souleyez 2.43.29__py3-none-any.whl → 2.43.32__py3-none-any.whl

souleyez/plugins/crackmapexec.py

@@ -30,12 +30,12 @@ HELP = {
         "- Check for MS17-010 (EternalBlue) on all SMB hosts\n"
         "- Results link to Impacket for follow-up attacks\n"
     ),
-    "usage": "souleyez jobs enqueue crackmapexec <target> --args \"smb --shares\"",
+    "usage": 'souleyez jobs enqueue crackmapexec <target> --args "smb --shares"',
     "examples": [
-        "souleyez jobs enqueue crackmapexec 10.0.0.82 --args \"smb --shares\"",
-        "souleyez jobs enqueue crackmapexec 10.0.0.82 --args \"smb -u admin -p password\"",
+        'souleyez jobs enqueue crackmapexec 10.0.0.82 --args "smb --shares"',
+        'souleyez jobs enqueue crackmapexec 10.0.0.82 --args "smb -u admin -p password"',
         "souleyez jobs enqueue crackmapexec 10.0.0.82 --args \"smb -u '' -p '' -M ms17-010\"",
-        "souleyez jobs enqueue crackmapexec 10.0.0.0/24 --args \"smb --users\"",
+        'souleyez jobs enqueue crackmapexec 10.0.0.0/24 --args "smb --users"',
     ],
     "flags": [
         ["smb", "SMB protocol"],
@@ -55,90 +55,134 @@ HELP = {
             {
                 "name": "Basic SMB Enum",
                 "args": ["smb", "--shares"],
-                "desc": "Enumerate shares (no credentials)"
+                "desc": "Enumerate shares (no credentials)",
             },
             {
                 "name": "Vulnerability Check",
                 "args": ["smb", "-u", "", "-p", "", "-M", "ms17-010"],
-                "desc": "Check for MS17-010 (EternalBlue)"
+                "desc": "Check for MS17-010 (EternalBlue)",
             },
             {
                 "name": "User Enumeration",
                 "args": ["smb", "--users"],
-                "desc": "Enumerate domain users"
-            }
+                "desc": "Enumerate domain users",
+            },
         ],
         "authenticated": [
             {
                 "name": "With Credentials",
                 "args": ["smb", "-u", "<username>", "-p", "<password>", "--shares"],
-                "desc": "Authenticated share enumeration"
+                "desc": "Authenticated share enumeration",
             },
             {
                 "name": "Domain Auth",
-                "args": ["smb", "-u", "<username>", "-p", "<password>", "-d", "<domain>"],
-                "desc": "Domain authentication"
+                "args": [
+                    "smb",
+                    "-u",
+                    "<username>",
+                    "-p",
+                    "<password>",
+                    "-d",
+                    "<domain>",
+                ],
+                "desc": "Domain authentication",
             },
             {
                 "name": "Password Spray",
                 "args": ["smb", "-u", "users.txt", "-p", "password", "--no-bruteforce"],
-                "desc": "Spray single password across user list"
-            }
-        ]
+                "desc": "Spray single password across user list",
+            },
+        ],
     },
     "presets": [
-        {"name": "Basic SMB Enum", "args": ["smb", "--shares"], "desc": "Enumerate shares (no credentials)"},
-        {"name": "Vulnerability Check", "args": ["smb", "-u", "", "-p", "", "-M", "ms17-010"], "desc": "Check for MS17-010 (EternalBlue)"},
-        {"name": "User Enumeration", "args": ["smb", "--users"], "desc": "Enumerate domain users"},
-        {"name": "With Credentials", "args": ["smb", "-u", "<username>", "-p", "<password>", "--shares"], "desc": "Authenticated share enumeration"},
+        {
+            "name": "Basic SMB Enum",
+            "args": ["smb", "--shares"],
+            "desc": "Enumerate shares (no credentials)",
+        },
+        {
+            "name": "Vulnerability Check",
+            "args": ["smb", "-u", "", "-p", "", "-M", "ms17-010"],
+            "desc": "Check for MS17-010 (EternalBlue)",
+        },
+        {
+            "name": "User Enumeration",
+            "args": ["smb", "--users"],
+            "desc": "Enumerate domain users",
+        },
+        {
+            "name": "With Credentials",
+            "args": ["smb", "-u", "<username>", "-p", "<password>", "--shares"],
+            "desc": "Authenticated share enumeration",
+        },
     ],
     "help_sections": [
         {
             "title": "What is CrackMapExec?",
             "color": "cyan",
             "content": [
-                {"title": "Overview", "desc": "CrackMapExec (now NetExec) is the Swiss army knife for Windows and Active Directory pentesting, supporting SMB, WinRM, MSSQL, LDAP, and RDP protocols."},
-                {"title": "Use Cases", "desc": "Industry-standard tool for Windows/AD enumeration and exploitation", "tips": [
