580018050c
Add better logic to MSSQL connection #364
2020-05-01 17:18:25 -04:00
c5be1e5234
Add exception handler when login fails on MSSQL protocol #364
2020-05-01 17:11:54 -04:00
ef934a7925
Rename options for module metasploit #357
2020-05-01 16:53:02 -04:00
bfe1d5b7c3
Fix uninitialized variable #363
2020-05-01 14:33:18 -04:00
062e312fd5
Add try catch for issue #363
2020-05-01 14:20:55 -04:00
fd912c0b7d
Fix thread stop assert error #357
2020-05-01 14:02:12 -04:00
73fb336040
Update module metasploit #357
...
As the old code with the shellcode was broken, we switch to a simple powershell solution with Invoke-MetasploitPayload.ps1
2020-05-01 13:12:01 -04:00
4dc4892660
Check if output is byte before decoding
2020-04-30 13:56:34 -04:00
74792ce712
Add option --no-bruteforce allowing credentials spraying without bruteforce
...
cme accept user file and password file and works like this:
user1 -> pass1
-> pass2
user2 -> pass1
-> pass2
Option --no-bruteforce works like this
user1 -> pass1
user2 -> pass2
2020-04-30 10:06:57 -04:00
7b0f2e9bdb
Add multi domain support DOMAIN\user when passing file to -u option #243
2020-04-29 12:32:21 -04:00
2ca377f3d8
Simplify command for wireless password #305
2020-04-29 11:09:44 -04:00
b6a6e6a9bf
Add wireless module #305
2020-04-29 11:03:52 -04:00
78c5d9ebd9
Update WINRM authentication option
...
If you want to avoind SMB connection use the flag -d DOMAIN
2020-04-29 06:28:47 -04:00
479ae1f721
Update MSSQL protocol for windows authentication #306
...
If you want to use windows auth for MSSQL without SMB, add the flag -d DOMAIN
2020-04-29 05:56:11 -04:00
f58a10124d
Update winrm method to allows code execution from normal user
...
User who can winrm but are not local admin can now use this method to exec command
more at https://github.com/diyan/pywinrm/issues/275
we switch from pywinrm to pypsrp
2020-04-28 15:30:18 -04:00
a20d28a885
Update RID-Hijacking to latest version #353
2020-04-28 13:22:42 -04:00
e9a5841731
Fix typo on put-file function
2020-04-28 12:28:25 -04:00
f84035fa7a
Add function get-file and put-file
2020-04-28 12:22:30 -04:00
1bbe1ac0cc
Clean output of mssql protocol
2020-04-28 09:39:33 -04:00
af68773b6c
Fix #352 target using file
2020-04-28 08:42:25 -04:00
356b020cb3
Fix winrm warning from pywinrm
2020-04-28 07:24:01 -04:00
63cf5af003
Fix smbexec function #269
2020-04-28 06:19:33 -04:00
18c438993c
Fix ssh connection #351
2020-04-28 06:11:16 -04:00
ba04528738
Add feature: file as argument for -x and -X command #269
2020-04-27 16:38:30 -04:00
f19f137b0d
Fix smbexec.py decode error
2020-04-22 11:04:22 -04:00
84222eb001
Fix bytes error on gpp_autologin and gpp_password modules
2020-04-22 10:33:03 -04:00
a13ec6c3d6
Fix gpp_password encoding error with python3 #350
2020-04-22 06:43:17 -04:00
1e8cd73a26
Switch Invoke-VNC project to python3 branch #317
2020-04-21 09:12:43 -04:00
6c0228f403
Fixed dependency hell, added Github actions workflow
...
