From 675975e614f522b4a0b97979fc92ffeede6aae12 Mon Sep 17 00:00:00 2001 From: termanix Date: Thu, 16 Jan 2025 04:46:43 -0500 Subject: [PATCH 1/8] Fix procdump deleting when lsass dump fail --- nxc/modules/procdump.py | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/nxc/modules/procdump.py b/nxc/modules/procdump.py index 6432481b..a5a8902a 100644 --- a/nxc/modules/procdump.py +++ b/nxc/modules/procdump.py @@ -152,3 +152,10 @@ class NXCModule: add_user_bh(credz_bh, None, context.log, connection.config) except Exception as e: context.log.fail("Error openning dump file", str(e)) + + else: + try: + connection.conn.deleteFile(self.share, self.tmp_share + self.procdump) + context.log.success(f"Deleted procdump file on the {self.share} share") + except Exception as e: + context.log.fail(f"Error deleting procdump file on share {self.share}: {e}") \ No newline at end of file From fdb1a7993a50fc8e6b7e6f806b54ead01a8f9a0f Mon Sep 17 00:00:00 2001 From: termanix Date: Thu, 16 Jan 2025 05:12:46 -0500 Subject: [PATCH 2/8] Fix lsass dump files deleting process when dump fail --- nxc/modules/handlekatz.py | 17 ++++++++++++----- nxc/modules/nanodump.py | 3 +++ 2 files changed, 15 insertions(+), 5 deletions(-) diff --git a/nxc/modules/handlekatz.py b/nxc/modules/handlekatz.py index 7aa7ab7c..af18005f 100644 --- a/nxc/modules/handlekatz.py +++ b/nxc/modules/handlekatz.py @@ -78,6 +78,7 @@ class NXCModule: if not p or p == "None": context.log.fail("Failed to execute command to get LSASS PID") + self.delete_handlekatz_binary(connection, context) return # we get a CSV string back from `tasklist`, so we grab the PID from it pid = p.split(",")[1][1:-1] @@ -113,11 +114,7 @@ class NXCModule: except Exception as e: context.log.fail(f"Error while get file: {e}") - try: - connection.conn.deleteFile(self.share, self.tmp_share + self.handlekatz) - context.log.success(f"Deleted handlekatz file on the {self.share} share") - except Exception as e: - context.log.fail(f"[OPSEC] Error deleting handlekatz file on share {self.share}: {e}") + self.delete_handlekatz_binary() try: connection.conn.deleteFile(self.share, self.tmp_share + machine_name) @@ -182,3 +179,13 @@ class NXCModule: add_user_bh(credz_bh, None, context.log, connection.config) except Exception as e: context.log.fail(f"Error opening dump file: {e}") + + else: + self.delete_handlekatz_binary(connection, context) + + def delete_handlekatz_binary(self, connection, context): + try: + connection.conn.deleteFile(self.share, self.tmp_share + self.handlekatz) + context.log.success(f"Deleted handlekatz file on the {self.share} share") + except Exception as e: + context.log.fail(f"[OPSEC] Error deleting handlekatz file on share {self.share}: {e}") diff --git a/nxc/modules/nanodump.py b/nxc/modules/nanodump.py index 5dc1ec2d..71a86144 100644 --- a/nxc/modules/nanodump.py +++ b/nxc/modules/nanodump.py @@ -252,6 +252,9 @@ class NXCModule: except Exception as e: self.context.log.fail(f"Error opening dump file: {e}") + else: + self.delete_nanodump_binary() + def delete_nanodump_binary(self): try: self.connection.execute(f"del {self.remote_tmp_dir + self.nano}") From dd6c62e8c23454046fa397e5155614ede72dd3bb Mon Sep 17 00:00:00 2001 From: termanix Date: Thu, 16 Jan 2025 05:18:39 -0500 Subject: [PATCH 3/8] Delete funciton created with same as nanodump and handlekatz --- nxc/modules/procdump.py | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/nxc/modules/procdump.py