Giter VIP home page Giter VIP logo

netexec's Introduction

Supported Python versions Twitter Twitter Twitter Twitter

๐Ÿšฉ This is the open source repository of NetExec maintained by a community of passionate people

NetExec - The Network Execution Tool

This project was initially created in 2015 by @byt3bl33d3r, known as CrackMapExec. In 2019 @mpgn_x64 started maintaining the project for the next 4 years, adding a lot of great tools and features. In September 2023 he retired from maintaining the project.

Along with many other contributors, we (NeffIsBack, Marshall-Hallenbeck, and zblurx) developed new features, bug fixes, and helped maintain the original project CrackMapExec. During this time, with both a private and public repository, community contributions were not easily merged into the project. The 6-8 month discrepancy between the code bases caused many development issues and heavily reduced community-driven development. With the end of mpgn's maintainer role, we (the remaining most active contributors) decided to maintain the project together as a fully free and open source project under the new name NetExec ๐Ÿš€ Going forward, our intent is to maintain a community-driven and maintained project with regular updates for everyone to use.

You are on the latest up-to-date repository of the project NetExec (nxc) ! ๐ŸŽ‰

  • ๐Ÿšง If you want to report a problem, open an Issue
  • ๐Ÿ”€ If you want to contribute, open a Pull Request
  • ๐Ÿ’ฌ If you want to discuss, open a Discussion

Official Discord Channel

If you don't have a Github account, you can ask your questions on Discord!

NetExec

Documentation, Tutorials, Examples

See the project's wiki (in development) for documentation and usage examples

Installation

Please see the installation instructions on the wiki (in development)

Linux

sudo apt install pipx git
pipx ensurepath
pipx install git+https://github.com/Pennyw0rth/NetExec

Development

Development guidelines and recommendations in development

Acknowledgments

All the hard work and development over the years from everyone in the CrackMapExec project

Code Contributors

Awesome code contributors of NetExec:

netexec's People

Contributors

aj-cgtech avatar bongobongoland avatar byt3bl33d3r avatar chocapicyo avatar cyb3rc3lt avatar d3lb3 avatar dfte avatar hackndo avatar ilightthings avatar juliourena avatar kahvi-0 avatar lesydimitri avatar lodos2005 avatar marshall-hallenbeck avatar mpgn avatar neffisback avatar noraj avatar nurfed1 avatar pgormands avatar qtc-de avatar r4wd3r avatar sebrink avatar serizao avatar shad0wc0ntr0ller avatar shresthasurav avatar snovvcrash avatar spyr0-sec avatar termanix avatar xiaolichan avatar zblurx avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

netexec's Issues

'/tmp/msol.ps1' does not exist!

Describe the bug
I get error that the file does not exist, and my friend run this command from his workstation on the same server, and it worked for him

To Reproduce
Steps to reproduce the behavior i.e.:
Command: .\nxc.exe smb US-ADCONNECT -u us\helpdeskadmin -H 94b4a7961bb45377f6e7951b0d8630be -M msol
Resulted in:

SMB         192.168.1.209   445    US-ADCONNECT     [*] Windows 10.0 Build 17763 x64 (name:US-ADCONNECT) (domain:us.techcorp.local) (signing:False) (SMBv1:False)
SMB         192.168.1.209   445    US-ADCONNECT     [+] us\helpdeskadmin:94b4a7961bb45377f6e7951b0d8630be (Pwn3d!)
MSOL        192.168.1.209   445    US-ADCONNECT     [-] Impersonate file specified '/tmp/msol.ps1' does not exist!

NetExec info

OS: Windows server 2019
Version of nxc: 1.1.0

Implement Ruff Linter

We've used flake8 and black in the past, but Ruff seems to be the best way to easily and quickly lint for common mistakes.

We will not be checking for line length of 80 - this is annoying for everyone.

(Win Binary) Issue with -x/-X

Simple -x commands work fine, however, slightly more complex commands fail. This is a Windows version issue.

For example, -x 'net group "Big Boys Group" Wannabe /add' is not going to work, it won't go thru:
nxc.exe: error: unrecognized arguments

-x 'net group Big Boys Group Wannabe /add' will go thru but will return
The group name could not be found.

I've tried running nxc.exe in both PS and cmd.
Btw, this issue was present in cme's binary for windows.

Veeam Module crashing

Describe the bug
Veeam Modul randomly crashes

To Reproduce
Uknown

Screenshots

ERROR    Exception while calling proto_flow() on target 999.999.999.999: not enough values to unpack (expected 2, got 1)                                                connection.py:115
                    โ•ญโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ Traceback (most recent call last) โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฎ                  
                    โ”‚ /home/kali/.local/pipx/venvs/netexec/lib/python3.11/site-packages/nxc/connection.py:113 in __init__                                                          โ”‚                  
                    โ”‚                                                                                                                                                            โ”‚                  
                    โ”‚   110 โ”‚   โ”‚   โ”‚   sleep(value)                                                                                                                             โ”‚                  
                    โ”‚   111 โ”‚   โ”‚                                                                                                                                                โ”‚                  
                    โ”‚   112 โ”‚   โ”‚   try:                                                                                                                                         โ”‚                  
                    โ”‚ โฑ 113 โ”‚   โ”‚   โ”‚   self.proto_flow()                                                                                                                        โ”‚                  
                    โ”‚   114 โ”‚   โ”‚   except Exception as e:                                                                                                                       โ”‚                  
                    โ”‚   115 โ”‚   โ”‚   โ”‚   self.logger.exception(f"Exception while calling proto_flow() on target                                                                   โ”‚                  
                    โ”‚       {self.host}: {e}")                                                                                                                                   โ”‚                  
                    โ”‚   116                                                                                                                                                      โ”‚                  
                    โ”‚                                                                                                                                                            โ”‚                  
                    โ”‚ /home/kali/.local/pipx/venvs/netexec/lib/python3.11/site-packages/nxc/connection.py:163 in proto_flow                                                        โ”‚                  
                    โ”‚                                                                                                                                                            โ”‚                  
                    โ”‚   160 โ”‚   โ”‚   โ”‚   โ”‚   # because of null session                                                                                                            โ”‚                  
                    โ”‚   161 โ”‚   โ”‚   โ”‚   โ”‚   if self.login() or (self.username == "" and self.password == ""):                                                                    โ”‚                  
                    โ”‚   162 โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   if hasattr(self.args, "module") and self.args.module:                                                                            โ”‚                  
                    โ”‚ โฑ 163 โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   self.call_modules()                                                                                                          โ”‚                  
                    โ”‚   164 โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   else:                                                                                                                            โ”‚                  
                    โ”‚   165 โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   self.call_cmd_args()                                                                                                         โ”‚                  
                    โ”‚   166                                                                                                                                                      โ”‚                  
                    โ”‚                                                                                                                                                            โ”‚                  
                    โ”‚ /home/kali/.local/pipx/venvs/netexec/lib/python3.11/site-packages/nxc/connection.py:201 in call_modules                                                      โ”‚                  
                    โ”‚                                                                                                                                                            โ”‚                  
                    โ”‚   198 โ”‚   โ”‚   โ”‚                                                                                                                                            โ”‚                  
                    โ”‚   199 โ”‚   โ”‚   โ”‚   if self.admin_privs and hasattr(module, "on_admin_login"):                                                                               โ”‚                  
                    โ”‚   200 โ”‚   โ”‚   โ”‚   โ”‚   self.logger.debug(f"Module {module.name} has on_admin_login method")                                                                 โ”‚                  
                    โ”‚ โฑ 201 โ”‚   โ”‚   โ”‚   โ”‚   module.on_admin_login(context, self)                                                                                                 โ”‚                  
                    โ”‚   202 โ”‚   โ”‚   โ”‚                                                                                                                                            โ”‚                  
                    โ”‚   203 โ”‚   โ”‚   โ”‚   if (not hasattr(module, "on_request") and not hasattr(module,                                                                            โ”‚                  
                    โ”‚       "has_response")) and hasattr(module, "on_shutdown"):                                                                                                 โ”‚                  
                    โ”‚   204 โ”‚   โ”‚   โ”‚   โ”‚   self.logger.debug(f"Module {module.name} has on_shutdown method")                                                                    โ”‚      
                    โ”‚                                                                                                                                                            โ”‚                  
                    โ”‚ /home/kali/.local/pipx/venvs/netexec/lib/python3.11/site-packages/nxc/modules/veeam_dump.py:170 in on_admin_login                                            โ”‚                  
                    โ”‚                                                                                                                                                            โ”‚                  
                    โ”‚   167 โ”‚   โ”‚   โ”‚   โ”‚   context.log.fail(f"Password contains whitespaces! The password for user                                                              โ”‚                  
                    โ”‚       \"{user}\" is: \"{password}\"")                                                                                                                      โ”‚                  
                    โ”‚   168 โ”‚                                                                                                                                                    โ”‚                  
                    โ”‚   169 โ”‚   def on_admin_login(self, context, connection):                                                                                                   โ”‚                  
                    โ”‚ โฑ 170 โ”‚   โ”‚   self.checkVeeamInstalled(context, connection)                                                                                                โ”‚                  
                    โ”‚   171                                                                                                                                                      โ”‚                  
                    โ”‚                                                                                                                                                            โ”‚                  
                    โ”‚ /home/kali/.local/pipx/venvs/netexec/lib/python3.11/site-packages/nxc/modules/veeam_dump.py:121 in checkVeeamInstalled                                       โ”‚                  
                    โ”‚                                                                                                                                                            โ”‚                  
                    โ”‚   118 โ”‚   โ”‚   if SqlDatabase and SqlInstance and SqlServer:                                                                                                โ”‚                  
                    โ”‚   119 โ”‚   โ”‚   โ”‚   context.log.success(f'Found Veeam DB "{SqlDatabase}" on SQL Server                                                                       โ”‚                  
                    โ”‚       "{SqlServer}\\{SqlInstance}"! Extracting stored credentials...')                                                                                     โ”‚                  
                    โ”‚   120 โ”‚   โ”‚   โ”‚   credentials = self.executePsMssql(context, connection, SqlDatabase,                                                                      โ”‚                  
                    โ”‚       SqlInstance, SqlServer)                                                                                                                              โ”‚                  
                    โ”‚ โฑ 121 โ”‚   โ”‚   โ”‚   self.printCreds(context, credentials)                                                                                                    โ”‚                  
                    โ”‚   122 โ”‚   โ”‚   elif PostgreSqlExec and PostgresUserForWindowsAuth and SqlDatabaseName:                                                                      โ”‚                  
                    โ”‚   123 โ”‚   โ”‚   โ”‚   context.log.success(f'Found Veeam DB "{SqlDatabaseName}" on an PostgreSQL                                                                โ”‚                  
                    โ”‚       Instance! Extracting stored credentials...')                                                                                                         โ”‚                  
                    โ”‚   124 โ”‚   โ”‚   โ”‚   credentials = self.executePsPostgreSql(context, connection, PostgreSqlExec,                                                              โ”‚                  
                    โ”‚       PostgresUserForWindowsAuth, SqlDatabaseName)                                                                                                         โ”‚                  
                    โ”‚                                                                                                                                                            โ”‚                  
                    โ”‚ /home/kali/.local/pipx/venvs/netexec/lib/python3.11/site-packages/nxc/modules/veeam_dump.py:163 in printCreds                                                โ”‚                  
                    โ”‚                                                                                                                                                            โ”‚                  
                    โ”‚   160 โ”‚   โ”‚   โ”‚   return                                                                                                                                   โ”‚                  
                    โ”‚   161 โ”‚   โ”‚                                                                                                                                                โ”‚                  
                    โ”‚   162 โ”‚   โ”‚   for account in output_stripped:                                                                                                              โ”‚                  
                    โ”‚ โฑ 163 โ”‚   โ”‚   โ”‚   user, password = account.split(" ", 1)                                                                                                   โ”‚                  
                    โ”‚   164 โ”‚   โ”‚   โ”‚   password = password.replace("WHITESPACE_ERROR", " ")                                                                                     โ”‚                  
                    โ”‚   165 โ”‚   โ”‚   โ”‚   context.log.highlight(user + ":" + f"{password}")                                                                                        โ”‚                  
                    โ”‚   166 โ”‚   โ”‚   โ”‚   if ' ' in password:                                                                                                                      โ”‚                  
                    โ•ฐโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฏ                  
                    ValueError: not enough values to unpack (expected 2, got 1)