- Got rid of netaddr in favor of built in ipaddress module
- cme/cmedb binaries are now built with shiv
- Removed http protocol as it was basically useless and added another
dependency
2020-04-20 13:19:55 -03:00
e294a72924
Fix mimikatz module decode error #308
2020-04-20 06:24:56 -04:00
ed8c91ab60
changed comparison operators that generate syntax warnings
2020-04-20 03:22:03 +03:00
9790c67620
Fix pylnk3 version from setup
...
fix warning with pylnk3 version
remove useless import and comment from lsassy module
2020-04-19 15:18:23 -04:00
47c83d90dc
Add lsassy module
2020-04-19 20:30:35 +02:00
e2e976847b
Update module rid_hijack to python3
2020-04-19 14:09:32 -04:00
7bb0e4e4e6
Merge pull request #300 from hantwister/patch-1
...
Fix false positive signing disabled with SMB2/3
2020-04-19 14:36:59 -03:00
02a62b027c
Merge pull request #295 from r4wd3r/rid_hijacking
...
Add RID Hijacking Persistence Module
2020-04-19 14:36:47 -03:00
498f3fc197
Merge pull request #327 from noraj/patch-1
...
lsa secrets: dump file extension
2020-04-19 14:32:48 -03:00
ff167fa152
Fix typo response module mimikatz #334
2020-03-09 10:26:48 +01:00
f34820939f
Remove impacket and pywinrm thirdparty
...
impacket and pywinrm are pip package, no need to have them in the
thirdparty folder anymore
2020-01-24 03:40:02 -05:00
83c8e5b5a3
Add module compatibility for Python3
...
Mimikatz, Bloodhound etc
2020-01-18 07:20:10 -05:00
545b59054b
Fix Pipfile python version and submodile version
2020-01-16 04:34:21 -05:00
18634423f3
lsa secrets: dump file extension
...
The logger tell you LSA secrets are dump in a file named xxx.lsa
```
SMB x.x.x.x 445 FRSCWP0001 [+] Dumped 22 LSA secrets to /home/noraj/.cme/logs/host_x.x.x.x_2019-12-19_095552.lsa and /home/noraj/.cme/logs/host_x.x.x.x_2019-12-19_095552.cached
```
But in reality they are logged in xxx.screts.
So just fixing the extension showed by the logger.
2019-12-19 10:12:17 +01:00
2cf0c0fb90
Migrate cmedb to python3
2019-11-12 16:39:26 -05:00
c2698ba8ed
Fix HTTP server for module Mimikatz
2019-11-12 14:42:52 -05:00
38acbbead5
Fix option --pass-pol in python3
...
error due to :
python2 => 1 / 2 = 0
python3 => 1 / 2 = 0.5
python3 => 1 // 2 = 0
2019-11-12 13:33:14 -05:00
179dfef811
Fix mimikatz range issue
2019-11-11 06:26:38 -05:00
d2c477aafb
Migrate file option input
...
* -u user.txt
* -p password.txt
* -H hashntlm
2019-11-11 05:39:44 -05:00
73ab379acc
Migrate function to python3
...
* --shares -> OK
* --sessions -> OK
* --disks -> OK
* --loggedon-users -> OK
* --users -> Not tested
* --rid-brute -> OK
* --groups -> Not tested
* --local-groups -> OK
* --pass-pol -> OK
2019-11-11 05:06:39 -05:00
a29cf6760c
update python3
2019-11-10 18:39:00 -05:00
c3c4b3192d
start python3 migration
2019-11-10 22:42:04 +01:00
48fd338d22
Merge pull request #304 from gustavi/master
...
Fix encoding in smb --sam
2019-08-16 10:57:11 -06:00
44fd121dce
Merge pull request #309 from shadowgatt/master
...
Fixing SMB encoding error
2019-08-16 10:56:39 -06:00
f1228174cd
Update winrm.py
...
Closes https://github.com/byt3bl33d3r/CrackMapExec/issues/310
2019-08-16 08:58:26 -05:00
12443285e9
Fix SMB encode
2019-07-13 17:52:00 +02:00
e435a4f87b
Fix SMB encode
2019-07-13 17:50:24 +02:00
fdb41c0125
Fix encoding in smb --sam
2019-04-12 13:32:38 +02:00
85e4de988b
Fix false positive signing disabled with SMB2/3
...
