntlm_hash else "",
-                kdcHost=self.kdcHost,
-                aesKey=self.aesKey,
-            )
-        else:
-            connection = ldapco.auth_login(
-                domain,
-                username[0] if username else "",
-                password[0] if password else "",
-                ntlm_hash[0] if ntlm_hash else "",
-            )
-        if not connection:
-            self.logger.fail(f"LDAP connection failed with account {username[0]}")
-            return False
-
-        search_filter = "(&(objectCategory=computer)(|(msLAPS-EncryptedPassword=*)(ms-MCS-AdmPwd=*)(msLAPS-Password=*))(name=" + self.hostname + "))"
-        attributes = [
-            "msLAPS-EncryptedPassword",
-            "msLAPS-Password",
-            "ms-MCS-AdmPwd",
-            "sAMAccountName",
-        ]
-        results = connection.search(searchFilter=search_filter, attributes=attributes, sizeLimit=0)
-
-        msMCSAdmPwd = ""
-        sAMAccountName = ""
-        username_laps = ""
-
-        from impacket.ldap import ldapasn1 as ldapasn1_impacket
-
-        results = [r for r in results if isinstance(r, ldapasn1_impacket.SearchResultEntry)]
-        if len(results) != 0:
-            for host in results:
-                values = {str(attr["type"]).lower(): attr["vals"][0] for attr in host["attributes"]}
-                if "mslaps-encryptedpassword" in values:
-                    from json import loads
-
-                    msMCSAdmPwd = values["mslaps-encryptedpassword"]
-                    d = LAPSv2Extract(bytes(msMCSAdmPwd), username[0] if username else "", password[0] if password else "", domain, ntlm_hash[0] if ntlm_hash else "", self.args.kerberos, self.args.kdcHost, 339)
-                    data = d.run()
-                    r = loads(data)
-                    msMCSAdmPwd = r["p"]
-                    username_laps = r["n"]
-                elif "mslaps-password" in values:
-                    from json import loads
-
-                    r = loads(str(values["mslaps-password"]))
-                    msMCSAdmPwd = r["p"]
-                    username_laps = r["n"]
-                elif "ms-mcs-admpwd" in values:
-                    msMCSAdmPwd = str(values["ms-mcs-admpwd"])
-                else:
-                    self.logger.fail("No result found with attribute ms-MCS-AdmPwd or msLAPS-Password")
-            self.logger.debug(f"Host: {sAMAccountName:<20} Password: {msMCSAdmPwd} {self.hostname}")
-        else:
-            self.logger.fail(f"msMCSAdmPwd or msLAPS-Password is empty or account cannot read LAPS property for {self.hostname}")
-            return False
-
-        self.username = username_laps if username_laps else self.args.laps
-        self.password = msMCSAdmPwd
-
-        if msMCSAdmPwd == "":
-            self.logger.fail(f"msMCSAdmPwd or msLAPS-Password is empty or account cannot read LAPS property for {self.hostname}")
-            return False
-        if ntlm_hash:
-            hash_ntlm = hashlib.new("md4", msMCSAdmPwd.encode("utf-16le")).digest()
-            self.hash = binascii.hexlify(hash_ntlm).decode()
-
-        self.domain = self.hostname
-        return True
-
     def print_host_info(self):
+        if self.args.no_smb:
             self.logger.extra["protocol"] = "WINRM-SSL" if self.ssl else "WINRM"
             self.logger.extra["port"] = self.port
             self.logger.display(f"{self.server_os} (name:{self.hostname}) (domain:{self.domain})")
+        else:
+            self.logger.display(f"{self.server_os} (name:{self.hostname}) (domain:{self.domain})")
+            self.logger.extra["protocol"] = "WINRM-SSL" if self.ssl else "WINRM"
+            self.logger.extra["port"] = self.port
         
-        if self.args.laps:
-            return self.laps_search(self.args.username, self.args.password, self.args.hash, self.domain)
+        self.logger.info(f"Connection information: {self.endpoint} (auth type:{self.auth_type}) (domain:{self.domain if self.args.domain else ''})")
         return True
 
     def create_conn_obj(self):
@@ -211,6 +133,7 @@ class winrm(connection):
                 self.logger.debug(f"Requesting URL: {endpoints[protocol]['url']}")
                 res = requests.post(endpoints[protocol]["url"], verify=False, timeout=self.args.http_timeout)
                 self.logger.debug(f"Received response code: {res.status_code}")
+                self.auth_type = res.headers["WWW-Authenticate"] if "WWW-Authenticate" in res.headers else "NOAUTH"
                 self.endpoint = endpoints[protocol]["url"]
                 self.ssl = endpoints[protocol]["ssl"]
                 return True
@@ -238,7 +161,6 @@ class winrm(connection):
 
     def plaintext_login(self, domain, username, password):
         self.admin_privs = False
-        if not self.args.laps:
         self.password = password
         self.username = username
         self.domain = domain
@@ -279,15 +201,13 @@ class winrm(connection):
         self.admin_privs = False
         lmhash = "00000000000000000000000000000000"
         nthash = ""
-        if not self.args.laps:
         self.username = username
         # This checks to see if we didn't provide the LM Hash
         if ntlm_hash.find(":") != -1:
             lmhash, nthash = ntlm_hash.split(":")
         else:
             nthash = ntlm_hash
-        else:
-            nthash = self.hash
+
         self.lmhash = lmhash
         self.nthash = nthash
         self.domain = domain

pyproject.toml

@@ -33,7 +33,7 @@ NetExec = 'nxc.netexec:main'
 nxcdb = 'nxc.nxcdb:main'
 
 [tool.poetry.dependencies]
-python = "^3.7.0"
+python = "^3.8.0"
 requests = ">=2.27.1"
 beautifulsoup4 = ">=4.11,<5"
 lsassy = ">=3.1.8"
@@ -61,15 +61,15 @@ aiosqlite = "^0.19.0"
 pyasn1-modules = "^0.3.0"
 rich = "^13.3.5"
 python-libnmap = "^0.7.3"
-resource = "^0.2.1"
 oscrypto = { git = "https://github.com/Pennyw0rth/oscrypto" } # Pypi version currently broken, see: https://github.com/wbond/oscrypto/issues/78 (as of 9/23)
-pyreadline = "^2.1" # for the build - impacket imports its hidden from the builder so an error occurs
-ruff = "=0.0.292"
+pyreadline = { version = "^2.1", markers = "sys_platform == 'win32'" } # for the build - impacket imports its hidden from the builder so an error occurs
+argcomplete = "3.2.1"
 
 [tool.poetry.group.dev.dependencies]
 flake8 = "*"
 shiv = "*"
 pytest = "^7.2.2"
+ruff = "=0.0.292"
 
 [build-system]
 requires = ["poetry-core>=1.2.0"]