NetExec info

  • OS: kali-rolling
  • Version of nxc: github upstream
  • Installed from: pipx from github

Additional context
My best guess is that powershell returns an output string which the module can't properly interprete. I will add a general error handling to the powershell output.

Upgrade to python 3.9

Dropping py3.8 would enable updates for several packages. With that in mind we can also try to include the latest py3.12 version.

Bug when password spraying WinRM protocol

Describe the bug

When password spraying under WinRM and after finding a succesful combination, every other combination is marked as Pwn3d!.

To Reproduce

Command: netexec winrm <IP> -u username.list -p password.list --continue-on-success

Resulted in:

image

Expected behavior

To not have the Pwn3d tag if it is not even a correct combination.

NetExec info

  • OS: Linux parrot 6.1.0-1parrot1-amd64
  • Version of nxc: develop commit d1aec06
  • Installed from: cloning the repo and pipx to install

Investigate Usage of HTTP Server

I don't think we actually use the HTTP server anywhere. Its intended purpose seems to be catching responses for modules, but none of the modules have on_request or on_response functions, so we can probably remove this code.

Crash on ldap --dc-list

Describe the bug
NetExec is crashing on nxc ldap [ip] -u user -p password --dc-list with logging enabled through config

To Reproduce
Enable logging in nxc.conf
Command: nxc ldap [ip] -u user -p password --dc-list
Resulted in:
image
Somehow it cant handle the line with the ip output from the dcs. The Message is reported as:

Message: 'LDAP        [IP]  389    [HOSTNAME]       [HOSTNAME.DOMAIN] ='
Arguments: ('[IP_FROM_ONE_DC',)

NetExec info

  • OS: Kali latest rolling
  • Version of nxc: latest
  • Installed from: upstream git with pipx

Filter output for "pw3nd" when spray across big scopes

Hey,

it would be cool to get a filter like "--only-admin" when spaying vaild credentials over many hosts. In my PenTests i spray newly gathered creds a gsinst all clients to check for admin access.

Yes I could grep for it but with the filter the colors would stay and it's much nicer for Screenshots :)

New domain formatting with dot blocks socks authentications

Describe the bug
This issue is possibly already known, but I haven't seen it in the issue list.

The fact that the domain declaration now forces the presence of a dot for an FQDN format blocks the use of NetExec through a socks session set up with Impacket's ntlmrelayx.py.
ntlmrelayx.py setups socks sessions with the format DOMAIN/username and it now cannot be used with NetExec to authenticate.

To Reproduce
Setup proxy socks sessions with ntlmrelayx.py on SMB from a NTLM relay with a command like this:

ntlmrelayx.py -tf noSigning.txt -smb2support -socks

This result in sessions like this:

ntlmrelayx> socks
Protocol  Target        Username           AdminStatus  Port 
--------  ------------  -----------------  -----------  ----
SMB       <target>      DOMAIN/USER        FALSE        445  
SMB       <target>      DOMAIN/USER        FALSE        445  
SMB       <target>      DOMAIN/USER        FALSE        445  
SMB       <target>      DOMAIN/USER        FALSE        445  
SMB       <target>      DOMAIN/USER        FALSE        445  
SMB       <target>      DOMAIN/USER        FALSE        445 

Now, we attempte to authenticate on the target with the credentials.

Command: proxychains4 -q poetry run netexec smb <target> -u USER -d DOMAIN -p password
Resulted in:

proxychains4 -q poetry run netexec smb <target> -u USER -d DOMAIN -p password
SMB         <target_IP>    445    <target>       [*] Windows 10.0 Build 19041 (name:<target>) (domain:DOMAIN) (signing:False) (SMBv1:False)
[12:29:08] ERROR    Domain DOMAIN for user USER need to be FQDN ex:domain.local, not domain                                     connection.py:372

And if we declare the domain as DOMAIN.local, ntlmrelayx.py drops an error for no available session.

[2023-10-16 12:30:01] [-] SOCKS: No session for DOMAIN.LOCAL/USER@<target_IP>(445) available

Expected behavior
NetExec should be able to handle this format of domain declaration to authenticate through a socks session opened with ntlmrelayx.py.

NetExec info

  • OS: Kali
  • Version of nxc: 1.0.0
  • Installed from: GitHub + Poetry

Additional context
As indicated in the error message, the problem comes from the line 372 in the connection.py file. Here are the lines 370, 371, 372 and 373:

        # Enforcing FQDN for SMB if not using local authentication. Related issues/PRs: #26, #28, #24, #38
        if self.args.protocol == 'smb' and not self.args.local_auth and "." not in domain and not self.args.laps and secret != "" and not (self.domain.upper() == self.hostname.upper()) :
            self.logger.error(f"Domain {domain} for user {username.rstrip()} need to be FQDN ex:domain.local, not domain")
            return False

For the moment, as a temporary workaround, these lines can be commented to perform a successful authentication through a socks.

RDP not working as expected

The RDP Password spray works but produces a lot of junk in between for some reason. This doesn't happen for smb or winrm

image

Any assistance would be highly appreciated!

No package metadata was found for netexec

Executing the latest build will fail with an PackageNotFoundError

To Reproduce
Download the latest build from actions: nxc-ubuntu-latest-3.11

Run it with the following command: ./nxc smb 10.10.121.244 -u 'test' -p 'test'
Resulted in:

Traceback (most recent call last):
  File "/usr/lib/python3.11/importlib/metadata/__init__.py", line 563, in from_name
    return next(cls.discover(name=name))
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
StopIteration

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "<frozen runpy>", line 198, in _run_module_as_main
  File "<frozen runpy>", line 88, in _run_code
  File "/home/sec/./nxc/__main__.py", line 3, in <module>
  File "/home/sec/./nxc/_bootstrap/__init__.py", line 253, in bootstrap
  File "/home/sec/./nxc/_bootstrap/__init__.py", line 38, in run
  File "/home/sec/.shiv/nxc_aecf6c0b8a0cbcd1f5679edf2b69e9c2008a4c3700c4a451aea1d3f78207456c/site-packages/nxc/netexec.py", line 80, in main
    args = gen_cli_args()
           ^^^^^^^^^^^^^^
  File "/home/sec/.shiv/nxc_aecf6c0b8a0cbcd1f5679edf2b69e9c2008a4c3700c4a451aea1d3f78207456c/site-packages/nxc/cli.py", line 15, in gen_cli_args
    VERSION = importlib.metadata.version("netexec")
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/importlib/metadata/__init__.py", line 1008, in version
    return distribution(distribution_name).version
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/importlib/metadata/__init__.py", line 981, in distribution
    return Distribution.from_name(distribution_name)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/importlib/metadata/__init__.py", line 565, in from_name
    raise PackageNotFoundError(name)
importlib.metadata.PackageNotFoundError: No package metadata was found for netexec

NetExec info

  • OS: Kali
  • Version of nxc [latest]
  • Installed from: Actions

Module ms17-010 is falsely reporting "not vulnerable", despite the target being vulnerable.

Describe the bug
The module ms17-010 is always reporting "not vulnerable", despite the target being vulnerable.

This is because the module code itself is not working with python3, but the errors are being catched by the try/except/finally wrapper, more specifically the "except: return false" part.

To Reproduce

  • Tested with HackTheBox Machine "Blue"
  • Remove the try/except/finally block and look at the error messages

Expected behavior
The module should report vulnerable ms17-010 instances.

