Create get_gpos module, implement get-folder command, and add some module helper functions #320

Marshall-Hallenbeck · 2024-05-21T19:30:38Z

I was initially going to have the get_gpos module have the ability to download all of them, hence the helper functions, but LDAP can only query certain GPO information, so it'd have to be another SMB module to download them all; however, the user can just take the GUID output from the module and pass it to --get-folder

get_gpos module:

--get-folder feature:

…into marshall-get-gpos

…o from LDAP

NeffIsBack · 2024-06-14T20:17:29Z

Would it be possible to detect a folder on a remote system? Than we could just integrate it into the existing get commands

Marshall-Hallenbeck · 2024-06-14T20:28:23Z

Would it be possible to detect a folder on a remote system? Than we could just integrate it into the existing get commands

Well the current get-file command references a file, so what would we change it to? I think having them separate makes more sense.

NeffIsBack · 2024-06-15T00:49:30Z

Would it be possible to detect a folder on a remote system? Than we could just integrate it into the existing get commands

Well the current get-file command references a file, so what would we change it to? I think having them separate makes more sense.

Hmm yeah i was thinking about moving --get-file/--put-file maybe to --get/--put anyway and add some sort of deprecation warning for the old function. But of course that would only make sense if it is possible to do a smart download/upload. Thoughts?

Marshall-Hallenbeck · 2024-06-15T14:38:03Z

just using the verbs "get" and "put" doesn't make it clear what you are getting or putting, so it's sorta confusing, and honestly, changing all that code to just make it a single call sounds like a huge pain in the ass that I'm not interested in doing lol

Signed-off-by: Marshall Hallenbeck <[email protected]>

NeffIsBack · 2024-06-18T15:10:36Z

just using the verbs "get" and "put" doesn't make it clear what you are getting or putting, so it's sorta confusing, and honestly, changing all that code to just make it a single call sounds like a huge pain in the ass that I'm not interested in doing lol

I mean we are on SMB, imo its pretty clear what you are trying to achieve. But if it cant be changed by a fairly simple check or try&except call its fine i guess. I just try to limit the amount of options the smb protocol has, there are already a lot (too much imo)

Marshall-Hallenbeck · 2024-06-18T15:53:21Z

I mean we are on SMB, imo its pretty clear what you are trying to achieve

Well I disagree with that... we have numerous options to get things such as users, groups, disks, computers, etc all under the SMB protocol.

…not be merged

NeffIsBack

Tried to request a non valid folder, imo that should be handled with a proper message:

Rest looks good so far:

NeffIsBack · 2024-06-21T22:48:24Z

nxc/helpers/modules.py

+ module_logger.addHandler(module_file_handler)
+ return module_logger
+
+def add_loot_data(module_name, filename, data):


Can you add this as an example to the example_module.py?

NeffIsBack · 2024-06-21T23:07:54Z

nxc/modules/get_gpos.py

+ if self.gpo_name:
+ if k == "displayname":
+ context.log.highlight(f"Display Name: {v}")
+ elif k == "name":
+ context.log.highlight(f"GUID: {v}")
+ else:
+ context.log.highlight(f"{k}: {v}")


Any specific reason you only "pretty print" the key&value pair if self.gpo_name is set and not always?

NeffIsBack · 2024-06-21T23:09:50Z

tests/e2e_commands.txt

@@ -177,6 +177,14 @@ netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M subnets
 netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M user-desc
 netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M whoami
 netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M pso
+netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M get_gpos
+netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M get_gpos --options


--options should be removed

NeffIsBack · 2024-06-22T00:02:44Z

nxc/protocols/smb.py

+ self.logger.debug(f"Sharing violation on {remote_path}: {e}")
+ return False
+ except Exception as e:
+ self.logger.debug(f"Other error when attempting to download file {remote_path}: {e}")


imo we should include the error message in the fail output not in the debug log

NeffIsBack · 2024-06-22T00:17:32Z

nxc/protocols/smb.py

+ def get_file_single(self, remote_path, download_path, silent=False):
 share_name = self.args.share
- self.logger.display(f'Copying "{remote_path}" to "{download_path}"')
+ if not silent:
+ self.logger.display(f"Copying '{remote_path}' to '{download_path}'")
 if self.args.append_host:
 download_path = f"{self.hostname}-{remote_path}"
 with open(download_path, "wb+") as file:
- try:
- self.conn.getFile(share_name, remote_path, file.write)
- self.logger.success(f'File "{remote_path}" was downloaded to "{download_path}"')
- except Exception as e:
- self.logger.fail(f'Error writing file "{remote_path}" from share "{share_name}": {e}')
- if os.path.getsize(download_path) == 0:
- os.remove(download_path)
-
+ if self.download_file(share_name, remote_path, file.write):
+ if not silent:
+ self.logger.success(f"File '{remote_path}' was downloaded to '{download_path}'")
+ else:
+ self.logger.debug("Opening with READ alone failed, trying to open file with READ/WRITE access")
+ if self.download_file(share_name, remote_path, file.write, FILE_READ_DATA | FILE_WRITE_DATA):
+ if not silent:
+ self.logger.success(f"File '{remote_path}' was downloaded to '{download_path}'")
+ else:
+ if not silent:
+ self.logger.fail(f"Error downloading file '{remote_path}' from share '{share_name}'")


I am kinda not a huge fan of having 3 different "get file" functions now. Maybe we should merge this function with download_file and make the access_mode and log message conditional? That way we can also get the error message in the fail message.

