- Replaced Gevent with AsyncIO
- Shares are now logged in the database and can be queried
- You can now press enter while a scan is being performed and CME will
give you a completion percentage and the number of hosts remaining to
scan
Before this commit, file objects for the username, password or NTLM hash
files were all shared between target jobs for different hosts. This
could cause numerous different errors in password or hash spraying jobs
with multiple targets. Sometimes some lines in input files were skipped
for some targets, and sometimes CME even ended up in an infinite loop
due to seeking in a file that is currently also being iterated on.
There have been attempts to fix some of these errors with file.seek(0)
in some places, such as with d13042f637.
This almost works because of the BoundedSemaphore sem that effectively
keeps CME attacks single-threaded. However, there were still corner
cases with shared file object accesses not protected by the semaphore.
To fix this in a reliable way, this commit shifts the responsibility of
open()ing a file object to every job instead of globally at the start.
While this does mean that the application will open the same files a
bunch of times, it also ensures correctness in regard to concurrency.
This should also allow to relax the semaphore in the future in case no
global or username limit across all targets is required.
* --shares -> OK
* --sessions -> OK
* --disks -> OK
* --loggedon-users -> OK
* --users -> Not tested
* --rid-brute -> OK
* --groups -> Not tested
* --local-groups -> OK
* --pass-pol -> OK
- Added the WINRM protocol, CME now supports executing commands through WinRM (Powershell Remoting)
- Added support for NMap XML and .Nessus files if given as targets
- Fixed a bug in the MSSQL protocol which caused it to not retrieve host info
- Version Bump
- Two new flags can be added to protocols that use powershell that can
clear cached obfuscated powershell scripts and obfuscate them if
powershell is installed
- Modules now do not print output of commands called from their protocol
- Added the enum_avproducts module
- Fixed the mimikatz_enum_vault_creds to not display creds with invalid
passwords
- Added an export command to the SMB protocols DB navigator (as
suggested by @hatredshapedlikeaman)
- Misc output fixes
- Fixed an edge case in gpp_decrypt.py also renamed to gpp_password
- Added the gpp_autologin module
- Added a workaround for the current impacket smb server bug in
get_keystrokes
- fixed formatting in the SMB database navigator
- fixed an error where DC would have there dc attribute overwritten
- Other stuff that i don't remember
- added two more attributes to use in modules:opsec_safe and multiple_hosts
- renamed db function names
- Added the python_injector module and it's necessary files as a reminder
Marshall Hallenbeck
mpgn
zblurx
Wlayzz
Gianfranco Alongi
byt3bl33d3r
Marius Renner
byt3bl33d3r
aj-cgtech
byt3bl33d3r