611 lines
21 KiB
Python
611 lines
21 KiB
Python
#!/usr/bin/env python3
|
|
|
|
import cmd
|
|
import configparser
|
|
import csv
|
|
import os
|
|
from os import listdir
|
|
from os.path import exists
|
|
from os.path import join as path_join
|
|
import shutil
|
|
from sqlite3 import connect
|
|
import sys
|
|
from textwrap import dedent
|
|
|
|
from requests import get, post, ConnectionError
|
|
from sqlalchemy import create_engine
|
|
from terminaltables import AsciiTable
|
|
|
|
from nxc.loaders.protocolloader import ProtocolLoader
|
|
from nxc.paths import CONFIG_PATH, WS_PATH, WORKSPACE_DIR
|
|
|
|
|
|
class UserExitedProto(Exception):
|
|
pass
|
|
|
|
|
|
def create_db_engine(db_path):
|
|
return create_engine(f"sqlite:///{db_path}", isolation_level="AUTOCOMMIT", future=True)
|
|
|
|
|
|
def print_table(data, title=None):
|
|
print()
|
|
table = AsciiTable(data)
|
|
if title:
|
|
table.title = title
|
|
print(table.table)
|
|
print()
|
|
|
|
|
|
def write_csv(filename, headers, entries):
|
|
"""Writes a CSV file with the provided parameters."""
|
|
with open(os.path.expanduser(filename), "w") as export_file:
|
|
csv_file = csv.writer(
|
|
export_file,
|
|
delimiter=";",
|
|
quoting=csv.QUOTE_ALL,
|
|
lineterminator="\n",
|
|
escapechar="\\",
|
|
)
|
|
csv_file.writerow(headers)
|
|
for entry in entries:
|
|
csv_file.writerow(entry)
|
|
|
|
|
|
def write_list(filename, entries):
|
|
"""Writes a file with a simple list"""
|
|
with open(os.path.expanduser(filename), "w") as export_file:
|
|
for line in entries:
|
|
export_file.write(line + "\n")
|
|
|
|
|
|
def complete_import(text, line):
|
|
"""Tab-complete 'import' commands"""
|
|
commands = ("empire", "metasploit")
|
|
mline = line.partition(" ")[2]
|
|
offs = len(mline) - len(text)
|
|
return [s[offs:] for s in commands if s.startswith(mline)]
|
|
|
|
|
|
def complete_export(text, line):
|
|
"""Tab-complete 'creds' commands."""
|
|
commands = (
|
|
"creds",
|
|
"plaintext",
|
|
"hashes",
|
|
"shares",
|
|
"local_admins",
|
|
"signing",
|
|
"keys",
|
|
)
|
|
mline = line.partition(" ")[2]
|
|
offs = len(mline) - len(text)
|
|
return [s[offs:] for s in commands if s.startswith(mline)]
|
|
|
|
|
|
def print_help(help_string):
|
|
print(dedent(help_string))
|
|
|
|
|
|
class DatabaseNavigator(cmd.Cmd):
|
|
def __init__(self, main_menu, database, proto):
|
|
cmd.Cmd.__init__(self)
|
|
self.main_menu = main_menu
|
|
self.config = main_menu.config
|
|
self.proto = proto
|
|
self.db = database
|
|
self.prompt = f"nxcdb ({main_menu.workspace})({proto}) > "
|
|
|
|
def do_exit(self, line):
|
|
self.db.shutdown_db()
|
|
sys.exit()
|
|
|
|
@staticmethod
|
|
def help_exit():
|
|
help_string = """
|
|
Exits
|
|
"""
|
|
print_help(help_string)
|
|
|
|
def do_back(self, line):
|
|
raise UserExitedProto
|
|
|
|
def do_export(self, line):
|
|
if not line:
|
|
print("[-] not enough arguments")
|
|
return
|
|
line = line.split()
|
|
command = line[0].lower()
|
|
# Need to use if/elif/else to keep compatibility with py3.8/3.9
|
|
# Reference DB Function nxc/protocols/smb/database.py
|
|
# Users
|
|
if command == "creds":
|
|
if len(line) < 3:
|
|
print("[-] invalid arguments, export creds <simple|detailed|hashcat> <filename>")
|
|
return
|
|
|
|
filename = line[2]
|
|
creds = self.db.get_credentials()
|
|
csv_header = (
|
|
"id",
|
|
"domain",
|
|
"username",
|
|
"password",
|
|
"credtype",
|
|
"pillaged_from",
|
|
)
|
|
|
|
if line[1].lower() == "simple":
|
|
write_csv(filename, csv_header, creds)
|
|
elif line[1].lower() == "detailed":
|
|
