- Replaced Gevent with AsyncIO
- Shares are now logged in the database and can be queried
- You can now press enter while a scan is being performed and CME will
give you a completion percentage and the number of hosts remaining to
scan
Before this commit, file objects for the username, password or NTLM hash
files were all shared between target jobs for different hosts. This
could cause numerous different errors in password or hash spraying jobs
with multiple targets. Sometimes some lines in input files were skipped
for some targets, and sometimes CME even ended up in an infinite loop
due to seeking in a file that is currently also being iterated on.
There have been attempts to fix some of these errors with file.seek(0)
in some places, such as with d13042f637.
This almost works because of the BoundedSemaphore sem that effectively
keeps CME attacks single-threaded. However, there were still corner
cases with shared file object accesses not protected by the semaphore.
To fix this in a reliable way, this commit shifts the responsibility of
open()ing a file object to every job instead of globally at the start.
While this does mean that the application will open the same files a
bunch of times, it also ensures correctness in regard to concurrency.
This should also allow to relax the semaphore in the future in case no
global or username limit across all targets is required.
* --shares -> OK
* --sessions -> OK
* --disks -> OK
* --loggedon-users -> OK
* --users -> Not tested
* --rid-brute -> OK
* --groups -> Not tested
* --local-groups -> OK
* --pass-pol -> OK
- Added the WINRM protocol, CME now supports executing commands through WinRM (Powershell Remoting)
- Added support for NMap XML and .Nessus files if given as targets
- Fixed a bug in the MSSQL protocol which caused it to not retrieve host info
- Version Bump
- Two new flags can be added to protocols that use powershell that can
clear cached obfuscated powershell scripts and obfuscate them if
powershell is installed
- Modules now do not print output of commands called from their protocol
- Added the enum_avproducts module
- Fixed the mimikatz_enum_vault_creds to not display creds with invalid
passwords
- Added an export command to the SMB protocols DB navigator (as
suggested by @hatredshapedlikeaman)
- Misc output fixes
- Fixed an edge case in gpp_decrypt.py also renamed to gpp_password
- Added the gpp_autologin module
- Added a workaround for the current impacket smb server bug in
get_keystrokes
- fixed formatting in the SMB database navigator
- fixed an error where DC would have there dc attribute overwritten
- Other stuff that i don't remember
- added two more attributes to use in modules:opsec_safe and multiple_hosts
- renamed db function names
- Added the python_injector module and it's necessary files as a reminder
Just fyi for anyone reading this, it's not even close to being
finished.
The amount of changes are pretty insane, this commit is to serve as a
refrence point for myself.
Highlights for v4.0:
- The whole codebase has been re-written from scratch
- Codebase has been cut around 2/4
- Protocols are now modular! In theory we could use CME for everything
- Module chaining has been removed for now, still trying to figure out a
more elegant solution
- Workspaces have implemented in cmedb
- The smb protocol's database schema has been changed to support storing users,
groups and computers with their respective memberships and relations.
- I'm in the process of re-writing most of the modules, will re-add them
once i've finished
Oook, this commit is basicallu just so I can start tracking (and
testing) all of the changes made so far:
- All execution methods are now completely fileless, all output and/or batch
files get outputted/hosted locally on a SMB server that gets spun up on runtime
- Module structure has been modified for module chaining
- Module chaining implementation is currently very hacky, I definitly
have to figure out something more elegant but for now it
works. Module chaining is performed via the -MC flag and has it's own
mini syntax (will be adding it to the wiki)
- You can now specify credential ID ranges using the -id flag
- Added the eventvwr_bypass and rundll32_exec modules
- Renamed a lot of the modules for naming consistency
TODO:
- Launchers/Payloads need to be escaped before being generated when
module chaining
- Add check for modules 'required_server' attribute
- Finish modifying the functions in the Connection object so they return
the results
- The whole connector function has been removed finally (was there since
v1.0)
- Functions now get called dynamically based on parsed arguments
- All of CME's functionality can now be accessed through the modules
(W00t!), just have finish modifing the code so the results will get
returned
time) to limit failed login attemptes
- The logic responsible for SMB bruteforcing/login has been modified
to sync between the concurrent threads: this allows us to limit failed login
attemptes with the two new flags. However this does cause the threads
to lock so there is a minor reduction in speed but IMHO this is a good
middle ground.
- You can now specify multiple DB credential IDs, CME will then
bruteforce using the specifspecified cred set
- Version bump
* For some reason the config file got lost in between version bumps, re-added it
* Improved the logic in first_run.py, it will now autodetect missing files and will copy/generate them accordinglu
* Code cleanup in cmedb.py and bug fixes in crackmapexec.py
mpgn
byt3bl33d3r
Marius Renner
byt3bl33d3r
aj-cgtech
byt3bl33d3r