mirror of
https://github.com/Pennyw0rth/NetExec
synced 2026-06-06 16:34:30 +00:00
Alexander Neff
50 lines
2.0 KiB
Python
50 lines
2.0 KiB
Python
# Credit to https://airbus-cyber-security.com/fr/the-oxid-resolver-part-1-remote-enumeration-of-network-interfaces-without-any-authentication/
|
|
# Airbus CERT
|
|
# module by @mpgn_x64
|
|
# updated by @NeffIsBack
|
|
|
|
from ipaddress import ip_address
|
|
from impacket.dcerpc.v5 import transport
|
|
from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_LEVEL_NONE, DCERPCException
|
|
from impacket.dcerpc.v5.dcomrt import IObjectExporter
|
|
from nxc.helpers.misc import CATEGORY
|
|
|
|
|
|
class NXCModule:
|
|
name = "ioxidresolver"
|
|
description = "This module helps you to identify hosts that have additional active interfaces"
|
|
supported_protocols = ["smb", "wmi"]
|
|
category = CATEGORY.ENUMERATION
|
|
|
|
def options(self, context, module_options):
|
|
"""DIFFERENT show only ip address if different from target ip (Default: False)"""
|
|
self.pivot = module_options.get("DIFFERENT", "false").lower() in ["true", "1"]
|
|
|
|
def on_login(self, context, connection):
|
|
try:
|
|
rpctransport = transport.DCERPCTransportFactory(f"ncacn_ip_tcp:{connection.host}")
|
|
rpctransport.setRemoteHost(connection.host)
|
|
|
|
portmap = rpctransport.get_dce_rpc()
|
|
portmap.set_auth_level(RPC_C_AUTHN_LEVEL_NONE)
|
|
portmap.connect()
|
|
|
|
objExporter = IObjectExporter(portmap)
|
|
bindings = objExporter.ServerAlive2()
|
|
|
|
context.log.debug(f"Retrieving network interface of {connection.host}")
|
|
|
|
for binding in bindings:
|
|
NetworkAddr = binding["aNetworkAddr"]
|
|
try:
|
|
ip_address(NetworkAddr[:-1])
|
|
if self.pivot:
|
|
if NetworkAddr.rstrip("\x00") != connection.host:
|
|
context.log.highlight(f"Address: {NetworkAddr}")
|
|
else:
|
|
context.log.highlight(f"Address: {NetworkAddr}")
|
|
except Exception as e:
|
|
context.log.debug(e)
|
|
except DCERPCException as e:
|
|
context.log.error(f"DCERPCException error: {e}")
|