admin/Pennyw0rth-NetExec
1
0
Fork 0
mirror of https://github.com/Pennyw0rth/NetExec synced 2026-06-06 16:34:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(cmedb): update queries for smb.hosts

Browse Source
This commit is contained in:
Marshall Hallenbeck
2023-03-03 19:37:02 -05:00
parent 9185555c0f
commit bc2ba6a025
3 changed files with 28 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cme/protocols/mssql/db_navigator.py
+4 -4
View File
@@ -20,7 +20,7 @@ class navigator(DatabaseNavigator):
password = cred[4]
# pillaged_from = cred[5]
links = self.db.get_admin_relations(userID=credID)
links = self.db.get_admin_relations(user_id=credID)
data.append([credID, str(len(links)) + ' Host(s)', credtype, domain, username, password])
@@ -39,7 +39,7 @@ class navigator(DatabaseNavigator):
os = host[4]
instances = host[5]
links = self.db.get_admin_relations(hostID=hostID)
links = self.db.get_admin_relations(host_id=hostID)
data.append([hostID, str(len(links)) + ' Cred(s)', ip, hostname, domain, os, instances])
@@ -76,7 +76,7 @@ class navigator(DatabaseNavigator):
data = [['CredID', 'CredType', 'Domain', 'UserName', 'Password']]
for hostID in hostIDList:
links = self.db.get_admin_relations(hostID=hostID)
links = self.db.get_admin_relations(host_id=hostID)
for link in links:
linkID, credID, hostID = link
@@ -155,7 +155,7 @@ class navigator(DatabaseNavigator):
data = [['HostID', 'IP', 'Hostname', 'Domain', 'OS']]
for credID in credIDList:
links = self.db.get_admin_relations(userID=credID)
links = self.db.get_admin_relations(user_id=credID)
for link in links:
linkID, credID, hostID = link
cme/protocols/smb/database.py
+18 -23
View File
@@ -11,10 +11,12 @@ class database:
self.conn = conn
self.metadata = metadata
self.computers_table = metadata.tables["computers"]
self.users_table = metadata.tables["users"]
self.groups_table = metadata.tables["groups"]
self.shares_table = metadata.tables["shares"]
self.admin_relations_table = metadata.tables["admin_relations"]
self.group_relations_table = metadata.tables["group_relations"]
self.loggedin_relations = metadata.tables["loggedin_relations"]
@staticmethod
def db_schema(db_conn):
@@ -363,31 +365,28 @@ class database:
self.conn.commit()
self.conn.close()
def get_admin_relations(self, userID=None, hostID=None):
if userID:
self.conn.execute("SELECT * FROM admin_relations WHERE userid=?", [userID])
elif hostID:
self.conn.execute("SELECT * FROM admin_relations WHERE computerid=?", [hostID])
def get_admin_relations(self, user_id=None, host_id=None):
if user_id:
results = self.conn.query(self.admin_relations_table).filter(self.admin_relations_table.c.userid == user_id).all()
elif host_id:
results = self.conn.query(self.admin_relations_table).filter(
self.admin_relations_table.c.computerid == host_id).all()
else:
self.conn.execute("SELECT * FROM admin_relations")
results = self.conn.query(self.admin_relations_table).all()
results = self.conn.fetchall()
self.conn.commit()
self.conn.close()
return results
def get_group_relations(self, userID=None, groupID=None):
if userID and groupID:
self.conn.execute("SELECT * FROM group_relations WHERE userid=? and groupid=?", [userID, groupID])
def get_group_relations(self, user_id=None, group_id=None):
if user_id and group_id:
self.conn.execute("SELECT * FROM group_relations WHERE userid=? and groupid=?", [user_id, group_id])
elif userID:
self.conn.execute("SELECT * FROM group_relations WHERE userid=?", [userID])
elif user_id:
self.conn.execute("SELECT * FROM group_relations WHERE userid=?", [user_id])
elif groupID:
self.conn.execute("SELECT * FROM group_relations WHERE groupid=?", [groupID])
elif group_id:
self.conn.execute("SELECT * FROM group_relations WHERE groupid=?", [group_id])
results = self.conn.fetchall()
self.conn.commit()
@@ -514,23 +513,19 @@ class database:
# if we're returning a single host by ID
if self.is_computer_valid(filterTerm):
self.conn.execute("SELECT * FROM computers WHERE id=? LIMIT 1", [filterTerm])
# if we're filtering by domain controllers
elif filterTerm == 'dc':
if domain:
self.conn.execute("SELECT * FROM computers WHERE dc=1 AND LOWER(domain)=LOWER(?)", [domain])
else:
self.conn.execute("SELECT * FROM computers WHERE dc=1")
# if we're filtering by ip/hostname
elif filterTerm and filterTerm != "":
self.conn.execute("SELECT * FROM computers WHERE ip LIKE ? OR LOWER(hostname) LIKE LOWER(?)", ['%{}%'.format(filterTerm), '%{}%'.format(filterTerm)])
# otherwise return all computers
else:
self.conn.execute("SELECT * FROM computers")
results = self.conn.query(self.computers_table).all()
results = self.conn.fetchall()
self.conn.commit()
self.conn.close()
return results
cme/protocols/smb/db_navigator.py
+6 -6
View File
@@ -20,7 +20,7 @@ class navigator(DatabaseNavigator):
credtype = cred[4]
# pillaged_from = cred[5]
links = self.db.get_admin_relations(userID=credID)
links = self.db.get_admin_relations(user_id=credID)
data.append([credID, str(len(links)) + ' Host(s)', credtype, domain, username, password])
@@ -34,7 +34,7 @@ class navigator(DatabaseNavigator):
groupID = group[0]
domain = group[1]
name = group[2]
members = len(self.db.get_group_relations(groupID=groupID))
members = len(self.db.get_group_relations(group_id=groupID))
data.append([groupID, domain, name, members])
@@ -69,7 +69,7 @@ class navigator(DatabaseNavigator):
spooler = ''
zerologon = ''
petitpotam = ''
links = self.db.get_admin_relations(hostID=hostID)
links = self.db.get_admin_relations(host_id=hostID)
data.append([hostID, str(len(links)) + ' Cred(s)', ip, hostname, domain, os, smbv1, signing, spooler, zerologon, petitpotam])
print_table(data, title='Hosts')
@@ -217,7 +217,7 @@ class navigator(DatabaseNavigator):
data = [['CredID', 'CredType', 'Pillaged From HostID', 'Domain', 'UserName', 'Password']]
for group in groups:
members = self.db.get_group_relations(groupID=group[0])
members = self.db.get_group_relations(group_id=group[0])
for member in members:
_,userid,_ = member
@@ -267,7 +267,7 @@ class navigator(DatabaseNavigator):
data = [['CredID', 'CredType', 'Domain', 'UserName', 'Password']]
for hostID in hostIDList:
links = self.db.get_admin_relations(hostID=hostID)
links = self.db.get_admin_relations(host_id=hostID)
for link in links:
linkID, credID, hostID = link
@@ -414,7 +414,7 @@ class navigator(DatabaseNavigator):
data = [['HostID', 'IP', 'Hostname', 'Domain', 'OS']]
for credID in credIDList:
links = self.db.get_admin_relations(userID=credID)
links = self.db.get_admin_relations(user_id=credID)
for link in links:
linkID, credID, hostID = link