Currently, the SMBConnection.isSigningRequired and SMB3.is_signing_required methods in Impacket reflect the state of the session as opposed to the state of the connection. When using CME with the --gen-relay-list option, the login method would encounter an exception near the end, and would reset the session state. Afterwards, the connection state correctly showed that signing was required, but the session state claimed the opposite. The latter contributed to many false positives in the --gen-relay-list output file. This is a hackish change that addressed the issue for me.
2019-03-26 15:45:02 -04:00
49a002fcd4
Merge branch 'master' into rid_hijacking
2019-03-23 16:10:44 -05:00
333f1c4e06
Updated all submodules, replace pycrypto with pycryptodomex
2019-03-13 21:51:25 -06:00
56ed25b621
Add rid_hijack.py module
2019-02-24 20:51:16 -05:00
d472bdb004
Add RID-Hijacking submodule
2019-02-24 20:50:03 -05:00
dbe142c1ae
Merge pull request #280 from awsmhacks/master
...
update to powershell.py
2018-12-10 16:03:12 -07:00
304836d702
update powershell.py
...
Adding [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]'Ssl3,Tls,Tls11,Tls12' to fix a SSL/TLS error
2018-12-06 14:07:40 -06:00
b4fb22f6fe
Get-ComputerDetails.py
2018-11-04 14:22:17 +05:30
224c24a0a4
Updated all submodules and packages
2018-08-29 15:33:02 +08:00
f61cb7e3f0
Merge pull request #256 from FrankSpierings/patch-2
...
Modified logging in spider.py
2018-08-28 19:57:55 +08:00
50a379dad4
Merge pull request #255 from FrankSpierings/patch-1
...
Update smbspider.py - Feature to use `--spider '*'` to spider all rea…
2018-08-28 19:55:54 +08:00
0128b589dc
Merge pull request #248 from kmackinley/kmackinley-cme-dev1
...
Flag to allow continuation while password spraying
2018-08-28 19:40:14 +08:00
1a7174137c
Added remotehost in the spidering output. It is now //<remotehost>/<share>/<folder *>/<file>
2018-07-07 14:33:14 +00:00
2823452053
Update smbspider.py - Feature to use `--spider '*'` to spider all readable shares
...
I've added the option to allow spidering over all readable shares.
2018-07-07 16:00:59 +02:00
dabdcf49ca
updated amsi bypass
2018-05-29 17:47:54 -06:00
7034ab66d0
Flag to allow continuation while password spraying
...
Adds --continue-on-success flag when spraying passwords using smb. Allows for continuing of password spraying even after valid password is found. (Useful when password spraying with userlist.)
Usage example:
cme smb ipaddress -u users.txt -p password --continue-on-success
In response to:
https://github.com/byt3bl33d3r/CrackMapExec/issues/245
https://github.com/byt3bl33d3r/CrackMapExec/issues/247
2018-05-26 19:44:24 -06:00
f3465ef008
Fixed up @aj-cgtech changes
2018-03-01 12:36:17 -07:00
5fd4aa716c
Merge branch 'usersfix' of https://github.com/aj-cgtech/CrackMapExec into aj-cgtech-usersfix
2018-03-01 11:57:33 -07:00
12846a7e9e
Merge pull request #237 from friendlyintruder/master
...
fixes debug output error if exec method fails
2018-03-01 11:51:57 -07:00
8dd4e95fe7
fixes debug output error if exec method fails
2018-02-23 14:55:05 +01:00
fffc24ae46
Having worked out how the protocol object is created. Created config
...
object once, and set as an attr on each protocol.
More elegant, and allows for further config options in the future.
2018-02-23 10:13:46 +00:00
b6a7028999
Typo, not l33t.