formatted_creds = []
|
|
|
|
for cred in creds:
|
|
entry = [
|
|
cred[0], # ID
|
|
cred[1], # Domain
|
|
cred[2], # Username
|
|
cred[3], # Password/Hash
|
|
cred[4], # Cred Type
|
|
]
|
|
if cred[5] is None:
|
|
entry.append("")
|
|
else:
|
|
entry.append(self.db.get_hosts(cred[5])[0][2])
|
|
formatted_creds.append(entry)
|
|
write_csv(filename, csv_header, formatted_creds)
|
|
elif line[1].lower() == "hashcat":
|
|
usernames = []
|
|
passwords = []
|
|
for cred in creds:
|
|
if cred[4] == "hash":
|
|
usernames.append(cred[2])
|
|
passwords.append(cred[3])
|
|
output_list = [":".join(combination) for combination in zip(usernames, passwords)]
|
|
write_list(filename, output_list)
|
|
else:
|
|
print(f"[-] No such export option: {line[1]}")
|
|
return
|
|
print("[+] Creds exported")
|
|
# Hosts
|
|
elif command == "hosts":
|
|
if len(line) < 3:
|
|
print("[-] invalid arguments, export hosts <simple|detailed|signing> <filename>")
|
|
return
|
|
|
|
csv_header_simple = (
|
|
"id",
|
|
"ip",
|
|
"hostname",
|
|
"domain",
|
|
"os",
|
|
"dc",
|
|
"smbv1",
|
|
"signing",
|
|
)
|
|
csv_header_detailed = (
|
|
"id",
|
|
"ip",
|
|
"hostname",
|
|
"domain",
|
|
"os",
|
|
"dc",
|
|
"smbv1",
|
|
"signing",
|
|
"spooler",
|
|
"zerologon",
|
|
"petitpotam",
|
|
)
|
|
filename = line[2]
|
|
|
|
if line[1].lower() == "simple":
|
|
hosts = self.db.get_hosts()
|
|
simple_hosts = [host[:8] for host in hosts]
|
|
write_csv(filename, csv_header_simple, simple_hosts)
|
|
# TODO: maybe add more detail like who is an admin on it, shares discovered, etc
|
|
elif line[1].lower() == "detailed":
|
|
hosts = self.db.get_hosts()
|
|
write_csv(filename, csv_header_detailed, hosts)
|
|
elif line[1].lower() == "signing":
|
|
hosts = self.db.get_hosts("signing")
|
|
signing_hosts = [host[1] for host in hosts]
|
|
write_list(filename, signing_hosts)
|
|
else:
|
|
print(f"[-] No such export option: {line[1]}")
|
|
return
|
|
print("[+] Hosts exported")
|
|
# Shares
|
|
elif command == "shares":
|
|
if len(line) < 3:
|
|
print("[-] invalid arguments, export shares <simple|detailed> <filename>")
|
|
return
|
|
|
|
shares = self.db.get_shares()
|
|
csv_header = ("id", "host", "userid", "name", "remark", "read", "write")
|
|
filename = line[2]
|
|
|
|
if line[1].lower() == "simple":
|
|
write_csv(filename, csv_header, shares)
|
|
print("[+] shares exported")
|
|
# Detailed view gets hostname, usernames, and true false statement
|
|
elif line[1].lower() == "detailed":
|
|
formatted_shares = []
|
|
for share in shares:
|
|
user = self.db.get_users(share[2])[0]
|
|
share_host = self.db.get_hosts(share[1])[0][2] if self.db.get_hosts(share[1]) else "ERROR"
|
|
|
|
entry = (
|
|
share[0], # shareID
|
|
share_host, # hosts
|
|
f"{user[1]}\\{user[2]}", # userID
|
|
share[3], # name
|
|
share[4], # remark
|
|
bool(share[5]), # read
|
|
bool(share[6]), # write
|
|
)
|
|
formatted_shares.append(entry)
|
|
write_csv(filename, csv_header, formatted_shares)
|
|
print("[+] Shares exported")
|
|
else:
|
|
print(f"[-] No such export option: {line[1]}")
|
|
return
|
|
# Local Admin
|
|
elif command == "local_admins":
|
|
if len(line) < 3:
|
|
print("[-] invalid arguments, export local_admins <simple|detailed> <filename>")
|
|
return
|
|
|
|
# These values don't change between simple and detailed
|
|
local_admins = self.db.get_admin_relations()
|
|
csv_header = ("id", "userid", "host")
|
|
filename = line[2]
|
|
|
|
if line[1].lower() == "simple":
|
|
write_csv(filename, csv_header, local_admins)
|
|
elif line[1].lower() == "detailed":
|
|