-                    "Enumerate SMB shares without credentials",
-                    "Validate credentials across multiple hosts",
-                    "Check for critical vulnerabilities (MS17-010, ZeroLogon)",
-                    "Execute commands and dump hashes with valid creds"
-                ]}
-            ]
+                {
+                    "title": "Overview",
+                    "desc": "CrackMapExec (now NetExec) is the Swiss army knife for Windows and Active Directory pentesting, supporting SMB, WinRM, MSSQL, LDAP, and RDP protocols.",
+                },
+                {
+                    "title": "Use Cases",
+                    "desc": "Industry-standard tool for Windows/AD enumeration and exploitation",
+                    "tips": [
+                        "Enumerate SMB shares without credentials",
+                        "Validate credentials across multiple hosts",
+                        "Check for critical vulnerabilities (MS17-010, ZeroLogon)",
+                        "Execute commands and dump hashes with valid creds",
+                    ],
+                },
+            ],
         },
         {
             "title": "How to Use",
             "color": "green",
             "content": [
-                {"title": "Basic Workflow", "desc": "1. Start with unauthenticated scans (--shares)\n     2. Check for vulnerabilities (-M ms17-010)\n     3. Use found credentials to enumerate further\n     4. Pivot across network with credential spraying"},
-                {"title": "Common Tasks", "desc": "Key enumeration and validation features", "tips": [
-                    "Share enumeration: netexec smb <target> --shares",
-                    "User enumeration: netexec smb <target> --users",
-                    "Credential validation: netexec smb <target> -u user -p pass",
-                    "Vulnerability check: netexec smb <target> -M ms17-010"
-                ]}
-            ]
+                {
+                    "title": "Basic Workflow",
+                    "desc": "1. Start with unauthenticated scans (--shares)\n     2. Check for vulnerabilities (-M ms17-010)\n     3. Use found credentials to enumerate further\n     4. Pivot across network with credential spraying",
+                },
+                {
+                    "title": "Common Tasks",
+                    "desc": "Key enumeration and validation features",
+                    "tips": [
+                        "Share enumeration: netexec smb <target> --shares",
+                        "User enumeration: netexec smb <target> --users",
+                        "Credential validation: netexec smb <target> -u user -p pass",
+                        "Vulnerability check: netexec smb <target> -M ms17-010",
+                    ],
+                },
+            ],
         },
         {
             "title": "Tips & Best Practices",
             "color": "yellow",
             "content": [
-                ("Best Practices:", [
-                    "Start with unauthenticated enumeration",
-                    "Check MS17-010 on all SMB hosts",
-                    "Use found credentials for lateral movement",
-                    "Save results for Impacket follow-up attacks",
-                    "Test one credential at a time to avoid lockouts"
-                ]),
-                ("Common Issues:", [
-                    "Access denied: Try null session (-u '' -p '')",
-                    "No output: Verify SMB is open (port 445)",
-                    "Credential errors: Check domain name format (DOMAIN/user)",
-                    "Module not found: Update NetExec to latest version"
-                ])
-            ]
-        }
-    ]
+                (
+                    "Best Practices:",
+                    [
+                        "Start with unauthenticated enumeration",
+                        "Check MS17-010 on all SMB hosts",
+                        "Use found credentials for lateral movement",
+                        "Save results for Impacket follow-up attacks",
+                        "Test one credential at a time to avoid lockouts",
+                    ],
+                ),
+                (
+                    "Common Issues:",
+                    [
+                        "Access denied: Try null session (-u '' -p '')",
+                        "No output: Verify SMB is open (port 445)",
+                        "Credential errors: Check domain name format (DOMAIN/user)",
+                        "Module not found: Update NetExec to latest version",
+                    ],
+                ),
+            ],
+        },
+    ],
 }
 