b/nxc/modules/procdump.py index a5a8902a..c53a0ae6 100644 --- a/nxc/modules/procdump.py +++ b/nxc/modules/procdump.py @@ -98,11 +98,7 @@ class NXCModule: except Exception as e: context.log.fail(f"Error while get file: {e}") - try: - connection.conn.deleteFile(self.share, self.tmp_share + self.procdump) - context.log.success(f"Deleted procdump file on the {self.share} share") - except Exception as e: - context.log.fail(f"Error deleting procdump file on share {self.share}: {e}") + self.delete_procdump_binary(connection, context) try: connection.conn.deleteFile(self.share, self.tmp_share + machine_name) @@ -154,8 +150,11 @@ class NXCModule: context.log.fail("Error openning dump file", str(e)) else: - try: - connection.conn.deleteFile(self.share, self.tmp_share + self.procdump) - context.log.success(f"Deleted procdump file on the {self.share} share") - except Exception as e: - context.log.fail(f"Error deleting procdump file on share {self.share}: {e}") \ No newline at end of file + self.delete_procdump_binary(connection, context) + + def delete_procdump_binary(self, connection, context): + try: + connection.conn.deleteFile(self.share, self.tmp_share + self.procdump) + context.log.success(f"Deleted procdump file on the {self.share} share") + except Exception as e: + context.log.fail(f"Error deleting procdump file on share {self.share}: {e}") \ No newline at end of file From 34063e3410eaf969f68a37b45c7ed3a27bd64ea2 Mon Sep 17 00:00:00 2001 From: Alexander Neff Date: Sun, 2 Feb 2025 18:09:30 -0500 Subject: [PATCH 4/8] Increase readability --- nxc/modules/handlekatz.py | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/nxc/modules/handlekatz.py b/nxc/modules/handlekatz.py index af18005f..6bc5758e 100644 --- a/nxc/modules/handlekatz.py +++ b/nxc/modules/handlekatz.py @@ -97,12 +97,15 @@ class NXCModule: context.log.fail("Process lsass.exe error un dump, try with verbose") dump = False - if dump: + if not dump: + self.delete_handlekatz_binary(connection, context) + return + else: regex = r"([A-Za-z0-9-]*\.log)" matches = re.search(regex, str(p), re.MULTILINE) if not matches: context.log.display("Error getting the lsass.dmp file name") - sys.exit(1) + return machine_name = matches.group() context.log.display(f"Copy {machine_name} to host") @@ -115,7 +118,6 @@ class NXCModule: context.log.fail(f"Error while get file: {e}") self.delete_handlekatz_binary() - try: connection.conn.deleteFile(self.share, self.tmp_share + machine_name) context.log.success(f"Deleted lsass.dmp file on the {self.share} share") @@ -180,9 +182,6 @@ class NXCModule: except Exception as e: context.log.fail(f"Error opening dump file: {e}") - else: - self.delete_handlekatz_binary(connection, context) - def delete_handlekatz_binary(self, connection, context): try: connection.conn.deleteFile(self.share, self.tmp_share + self.handlekatz) From 056b69a92c32392ec1f3b580e042c7e12bdd63a9 Mon Sep 17 00:00:00 2001 From: Alexander Neff Date: Sun, 2 Feb 2025 18:10:01 -0500 Subject: [PATCH 5/8] Lint --- nxc/modules/handlekatz.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nxc/modules/handlekatz.py b/nxc/modules/handlekatz.py index 6bc5758e..3e5411cb 100644 --- a/nxc/modules/handlekatz.py +++ b/nxc/modules/handlekatz.py @@ -50,7 +50,7 @@ class NXCModule: def on_admin_login(self, context, connection): handlekatz_loc = self.handlekatz_path + self.handlekatz - + if self.useembeded: try: with open(handlekatz_loc, "wb") as handlekatz: From 7d918e403b646e9fd65ca04efddf11b4b71a018c Mon Sep 17 00:00:00 2001 From: Alexander Neff Date: Sun, 2 Feb 2025 18:11:09 -0500 Subject: [PATCH 6/8] Increase readability --- nxc/modules/nanodump.