Screenshots
This screenshot was created after replacing line 437 with "raise" to propagate the error.

image

Additional information
The python code in the following link is a python3 conversion from the python2 code that was used for the module. The converted python3 version is working for me:
https://gist.github.com/mdawsonuk/caac9ec724abe4e70277c6a2478629da

(WIN BIN) aardwof missing

Traceback (most recent call last):
File "netexec.py", line 276, in
File "netexec.py", line 162, in main
File "loaders\protocolloader.py", line 18, in load_protocol
File "", line 940, in exec_module
File "", line 241, in _call_with_frames_removed
File "C:\Users\mrpoopypants\AppData\Local\Temp_MEI112922\nxc\protocols\rdp.py", line 18, in
from aardwolf.connection import RDPConnection
ModuleNotFoundError: No module named 'aardwolf'
[4176] Failed to execute script 'netexec' due to unhandled exception!

RDP module issues

@XiaoliChan

I know it's actually not the module problem but an issue with that particular host. However, maybe you have some ideas how to deal with this. Please, have a look. Cheers.

rdpissue

Module path checking broken on windows

On windows the path checking is broken atm resulting in:

[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\add-computer.py filename must match the module name add-computer
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\bh_owned.py filename must match the module name bh_owned
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\daclread.py filename must match the module name daclread
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\dfscoerce.py filename must match the module name dfscoerce
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\drop-sc.py filename must match the module name drop-sc
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\empire_exec.py filename must match the module name empire_exec
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\enum_av.py filename must match the module name enum_av
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\enum_dns.py filename must match the module name enum_dns
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\enum_trusts.py filename must match the module name enum_trusts
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\find-computer.py filename must match the module name find-computer
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\firefox.py filename must match the module name firefox
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\get-desc-users.py filename must match the module name get-desc-users
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\get-network.py filename must match the module name get-network
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\get-unixUserPassword.py filename must match the module name get-unixUserPassword
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\get-userPassword.py filename must match the module name get-userPassword
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\get_netconnections.py filename must match the module name get_netconnections
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\gpp_autologin.py filename must match the module name gpp_autologin
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\gpp_password.py filename must match the module name gpp_password
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\group-mem.py filename must match the module name group-mem
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\groupmembership.py filename must match the module name groupmembership
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\handlekatz.py filename must match the module name handlekatz
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\hash_spider.py filename must match the module name hash_spider
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\iis.py filename must match the module name iis
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\impersonate.py filename must match the module name impersonate
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\install_elevated.py filename must match the module name install_elevated
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\ioxidresolver.py filename must match the module name ioxidresolver
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\keepass_discover.py filename must match the module name keepass_discover
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\keepass_trigger.py filename must match the module name keepass_trigger
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\laps.py filename must match the module name laps
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\ldap-checker.py filename must match the module name ldap-checker
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\lsassy.py filename must match the module name lsassy
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\MAQ.py filename must match the module name MAQ
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\masky.py filename must match the module name masky
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\met_inject.py filename must match the module name met_inject
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\ms17-010.py filename must match the module name ms17-010
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\msol.py filename must match the module name msol
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\mssql_priv.py filename must match the module name mssql_priv
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\nanodump.py filename must match the module name nanodump
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\nopac.py filename must match the module name nopac
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\ntdsutil.py filename must match the module name ntdsutil
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\ntlmv1.py filename must match the module name ntlmv1
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\petitpotam.py filename must match the module name petitpotam
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\pi.py filename must match the module name pi
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\printnightmare.py filename must match the module name printnightmare
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\procdump.py filename must match the module name procdump
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\pso.py filename must match the module name pso
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\rdcman.py filename must match the module name rdcman
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\rdp.py filename must match the module name rdp
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\reg-query.py filename must match the module name reg-query
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\runasppl.py filename must match the module name runasppl
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\schtask_as.py filename must match the module name schtask_as
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\scuffy.py filename must match the module name scuffy
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\shadowcoerce.py filename must match the module name shadowcoerce
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\slinky.py filename must match the module name slinky
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\spider_plus.py filename must match the module name spider_plus
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\spooler.py filename must match the module name spooler
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\subnets.py filename must match the module name subnets
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\teams_localdb.py filename must match the module name teams_localdb
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\test_connection.py filename must match the module name test_connection
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\uac.py filename must match the module name uac
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\user-desc.py filename must match the module name user-desc
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\veeam.py filename must match the module name veeam
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\wcc.py filename must match the module name wcc
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\wdigest.py filename must match the module name wdigest
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\webdav.py filename must match the module name webdav
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\web_delivery.py filename must match the module name web_delivery
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\whoami.py filename must match the module name whoami
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\wifi.py filename must match the module name wifi
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\winscp.py filename must match the module name winscp
[-] C:\Users\ADMIN~1.SEC\AppData\Local\Temp\_MEI35202\nxc\modules\zerologon.py filename must match the module name zerologon
[10:06:21] ERROR    Module not found: lsassy                     netexec.py:189```


_Originally posted by @andretorresbr in https://github.com/Pennyw0rth/NetExec/discussions/127#discussioncomment-7939121_

IPv6 support on winrm

Bug
IPv6 support for the winrm service has been removed

Reproduce
Command: netexec winrm dead:beef::b885:d62a:d679:573f -u username -p password
Resulted in:

$ netexec winrm dead:beef::b885:d62a:d679:573f -u username -p password
[13:50:09] ERROR    Exception while calling proto_flow() on target dead:beef::b885:d62a:d679:573f: Failed to parse:                                        connection.py:115
                    https://dead:beef::b885:d62a:d679:573f:5986/wsman                                                                                                       
                    โ•ญโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ Traceback (most recent call last) โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฎ                  
                    โ”‚ /usr/lib/python3/dist-packages/requests/models.py:434 in prepare_url                                                               โ”‚                  
                    โ”‚                                                                                                                                    โ”‚                  
                    โ”‚    431 โ”‚   โ”‚                                                                                                                       โ”‚                  
                    โ”‚    432 โ”‚   โ”‚   # Support for unicode domain names and paths.                                                                       โ”‚                  
                    โ”‚    433 โ”‚   โ”‚   try:                                                                                                                โ”‚                  
                    โ”‚ โฑ  434 โ”‚   โ”‚   โ”‚   scheme, auth, host, port, path, query, fragment = parse_url(url)                                                โ”‚                  
                    โ”‚    435 โ”‚   โ”‚   except LocationParseError as e:                                                                                     โ”‚                  
                    โ”‚    436 โ”‚   โ”‚   โ”‚   raise InvalidURL(*e.args)                                                                                       โ”‚                  
                    โ”‚    437                                                                                                                             โ”‚                  
                    โ”‚                                                                                                                                    โ”‚                  
                    โ”‚ /usr/lib/python3/dist-packages/urllib3/util/url.py:397 in parse_url                                                                โ”‚                  
                    โ”‚                                                                                                                                    โ”‚                  
                    โ”‚   394 โ”‚   โ”‚   โ”‚   fragment = _encode_invalid_chars(fragment, FRAGMENT_CHARS)                                                       โ”‚                  
                    โ”‚   395 โ”‚                                                                                                                            โ”‚                  
                    โ”‚   396 โ”‚   except (ValueError, AttributeError):                                                                                     โ”‚                  
                    โ”‚ โฑ 397 โ”‚   โ”‚   return six.raise_from(LocationParseError(source_url), None)                                                          โ”‚                  
                    โ”‚   398 โ”‚                                                                                                                            โ”‚                  
                    โ”‚   399 โ”‚   # For the sake of backwards compatibility we put empty                                                                   โ”‚                  
                    โ”‚   400 โ”‚   # string values for path if there are any defined values                                                                 โ”‚                  
                    โ”‚ in raise_from:3                                                                                                                    โ”‚                  
                    โ•ฐโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฏ                  
                    LocationParseError: Failed to parse: https://dead:beef::b885:d62a:d679:573f:5986/wsman                                                                  
                                                                                                                                                                            
                    During handling of the above exception, another exception occurred:                                                                                     
                                                                                                                                                                            