formatted_local_admins = []
|
|
for entry in local_admins:
|
|
user = self.db.get_users(filter_term=entry[1])[0]
|
|
|
|
formatted_entry = (
|
|
entry[0], # Entry ID
|
|
f"{user[1]}/{user[2]}", # DOMAIN/Username
|
|
self.db.get_hosts(filter_term=entry[2])[0][2], # Hostname
|
|
)
|
|
# Can't modify a tuple which is what self.db.get_admin_relations() returns
|
|
formatted_local_admins.append(formatted_entry)
|
|
write_csv(filename, csv_header, formatted_local_admins)
|
|
else:
|
|
print(f"[-] No such export option: {line[1]}")
|
|
return
|
|
print("[+] Local Admins exported")
|
|
elif command == "dpapi":
|
|
if len(line) < 3:
|
|
print("[-] invalid arguments, export dpapi <simple|detailed> <filename>")
|
|
return
|
|
|
|
# These values don't change between simple and detailed
|
|
dpapi_secrets = self.db.get_dpapi_secrets()
|
|
csv_header = (
|
|
"id",
|
|
"host",
|
|
"dpapi_type",
|
|
"windows_user",
|
|
"username",
|
|
"password",
|
|
"url",
|
|
)
|
|
filename = line[2]
|
|
|
|
if line[1].lower() == "simple":
|
|
write_csv(filename, csv_header, dpapi_secrets)
|
|
elif line[1].lower() == "detailed":
|
|
formatted_dpapi_secret = []
|
|
for entry in dpapi_secrets:
|
|
formatted_entry = (
|
|
entry[0], # Entry ID
|
|
self.db.get_hosts(filter_term=entry[1])[0][2], # Hostname
|
|
entry[2], # DPAPI type
|
|
entry[3], # Windows User
|
|
entry[4], # Username
|
|
entry[5], # Password
|
|
entry[6], # URL
|
|
)
|
|
# Can't modify a tuple which is what self.db.get_admin_relations() returns
|
|
formatted_dpapi_secret.append(formatted_entry)
|
|
write_csv(filename, csv_header, formatted_dpapi_secret)
|
|
else:
|
|
print(f"[-] No such export option: {line[1]}")
|
|
return
|
|
print("[+] DPAPI secrets exported")
|
|
elif command == "keys":
|
|
keys = self.db.get_keys() if line[1].lower() == "all" else self.db.get_keys(key_id=int(line[1]))
|
|
writable_keys = [key[2] for key in keys]
|
|
filename = line[2]
|
|
write_list(filename, writable_keys)
|
|
elif command == "wcc":
|
|
if len(line) < 3:
|
|
print("[-] invalid arguments, export wcc <simple|detailed> <filename>")
|
|
return
|
|
|
|
csv_header_simple = (
|
|
"id",
|
|
"ip",
|
|
"hostname",
|
|
"check",
|
|
"status",
|
|
)
|
|
csv_header_detailed = ("id", "ip", "hostname", "check", "description", "status", "reasons")
|
|
filename = line[2]
|
|
host_mapping = {}
|
|
check_mapping = {}
|
|
|
|
hosts = self.db.get_hosts()
|
|
checks = self.db.get_checks()
|
|
check_results = self.db.get_check_results()
|
|
rows = []
|
|
|
|
for result_id, hostid, checkid, secure, reasons in check_results:
|
|
row = [result_id]
|
|
if hostid in host_mapping:
|
|
row.extend(host_mapping[hostid])
|
|
else:
|
|
for host_id, ip, hostname, _, _, _, _, _, _, _, _ in hosts:
|
|
if host_id == hostid:
|
|
row.extend([ip, hostname])
|
|
host_mapping[hostid] = [ip, hostname]
|
|
break
|
|
if checkid in check_mapping:
|
|
row.extend(check_mapping[checkid])
|
|
else:
|
|
for check in checks:
|
|
check_id, name, description = check
|
|
if check_id == checkid:
|
|
row.extend([name, description])
|
|
check_mapping[checkid] = [name, description]
|
|
break
|
|
row.extend(("OK" if secure else "KO", reasons))
|
|
rows.append(row)
|
|
|
|
if line[1].lower() == "simple":
|
|
simple_rows = [(row[0], row[1], row[2], row[3], row[5]) for row in rows]
|
|
write_csv(filename, csv_header_simple, simple_rows)
|
|
elif line[1].lower() == "detailed":
|
|
write_csv(filename, csv_header_detailed, rows)
|
|
elif line[1].lower() == "signing":
|
|
hosts = self.db.get_hosts("signing")
|
|
signing_hosts = [host[1] for host in hosts]