2018-02-22 21:18:31 +00:00
7e2a267328
Merging "Pwn3d!" label changes.
...
Fixes issue #236
Adds the ability to change the (Pwned!) label on CME output.
By default, nothing changes, but if required, to keep suits happy, you
can change the output of CME by adding a property to ~/.cme/cme.conf, in
the [CME] section, property "pwn3d_label".
eg:
[CME]
workspace = default
last_used_db = smb
pwn3d_label = Woot!
2018-02-22 20:24:03 +00:00
6ee852387c
Pwn3d label parameterised in config file.
2018-02-22 13:03:07 +00:00
8bba4b46f6
Changes to users() and groups()
...
users() was failing on a bad attribute, changed code to use getattr
instead. If attribute is missing, it no longer throws exception.
extraction of domain from distinguished name was not working in all
circumstances. FOO.COM would work, but FOO.CO.UK or even FOO.BAR.CO.UK
would extract CO incorrectly. function now extracts fully qualified
domain, which then gets shortened by db_add_user() function.
2018-02-20 12:57:23 +00:00
e1e68abe9a
Added extra export options and command line feedback.
2018-02-19 14:47:12 +00:00
a908d64fc1
Added module for enumerating AD DNS via WMI.
2018-01-22 18:45:56 -06:00
4b35455997
Refactored Database Menu code
...
- Fixed some MSSQL DB interaction bugs
- Made MSSQL DB schema more consistent
- cmedb output now gets formatted using terminaltables (so perty)
- Made everything a bit more PEP8 compliant
2017-11-02 17:43:08 +08:00
6b6a1b4de5
Fix errors from empire
2017-10-25 10:28:55 +02:00
2b00a795da
Fixed Powershell execution using MSSQL
2017-10-25 00:45:58 -06:00
f1c6858e55
Fixed bug where creds dumped via mimikatz wouldn't be added to the database
2017-10-24 22:56:34 -06:00
03f8fc6503
Fixes #187
2017-10-24 21:52:41 -06:00
211e78314d
Merge branch 'master' of github.com:byt3bl33d3r/CrackMapExec
2017-10-24 21:30:21 -06:00
e74b0a7efc
Fixes #204
2017-10-24 21:30:14 -06:00
e80c911378
Merge pull request #181 from martindube/fix_for_smb_fr
...
Replacing characters when they cannot be converted (UTF-8)
2017-10-24 21:14:30 -06:00
009822707b
Merge pull request #208 from hateshape/patch-1
...
Critical new video for list
2017-10-24 21:12:42 -06:00
1603ac4819
Added WINRM support, NMap XML and .Nessus parsing
...
- Added the WINRM protocol, CME now supports executing commands through WinRM (Powershell Remoting)
- Added support for NMap XML and .Nessus files if given as targets
- Fixed a bug in the MSSQL protocol which caused it to not retrieve host info
- Version Bump
2017-10-24 20:08:19 -06:00
6a645d0176
Merge branch 'master' of github.com:byt3bl33d3r/CrackMapExec
2017-10-21 17:24:32 -06:00
6cce1483a4
Updated Submodules
2017-10-21 17:24:09 -06:00
2ac8788dd8
Critical new video for list
...
Critical new video for list - Actual drrll here
2017-09-22 13:33:06 -06:00
dc0a7d8fd7
Merge pull request #203 from Waffle-Wrath/master
...
Bloodhound module
2017-09-08 10:21:55 -06:00
03465e3c58
default csv path modification
2017-08-30 17:54:40 +02:00
cacfdf2915
Added bloodhound module and BloodHound-modified.ps1 script
2017-08-30 17:54:23 +02:00
8644137faa
CME Module: SCUFFY
...
Similarly to LNK abuse except SCF abuse.