                    โ•ญโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ Traceback (most recent call last) โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฎ                  
                    โ”‚ /home/kali/.local/lib/python3.11/site-packages/nxc/connection.py:113 in __init__                                                   โ”‚                  
                    โ”‚                                                                                                                                    โ”‚                  
                    โ”‚   110 โ”‚   โ”‚   โ”‚   sleep(value)                                                                                                     โ”‚                  
                    โ”‚   111 โ”‚   โ”‚                                                                                                                        โ”‚                  
                    โ”‚   112 โ”‚   โ”‚   try:                                                                                                                 โ”‚                  
                    โ”‚ โฑ 113 โ”‚   โ”‚   โ”‚   self.proto_flow()                                                                                                โ”‚                  
                    โ”‚   114 โ”‚   โ”‚   except Exception as e:                                                                                               โ”‚                  
                    โ”‚   115 โ”‚   โ”‚   โ”‚   self.logger.exception(f"Exception while calling proto_flow() on target                                           โ”‚                  
                    โ”‚       {self.host}: {e}")                                                                                                           โ”‚                  
                    โ”‚   116                                                                                                                              โ”‚                  
                    โ”‚                                                                                                                                    โ”‚                  
                    โ”‚ /home/kali/.local/lib/python3.11/site-packages/nxc/connection.py:157 in proto_flow                                                 โ”‚                  
                    โ”‚                                                                                                                                    โ”‚                  
                    โ”‚   154 โ”‚   def proto_flow(self):                                                                                                    โ”‚                  
                    โ”‚   155 โ”‚   โ”‚   self.logger.debug(f"Kicking off proto_flow")                                                                         โ”‚                  
                    โ”‚   156 โ”‚   โ”‚   self.proto_logger()                                                                                                  โ”‚                  
                    โ”‚ โฑ 157 โ”‚   โ”‚   if self.create_conn_obj():                                                                                           โ”‚                  
                    โ”‚   158 โ”‚   โ”‚   โ”‚   self.enum_host_info()                                                                                            โ”‚                  
                    โ”‚   159 โ”‚   โ”‚   โ”‚   if self.print_host_info():                                                                                       โ”‚                  
                    โ”‚   160 โ”‚   โ”‚   โ”‚   โ”‚   # because of null session                                                                                    โ”‚                  
                    โ”‚                                                                                                                                    โ”‚                  
                    โ”‚ /home/kali/.local/lib/python3.11/site-packages/nxc/protocols/winrm.py:208 in create_conn_obj                                       โ”‚                  
                    โ”‚                                                                                                                                    โ”‚                  
                    โ”‚   205 โ”‚   โ”‚   for url in endpoints:                                                                                                โ”‚                  
                    โ”‚   206 โ”‚   โ”‚   โ”‚   try:                                                                                                             โ”‚                  
                    โ”‚   207 โ”‚   โ”‚   โ”‚   โ”‚   self.logger.debug(f"winrm create_conn_obj() - Requesting URL: {url}")                                        โ”‚                  
                    โ”‚ โฑ 208 โ”‚   โ”‚   โ”‚   โ”‚   res = requests.post(url, verify=False, timeout=self.args.http_timeout)                                       โ”‚                  
                    โ”‚   209 โ”‚   โ”‚   โ”‚   โ”‚   self.logger.debug("winrm create_conn_obj() - Received response code:" f"                                     โ”‚                  
                    โ”‚       {res.status_code}")                                                                                                          โ”‚                  
                    โ”‚   210 โ”‚   โ”‚   โ”‚   โ”‚   self.endpoint = url                                                                                          โ”‚                  
                    โ”‚   211 โ”‚   โ”‚   โ”‚   โ”‚   if self.endpoint.startswith("https://"):                                                                     โ”‚                  
                    โ”‚                                                                                                                                    โ”‚                  
                    โ”‚ /usr/lib/python3/dist-packages/requests/api.py:115 in post                                                                         โ”‚                  
                    โ”‚                                                                                                                                    โ”‚                  
                    โ”‚   112 โ”‚   :rtype: requests.Response                                                                                                โ”‚                  
                    โ”‚   113 โ”‚   """                                                                                                                      โ”‚                  
                    โ”‚   114 โ”‚                                                                                                                            โ”‚                  
                    โ”‚ โฑ 115 โ”‚   return request("post", url, data=data, json=json, **kwargs)                                                              โ”‚                  
                    โ”‚   116                                                                                                                              โ”‚                  
                    โ”‚   117                                                                                                                              โ”‚                  
                    โ”‚   118 def put(url, data=None, **kwargs):                                                                                           โ”‚                  
                    โ”‚                                                                                                                                    โ”‚                  
                    โ”‚ /usr/lib/python3/dist-packages/requests/api.py:59 in request                                                                       โ”‚                  
                    โ”‚                                                                                                                                    โ”‚                  
                    โ”‚    56 โ”‚   # avoid leaving sockets open which can trigger a ResourceWarning in some                                                 โ”‚                  
                    โ”‚    57 โ”‚   # cases, and look like a memory leak in others.                                                                          โ”‚                  
                    โ”‚    58 โ”‚   with sessions.Session() as session:                                                                                      โ”‚                  
                    โ”‚ โฑ  59 โ”‚   โ”‚   return session.request(method=method, url=url, **kwargs)                                                             โ”‚                  
                    โ”‚    60                                                                                                                              โ”‚                  
                    โ”‚    61                                                                                                                              โ”‚                  
                    โ”‚    62 def get(url, params=None, **kwargs):                                                                                         โ”‚                  
                    โ”‚                                                                                                                                    โ”‚                  
                    โ”‚ /usr/lib/python3/dist-packages/requests/sessions.py:575 in request                                                                 โ”‚                  
                    โ”‚                                                                                                                                    โ”‚                  
                    โ”‚   572 โ”‚   โ”‚   โ”‚   cookies=cookies,                                                                                                 โ”‚                  
                    โ”‚   573 โ”‚   โ”‚   โ”‚   hooks=hooks,                                                                                                     โ”‚                  
                    โ”‚   574 โ”‚   โ”‚   )                                                                                                                    โ”‚                  
                    โ”‚ โฑ 575 โ”‚   โ”‚   prep = self.prepare_request(req)                                                                                     โ”‚                  
                    โ”‚   576 โ”‚   โ”‚                                                                                                                        โ”‚                  
                    โ”‚   577 โ”‚   โ”‚   proxies = proxies or {}                                                                                              โ”‚                  
                    โ”‚   578                                                                                                                              โ”‚                  
                    โ”‚                                                                                                                                    โ”‚                  
                    โ”‚ /usr/lib/python3/dist-packages/requests/sessions.py:486 in prepare_request                                                         โ”‚                  
                    โ”‚                                                                                                                                    โ”‚                  
                    โ”‚   483 โ”‚   โ”‚   โ”‚   auth = get_netrc_auth(request.url)                                                                               โ”‚                  
                    โ”‚   484 โ”‚   โ”‚                                                                                                                        โ”‚                  
                    โ”‚   485 โ”‚   โ”‚   p = PreparedRequest()                                                                                                โ”‚                  
                    โ”‚ โฑ 486 โ”‚   โ”‚   p.prepare(                                                                                                           โ”‚                  
                    โ”‚   487 โ”‚   โ”‚   โ”‚   method=request.method.upper(),                                                                                   โ”‚                  
                    โ”‚   488 โ”‚   โ”‚   โ”‚   url=request.url,                                                                                                 โ”‚                  
                    โ”‚   489 โ”‚   โ”‚   โ”‚   files=request.files,                                                                                             โ”‚                  
                    โ”‚                                                                                                                                    โ”‚                  
                    โ”‚ /usr/lib/python3/dist-packages/requests/models.py:368 in prepare                                                                   โ”‚                  
                    โ”‚                                                                                                                                    โ”‚                  
                    โ”‚    365 โ”‚   โ”‚   """Prepares the entire request with the given parameters."""                                                        โ”‚                  
                    โ”‚    366 โ”‚   โ”‚                                                                                                                       โ”‚                  
                    โ”‚    367 โ”‚   โ”‚   self.prepare_method(method)                                                                                         โ”‚                  
                    โ”‚ โฑ  368 โ”‚   โ”‚   self.prepare_url(url, params)                                                                                       โ”‚                  
                    โ”‚    369 โ”‚   โ”‚   self.prepare_headers(headers)                                                                                       โ”‚                  
                    โ”‚    370 โ”‚   โ”‚   self.prepare_cookies(cookies)                                                                                       โ”‚                  
                    โ”‚    371 โ”‚   โ”‚   self.prepare_body(data, files, json)                                                                                โ”‚                  
                    โ”‚                                                                                                                                    โ”‚                  
                    โ”‚ /usr/lib/python3/dist-packages/requests/models.py:436 in prepare_url                                                               โ”‚                  
                    โ”‚                                                                                                                                    โ”‚                  
                    โ”‚    433 โ”‚   โ”‚   try:                                                                                                                โ”‚                  
                    โ”‚    434 โ”‚   โ”‚   โ”‚   scheme, auth, host, port, path, query, fragment = parse_url(url)                                                โ”‚                  
                    โ”‚    435 โ”‚   โ”‚   except LocationParseError as e:                                                                                     โ”‚                  
                    โ”‚ โฑ  436 โ”‚   โ”‚   โ”‚   raise InvalidURL(*e.args)                                                                                       โ”‚                  
                    โ”‚    437 โ”‚   โ”‚                                                                                                                       โ”‚                  
                    โ”‚    438 โ”‚   โ”‚   if not scheme:                                                                                                      โ”‚                  
                    โ”‚    439 โ”‚   โ”‚   โ”‚   raise MissingSchema(                                                                                            โ”‚                  
                    โ•ฐโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฏ                  
                    InvalidURL: Failed to parse: https://dead:beef::b885:d62a:d679:573f:5986/wsman                                                                          

Info

  • OS: Kali
  • Version: latest (just installed from github)
  • Installed from: github

More context
One possible solution I thought of would be to add a hostname, however, when referencing the hostname it tries to load the ipv6 address in the url, it will probably fail because you have to add [] in the ipv6 addresses, using the hostname in the url would also work

$ echo "dead:beef::b885:d62a:d679:573f hostnameipv6" | sudo tee -a /etc/hosts

$ netexec winrm hostnameipv6 -u username -p password
[13:22:48] ERROR    Exception while calling proto_flow() on target dead:beef::b885:d62a:d679:573f: Failed to parse:         connection.py:115
                    https://dead:beef::b885:d62a:d679:573f:5986/wsman                                                      
                    โ•ญโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ Traceback (most recent call last) โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฎ
                    โ”‚ /usr/lib/python3/dist-packages/requests/models.py:434 in prepare_url                 โ”‚
                    โ”‚ ...[snip]...                                                                         โ”‚
                    โ•ฐโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฏ
                    LocationParseError: Failed to parse: https://dead:beef::b885:d62a:d679:573f:5986/wsman                 

Tracebacks when using Win binary

The latest .exe has nasty issue. It's impossible to use smb bruteforce because every single unsuccessful attempt also brings a lot of traceback information. It's big mess. As you can see, there's no STATUS_LOGON_FAILURE line

[20:32:29] ERROR Exception while calling proto_flow() on target 192.168.1.1: too many values to unpack (expected 2) connection.py:123
โ•ญโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ Traceback (most recent call last) โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฎ
โ”‚ in login:3501 โ”‚
โ”‚ โ”‚
โ”‚ in login_extended:3436 โ”‚
โ”‚ โ”‚
โ”‚ in isValidAnswer:785 โ”‚
โ•ฐโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฏ
SessionError: SMB SessionError: code: 0xc000006d - STATUS_LOGON_FAILURE - The attempted logon is invalid. This is either due to a bad username or
authentication information.

                During handling of the above exception, another exception occurred:

                โ•ญโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ Traceback (most recent call last) โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฎ
                โ”‚ in login:276                                                                                                                                            โ”‚
                โ”‚                                                                                                                                                         โ”‚
                โ”‚ in login:3505                                                                                                                                           โ”‚
                โ”‚                                                                                                                                                         โ”‚
                โ”‚ in login_extended:3436                                                                                                                                  โ”‚
                โ”‚                                                                                                                                                         โ”‚
                โ”‚ in isValidAnswer:785                                                                                                                                    โ”‚
                โ•ฐโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฏ
                SessionError: SMB SessionError: code: 0xc000006d - STATUS_LOGON_FAILURE - The attempted logon is invalid. This is either due to a bad username or
                authentication information.