|
|
write_list(filename, signing_hosts)
|
|
else:
|
|
print(f"[-] No such export option: {line[1]}")
|
|
return
|
|
print("[+] WCC exported")
|
|
else:
|
|
print("[-] Invalid argument, specify creds, hosts, local_admins, shares, wcc or dpapi")
|
|
|
|
@staticmethod
|
|
def help_export():
|
|
help_string = """
|
|
export [creds|hosts|local_admins|shares|signing|keys] [simple|detailed|*] [filename]
|
|
Exports information to a specified file
|
|
|
|
* hosts has an additional third option from simple and detailed: signing - this simply writes a list of ips of
|
|
hosts where signing is enabled
|
|
* keys' third option is either "all" or an id of a key to export
|
|
export keys [all|id] [filename]
|
|
"""
|
|
print_help(help_string)
|
|
|
|
def do_import(self, line):
|
|
if not line:
|
|
return
|
|
|
|
if line == "empire":
|
|
headers = {"Content-Type": "application/json"}
|
|
# Pull the username and password from the config file
|
|
payload = {
|
|
"username": self.config.get("Empire", "username"),
|
|
"password": self.config.get("Empire", "password"),
|
|
}
|
|
# Pull the host and port from the config file
|
|
base_url = f"https://{self.config.get('Empire', 'api_host')}:{self.config.get('Empire', 'api_port')}"
|
|
|
|
try:
|
|
r = post(
|
|
base_url + "/api/admin/login",
|
|
json=payload,
|
|
headers=headers,
|
|
verify=False,
|
|
)
|
|
if r.status_code == 200:
|
|
token = r.json()["token"]
|
|
url_params = {"token": token}
|
|
r = get(
|
|
base_url + "/api/creds",
|
|
headers=headers,
|
|
params=url_params,
|
|
verify=False,
|
|
)
|
|
creds = r.json()
|
|
|
|
for cred in creds["creds"]:
|
|
if cred["credtype"] == "token" or cred["credtype"] == "krbtgt" or cred["username"].endswith("$"):
|
|
continue
|
|
self.db.add_credential(
|
|
cred["credtype"],
|
|
cred["domain"],
|
|
cred["username"],
|
|
cred["password"],
|
|
)
|
|
print("[+] Empire credential import successful")
|
|
else:
|
|
print("[-] Error authenticating to Empire's RESTful API server!")
|
|
except ConnectionError as e:
|
|
print(f"[-] Unable to connect to Empire's RESTful API server: {e}")
|
|
|
|
|
|
class NXCDBMenu(cmd.Cmd):
|
|
def __init__(self, config_path):
|
|
cmd.Cmd.__init__(self)
|
|
self.config_path = config_path
|
|
|
|
try:
|
|
self.config = configparser.ConfigParser()
|
|
self.config.read(self.config_path)
|
|
except Exception as e:
|
|
print(f"[-] Error reading nxc.conf: {e}")
|
|
sys.exit(1)
|
|
|
|
self.conn = None
|
|
self.p_loader = ProtocolLoader()
|
|
self.protocols = self.p_loader.get_protocols()
|
|
|
|
self.workspace = self.config.get("nxc", "workspace")
|
|
self.do_workspace(self.workspace)
|
|
|
|
self.db = self.config.get("nxc", "last_used_db")
|
|
if self.db:
|
|
self.do_proto(self.db)
|
|
|
|
def write_configfile(self):
|
|
with open(self.config_path, "w") as configfile:
|
|
self.config.write(configfile)
|
|
|
|
def do_proto(self, proto):
|
|
if not proto:
|
|
return
|
|
|
|
proto_db_path = path_join(WORKSPACE_DIR, self.workspace, f"{proto}.db")
|
|
if exists(proto_db_path):
|
|
self.conn = create_db_engine(proto_db_path)
|
|
db_nav_object = self.p_loader.load_protocol(self.protocols[proto]["nvpath"])
|
|
db_object = self.p_loader.load_protocol(self.protocols[proto]["dbpath"])
|
|
self.config.set("nxc", "last_used_db", proto)
|
|
self.write_configfile()
|
|
try:
|
|
proto_menu = db_nav_object.navigator(self, db_object.database(self.conn), proto)
|
|
proto_menu.cmdloop()
|
|
except UserExitedProto:
|
|
pass
|
|
|
|
@staticmethod
|
|
def help_proto():
|
|
help_string = """
|
|
proto [smb|mssql|winrm]