NeffIsBack · 2024-06-22T00:59:30Z

I mean we are on SMB, imo its pretty clear what you are trying to achieve

Well I disagree with that... we have numerous options to get things such as users, groups, disks, computers, etc all under the SMB protocol.

That is true but it is still listed in the Options for put and get remote files. Also the options have descriptions & we have a wiki. Imo that should be enough, but if its not possible it doesnt matter anyway :D

NeffIsBack · 2024-06-22T22:52:38Z

why the heck did i/it close it lol

Marshall-Hallenbeck added 6 commits May 16, 2024 12:06

feat(get-gpos): add new module to get GPOs from LDAP

1409fea

feat(modules): add module helper for logging and loot saving

3ec55a6

feat(get_gpos): add in more options

e5151ff

feat(get-gpos): add new module to get GPOs from LDAP

83a4758

feat(modules): add module helper for logging and loot saving

13bf6ee

feat(get_gpos): add in more options

9c952be

Marshall-Hallenbeck added enhancement New feature or request new module refactor labels May 21, 2024

Marshall-Hallenbeck self-assigned this May 21, 2024

Marshall-Hallenbeck added 3 commits May 21, 2024 15:32

Merge remote-tracking branch 'refs/remotes/remote/marshall-get-gpos' …

785169f

…into marshall-get-gpos

feat(smb): add feature to download entire folders from target

0d5daf6

smb: clean up get-folder code

b551d11

Marshall-Hallenbeck marked this pull request as ready for review May 22, 2024 09:44

Marshall-Hallenbeck requested review from zblurx, NeffIsBack and mpgn as code owners May 22, 2024 09:44

Marshall-Hallenbeck changed the title ~~Create get_gpos module and update how modules perform specific logging & loot saving~~ Create get_gpos module, implement get-folder command, and add some module helper functions May 22, 2024

Marshall-Hallenbeck added 2 commits May 22, 2024 05:47

add function to get loot data folder for modules

d17460d

get_gpos: remove download option as you can only retrieve certain inf…

beb0885

…o from LDAP

NeffIsBack added this to the v1.3.0 milestone May 25, 2024

Marshall-Hallenbeck mentioned this pull request Jun 6, 2024

Add Recall module for dumping all users Microsoft Recall DBs & screenshots #335

Open

NeffIsBack linked an issue Jun 15, 2024 that may be closed by this pull request

Multi-file / Folder upload for --put-file #281

Open

Merge branch 'main' into marshall-get-gpos

d5883ae

Signed-off-by: Marshall Hallenbeck <[email protected]>

feat: add all updated folder download stuff from #335 since that may …

8e1bc7b

…not be merged

NeffIsBack requested changes Jun 22, 2024

View reviewed changes

NeffIsBack closed this Jun 22, 2024

NeffIsBack reopened this Jun 22, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Create get_gpos module, implement get-folder command, and add some module helper functions #320

Create get_gpos module, implement get-folder command, and add some module helper functions #320

Marshall-Hallenbeck commented May 21, 2024 •

edited

NeffIsBack commented Jun 14, 2024

Marshall-Hallenbeck commented Jun 14, 2024

NeffIsBack commented Jun 15, 2024

Marshall-Hallenbeck commented Jun 15, 2024

NeffIsBack commented Jun 18, 2024

Marshall-Hallenbeck commented Jun 18, 2024

NeffIsBack left a comment

NeffIsBack Jun 21, 2024

NeffIsBack Jun 21, 2024

NeffIsBack Jun 21, 2024

NeffIsBack Jun 22, 2024

NeffIsBack Jun 22, 2024

NeffIsBack commented Jun 22, 2024 •

edited

NeffIsBack commented Jun 22, 2024

Create get_gpos module, implement get-folder command, and add some module helper functions #320

Are you sure you want to change the base?

Create get_gpos module, implement get-folder command, and add some module helper functions #320

Conversation

Marshall-Hallenbeck commented May 21, 2024 • edited

NeffIsBack commented Jun 14, 2024

Marshall-Hallenbeck commented Jun 14, 2024

NeffIsBack commented Jun 15, 2024

Marshall-Hallenbeck commented Jun 15, 2024

NeffIsBack commented Jun 18, 2024

Marshall-Hallenbeck commented Jun 18, 2024

NeffIsBack left a comment

Choose a reason for hiding this comment

NeffIsBack Jun 21, 2024

Choose a reason for hiding this comment

NeffIsBack Jun 21, 2024

Choose a reason for hiding this comment

NeffIsBack Jun 21, 2024

Choose a reason for hiding this comment

NeffIsBack Jun 22, 2024

Choose a reason for hiding this comment

NeffIsBack Jun 22, 2024

Choose a reason for hiding this comment

NeffIsBack commented Jun 22, 2024 • edited

NeffIsBack commented Jun 22, 2024

Marshall-Hallenbeck commented May 21, 2024 •

edited

NeffIsBack commented Jun 22, 2024 •

edited