                During handling of the above exception, another exception occurred:

                โ•ญโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ Traceback (most recent call last) โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฎ
                โ”‚ C:\Users\poop\AppData\Local\Temp\_MEI23722\nxc\protocols\smb.py:465 in plaintext_login                                                                   โ”‚
                โ”‚                                                                                                                                                         โ”‚
                โ”‚    462 โ”‚   โ”‚   โ”‚   self.domain = domain                                                                                                                 โ”‚
                โ”‚    463 โ”‚   โ”‚   โ”‚                                                                                                                                        โ”‚
                โ”‚    464 โ”‚   โ”‚   โ”‚   try:                                                                                                                                 โ”‚
                โ”‚ โฑ  465 โ”‚   โ”‚   โ”‚   โ”‚   self.conn.login(self.username, self.password, domain)                                                                            โ”‚
                โ”‚    466 โ”‚   โ”‚   โ”‚   except UnicodeEncodeError:                                                                                                           โ”‚
                โ”‚    467 โ”‚   โ”‚   โ”‚   โ”‚   self.logger.error(f"UnicodeEncodeError on:                                                                                       โ”‚
                โ”‚        '{self.username}:{self.password}'. Trying again with a different encoding...")                                                                   โ”‚
                โ”‚    468 โ”‚   โ”‚   โ”‚   โ”‚   self.create_conn_obj()                                                                                                           โ”‚
                โ”‚                                                                                                                                                         โ”‚
                โ”‚ in login:280                                                                                                                                            โ”‚
                โ•ฐโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฏ
                SessionError: SMB SessionError: code: 0xc000006d - STATUS_LOGON_FAILURE - The attempted logon is invalid. This is either due to a bad username or
                authentication information.

                During handling of the above exception, another exception occurred:

                โ•ญโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ Traceback (most recent call last) โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฎ
                โ”‚ in __init__:121                                                                                                                                         โ”‚
                โ”‚                                                                                                                                                         โ”‚
                โ”‚ in proto_flow:168                                                                                                                                       โ”‚
                โ”‚                                                                                                                                                         โ”‚
                โ”‚ in login:465                                                                                                                                            โ”‚
                โ”‚                                                                                                                                                         โ”‚
                โ”‚ in try_credentials:407                                                                                                                                  โ”‚
                โ”‚                                                                                                                                                         โ”‚
                โ”‚ C:\Users\foo\AppData\Local\Temp\_MEI23722\nxc\protocols\smb.py:503 in plaintext_login                                                                   โ”‚
                โ”‚                                                                                                                                                         โ”‚
                โ”‚    500 โ”‚   โ”‚   โ”‚   โ”‚   self.create_conn_obj()                                                                                                           โ”‚
                โ”‚    501 โ”‚   โ”‚   โ”‚   return True                                                                                                                          โ”‚
                โ”‚    502 โ”‚   โ”‚   except SessionError as e:                                                                                                                โ”‚
                โ”‚ โฑ  503 โ”‚   โ”‚   โ”‚   error, desc = e.getErrorString()                                                                                                     โ”‚
                โ”‚    504 โ”‚   โ”‚   โ”‚   self.logger.fail(                                                                                                                    โ”‚
                โ”‚    505 โ”‚   โ”‚   โ”‚   โ”‚   f'{domain}\\{self.username}:{process_secret(self.password)} {error}                                                              โ”‚
                โ”‚        {f"({desc})" if self.args.verbose else ""}',                                                                                                     โ”‚
                โ”‚    506 โ”‚   โ”‚   โ”‚   โ”‚   color="magenta" if error in smb_error_status else "red",                                                                         โ”‚
                โ•ฐโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฏ
                ValueError: too many values to unpack (expected 2)

^^^ that is just unsuccessful attempt.

Accounts with admin rights missing (Pwn3d) tag

I see this on a regular basis.
SMB finds an account but fails to tag it as Pwn3d, even though the account has admin rights.
Maybe I'm missing something.

Windows 10.0 Build 17763
The account is a local account, and the host is not part of any domain.

Option `--domain` does not override internal domain

Describe the bug
Usually the option --domain/-d should override the domain retreived by impacket. This is clearly not the case here
image

To Reproduce
Steps to reproduce the behavior i.e.:
Command: netexec smb -u username -p password --domain SOMETHING_INVALID
Successful login

Expected behavior
This should not result in a login, rather it should fail as this furthermore suggests that specifying the domain manually does not work.

NetExec info

  • OS: Kali rolling
  • Version of nxc: github-upstream
  • Installed from: pipx+github

Windows binary version: issues with --ntds option

Describe the bug
When I use --ntds option in the Windows compiled binary version (single .EXE file), the tools crashes with EOFError.

To Reproduce

  1. Compile Windows single binary, as described in the documentation.
  2. Run NetExec with --ntds option:

.\nxc.exe smb 192.168.144.1 -u syslogagent -H '58a478135a93ac3bf058a5ea0e8fdb71' -d gcbsec.local --ntds

Resulted in:
001

Expected behavior
NTDS.dit extraction

enum_trusts not working

enum_trusts not working on several DCs

.\nxc.exe ldap us-dc -u us\studentuser55 -p 7fySHxncnPQS3vrW -M enum_trusts

SMB         192.168.1.2     445    US-DC            [*] Windows 10.0 Build 17763 x64 (name:US-DC) (domain:us.techcorp.local) (signing:True) (SMBv1:False)
LDAP        192.168.1.2     389    US-DC            [+] us\studentuser55:7fySHxncnPQS3vrW
[02:47:14] ERROR    Exception while calling proto_flow() on target 192.168.1.2: Error in searchRequest -> referral: 0000202B: RefErr: DSID-0310084A, data 0, 1     connection.py:123
                    access points
                        ref 1: 'us'
                                                                                                                                                                                    
                    โ•ญโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ Traceback (most recent call last) โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฎ
                    โ”‚ in __init__:121                                                                                                                            โ”‚
                    โ”‚                                                                                                                                            โ”‚
                    โ”‚ in proto_flow:171                                                                                                                          โ”‚
                    โ”‚                                                                                                                                            โ”‚
                    โ”‚ in call_modules:225                                                                                                                        โ”‚
                    โ”‚                                                                                                                                            โ”‚
                    โ”‚ C:\Users\STUDEN~1\AppData\Local\Temp\_MEI38962\nxc\modules\trust.py:25 in on_login                                                         โ”‚
                    โ”‚                                                                                                                                            โ”‚
                    โ”‚   22 โ”‚   โ”‚   attributes = ["flatName", "trustPartner", "trustDirection", "trustAttributes"]                                                โ”‚
                    โ”‚   23 โ”‚   โ”‚                                                                                                                                 โ”‚
                    โ”‚   24 โ”‚   โ”‚   context.log.debug(f"Search Filter={search_filter}")                                                                           โ”‚
                    โ”‚ โฑ 25 โ”‚   โ”‚   resp = connection.ldapConnection.search(searchBase=domain_dn,                                                                 โ”‚
                    โ”‚      searchFilter=search_filter, attributes=attributes, sizeLimit=0)                                                                       โ”‚
                    โ”‚   26 โ”‚   โ”‚                                                                                                                                 โ”‚
                    โ”‚   27 โ”‚   โ”‚   trusts = []                                                                                                                   โ”‚
                    โ”‚   28 โ”‚   โ”‚   context.log.debug(f"Total of records returned {len(resp)}")                                                                   โ”‚
                    โ”‚                                                                                                                                            โ”‚
                    โ”‚ in search:402                                                                                                                              โ”‚
                    โ•ฐโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฏ
                    LDAPSearchError: Error in searchRequest -> referral: 0000202B: RefErr: DSID-0310084A, data 0, 1 access points
                            ref 1: 'us'

NetExec info

  • OS: Windows server 2019
  • Version of nxc: 1.1.0

Kerberoasting not returning any output

Describe the bug
When using the --kerberoasting flag the tool returns an error while using GetUserSPNs from Impacket does not.

To Reproduce
Steps to reproduce the behavior i.e.:
Command: nxc ldap 172.16.5.5 -u forend -p Klmcargo2 --kerberoasting kerberoasting
Resulted in:
image

NetExec info

  • OS: Parrot
  • Version of nxc: commit 470b4e8 dev branch
  • Installed from: cloning repo -> pipx

Compiled Versions Missing Required Module(s)

It appears that module(s) required for the LDAP protocol to run in the windows executable are not present.

Steps to reproduce the behavior:
Command: nxc.exe ldap 10.10.10.3
Resulted in:
1 (2)

2

Expected behavior
The netexec LDAP protocol to function without error.

NetExec info

  • OS: Windows 10, Kali
  • Version of nxc: 1.0.0
  • Installed from: Executable

ModuleNotFoundError: No module named 'bloodhound'

Describe the bug
When running the -L flag in ldap I get the following error message ModuleNotFoundError: No module named 'bloodhound'

To Reproduce
Steps to reproduce the behavior i.e.:
Command: ~/nxc-ubuntu-latest ldap dc01 -u 'user' -p 'password' -L
Resulted in:

Traceback (most recent call last):
  File "netexec.py", line 276, in <module>
  File "netexec.py", line 162, in main
  File "loaders/protocolloader.py", line 18, in load_protocol
  File "<frozen importlib._bootstrap_external>", line 940, in exec_module
  File "<frozen importlib._bootstrap>", line 241, in _call_with_frames_removed
  File "/tmp/_MEIHqKXxZ/nxc/protocols/ldap.py", line 17, in <module>
    from bloodhound.ad.authentication import ADAuthentication
ModuleNotFoundError: No module named 'bloodhound'
[2600402] Failed to execute script 'netexec' due to unhandled exception!...

Expected behavior
List of the available LDAP modules

Screenshots
image

NetExec info

  • OS: Kali
  • Version: 1.0.0 - A New Beginning
  • Installed from: binary from release

ssh connection shutdown with valid credential

Using ssh with valid credential on a server led to just EOF

This might have to do with the server using ssh-rsa /dss ?

