cme accept user file and password file and works like this:
user1 -> pass1
-> pass2
user2 -> pass1
-> pass2
Option --no-bruteforce works like this
user1 -> pass1
user2 -> pass2
- Added the WINRM protocol, CME now supports executing commands through WinRM (Powershell Remoting)
- Added support for NMap XML and .Nessus files if given as targets
- Fixed a bug in the MSSQL protocol which caused it to not retrieve host info
- Version Bump
- Passing --ntds will automatically use the drsuapi method (DCSync)
- Initial implementation of the SSH protocol and the mimipenguin module
(This is very much still not finished, lots of stuff missing)
- Added check to make sure existing config file is in the 4.x format
- Added splinter and paramiko to dep requirements
- Updated Impacket to latest commit
- HTTP protocol now also returns server version in output
- Fixed error in MSSQL protocol which would cause it to error out when
executing commands
- Fixed logic to deal with standard MSSQL auth instead of windows auth
- Refactored the HTTP protocol
Just fyi for anyone reading this, it's not even close to being
finished.
The amount of changes are pretty insane, this commit is to serve as a
refrence point for myself.
Highlights for v4.0:
- The whole codebase has been re-written from scratch
- Codebase has been cut around 2/4
- Protocols are now modular! In theory we could use CME for everything
- Module chaining has been removed for now, still trying to figure out a
more elegant solution
- Workspaces have implemented in cmedb
- The smb protocol's database schema has been changed to support storing users,
groups and computers with their respective memberships and relations.
- I'm in the process of re-writing most of the modules, will re-add them
once i've finished
Oook, this commit is basicallu just so I can start tracking (and
testing) all of the changes made so far:
- All execution methods are now completely fileless, all output and/or batch
files get outputted/hosted locally on a SMB server that gets spun up on runtime
- Module structure has been modified for module chaining
- Module chaining implementation is currently very hacky, I definitly
have to figure out something more elegant but for now it
works. Module chaining is performed via the -MC flag and has it's own
mini syntax (will be adding it to the wiki)
- You can now specify credential ID ranges using the -id flag
- Added the eventvwr_bypass and rundll32_exec modules
- Renamed a lot of the modules for naming consistency
TODO:
- Launchers/Payloads need to be escaped before being generated when
module chaining
- Add check for modules 'required_server' attribute
- Finish modifying the functions in the Connection object so they return
the results
- The whole connector function has been removed finally (was there since
v1.0)
- Functions now get called dynamically based on parsed arguments
- All of CME's functionality can now be accessed through the modules
(W00t!), just have finish modifing the code so the results will get
returned
- @mattifestation's AMSI bypass now gets called before executing
powershell commands or scripts
- Squashed some bugs related to account bruteforcing, enumerating users
and creating/deleting the UseLogonCredential reg key
time) to limit failed login attemptes
- The logic responsible for SMB bruteforcing/login has been modified
to sync between the concurrent threads: this allows us to limit failed login
attemptes with the two new flags. However this does cause the threads
to lock so there is a minor reduction in speed but IMHO this is a good
middle ground.
- You can now specify multiple DB credential IDs, CME will then
bruteforce using the specifspecified cred set
- Version bump
connection.py
Additionally, since the smbexec execution method seems to be detected by
a number of AV HIPS'es, i've switched the default execution method order
to:
1. wmiexec
2. atexec
3. smbexec
Furthermore, the method argument in the execute function now accepts a
list of exec methods.
mpgn
byt3bl33d3r
byt3bl33d3r
byt3bl33d3r