3460931d6b
Add checks for NBTNS and Powershell v2
2023-05-03 18:20:38 +02:00
dd08ae0d86
Implement several checks
...
Administrator's name
Spooler service
WSUS configuration
Guest account
Powershell execution policy
2023-05-02 20:35:56 +02:00
cddbd26119
Add LAPS check
2023-04-28 19:29:40 +02:00
e6d7e81d7b
Finish simple registry checks and add last update check
2023-04-28 16:45:58 +02:00
baa1c78068
New module for checking Windows configuration
2023-04-27 15:54:51 +02:00
ada917cc02
Update masky module (v0.2.0)
2023-02-13 23:20:17 +01:00
a3046f657b
Fixed bh_owned error on non-existing values
...
If a computer on the network has been compromised but is not listed in the Neo4j database. CME won't crash any more.
2022-11-25 16:58:52 +05:00
a5c30851c0
Fix output always returning false
...
Based on Neo4j documentation https://neo4j.com/docs/api/python-driver/current/api.html#neo4j.Result I added some modification to the result variable.
The way it was code, `result.value()` always return 0.
2022-11-09 15:39:43 -04:00
ba690f93fd
Added the option to select architecture (64 or 32)
...
The module only allowed 32 bits, with this change it is possible to select 32 bits or 64 bits architecture.
2022-11-09 07:07:29 -04:00
ccfd9565e0
Fix #671 - handlekatz modules fail
...
handlekatz modules fail if directory /tmp/shared does not exist. I changed the directory from /tmp/shared to /tmp and the option description.
2022-11-08 11:14:00 -04:00
61757a2cd2
Fix #671 - procdump modules fail
...
procdump modules fail if directory /tmp/shared does not exist. I changed the directory from /tmp/shared to /tmp and the option description.
2022-11-08 11:13:05 -04:00
be6b0edd42
Merge pull request #662 from Porchetta-Industries/rdp
...
Bump aardwolf to version 0.2.0
2022-11-08 09:31:58 +01:00
60e3dda195
Merge pull request #601 from Dfte/master
...
Add the Impersonate module
2022-11-07 12:26:37 +01:00
12ec7f2278
update impersonate binary
2022-11-02 07:23:07 -04:00
5d4f3b5606
Update impersonate.py
...
I'll add technical links to the blog post explaining token manipulation internals as well as the source code of the original binary when the blog post will be released (should be on monday)
2022-10-29 11:55:34 +02:00
1bfb3a860b
Addind the IMP_EXE option
...
Guess this will be the final one :P
2022-10-29 11:52:48 +02:00
9c66f29474
Merge branch 'master' into rdp
2022-10-28 15:22:28 +02:00
aa8bf6aa46
Refactor options
2022-10-27 15:32:55 -04:00
2dcd33ee17
Update impersonate.py
...
Adding double quotes for spaced cmd
2022-10-27 18:57:00 +02:00
ed80922b0e
Final update!
2022-10-27 12:21:46 +02:00
65724d4553
Merge pull request #653 from Z4kSec/master
...
Add Masky module
2022-10-25 13:03:29 +02:00
e2130c658c
Bump aardwolf to 0.2.0
2022-10-24 15:02:42 -04:00
704471b366
Update teams_localdb.py
...
Multi user support added.
Otherwise the file at /tmp/teams_cookies2.txt gets mangled up and you don't get back any results as sqlite3 can access it but won't find any content.
2022-10-20 11:51:53 +02:00
d55f7513d2
Merge remote-tracking branch 'upstream/master'
2022-10-18 22:29:04 +02:00
2806c81d73
Add masky module
2022-10-18 22:19:35 +02:00
74bbeee05a
Merge pull request #647 from R-Secure/master
...
Added functionality to retrieve ssoauthookie from Microsoft Teams local db
2022-10-18 20:42:53 +02:00
7b9ce02f46
update module teams
2022-10-16 09:15:00 -04:00
ff758fd6dd
Merge pull request #646 from bogey3/install_elevated
...
Module to check for AlwaysInstallElevated
2022-10-13 14:57:18 +02:00
d162d7b55c
Merge pull request #640 from Tw1sm/ntlmv1-module
...
Module to check for NTLMv1 Compatibility
2022-10-13 14:57:09 +02:00
dad84132e2
Merge pull request #637 from d3lb3/keepass_trigger
...
Add KeePass trigger abuse module
2022-10-13 14:56:39 +02:00
d3162ee45a
Merge pull request #636 from d3lb3/master
...
Add KeePass discovery module
2022-10-13 14:56:29 +02:00
1e5db5da61
Merge pull request #610 from BlWasp/dacledit
...
Add the new daclread.py LDAP module and the msada_guids.py library
2022-10-13 14:56:18 +02:00
247de78541
Merge pull request #597 from guervild/mssql-upload-download
...
Mssql upload / download
2022-10-13 14:55:20 +02:00
4f595fbbc7
Restart keepass to load cleaned config
2022-10-13 08:41:58 -04:00
bbd606c067
Added functionality to retrieve the Microsoft Teams Cookies database and extract the ssoauthcookie
2022-10-11 06:44:22 -04:00
ea63b29000
update nanodump module for mssql
2022-10-10 16:22:09 -04:00
acf1789f2f
Add warning messages about non recursivity.
2022-10-10 14:25:55 +00:00
927a82a554
parse keepass config file and extract password
2022-10-10 08:36:27 -04:00
777a422888
add error with config setting not found
2022-10-10 05:57:26 -04:00
521b55daee
Update message for polling
2022-10-10 05:36:52 -04:00
365abf8fb0
Update keepass module to set opsec safe to false
2022-10-10 05:32:47 -04:00
4ba1085128
update import csv
2022-10-10 05:14:16 -04:00
1629029d35
Update install_elevated.py
...
Updated to display enabled when only the entry in HKLM is enabled as low privilege users can modify the HKCU and grant themselves permission.
Note that once the per-machine policy for AlwaysInstallElevated is enabled, any user can set their per-user setting.
https://learn.microsoft.com/en-us/windows/win32/msi/alwaysinstallelevated
2022-10-07 16:25:56 -04:00
8d92e34d66
Created install_elevated.py
...
This module will check if the computer and the supplied user have AlwaysInstallElevated enabled.
2022-10-07 15:55:58 -04:00
fc57723678
Merge pull request #642 from nurfed1/master
...
LDAP protocol improvements and scan-network module bugfix
2022-10-05 17:34:56 +02:00
4aeb311e22
Fix PowerShell parsing after file search
2022-10-02 18:32:01 +02:00
65796271c0
Merge branch 'export'
2022-09-22 18:06:37 -04:00
4c5844890c
Improve module scan network
2022-09-22 18:05:39 -04:00
b0731f6f2c
Merge branch 'master' into master
2022-09-19 09:06:23 +02:00
f391b8a2a6
Bug fix: ensure DN is lowercase
2022-09-18 20:49:03 +02:00
François REYNAUD