|
|
*unimplemented protocols: ftp, rdp, ldap, ssh
|
|
Changes nxcdb to the specified protocol
|
|
"""
|
|
print_help(help_string)
|
|
|
|
def do_workspace(self, line):
|
|
line = line.strip()
|
|
if not line:
|
|
subcommand = ""
|
|
self.help_workspace()
|
|
else:
|
|
subcommand = line.split()[0]
|
|
|
|
if subcommand == "create":
|
|
new_workspace = line.split()[1].strip()
|
|
print(f"[*] Creating workspace '{new_workspace}'")
|
|
self.create_workspace(new_workspace, self.p_loader, self.protocols)
|
|
self.do_workspace(new_workspace)
|
|
elif subcommand == "list":
|
|
print("[*] Enumerating Workspaces")
|
|
for workspace in listdir(path_join(WORKSPACE_DIR)):
|
|
if workspace == self.workspace:
|
|
print("==> " + workspace)
|
|
else:
|
|
print(workspace)
|
|
elif exists(path_join(WORKSPACE_DIR, line)):
|
|
self.config.set("nxc", "workspace", line)
|
|
self.write_configfile()
|
|
self.workspace = line
|
|
self.prompt = f"nxcdb ({line}) > "
|
|
|
|
@staticmethod
|
|
def help_workspace():
|
|
help_string = """
|
|
workspace [create <targetName> | workspace list | workspace <targetName>]
|
|
"""
|
|
print_help(help_string)
|
|
|
|
@staticmethod
|
|
def do_exit(line):
|
|
sys.exit()
|
|
|
|
@staticmethod
|
|
def help_exit():
|
|
help_string = """
|
|
Exits
|
|
"""
|
|
print_help(help_string)
|
|
|
|
@staticmethod
|
|
def create_workspace(workspace_name, p_loader, protocols):
|
|
os.mkdir(path_join(WORKSPACE_DIR, workspace_name))
|
|
|
|
for protocol in protocols:
|
|
protocol_object = p_loader.load_protocol(protocols[protocol]["dbpath"])
|
|
proto_db_path = path_join(WORKSPACE_DIR, workspace_name, f"{protocol}.db")
|
|
|
|
if not exists(proto_db_path):
|
|
print(f"[*] Initializing {protocol.upper()} protocol database")
|
|
conn = connect(proto_db_path)
|
|
c = conn.cursor()
|
|
|
|
# try to prevent some weird sqlite I/O errors
|
|
c.execute("PRAGMA journal_mode = OFF")
|
|
c.execute("PRAGMA foreign_keys = 1")
|
|
|
|
protocol_object.database.db_schema(c)
|
|
|
|
# commit the changes and close everything off
|
|
conn.commit()
|
|
conn.close()
|
|
|
|
|
|
def delete_workspace(workspace_name):
|
|
shutil.rmtree(path_join(WORKSPACE_DIR, workspace_name))
|
|
|
|
|
|
def initialize_db(logger):
|
|
if not exists(path_join(WS_PATH, "default")):
|
|
logger.debug("Creating default workspace")
|
|
os.mkdir(path_join(WS_PATH, "default"))
|
|
|
|
p_loader = ProtocolLoader()
|
|
protocols = p_loader.get_protocols()
|
|
for protocol in protocols:
|
|
protocol_object = p_loader.load_protocol(protocols[protocol]["dbpath"])
|
|
proto_db_path = path_join(WS_PATH, "default", f"{protocol}.db")
|
|
|
|
if not exists(proto_db_path):
|
|
logger.debug(f"Initializing {protocol.upper()} protocol database")
|
|
conn = connect(proto_db_path)
|
|
c = conn.cursor()
|
|
# try to prevent some weird sqlite I/O errors
|
|
c.execute("PRAGMA journal_mode = OFF") # could try setting to PERSIST if DB corruption starts occurring
|
|
c.execute("PRAGMA foreign_keys = 1")
|
|
# set a small timeout (5s) so if another thread is writing to the database, the entire program doesn't crash
|
|
c.execute("PRAGMA busy_timeout = 5000")
|
|
protocol_object.database.db_schema(c)
|
|
# commit the changes and close everything off
|
|
conn.commit()
|
|
conn.close()
|
|
|
|
|
|
def main():
|
|
if not exists(CONFIG_PATH):
|
|
print("[-] Unable to find config file")
|
|
sys.exit(1)
|
|
try:
|
|
nxcdbnav = NXCDBMenu(CONFIG_PATH)
|
|
nxcdbnav.cmdloop()
|
|
except KeyboardInterrupt:
|
|
pass
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|