2023-11-01 19:38:09,509 - DEBUG - Added file handler: <RotatingFileHandler /home/user/.nxc/logs/2023-11-01/log_2023-11-01-19-38-09.log (NOTSET)>
2023-11-01 19:38:09,512 - DEBUG - PYTHON VERSION: 3.11.6 (main, Oct  8 2023, 05:06:43) [GCC 13.2.0]
2023-11-01 19:38:09,513 - DEBUG - RUNNING ON: Linux Release: 6.5.0-10-generic
2023-11-01 19:38:09,514 - DEBUG - Passed args: Namespace(threads=100, timeout=None, jitter=None, no_progress=False, verbose=False, debug=True, version=False, protocol='ssh', target=['<redacted>'], cred_id=[], username=['<redacted>'], password=['<redacted>'], ignore_pw_decoding=False, kerberos=False, no_bruteforce=False, continue_on_success=False, use_kcache=False, log=None, aesKey=None, kdcHost=None, gfail_limit=None, ufail_limit=None, fail_limit=None, module=None, module_options=[], list_modules=False, show_module_options=False, server='https', server_host='0.0.0.0', server_port=None, connectback_host=None, key_file=None, port=22, ssh_timeout=30, sudo_check=False, sudo_check_method='sudo-stdin', get_output_tries=5, codec='utf-8', no_output=False, execute=None)
2023-11-01 19:38:09,517 - DEBUG - Protocol: ssh
2023-11-01 19:38:09,518 - DEBUG - Protocol Path: /home/user/tools/NetExec/venv/lib/python3.11/site-packages/nxc/protocols/ssh.py
2023-11-01 19:38:09,519 - DEBUG - Protocol DB Path: /home/user/tools/NetExec/venv/lib/python3.11/site-packages/nxc/protocols/ssh/database.py
2023-11-01 19:38:09,672 - DEBUG - Protocol Object: <class 'protocol.ssh'>
2023-11-01 19:38:09,674 - DEBUG - Protocol DB Object: <class 'protocol.database'>
2023-11-01 19:38:09,675 - DEBUG - DB Path: /home/user/.nxc/workspaces/default/ssh.db
2023-11-01 19:38:09,689 - DEBUG - Creating ThreadPoolExecutor
2023-11-01 19:38:09,690 - DEBUG - Creating thread for <class 'protocol.ssh'>
2023-11-01 19:38:09,692 - INFO - Socket info: host=<redacted>, hostname=<redacted>, kerberos=False
2023-11-01 19:38:09,693 - DEBUG - Kicking off proto_flow
2023-11-01 19:38:09,853 - DEBUG - Remote version: SSH-2.0-OpenSSH_5.3
2023-11-01 19:38:09,856 - DEBUG - add_host(): Initial hosts results: [(19, '<redacted>', 22, 'SSH-2.0-OpenSSH_5.3', '')]
2023-11-01 19:38:09,857 - DEBUG - host: (19, '<redacted>', 22, 'SSH-2.0-OpenSSH_5.3', '')
2023-11-01 19:38:09,858 - DEBUG - host_data: {'id': 19, 'host': '<redacted>', 'port': 22, 'banner': 'SSH-2.0-OpenSSH_5.3', 'os': ''}
2023-11-01 19:38:09,859 - DEBUG - Hosts: [{'id': 19, 'host': '<redacted>', 'port': 22, 'banner': 'SSH-2.0-OpenSSH_5.3', 'os': ''}]
2023-11-01 19:38:09,861 - DEBUG - add_host() - Host IDs Updated: [19]
2023-11-01 19:38:09,897 - INFO - SSH         <redacted>   22     <redacted>    [*] SSH-2.0-OpenSSH_5.3
2023-11-01 19:38:09,898 - DEBUG - Trying to authenticate using plaintext over SSH
2023-11-01 19:38:09,899 - DEBUG - Logging <redacted> with username: <redacted>, password: <redacted>
2023-11-01 19:38:09,911 - INFO - SSH         <redacted>   22     <redacted>    [-] <redacted>:<redacted> Authentication failed: transport shut down or saw EOF

Inconsistency between --lsa via NTLM and Kerberos

It looks like there is some inconsistency between the result of the --lsa option when connecting via NTLM and Kerberos:

Below is the result when dumping lsa via a NTLM authentication:

image

And here is the result when dumping via Kerberos (-k):

image

The AES and DES keys for the DC$ account are not dumped.

I'll take a look at why ASAP.

Feature Dark Mode Addition

Feature request

The repository looks complete with the addition of the dark mode button in navbar

Proposal
Addition of the dark mode button

Kindly assign me this issue. @NeffIsBack

Issue with FQDN

No present in cme binary or linux version.

throws errors
ERROR Domain TestDomain for user TestAdmin need to be FQDN ex:domain.local, not domain

in other words it won't run unless I enter -d TestDomain.lan

ModuleNotFoundError: No module named 'aardwolf'

Describe the bug
When running the netexec.exe from the 9/19 nightly build, I'm getting "ModuleNotFoundError" regardless of which module I try to use (rdp, ldap, etc)

To Reproduce
Command: .\netexec.exe ldap azprts02.nsmg.com -u username -p 'Pa$$word'
Resulted in:

Traceback (most recent call last):
  File "netexec.py", line 276, in <module>
  File "netexec.py", line 162, in main
  File "loaders\protocolloader.py", line 18, in load_protocol
  File "<frozen importlib._bootstrap_external>", line 940, in exec_module
  File "<frozen importlib._bootstrap>", line 241, in _call_with_frames_removed
  File "C:\Users\SHAWN~1.JON\AppData\Local\Temp\_MEI44402\nxc\protocols\ldap.py", line 17, in <module>
    from bloodhound.ad.authentication import ADAuthentication
ModuleNotFoundError: No module named 'bloodhound'
[22320] Failed to execute script 'netexec' due to unhandled exception!

Expected behavior

Screenshots
n/a

NetExec info

  • OS: Win10
  • Version of nxc: 1.0.0
  • Installed from: binary from build 11

Additional context
n/a

ModuleNotFoundError: No module named 'aardwolf'

Describe the bug
Using rdp throws a missing module error

To Reproduce
Steps to reproduce the behavior i.e.:
Command: ./nxc rdp -L
Resulted in:

Traceback (most recent call last):
  File "netexec.py", line 255, in <module>
  File "netexec.py", line 152, in main
  File "loaders/protocolloader.py", line 16, in load_protocol
  File "<frozen importlib._bootstrap_external>", line 940, in exec_module
  File "<frozen importlib._bootstrap>", line 241, in _call_with_frames_removed
  File "/tmp/_MEIPpQPnv/nxc/protocols/rdp.py", line 15, in <module>
    from aardwolf.connection import RDPConnection
ModuleNotFoundError: No module named 'aardwolf'
[3169] Failed to execute script 'netexec' due to unhandled exception!

Expected behavior
The available rdp modules should be listed (if any)

Screenshots
image

NetExec info

It cannot be installed properly

My system is macOS 13.2.1, Python version 3.9.6, I didn't install with venv when installing (I don't think I need virtual space), it prompts two errors

ERROR: Failed building wheel for aardwolf
ERROR: Could not build wheels for aardwolf, which is required to install pyproject.toml-based projects

pip has been updated to the latest version, please how can I fix it

image

SSH password spray fails to work where hydra works with same inputs

Describe the bug
Using nxc ssh to password spray does not work where same data with hydra does
Reproduced this while hacking the Wifinetic machine on app.hackthebox.com

To Reproduce
Using the following two input files

pass.txt
VeRyUniUqWiFIPasswrd1!
badpassword
goodpassword

users.txt
olivia.walker17
netadmin
samantha.wood93

nxc

user@kali:~$ nxc ssh 10.10.11.247 -u users.txt -p pass.txt
SSH         10.10.11.247    22     10.10.11.247     [*] SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.9
SSH         10.10.11.247    22     10.10.11.247     [-] olivia.walker17:VeRyUniUqWiFIPasswrd1! Authentication failed.
SSH         10.10.11.247    22     10.10.11.247     [-] netadmin:VeRyUniUqWiFIPasswrd1! 'NoneType' object has no attribute 'auth_password'
SSH         10.10.11.247    22     10.10.11.247     [-] samantha.wood93:VeRyUniUqWiFIPasswrd1! 'NoneType' object has no attribute 'auth_password'
SSH         10.10.11.247    22     10.10.11.247     [-] olivia.walker17:badpassword 'NoneType' object has no attribute 'auth_password'
SSH         10.10.11.247    22     10.10.11.247     [-] netadmin:badpassword 'NoneType' object has no attribute 'auth_password'
SSH         10.10.11.247    22     10.10.11.247     [-] samantha.wood93:badpassword 'NoneType' object has no attribute 'auth_password'
SSH         10.10.11.247    22     10.10.11.247     [-] olivia.walker17:goodpassword 'NoneType' object has no attribute 'auth_password'
SSH         10.10.11.247    22     10.10.11.247     [-] netadmin:goodpassword 'NoneType' object has no attribute 'auth_password'
SSH         10.10.11.247    22     10.10.11.247     [-] samantha.wood93:goodpassword 'NoneType' object has no attribute 'auth_password'

Hydra

user@kali:~$ hydra -L users.txt -P pass.txt 10.10.11.247 ssh
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-11-09 19:03:40
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 9 tasks per 1 server, overall 9 tasks, 9 login tries (l:3/p:3), ~1 try per task
[DATA] attacking ssh://10.10.11.247:22/
[22][ssh] host: 10.10.11.247   login: netadmin   password: VeRyUniUqWiFIPasswrd1!
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2023-11-09 19:03:45

With --laps nxc still tries to add local creds to bloodhound

Describe the bug
NetExec tries to add creds retrieved by --laps to bloodhound because --local-auth is not set but we still do local-auth.
This will fail for obvious reasons.