2017-08-23 09:35:06 +01:00
527b58d05c
Don't make service auto-start (disable reboot persistance)
2017-08-04 14:19:06 -04:00
b9aff9579c
Debug message for service creation/modification
2017-08-04 14:18:39 -04:00
212f0c363b
Updated mimipenguin module description, fixed #193
2017-07-10 08:27:45 -06:00
0b936def23
Takes care of issue #190 and #191 , initial SSH protocol implementation
...
- Passing --ntds will automatically use the drsuapi method (DCSync)
- Initial implementation of the SSH protocol and the mimipenguin module
(This is very much still not finished, lots of stuff missing)
- Added check to make sure existing config file is in the 4.x format
- Added splinter and paramiko to dep requirements
- Updated Impacket to latest commit
- HTTP protocol now also returns server version in output
2017-07-09 23:44:58 -06:00
e973e8c210
logger status change
2017-06-26 03:58:56 -06:00
7149b24524
Plugged in the Powershell obfuscation functionality
...
- Two new flags can be added to protocols that use powershell that can
clear cached obfuscated powershell scripts and obfuscate them if
powershell is installed
2017-06-26 03:49:04 -06:00
d3a50afbfc
Removed warning if powershell is not installed
2017-06-26 01:19:04 -06:00
11280c4ab0
Updated submodules, initial implementation of powershell script &
...
launcher obfuscation
- All powershell scripts are now obfuscated if powershell for linux is
installed using Invoke-Obfuscation
- All PS launchers are obfuscated using GreatSCT's python implementation
of launcher obfuscation (for now)
2017-06-26 01:03:43 -06:00
01c0b334a8
Updated impacket
2017-06-24 17:59:42 -06:00
fd94502d48
Removed useless format param
2017-06-23 14:37:18 -06:00
92453cd7a9
Fixes #179
2017-06-23 14:29:36 -06:00
f4dfddc89b
Fixes #182
2017-06-23 12:15:09 -06:00
5eb275b55e
Replacing characters when they cannot be converted (UTF-8)
2017-06-13 14:59:18 -04:00
c9eec77cf8
Updated Impacket ( resolves #173 )
2017-05-21 22:37:01 -06:00
e9cafb2fdb
Updated the empire_exec module for Empire 2.0 (for realzies this time)
2017-05-16 17:52:43 -06:00
60ac9e249d
Updated the empire_exec module for Empire 2.0
2017-05-16 17:51:51 -06:00
e795197501
Added support for both SMBv1 and SMBv3 connections
...
- Host info output now shows if SMBv1 is supported
2017-05-14 22:44:49 -06:00
f9385023ed
Added web_delivery module
2017-05-08 00:24:01 -06:00
2d22cca3ab
Added SessionGopher module
2017-05-07 23:19:04 -06:00
4ff034f366
Added enum_avproducts module, fixed module logging
...
- Modules now do not print output of commands called from their protocol
- Added the enum_avproducts module
- Fixed the mimikatz_enum_vault_creds to not display creds with invalid
passwords
- Added an export command to the SMB protocols DB navigator (as
suggested by @hatredshapedlikeaman)
- Misc output fixes
2017-05-07 21:16:18 -06:00
04907ceb29
Merge branch 'master' of github.com:byt3bl33d3r/CrackMapExec
2017-05-05 15:11:56 -06:00
c71692e576
Fixed HTTP protocol exiting during setup and pass pol enumeration
2017-05-05 15:10:42 -06:00
1684d4988d
Update videos_for_darrell.harambe
2017-05-05 13:38:59 -06:00
c26d993db4
Added Slinky module, pylnk in requirements
2017-05-04 19:13:11 -06:00
ee36665516
Fixed MSSQL protocol, refactored HTTP Protocol
...
- Fixed error in MSSQL protocol which would cause it to error out when
executing commands
- Fixed logic to deal with standard MSSQL auth instead of windows auth
- Refactored the HTTP protocol
2017-05-02 18:52:16 -06:00
feb9f2f63e
Adjusted logger formatting
2017-04-30 13:40:00 -06:00
450fc19cdf
Added CME-Powershell-Scripts submodule
2017-04-30 13:28:09 -06:00
8f38025821
Some submodule crap
2017-04-30 13:19:53 -06:00
f0752f61b7
Re-wrote the HTTP protocol to use splinter and phantomjs
...
