mirror of
https://github.com/SpecterOps/Nemesis
synced 2026-06-08 12:36:42 +00:00
Lee Chagolla-Christensen
9d62493623
* fix: upgrade python-multipart to 0.0.22 to address CVE-2026-24486 (Dependabot #683) * update deps+skill, pyright * pyright + tests in CLI * Add pyright type checking and enhance registry hive analysis Registry Hive Analyzer Enhancements: - Extract machine SID from SAM domain V value with binary SID decoding - Extract per-user metadata via regipy (ACB flags, timestamps, full name, comment via USER_ACCOUNT_V) - Compute password expiration from domain max password age policy - Detect empty LM/NT hashes via well-known constants - Parse DCC cached domain credentials into structured entries - Store DPAPI system machine_key/user_key as separate fields - Add structured secret_type field to LSA secrets (dcc, dpapi_system, hex_blob, generic) - Add detailed markdown and plain-text formatters for SAM accounts and LSA secrets, replacing _get_lsa_secret_output_string - Fix SYSTEM hive attribute names: computer_name -> machinename, current_control_set -> currentcontrol - Switch SAM user iteration from sam.users to sam.secrets (pypykatz API) - Add FILETIME-to-UTC and regipy value-to-bytes helpers New Tests: - Add test_registry_hive.py with SAM, SECURITY, and SYSTEM hive fixtures - Add test_container.py for container analyzer - Add SAM/SECURITY/SYSTEM binary test fixtures Pyright Setup: - Add pyrightconfig.json (basic mode, Python 3.13) to all libs and projects - Add pyright>=1.1 as dev dependency to all pyproject.toml files - Update all uv.lock files accordingly - Update lint.sh to deactivate active venvs and verify pyright availability Type Annotation Fixes: - Fix globals initialized as None without Optional type across file_enrichment, document_conversion, and agents global_vars - Fix StorageMinio return types: upload/upload_file/upload_uploadfile return str, not uuid.UUID - Fix MockStorageMinio to match updated StorageMinio return types - Add explicit type annotations to dict literals in chromekey.py, pdf/analyzer.py, registry_hive/analyzer.py, and publish_findings.py - Fix kubeconfig current_context parameter to accept str | None - Fix container_contents allowed_extensions: set = None -> set | None = None - Fix file subscription file_queue: asyncio.Queue = None -> asyncio.Queue | None = None - Fix web_api upload_file to wrap object_id in uuid.UUID() for response None-safety Assertions: - Add assert statements for asyncpg_pool, tracking_service, workflow_client, workflow_manager, file_linking_engine, file_queue, gotenberg_url, and process.stdout across all activity, subscription, route, and workflow files in file_enrichment and document_conversion - Add assertions for asyncpg_pool in all chromium processors - Add assertions for File.from_metadata timestamp/expiration fields - Add assertion for alerting GQL client session type Pyright Ignore Annotations: - Suppress third-party type issues in Dapr workflow/activity APIs, gRPC subscription imports, ccache/lnk/office_doc attribute access, and nemesis_dpapi FlagMixin operators - Add file-level suppression for office2john.py, pdf2john.py, pe/analyzer.py, and test harness files Bug Fixes: - Fix office2john.py format string: bare % filename -> % (filename, stream) - Fix container analyzer 7z iteration: iterate sz.files list instead of calling .items() - Fix file_linking rules_engine: store match result to avoid double call - Fix logger.exception calls: remove exception object as first arg in storage.py, cookies.py, enrichments.py, housekeeping/main.py - Fix document_conversion lifespan: use stack.callback() for sync shutdown - Fix NoseyParkerOutput fallback: add missing workflow_id field - Fix regipy hive_type: handle None return from RegistryHive.hive_type DPAPI Manager: - Remove unused guid parameter from get_system_credentials across DpapiManager, NullDpapiManager, and DpapiManagerProtocol Added Missing Dependencies (file_enrichment_modules): - pypykatz>=0.6.11, pyarrow>=19.0.1, msoffcrypto-tool>=5.4.2, oletools>=0.60.2, regipy>=5.2.0, pillow>=11.3.0 * quiet console logs * feat: lazy file loading with backend range request support Add offset/length query params to the download endpoint so the frontend can request partial file content. FileViewer now fetches data on demand — hex, transform (Strings, etc.), ZIP, SQLite, and image tabs only load when activated. Text-based content is capped at 10 MB previews. * fix: transform tabs stuck on "Loading content..." - Prevent stale WS subscription from overwriting fetched content - Show retry button when transform content fails to load - Reset fetch guard on non-OK HTTP responses * fix: hex tab deferred loading with full file content * feat: truncation dropdown, spinner overlay, and tab render refactor - Add truncation dropdown to MonacoContentViewer for files > 10MB, replacing the old banner alert and hex "Load Hex View" button - Add spinner overlay on Monaco editor while loading full content - Wire truncation support to transform tabs (monaco/json types), enrichment tabs, and text tabs - Change hex tab to auto-load first 10MB preview with dropdown for full file instead of requiring manual load - Default word wrap to off - Remove "File is too large" warning message - Refactor ~150-line ternary chain into explicit per-tab render functions (renderPreviewTab, renderZipTab, renderSqliteTab, renderTextTab, renderHexTab, renderTabContent) with shared helpers (renderFullFileContent, getTextContent) * feat: improve Yara Rules UI - Compact table rows with tighter padding - Add X button and Esc key to close editor dialog - Disable Save button when rule content is unchanged - Disable Create button with inline warning when rule name already exists - Default source to "Created manually by <user>" for new rules - Update source placeholder to "e.g. /yara_rules/custom.yara" * update gitignore --------- Co-authored-by: Lee Chagolla-Christensen <lee@localhost>
53 lines
1.2 KiB
TOML
53 lines
1.2 KiB
TOML
[project]
|
|
name = "cli"
|
|
version = "0.1.0"
|
|
description = "Nemesis CLI"
|
|
authors = [{name = "SpecterOps"}]
|
|
readme = "README.md"
|
|
requires-python = ">=3.13,<3.14"
|
|
|
|
dependencies = [
|
|
"aiohttp>=3.13.3,<4.0.0",
|
|
"structlog>=25.1.0,<26.0.0",
|
|
"requests>=2.32.5,<3.0.0",
|
|
"click>=8.1.8,<9.0.0",
|
|
"tqdm>=4.67.1,<5.0.0",
|
|
"colorlog>=6.9.0,<7.0.0",
|
|
"mythic>=0.2.5,<0.3.0",
|
|
"humanfriendly>=10.0,<11.0",
|
|
"gql>=3.5.0,<4.0.0",
|
|
"pydantic-settings>=2.7.1,<3.0.0",
|
|
"dynaconf>=3.2.7,<4.0.0",
|
|
"docker>=7.1.0,<8.0.0",
|
|
"asyncpg>=0.30.0,<0.31.0",
|
|
"pyyaml>=6.0.2,<7.0.0",
|
|
"common",
|
|
"requests-toolbelt>=1.0.0,<2.0.0",
|
|
"watchdog>=6.0.0,<7.0.0",
|
|
"dapr==1.16.0",
|
|
"plyvel-ci>=1.5.1,<2.0.0",
|
|
]
|
|
|
|
[dependency-groups]
|
|
dev = [
|
|
"ruff>=0.9.2",
|
|
"pytest>=8.4.2",
|
|
"pytest-asyncio>=1.2.0",
|
|
"pyright>=1.1",
|
|
]
|
|
|
|
[project.scripts]
|
|
submit = "cli.main:submit"
|
|
module_runner = "cli.module_runner:main"
|
|
stress_test = "cli.stress_test:main"
|
|
|
|
[build-system]
|
|
requires = ["hatchling"]
|
|
build-backend = "hatchling.build"
|
|
|
|
[tool.hatch.build.targets.wheel]
|
|
packages = ["cli"]
|
|
|
|
[tool.uv.sources]
|
|
common = { path = "../../libs/common", editable = true }
|