Solution:
Add somewhere in laps_search in smb.py the line:
self.args.local_auth = True

Will commit the fix asap

Bug in WebDAV Module Exception Handler

Bug Description

When utilizing the SMB WebDAV module to scan a target, if the credentials are considered valid but are not permissive enough to enumerate shares, specifically the IPC$ share, a stack trace is thrown. Currently, the access denied error isn't handled gracefully by the module's exception handler.

Target Information

  • Windows Server 2019 Datacenter
  • Password protected sharing turned off
  • Promoted to a domain controller
  • No user accounts created besides default administrator account

Attacker Information

  • Ubuntu 22.04 LTS
  • Python 3.10.12
  • NetExec v1.0.0 installed from source with Poetry

To Reproduce

As a reminder, no accounts other than the default administrator account were created on the domain controller. The username and password shown are those actually used. No error occurs when an empty password is provided (see session recording below).

Command: nxc smb 10.0.0.5 -u username -p password -M webdav

webdav

Expected behavior

The exception handler should gracefully handle the error, very much like the --shares switch does (as seen in the session recording provided below). Here is an example of how I believe the error should be handled, the fix for which will be included in my pull request:

webdav-fix

Session Recording

webdav

UnicodeEncodeError when password contains โ‚ฌ symbol

Describe the bug

When the password contains a โ‚ฌ symbol, authentication fails due to an encoding error.
It is possible to bypass this error by using the hash.

To Reproduce
Steps to reproduce the behavior i.e.:
Command: netexec smb -u user -p Moโ‚ฌbius
Resulted in:

netexec smb 192.168.56.10 -u user -p Moโ‚ฌbius 
SMB         192.168.56.10   445    DC01             [*] Windows 10.0 Build 17763 x64 (name:DC01) (domain:corpo.local) (signing:True) (SMBv1:False)
[06:02:29] ERROR    UnicodeEncodeError on: 'user:Moโ‚ฌbius'. Trying again with a different encoding...                                                                                                                               smb.py:467
SMB         192.168.56.10   445    DC01             [-] corpo.local\MBO:Moโ‚ฌbius STATUS_LOGON_FAILURE
...

Expected behavior
A valid connection is expected.

NetExec info

  • OS: Ubuntu 22.04.1 and kali 6.5.0-kali3-amd64
  • Version of nxc: 1.1.0 - nxc4u
  • Installed from: poetry and pipx

ldap-checker module not detecting LDAPS channel binding

Describe the bug
When I use the ldap-checker module, I'm getting an error when attempt to binds to LDAPS.

To Reproduce
Steps to reproduce the behavior i.e.:
Command: nxc ldap XX.YY.ZZ.ZZ --port 636 -u 'USER' -p pass.txt -d 'test.local' -M ldap-checker
Resulted in:

SMB         XX.YY.ZZ.ZZ     445    DCTEST1         [*] Windows 10.0 Build 17763 x64 (name:DCTEST1) (domain:test.local) (signing:True) (SMBv1:False)
LDAP        XX.YY.ZZ.ZZ     636    DCTEST1         [+] test.local\USER:XXXXXXXX 
LDAP-CHE... XX.YY.ZZ.ZZ     636    DCTEST1         LDAP Signing NOT Enforced!
LDAP-CHE... XX.YY.ZZ.ZZ     636    DCTEST1         [-] ERROR while connecting to test.local: an integer is required (got type NoneType)

Expected behavior
LDAPS bindings to check status of channel binding.

NetExec info

  • OS: Exegol on Manjaro host
  • Version of nxc: 1.1.0
  • Installed from: pipx installation

Module rdp hangs on Windows when ACTION=enable

Describe the bug
When running the rdp module, and specifying ACTION=enable on Windows, it hangs. This problem is exaserbated by not being able to properly ctrl-c on Windows (see #61).

To Reproduce
Command: netexec smb -u username -p password -m rdp -o ACTION=enable

Login occurs correctly, but then it hangs.

Expected behavior
Command should execute and then exit.

NetExec info

  • OS: Windows
  • Version of nxc: develop branch (as of 10/12/2023)
  • Installed from: GitHub

git tags

Ref. byt3bl33d3r/CrackMapExec#800

If this become the official cme community fork, could you please recreate at least all previous git tags and create new git tags and github release for cme 6.0 and 6.1 please.

Error on SMB using wrong password

Describe the bug
I'm getting an error while trying to bruteforce passwords using a user list and the same list as passwords.
I'm working on the manager box from HTB but I've got the same issue on my home lab

To Reproduce
Steps to reproduce the behavior i.e.:
Command: netexec smb manager.htb -u users.txt -p users.txt
Resulted in:

โ”Œโ”€โ”€(fr3shใ‰ฟDeathStar)-[~/Documents/Challenges/hackTheBox/Manager]
โ””โ”€$ netexec smb manager.htb -u users.txt -p users.txt 
SMB         10.10.11.236    445    DC01             [*] Windows 10.0 Build 17763 x64 (name:DC01) (domain:manager.htb) (signing:True) (SMBv1:False)
[15:20:39] ERROR    Exception while calling proto_flow() on target 10.10.11.236: too many values to unpack (expected 2)                                                      connection.py:123
                    โ•ญโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ Traceback (most recent call last) โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฎ                  
                    โ”‚ /home/fr3sh/.local/pipx/venvs/netexec/lib/python3.11/site-packages/impacket/smbconnection.py:278 in login                                            โ”‚                  
                    โ”‚                                                                                                                                                      โ”‚                  
                    โ”‚   275 โ”‚   โ”‚   โ”‚   if self.getDialect() == smb.SMB_DIALECT:                                                                                           โ”‚                  
                    โ”‚   276 โ”‚   โ”‚   โ”‚   โ”‚   return self._SMBConnection.login(user, password, domain, lmhash, nthash,                                                       โ”‚                  
                    โ”‚       ntlmFallback)                                                                                                                                  โ”‚                  
                    โ”‚   277 โ”‚   โ”‚   โ”‚   else:                                                                                                                              โ”‚                  
                    โ”‚ โฑ 278 โ”‚   โ”‚   โ”‚   โ”‚   return self._SMBConnection.login(user, password, domain, lmhash, nthash)                                                       โ”‚                  
                    โ”‚   279 โ”‚   โ”‚   except (smb.SessionError, smb3.SessionError) as e:                                                                                     โ”‚                  
                    โ”‚   280 โ”‚   โ”‚   โ”‚   raise SessionError(e.get_error_code(), e.get_error_packet())                                                                       โ”‚                  
                    โ”‚   281                                                                                                                                                โ”‚                  
                    โ”‚                                                                                                                                                      โ”‚                  
                    โ”‚ /home/fr3sh/.local/pipx/venvs/netexec/lib/python3.11/site-packages/impacket/smb3.py:1040 in login                                                    โ”‚                  
                    โ”‚                                                                                                                                                      โ”‚                  
                    โ”‚   1037 โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   self._Session['SigningKey'] = crypto.KDF_CounterMode                                                                  โ”‚                  
                    โ”‚        (exportedSessionKey, b"SMB2AESCMAC\x00",                                                                                                      โ”‚                  
                    โ”‚   1038 โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   โ”‚                                                                     โ”‚                  
                    โ”‚        b"SmbSign\x00", 128)                                                                                                                          โ”‚                  
                    โ”‚   1039 โ”‚   โ”‚   โ”‚   try:                                                                                                                              โ”‚                  
                    โ”‚ โฑ 1040 โ”‚   โ”‚   โ”‚   โ”‚   if packet.isValidAnswer(STATUS_SUCCESS):                                                                                      โ”‚                  
                    โ”‚   1041 โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   sessionSetupResponse = SMB2SessionSetup_Response(packet['Data'])                                                          โ”‚                  
                    โ”‚   1042 โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   self._Session['SessionFlags'] = sessionSetupResponse['SessionFlags']                                                      โ”‚                  
                    โ”‚   1043 โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   self._Session['SessionID']    = packet['SessionID']                                                                       โ”‚                  
                    โ”‚                                                                                                                                                      โ”‚                  
                    โ”‚ /home/fr3sh/.local/pipx/venvs/netexec/lib/python3.11/site-packages/impacket/smb3structs.py:458 in isValidAnswer                                      โ”‚                  
                    โ”‚                                                                                                                                                      โ”‚                  
                    โ”‚    455 โ”‚   def isValidAnswer(self, status):                                                                                                          โ”‚                  
                    โ”‚    456 โ”‚   โ”‚   if self['Status'] != status:                                                                                                          โ”‚                  
                    โ”‚    457 โ”‚   โ”‚   โ”‚   from . import smb3                                                                                                                โ”‚                  
                    โ”‚ โฑ  458 โ”‚   โ”‚   โ”‚   raise smb3.SessionError(self['Status'], self)                                                                                     โ”‚                  
                    โ”‚    459 โ”‚   โ”‚   return True                                                                                                                           โ”‚                  
                    โ”‚    460 โ”‚                                                                                                                                             โ”‚                  
                    โ”‚    461 โ”‚   def __init__(self, data = None):                                                                                                          โ”‚                  
                    โ•ฐโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฏ                  
                    SessionError: SMB SessionError: STATUS_LOGON_FAILURE(The attempted logon is invalid. This is either due to a bad username or authentication                               
                    information.)                                                                                                                                                             
                                                                                                                                                                                              
                    During handling of the above exception, another exception occurred:                                                                                                       
                                                                                                                                                                                              