- All http connections are now concurrent
- Added a flag to take screenshots of webpages
- Minor Code cleanup
2017-04-30 12:54:35 -06:00
3e27f30cb1
Added the RDP module to enable/disable RDP ( Resolves #88 )
2017-04-26 18:01:47 -06:00
d9fb2a506a
Fixes #168 and #167
2017-04-26 17:04:15 -06:00
cada0fcbb4
Switched to gevents gethostbyname() function
2017-04-14 15:32:39 -06:00
3901ec4b13
Merge branch 'master' of github.com:byt3bl33d3r/CrackMapExec
2017-04-14 15:26:26 -06:00
e8def0ad4c
Fixes #165
2017-04-14 15:26:17 -06:00
63e4fb8f77
Update videos_for_darrell.harambe
2017-04-14 10:13:53 -06:00
0390529cf1
Added another video for darrell
2017-04-11 22:55:33 -06:00
e98f798eb3
Forcing the SMB dialect to SMBv1 since it gives us prettier OS banners
2017-04-10 02:58:33 -06:00
6d9de77f4b
Updated impacket and pywerview submodules
2017-04-10 01:27:45 -06:00
86273bdc27
Merge branch 'master' of github.com:byt3bl33d3r/CrackMapExec
2017-04-10 01:25:34 -06:00
fc147ddac0
Fixed content spidering and password policy enumeration
...
- Added enumeration for password complexity (resolves #135 )
2017-04-10 01:24:23 -06:00
8270e44ce9
Updated pywerview
2017-04-07 09:08:13 -06:00
5bd238e9ae
Fixed errors in on_request, options, and admin_login
2017-04-07 04:45:23 -05:00
57d5d7ca13
Y'all better be ready for this, initial 4.0 release
...
- Fixed an edge case in gpp_decrypt.py also renamed to gpp_password
- Added the gpp_autologin module
- Added a workaround for the current impacket smb server bug in
get_keystrokes
- fixed formatting in the SMB database navigator
- fixed an error where DC would have there dc attribute overwritten
- Other stuff that i don't remember
2017-04-06 22:34:30 -06:00
602b7e13f0
Re-added most of the SMB protocol functionality
...
- Added new module gpp_decrypt
- Cleaned up the SMB spider as much as possible
- --wmi now uses pywerview
- Re-added the http protocol
2017-04-05 09:07:00 -06:00
cae5ffb6ce
Various fixes
2017-04-03 09:25:05 -06:00
5dc7c4ae62
Fixed logic errors when adding users and groups to the database
...
- Added debug logging to core db functions
- Fixed logging output
- Updated modules to use the new API
2017-03-29 18:03:04 -06:00
751f209cd7
Initial 4.0 pre-release
2017-03-27 15:09:36 -06:00
f1346ad55f
Added impacket and pywerview as submodules
2017-03-26 16:34:11 -06:00
d2a1078c9a
Added more powershell submodules
2017-03-26 12:20:39 -06:00
d8d1bfc9cf
Re-Added invoke-obfuscation submodule
2017-02-11 12:17:24 -07:00
mpgn
byt3bl33d3r
sw
pixis
Alexandre ZANNI
Ryan
root
Augustin Laville
Harrison Neal
Sebastián Castro
Dhiraj Mishra
root
Frank Spierings
Dan McInerney
Korey McKinley
Markus Krell
aj-cgtech
Daniel Lawson
ganapati
byt3bl33d3r
hateshape
Waffle-Wrath
vani11a
Louis Dion-Marcil
byt3bl33d3r
Martin Dubé
hatredshapedlikeaman
byt3bl33d3r
caoimhinp