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/nxc/modules/nanodump.py b/nxc/modules/nanodump.py index 71a86144..91938836 100644 --- a/nxc/modules/nanodump.py +++ b/nxc/modules/nanodump.py @@ -149,7 +149,10 @@ class NXCModule: self.context.log.fail("Process lsass.exe error on dump, try with verbose") dump = False - if dump: + if not dump: + self.delete_nanodump_binary() + return + else: self.context.log.display(f"Copying {nano_log_name} to host") filename = os.path.join(self.dir_result, f"{self.connection.hostname}_{self.connection.os_arch}_{self.connection.domain}.log") if self.context.protocol == "smb": @@ -251,9 +254,6 @@ class NXCModule: add_user_bh(bh_creds, None, self.context.log, self.connection.config) except Exception as e: self.context.log.fail(f"Error opening dump file: {e}") - - else: - self.delete_nanodump_binary() def delete_nanodump_binary(self): try: From cb6cef60e8681988f88f281870de1fbc6f599de7 Mon Sep 17 00:00:00 2001 From: Alexander Neff Date: Sun, 2 Feb 2025 18:13:20 -0500 Subject: [PATCH 7/8] Increase readability and don't force quit on error --- nxc/modules/procdump.py | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/nxc/modules/procdump.py b/nxc/modules/procdump.py index c53a0ae6..68f1c90c 100644 --- a/nxc/modules/procdump.py +++ b/nxc/modules/procdump.py @@ -4,7 +4,6 @@ import base64 import re -import sys import pypykatz from nxc.helpers.bloodhound import add_user_bh from nxc.paths import TMP_PATH @@ -79,7 +78,10 @@ class NXCModule: else: context.log.fail("Process lsass.exe error un dump, try with verbose") - if dump: + if not dump: + self.delete_procdump_binary(connection, context) + return + else: regex = r"([A-Za-z0-9-]*.dmp)" matches = re.search(regex, str(p), re.MULTILINE) machine_name = "" @@ -87,7 +89,7 @@ class NXCModule: machine_name = matches.group() else: context.log.display("Error getting the lsass.dmp file name") - sys.exit(1) + return context.log.display(f"Copy {machine_name} to host") @@ -149,12 +151,9 @@ class NXCModule: except Exception as e: context.log.fail("Error openning dump file", str(e)) - else: - self.delete_procdump_binary(connection, context) - def delete_procdump_binary(self, connection, context): try: connection.conn.deleteFile(self.share, self.tmp_share + self.procdump) context.log.success(f"Deleted procdump file on the {self.share} share") except Exception as e: - context.log.fail(f"Error deleting procdump file on share {self.share}: {e}") \ No newline at end of file + context.log.fail(f"Error deleting procdump file on share {self.share}: {e}") From f87535ee3af29b68488508ffbbe764a533cd00ae Mon Sep 17 00:00:00 2001 From: Alexander Neff Date: Sun, 2 Feb 2025 18:18:12 -0500 Subject: [PATCH 8/8] Lint --- nxc/modules/nanodump.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nxc/modules/nanodump.py b/nxc/modules/nanodump.py index 91938836..053bdcaf 100644 --- a/nxc/modules/nanodump.py +++ b/nxc/modules/nanodump.py @@ -254,7 +254,7 @@ class NXCModule: add_user_bh(bh_creds, None, self.context.log, self.connection.config) except Exception as e: self.context.log.fail(f"Error opening dump file: {e}") - + def delete_nanodump_binary(self): try: self.connection.execute(f"del {self.remote_tmp_dir + self.nano}")