This commit is contained in:
mpgn
2024-12-17 21:08:00 +01:00
parent fb369f05b6
commit cb44d09df7
3 changed files with 5 additions and 9 deletions
+1 -1
View File
@@ -20,7 +20,7 @@ class NXCModule:
def on_admin_login(self, context, connection):
found = 0
for directory in connection.conn.listPath("C$", "Users\\*"):
for directory in connection.conn.listPath("C$", "Users\\*"):
if directory.get_longname() not in self.false_positive and directory.is_directory():
try:
notepad_backup_dir = f"Users\\{directory.get_longname()}\\AppData\\Roaming\\Notepad++\\backup\\"
+3 -7
View File
@@ -25,7 +25,7 @@ class NXCModule:
self.export = bool(module_options.get("EXPORT", False))
def on_admin_login(self, context, connection):
for directory in connection.conn.listPath("C$", "Users\\*"):
for directory in connection.conn.listPath("C$", "Users\\*"):
if directory.get_longname() not in self.false_positive and directory.is_directory():
try:
powershell_history_dir = f"Users\\{directory.get_longname()}\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadLine\\"
@@ -37,12 +37,8 @@ class NXCModule:
connection.conn.getFile("C$", file_path, buf.write)
buf.seek(0)
file_content = buf.read().decode("utf-8", errors="ignore").lower()
keywords = []
for keyword in self.sensitive_keywords:
if keyword in file_content:
keywords.append(keyword.upper())
if keyword:
keywords = [keyword.upper() for keyword in self.sensitive_keywords if keyword in file_content]
if len(keywords):
context.log.highlight(f"C:\\{file_path} [ {' '.join(keywords)} ]")
else:
context.log.highlight(f"C:\\{file_path}")
+1 -1
View File
@@ -38,7 +38,7 @@ class NXCModule:
remoteOps._RemoteOperations__rrp,
regHandle,
"Software\\Policies\\Microsoft\\Windows NT\\Terminal Services\\"
)['phkResult']
)["phkResult"]
# Checks if the key already exists or not
try: