diff --git a/cme/modules/get_netconnections.py b/cme/modules/get_netconnections.py new file mode 100755 index 00000000..efdfb97e --- /dev/null +++ b/cme/modules/get_netconnections.py @@ -0,0 +1,37 @@ +from datetime import datetime +from cme.helpers.logger import write_log +import json + +class CMEModule: + ''' + Uses WMI to extract network connections, used to find multi-homed hosts. + Module by @fang0654 + + ''' + + name = 'get_netconnections' + description = 'Uses WMI to query network connections.' + supported_protocols = ['smb'] + opsec_safe= True + multiple_hosts = True + + def options(self, context, module_options): + ''' + No options + ''' + pass + + def on_admin_login(self, context, connection): + + data = [] + cards = connection.wmi(f"select DNSDomainSuffixSearchOrder, IPAddress from win32_networkadapterconfiguration") + for c in cards: + if c['IPAddress'].get('value'): + context.log.success(f"IP Address: {c['IPAddress']['value']}\tSearch Domain: {c['DNSDomainSuffixSearchOrder']['value']}") + + data.append(cards) + + log_name = 'network-connections-{}-{}.log'.format(connection.args.target[0], datetime.now().strftime("%Y-%m-%d_%H%M%S")) + write_log(json.dumps(data), log_name) + context.log.info("Saved raw output to {}".format(log_name)) +