 
@@ -148,11 +192,13 @@ class CrackMapExecPlugin(PluginBase):
     category = "scanning"
     HELP = HELP
 
-    def build_command(self, target: str, args: List[str] = None, label: str = "", log_path: str = None):
+    def build_command(
+        self, target: str, args: List[str] = None, label: str = "", log_path: str = None
+    ):
         """Build CrackMapExec command for background execution with PID tracking."""
         # Handle multiple space-separated IPs
         target_list = []
-        if ' ' in target:
+        if " " in target:
             for ip in target.split():
                 ip = ip.strip()
                 if ip:
@@ -161,7 +207,7 @@ class CrackMapExecPlugin(PluginBase):
                         target_list.append(validated)
                     except ValidationError as e:
                         if log_path:
-                            with open(log_path, 'w') as f:
+                            with open(log_path, "w") as f:
                                 f.write(f"ERROR: Invalid target '{ip}': {e}\n")
                         return None
         else:
@@ -170,14 +216,31 @@ class CrackMapExecPlugin(PluginBase):
                 target_list = [target]
             except ValidationError as e:
                 if log_path:
-                    with open(log_path, 'w') as f:
+                    with open(log_path, "w") as f:
                         f.write(f"ERROR: Invalid target: {e}\n")
                 return None
 
         args = args or ["smb", "--shares"]
         args = [arg.replace("<target>", target_list[0]) for arg in args]
 
-        protocol = args[0] if args and args[0] in ['smb', 'winrm', 'mssql', 'ldap', 'ssh', 'rdp', 'ftp', 'vnc', 'nfs', 'wmi'] else 'smb'
+        protocol = (
+            args[0]
+            if args
+            and args[0]
+            in [
+                "smb",
+                "winrm",
+                "mssql",
+                "ldap",
+                "ssh",
+                "rdp",
+                "ftp",
+                "vnc",
+                "nfs",
+                "wmi",
+            ]
+            else "smb"
+        )
         cmd = ["netexec", protocol] + target_list
 
         if len(args) > 1:
@@ -185,28 +248,37 @@ class CrackMapExecPlugin(PluginBase):
         elif protocol not in args:
             cmd.extend(["--shares"])
 
-        has_creds = any(arg in cmd for arg in ['-u', '--username', '-p', '--password'])
-        has_enum = any(arg in cmd for arg in ['--shares', '--users', '--groups', '--sessions', '--disks', '--loggedon-users'])
+        has_creds = any(arg in cmd for arg in ["-u", "--username", "-p", "--password"])
+        has_enum = any(
+            arg in cmd
+            for arg in [
+                "--shares",
+                "--users",
+                "--groups",
+                "--sessions",
+                "--disks",
+                "--loggedon-users",
+            ]
+        )
 
         if has_enum and not has_creds:
             insert_pos = 2 + len(target_list)
-            cmd.insert(insert_pos, '-u')
-            cmd.insert(insert_pos + 1, '')
-            cmd.insert(insert_pos + 2, '-p')
-            cmd.insert(insert_pos + 3, '')
+            cmd.insert(insert_pos, "-u")
+            cmd.insert(insert_pos + 1, "")
+            cmd.insert(insert_pos + 2, "-p")
+            cmd.insert(insert_pos + 3, "")
 
-        return {
-            'cmd': cmd,
-            'timeout': 1800
-        }
+        return {"cmd": cmd, "timeout": 1800}
 
-    def run(self, target: str, args: List[str] = None, label: str = "", log_path: str = None) -> int:
+    def run(
+        self, target: str, args: List[str] = None, label: str = "", log_path: str = None
+    ) -> int:
         """Execute CrackMapExec (NetExec) and write output to log_path."""
 
         # Handle multiple space-separated IPs (from multi-host selection)
         # NetExec needs them as separate arguments, not a single string
         target_list = []
-        if ' ' in target:
+        if " " in target:
             # Multiple IPs separated by spaces
             for ip in target.split():
                 ip = ip.strip()
@@ -217,7 +289,7 @@ class CrackMapExecPlugin(PluginBase):
                         target_list.append(validated)
                     except ValidationError as e:
                         if log_path:
-                            with open(log_path, 'w') as f:
+                            with open(log_path, "w") as f:
                                 f.write(f"ERROR: Invalid target '{ip}': {e}\n")
                             return 1
                         raise ValueError(f"Invalid target '{ip}': {e}")
@@ -228,7 +300,7 @@ class CrackMapExecPlugin(PluginBase):
                 target_list = [target]
             except ValidationError as e:
                 if log_path:
-                    with open(log_path, 'w') as f:
+                    with open(log_path, "w") as f:
                         f.write(f"ERROR: Invalid target: {e}\n")
                     return 1
                 raise ValueError(f"Invalid target: {e}")
@@ -239,7 +311,24 @@ class CrackMapExecPlugin(PluginBase):
         args = [arg.replace("<target>", target_list[0]) for arg in args]
 
