From 698c32f73d99ae99dae709c065695911cc94c9c5 Mon Sep 17 00:00:00 2001 From: FRE Date: Thu, 22 May 2025 15:08:56 +0200 Subject: [PATCH 1/2] [WCC] Ignore KDNIC in NBTNS check --- nxc/modules/wcc.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/nxc/modules/wcc.py b/nxc/modules/wcc.py index 2db273f2..8e9db30f 100644 --- a/nxc/modules/wcc.py +++ b/nxc/modules/wcc.py @@ -454,13 +454,21 @@ class HostChecker: return ok, reasons def check_nbtns(self): + adapters_key = "HKLM\\SYSTEM\\CurrentControlSet\\Control\\Class\\{4d36e972-e325-11ce-bfc1-08002be10318}" key_name = "HKLM\\SYSTEM\\CurrentControlSet\\Services\\NetBT\\Parameters\\Interfaces" subkeys = self.reg_get_subkeys(self.dce, self.connection, key_name) success = False reasons = [] missing = 0 nbtns_enabled = 0 + for subkey in subkeys: + # Ignore Microsoft Kernel Debug Network Adapter + kdnic_key = adapters_key + "\\0000" + kdnic_uuid = self.reg_query_value(self.dce, self.connection, kdnic_key, "NetCfgInstanceId") + if subkey.lower() == ("Tcpip_" + kdnic_uuid).replace('\x00','').lower(): + continue + value = self.reg_query_value(self.dce, self.connection, key_name + "\\" + subkey, "NetbiosOptions") if type(value) == DCERPCSessionError: if value.error_code == ERROR_OBJECT_NOT_FOUND: From d76127cc09fe79845ac2d6b5e2d31aff452f7386 Mon Sep 17 00:00:00 2001 From: FRE Date: Thu, 22 May 2025 15:33:13 +0200 Subject: [PATCH 2/2] [WCC] Add check for LLMNR --- nxc/modules/wcc.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/nxc/modules/wcc.py b/nxc/modules/wcc.py index 8e9db30f..da076966 100644 --- a/nxc/modules/wcc.py +++ b/nxc/modules/wcc.py @@ -179,6 +179,7 @@ class HostChecker: ConfigCheck("CredentialGuard enabled", "Checks if CredentialGuard is enabled", checker_args=[[self, ("HKLM\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard", "EnableVirtualizationBasedSecurity", 1), ("HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa", "LsaCfgFlags", 1)]]), ConfigCheck("Lsass run as PPL", "Checks if lsass runs as a protected process", checker_args=[[self, ("HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa", "RunAsPPL", 1)]]), ConfigCheck("No Powershell v2", "Checks if powershell v2 is available", checker_args=[[self, ("HKLM\\SOFTWARE\\Microsoft\\PowerShell\\3\\PowerShellEngine", "PSCompatibleVersion", "2.0", not_(operator.contains))]]), + ConfigCheck("LLMNR disabled", "Checks if LLMNR is disabled", checker_args=[[self, ("HKLM\\Software\\policies\\Microsoft\\Windows NT\\DNSClient", "EnableMulticast", 0)]]), ConfigCheck("LmCompatibilityLevel == 5", "Checks if LmCompatibilityLevel is set to 5", checker_args=[[self, ("HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa", "LmCompatibilityLevel", 5, operator.ge)]]), ConfigCheck("NBTNS disabled", "Checks if NBTNS is disabled on all interfaces", checkers=[self.check_nbtns]), ConfigCheck("mDNS disabled", "Checks if mDNS is disabled", checker_args=[[self, ("HKLM\\SYSTEM\\CurrentControlSet\\Services\\DNScache\\Parameters", "EnableMDNS", 0)]]), @@ -466,7 +467,7 @@ class HostChecker: # Ignore Microsoft Kernel Debug Network Adapter kdnic_key = adapters_key + "\\0000" kdnic_uuid = self.reg_query_value(self.dce, self.connection, kdnic_key, "NetCfgInstanceId") - if subkey.lower() == ("Tcpip_" + kdnic_uuid).replace('\x00','').lower(): + if subkey.lower() == ("Tcpip_" + kdnic_uuid).replace("\x00", "").lower(): continue value = self.reg_query_value(self.dce, self.connection, key_name + "\\" + subkey, "NetbiosOptions")