                    โ•ญโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ Traceback (most recent call last) โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฎ                  
                    โ”‚ /home/fr3sh/.local/pipx/venvs/netexec/lib/python3.11/site-packages/nxc/protocols/smb.py:465 in plaintext_login                                       โ”‚                  
                    โ”‚                                                                                                                                                      โ”‚                  
                    โ”‚    462 โ”‚   โ”‚   โ”‚   self.domain = domain                                                                                                              โ”‚                  
                    โ”‚    463 โ”‚   โ”‚   โ”‚                                                                                                                                     โ”‚                  
                    โ”‚    464 โ”‚   โ”‚   โ”‚   try:                                                                                                                              โ”‚                  
                    โ”‚ โฑ  465 โ”‚   โ”‚   โ”‚   โ”‚   self.conn.login(self.username, self.password, domain)                                                                         โ”‚                  
                    โ”‚    466 โ”‚   โ”‚   โ”‚   except UnicodeEncodeError:                                                                                                        โ”‚                  
                    โ”‚    467 โ”‚   โ”‚   โ”‚   โ”‚   self.logger.error(f"UnicodeEncodeError on:                                                                                    โ”‚                  
                    โ”‚        '{self.username}:{self.password}'. Trying again with a different encoding...")                                                                โ”‚                  
                    โ”‚    468 โ”‚   โ”‚   โ”‚   โ”‚   self.create_conn_obj()                                                                                                        โ”‚                  
                    โ”‚                                                                                                                                                      โ”‚                  
                    โ”‚ /home/fr3sh/.local/pipx/venvs/netexec/lib/python3.11/site-packages/impacket/smbconnection.py:280 in login                                            โ”‚                  
                    โ”‚                                                                                                                                                      โ”‚                  
                    โ”‚   277 โ”‚   โ”‚   โ”‚   else:                                                                                                                              โ”‚                  
                    โ”‚   278 โ”‚   โ”‚   โ”‚   โ”‚   return self._SMBConnection.login(user, password, domain, lmhash, nthash)                                                       โ”‚                  
                    โ”‚   279 โ”‚   โ”‚   except (smb.SessionError, smb3.SessionError) as e:                                                                                     โ”‚                  
                    โ”‚ โฑ 280 โ”‚   โ”‚   โ”‚   raise SessionError(e.get_error_code(), e.get_error_packet())                                                                       โ”‚                  
                    โ”‚   281 โ”‚                                                                                                                                              โ”‚                  
                    โ”‚   282 โ”‚   def kerberosLogin(self, user, password, domain='', lmhash='', nthash='', aesKey='',                                                        โ”‚                  
                    โ”‚       kdcHost=None, TGT=None,                                                                                                                        โ”‚                  
                    โ”‚   283 โ”‚   โ”‚   โ”‚   โ”‚   โ”‚     TGS=None, useCache=True):                                                                                                โ”‚                  
                    โ•ฐโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฏ                  
                    SessionError: SMB SessionError: code: 0xc000006d - STATUS_LOGON_FAILURE - The attempted logon is invalid. This is either due to a bad username or                         
                    authentication information.                                                                                                                                               
                                                                                                                                                                                              
                    During handling of the above exception, another exception occurred:                                                                                                       
                                                                                                                                                                                              
                    โ•ญโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ Traceback (most recent call last) โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฎ                  
                    โ”‚ /home/fr3sh/.local/pipx/venvs/netexec/lib/python3.11/site-packages/nxc/connection.py:121 in __init__                                                 โ”‚                  
                    โ”‚                                                                                                                                                      โ”‚                  
                    โ”‚   118 โ”‚   โ”‚   โ”‚   sleep(value)                                                                                                                       โ”‚                  
                    โ”‚   119 โ”‚   โ”‚                                                                                                                                          โ”‚                  
                    โ”‚   120 โ”‚   โ”‚   try:                                                                                                                                   โ”‚                  
                    โ”‚ โฑ 121 โ”‚   โ”‚   โ”‚   self.proto_flow()                                                                                                                  โ”‚                  
                    โ”‚   122 โ”‚   โ”‚   except Exception as e:                                                                                                                 โ”‚                  
                    โ”‚   123 โ”‚   โ”‚   โ”‚   self.logger.exception(f"Exception while calling proto_flow() on target                                                             โ”‚                  
                    โ”‚       {self.host}: {e}")                                                                                                                             โ”‚                  
                    โ”‚   124                                                                                                                                                โ”‚                  
                    โ”‚                                                                                                                                                      โ”‚                  
                    โ”‚ /home/fr3sh/.local/pipx/venvs/netexec/lib/python3.11/site-packages/nxc/connection.py:168 in proto_flow                                               โ”‚                  
                    โ”‚                                                                                                                                                      โ”‚                  
                    โ”‚   165 โ”‚   โ”‚   if self.create_conn_obj():                                                                                                             โ”‚                  
                    โ”‚   166 โ”‚   โ”‚   โ”‚   self.logger.debug("Created connection object")                                                                                     โ”‚                  
                    โ”‚   167 โ”‚   โ”‚   โ”‚   self.enum_host_info()                                                                                                              โ”‚                  
                    โ”‚ โฑ 168 โ”‚   โ”‚   โ”‚   if self.print_host_info() and (self.login() or (self.username == "" and                                                            โ”‚                  
                    โ”‚       self.password == "")):                                                                                                                         โ”‚                  
                    โ”‚   169 โ”‚   โ”‚   โ”‚   โ”‚   if hasattr(self.args, "module") and self.args.module:                                                                          โ”‚                  
                    โ”‚   170 โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   self.logger.debug("Calling modules")                                                                                       โ”‚                  
                    โ”‚   171 โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   self.call_modules()                                                                                                        โ”‚                  
                    โ”‚                                                                                                                                                      โ”‚                  
                    โ”‚ /home/fr3sh/.local/pipx/venvs/netexec/lib/python3.11/site-packages/nxc/connection.py:465 in login                                                    โ”‚                  
                    โ”‚                                                                                                                                                      โ”‚                  
                    โ”‚   462 โ”‚   โ”‚   if not self.args.no_bruteforce:                                                                                                        โ”‚                  
                    โ”‚   463 โ”‚   โ”‚   โ”‚   for secr_index, secr in enumerate(secret):                                                                                         โ”‚                  
                    โ”‚   464 โ”‚   โ”‚   โ”‚   โ”‚   for user_index, user in enumerate(username):                                                                                   โ”‚                  
                    โ”‚ โฑ 465 โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   if self.try_credentials(domain[user_index], user, owned[user_index],                                                       โ”‚                  
                    โ”‚       secr, cred_type[secr_index], data[secr_index]):                                                                                                โ”‚                  
                    โ”‚   466 โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   owned[user_index] = True                                                                                               โ”‚                  
                    โ”‚   467 โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   if not self.args.continue_on_success:                                                                                  โ”‚                  
                    โ”‚   468 โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   return True                                                                                                        โ”‚                  
                    โ”‚                                                                                                                                                      โ”‚                  
                    โ”‚ /home/fr3sh/.local/pipx/venvs/netexec/lib/python3.11/site-packages/nxc/connection.py:407 in try_credentials                                          โ”‚                  
                    โ”‚                                                                                                                                                      โ”‚                  
                    โ”‚   404 โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   return self.kerberos_login(domain, username, secret, "", "",                                                               โ”‚                  
                    โ”‚       self.kdcHost, False)                                                                                                                           โ”‚                  
                    โ”‚   405 โ”‚   โ”‚   โ”‚   โ”‚   elif hasattr(self.args, "domain"):  # Some protocols don't use domain                                                          โ”‚                  
                    โ”‚       for login                                                                                                                                      โ”‚                  
                    โ”‚   406 โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   self.logger.debug("Trying to authenticate using plaintext with                                                             โ”‚                  
                    โ”‚       domain")                                                                                                                                       โ”‚                  
                    โ”‚ โฑ 407 โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   return self.plaintext_login(domain, username, secret)                                                                      โ”‚                  
                    โ”‚   408 โ”‚   โ”‚   โ”‚   โ”‚   elif self.args.protocol == "ssh":                                                                                              โ”‚                  
                    โ”‚   409 โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   self.logger.debug("Trying to authenticate using plaintext over SSH")                                                       โ”‚                  
                    โ”‚   410 โ”‚   โ”‚   โ”‚   โ”‚   โ”‚   return self.plaintext_login(username, secret, data)                                                                        โ”‚                  
                    โ”‚                                                                                                                                                      โ”‚                  
                    โ”‚ /home/fr3sh/.local/pipx/venvs/netexec/lib/python3.11/site-packages/nxc/protocols/smb.py:503 in plaintext_login                                       โ”‚                  
                    โ”‚                                                                                                                                                      โ”‚                  
                    โ”‚    500 โ”‚   โ”‚   โ”‚   โ”‚   self.create_conn_obj()                                                                                                        โ”‚                  
                    โ”‚    501 โ”‚   โ”‚   โ”‚   return True                                                                                                                       โ”‚                  
                    โ”‚    502 โ”‚   โ”‚   except SessionError as e:                                                                                                             โ”‚                  
                    โ”‚ โฑ  503 โ”‚   โ”‚   โ”‚   error, desc = e.getErrorString()                                                                                                  โ”‚                  
                    โ”‚    504 โ”‚   โ”‚   โ”‚   self.logger.fail(                                                                                                                 โ”‚                  
                    โ”‚    505 โ”‚   โ”‚   โ”‚   โ”‚   f'{domain}\\{self.username}:{process_secret(self.password)} {error}                                                           โ”‚                  
                    โ”‚        {f"({desc})" if self.args.verbose else ""}',                                                                                                  โ”‚                  
                    โ”‚    506 โ”‚   โ”‚   โ”‚   โ”‚   color="magenta" if error in smb_error_status else "red",                                                                      โ”‚                  
                    โ•ฐโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฏ                  
                    ValueError: too many values to unpack (expected 2)   
...

Expected behavior
Nice and clean output like with ldap which is working just fine

NetExec info
DEBUG PYTHON VERSION: 3.11.6 (main, Oct 8 2023, 05:06:43) [GCC 13.2.0]
DEBUG RUNNING ON: Linux Release: 6.5.0-kali3-amd64

  • Installed from: pipx

LAPS auth with smb currently crashing with `-id`

Describe the bug
Due to the current implementation of --laps it will crash when using credentials from the database.

To Reproduce
Steps to reproduce the behavior i.e.:
Command: netexec smb [ip] -id 1 --laps
Resulted in:
Exception, see screenshot

Expected behavior
Query laps password in ldap with user and password retrieved by the db.

Screenshots
image

NetExec info

  • OS: kali-rolling
  • Version of nx: latest
  • Installed from: github upstream

Additional Context
This is due to smb.py line 369 where laps_search is called with direct usernam&password from args and not from db

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.