         # Detect protocol (first arg should be protocol)
-        protocol = args[0] if args and args[0] in ['smb', 'winrm', 'mssql', 'ldap', 'ssh', 'rdp', 'ftp', 'vnc', 'nfs', 'wmi'] else 'smb'
+        protocol = (
+            args[0]
+            if args
+            and args[0]
+            in [
+                "smb",
+                "winrm",
+                "mssql",
+                "ldap",
+                "ssh",
+                "rdp",
+                "ftp",
+                "vnc",
+                "nfs",
+                "wmi",
+            ]
+            else "smb"
+        )
 
         # Use netexec (successor to crackmapexec)
         # Add all targets as separate arguments (NetExec supports multiple targets)
@@ -251,11 +340,21 @@ class CrackMapExecPlugin(PluginBase):
         elif protocol not in args:
             # No protocol specified in args, add default behavior
             cmd.extend(["--shares"])
-        
+
         # Auto-add null credentials for unauthenticated enumeration if no creds specified
         # Check if -u or --username already in command
-        has_creds = any(arg in cmd for arg in ['-u', '--username', '-p', '--password'])
-        has_enum = any(arg in cmd for arg in ['--shares', '--users', '--groups', '--sessions', '--disks', '--loggedon-users'])
+        has_creds = any(arg in cmd for arg in ["-u", "--username", "-p", "--password"])
+        has_enum = any(
+            arg in cmd
+            for arg in [
+                "--shares",
+                "--users",
+                "--groups",
+                "--sessions",
+                "--disks",
+                "--loggedon-users",
+            ]
+        )
 
         if has_enum and not has_creds:
             # Add null session credentials after ALL targets but before flags
@@ -263,14 +362,16 @@ class CrackMapExecPlugin(PluginBase):
             # Example: ['netexec', 'smb', '10.0.0.14', '10.0.0.82', '--shares']
             # Insert at position 4: ['netexec', 'smb', '10.0.0.14', '10.0.0.82', '-u', '', '-p', '', '--shares']
             insert_pos = 2 + len(target_list)
-            cmd.insert(insert_pos, '-u')
-            cmd.insert(insert_pos + 1, '')
-            cmd.insert(insert_pos + 2, '-p')
-            cmd.insert(insert_pos + 3, '')
+            cmd.insert(insert_pos, "-u")
+            cmd.insert(insert_pos + 1, "")
+            cmd.insert(insert_pos + 2, "-p")
+            cmd.insert(insert_pos + 3, "")
 
         if not log_path:
             try:
-                proc = subprocess.run(cmd, capture_output=True, timeout=300, check=False)
+                proc = subprocess.run(
+                    cmd, capture_output=True, timeout=300, check=False
+                )
                 return proc.returncode
             except Exception:
                 return 1
@@ -281,18 +382,18 @@ class CrackMapExecPlugin(PluginBase):
                 fh.write(f"Target(s): {' '.join(target_list)}\n")
                 fh.write(f"Protocol: {protocol}\n")
                 fh.write(f"Command: {' '.join(cmd)}\n")
-                fh.write(f"Started: {time.strftime('%Y-%m-%d %H:%M:%S UTC', time.gmtime())}\n\n")
+                fh.write(
+                    f"Started: {time.strftime('%Y-%m-%d %H:%M:%S UTC', time.gmtime())}\n\n"
+                )
                 fh.flush()
 
                 proc = subprocess.run(
-                    cmd,
-                    stdout=fh,
-                    stderr=subprocess.STDOUT,
-                    timeout=300,
-                    check=False
+                    cmd, stdout=fh, stderr=subprocess.STDOUT, timeout=300, check=False
                 )
 
-                fh.write(f"\n\nCompleted: {time.strftime('%Y-%m-%d %H:%M:%S UTC', time.gmtime())}\n")
+                fh.write(
+                    f"\n\nCompleted: {time.strftime('%Y-%m-%d %H:%M:%S UTC', time.gmtime())}\n"
+                )
                 fh.write(f"Exit Code: {proc.returncode}\n")
 
                 return proc.returncode