From a04f08db4ba8c2edb9a9ed196b6d5fd4eeb4e7c1 Mon Sep 17 00:00:00 2001 From: Alexander Neff Date: Sun, 22 Oct 2023 11:38:45 -0400 Subject: [PATCH 1/4] Improve bloodhound connector when adding users and using the NETBIOS name from the domain --- nxc/connection.py | 4 ---- nxc/helpers/bloodhound.py | 19 +++++++++++++++---- 2 files changed, 15 insertions(+), 8 deletions(-) diff --git a/nxc/connection.py b/nxc/connection.py index 58c26046..d6f59f6a 100755 --- a/nxc/connection.py +++ b/nxc/connection.py @@ -389,10 +389,6 @@ class connection: return False if self.args.continue_on_success and owned: return False - # Enforcing FQDN for SMB if not using local authentication. Related issues/PRs: #26, #28, #24, #38 - if self.args.protocol == "smb" and not self.args.local_auth and "." not in domain and not self.args.laps and secret != "" and self.domain.upper() != self.hostname.upper(): - self.logger.error(f"Domain {domain} for user {username.rstrip()} need to be FQDN ex:domain.local, not domain") - return False with sem: if cred_type == "plaintext": diff --git a/nxc/helpers/bloodhound.py b/nxc/helpers/bloodhound.py index 66336a4d..c6a00dcf 100644 --- a/nxc/helpers/bloodhound.py +++ b/nxc/helpers/bloodhound.py @@ -43,13 +43,21 @@ def add_user_bh(user, domain, logger, config): try: with driver.session() as session, session.begin_transaction() as tx: for info in users_owned: + distinguished_name = "".join(["DC=" + dc + "," for dc in info["domain"].split(".")]).rstrip(",") + domain_query = tx.run(f'MATCH (d:Domain) WHERE d.distinguishedname STARTS WITH "{distinguished_name}" RETURN d').data() + if not domain_query: + raise Exception("Domain not found in bloodhound") + else: + domain = domain_query[0]["d"].get("name") + if info["username"][-1] == "$": - user_owned = info["username"][:-1] + "." + info["domain"] + user_owned = info["username"][:-1] + "." + domain account_type = "Computer" else: - user_owned = info["username"] + "@" + info["domain"] + user_owned = info["username"] + "@" + domain account_type = "User" + result = tx.run(f'MATCH (c:{account_type} {{name:"{user_owned}"}}) RETURN c') if result.data()[0]["c"].get("owned") in (False, None): @@ -63,7 +71,10 @@ def add_user_bh(user, domain, logger, config): logger.fail(f"Neo4J does not seem to be available on {uri}.") return except Exception as e: - logger.fail(f"Unexpected error with Neo4J: {e}") - logger.fail("Account not found on the domain") + if "Domain not found in bloodhound" in str(e): + logger.fail("Neo4J Error: Domain not found in BloodHound. Please specify the FQDN ex:domain.local.") + else: + logger.fail(f"Unexpected error with Neo4J: {e}") + logger.fail("Account not found on the domain") return driver.close() From 4840ea0cd3b89ca4f62d5856887f20921112fe3d Mon Sep 17 00:00:00 2001 From: Alexander Neff Date: Mon, 30 Oct 2023 10:38:52 -0400 Subject: [PATCH 2/4] Changed to f-string, swapped single quote to double quotes --- nxc/helpers/bloodhound.py | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/nxc/helpers/bloodhound.py b/nxc/helpers/bloodhound.py index c6a00dcf..90f311c0 100644 --- a/nxc/helpers/bloodhound.py +++ b/nxc/helpers/bloodhound.py @@ -43,26 +43,26 @@ def add_user_bh(user, domain, logger, config): try: with driver.session() as session, session.begin_transaction() as tx: for info in users_owned: - distinguished_name = "".join(["DC=" + dc + "," for dc in info["domain"].split(".")]).rstrip(",") - domain_query = tx.run(f'MATCH (d:Domain) WHERE d.distinguishedname STARTS WITH "{distinguished_name}" RETURN d').data() + distinguished_name = "".join([f"DC={dc}," for dc in info["domain"].split(".")]).rstrip(",") + domain_query = tx.run(f"MATCH (d:Domain) WHERE d.distinguishedname STARTS WITH '{distinguished_name}' RETURN d").data() if not domain_query: raise Exception("Domain not found in bloodhound") else: domain = domain_query[0]["d"].get("name") if info["username"][-1] == "$": - user_owned = info["username"][:-1] + "." + domain + user_owned = f"{info['username'][:-1]}.{domain}" account_type = "Computer" else: - user_owned = info["username"] + "@" + domain + user_owned = f"{info['username']}@{domain}" account_type = "User" - result = tx.run(f'MATCH (c:{account_type} {{name:"{user_owned}"}}) RETURN c') + result = tx.run(f"MATCH (c:{account_type} {{name:'{user_owned}''}}) RETURN c") if result.data()[0]["c"].get("owned") in (False, None): - logger.debug(f'MATCH (c:{account_type} {{name:"{user_owned}"}}) SET c.owned=True RETURN c.name AS name') - result = tx.run(f'MATCH (c:{account_type} {{name:"{user_owned}"}}) SET c.owned=True RETURN c.name AS name') + logger.debug(f"MATCH (c:{account_type} {{name:'{user_owned}'}}) SET c.owned=True RETURN c.name AS name") + result = tx.run(f"MATCH (c:{account_type} {{name:'{user_owned}'}}) SET c.owned=True RETURN c.name AS name") logger.highlight(f"Node {user_owned} successfully set as owned in BloodHound") except AuthError: logger.fail(f"Provided Neo4J credentials ({config.get('BloodHound', 'bh_user')}:{config.get('BloodHound', 'bh_pass')}) are not valid.") From 00f08c608b575a34715d1e901b3c9e603aa35a52 Mon Sep 17 00:00:00 2001 From: Alexander Neff Date: Mon, 30 Oct 2023 13:38:10 -0400 Subject: [PATCH 3/4] Fix single quote --- nxc/helpers/bloodhound.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nxc/helpers/bloodhound.py b/nxc/helpers/bloodhound.py index 90f311c0..948c8310 100644 --- a/nxc/helpers/bloodhound.py +++ b/nxc/helpers/bloodhound.py @@ -58,7 +58,7 @@ def add_user_bh(user, domain, logger, config): account_type = "User" - result = tx.run(f"MATCH (c:{account_type} {{name:'{user_owned}''}}) RETURN c") + result = tx.run(f"MATCH (c:{account_type} {{name:'{user_owned}'}}) RETURN c") if result.data()[0]["c"].get("owned") in (False, None): logger.debug(f"MATCH (c:{account_type} {{name:'{user_owned}'}}) SET c.owned=True RETURN c.name AS name") From e20ed5c97ee58c18b5cacd23bdbe149e2e41afd0 Mon Sep 17 00:00:00 2001 From: Alexander Neff Date: Tue, 31 Oct 2023 16:38:24 -0400 Subject: [PATCH 4/4] Fix small typo in github bug report template --- .github/ISSUE_TEMPLATE/bug_report.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md index 1ffd2a82..01472c95 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.md +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -30,7 +30,7 @@ If applicable, add screenshots to help explain your problem. **NetExec info** - OS: [e.g. Kali] - - Version of nxc [e.g. v1.5.2] + - Version of nxc: [e.g. v1.5.2] - Installed from: apt/github/pip/docker/...? Please try with latest release before openning an issue **Additional context**