Skip to content

Commit f8811d8

Browse files
crypt0rrcrypt0rr
authored
Updated NetExec | Tools Framework (#590)
1 parent 89cbdb8 commit f8811d8

File tree

3 files changed

+230
-136
lines changed

3 files changed

+230
-136
lines changed

‎content/tools/framework/netexec/nxc-ldap/index.md‎

Lines changed: 61 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,13 @@ Install [NetExec]({{< ref "../netexec" >}}).
1818
## Usage
1919

2020
```plain
21-
netexec ldap [-h] [-t THREADS] [--timeout TIMEOUT] [--jitter INTERVAL] [--verbose] [--debug] [--no-progress] [--log LOG] [-6] [--dns-server DNS_SERVER] [--dns-tcp] [--dns-timeout DNS_TIMEOUT] [-u USERNAME [USERNAME ...]]
22-
[-p PASSWORD [PASSWORD ...]] [-id CRED_ID [CRED_ID ...]] [--ignore-pw-decoding] [--no-bruteforce] [--continue-on-success] [--gfail-limit LIMIT] [--ufail-limit LIMIT] [--fail-limit LIMIT] [-k] [--use-kcache]
23-
[--aesKey AESKEY [AESKEY ...]] [--kdcHost KDCHOST] [--server {http,https}] [--server-host HOST] [--server-port PORT] [--connectback-host CHOST] [-M MODULE] [-o MODULE_OPTION [MODULE_OPTION ...]] [-L] [--options]
24-
[-H HASH [HASH ...]] [--port PORT] [--no-smb] [-d DOMAIN | --local-auth] [--asreproast ASREPROAST] [--kerberoasting KERBEROASTING] [--query QUERY QUERY] [--trusted-for-delegation] [--password-not-required]
25-
[--admin-count] [--users [USERS ...]] [--groups] [--dc-list] [--get-sid] [--active-users [ACTIVE_USERS ...]] [--gmsa] [--gmsa-convert-id GMSA_CONVERT_ID] [--gmsa-decrypt-lsa GMSA_DECRYPT_LSA] [--bloodhound]
26-
[-c COLLECTION]
21+
netexec ldap [-h] [--version] [-t THREADS] [--timeout TIMEOUT] [--jitter INTERVAL] [--verbose] [--debug] [--no-progress] [--log LOG] [-6] [--dns-server DNS_SERVER] [--dns-tcp] [--dns-timeout DNS_TIMEOUT]
22+
[-u USERNAME [USERNAME ...]] [-p PASSWORD [PASSWORD ...]] [-id CRED_ID [CRED_ID ...]] [--ignore-pw-decoding] [--no-bruteforce] [--continue-on-success] [--gfail-limit LIMIT] [--ufail-limit LIMIT]
23+
[--fail-limit LIMIT] [-k] [--use-kcache] [--aesKey AESKEY [AESKEY ...]] [--kdcHost KDCHOST] [--pfx-cert PFXCERT] [--pfx-base64 PFXB64] [--pfx-pass PFXPASS] [--pem-cert PEMCERT] [--pem-key PEMKEY]
24+
[-M MODULE] [-o MODULE_OPTION [MODULE_OPTION ...]] [-L [LIST_MODULES]] [--options] [-H HASH [HASH ...]] [--port PORT] [-d DOMAIN | --local-auth] [--asreproast ASREPROAST]
25+
[--kerberoasting KERBEROASTING] [--kerberoast-account KERBEROAST_ACCOUNT [KERBEROAST_ACCOUNT ...]] [--no-preauth-targets NO_PREAUTH_TARGETS] [--base-dn BASE_DN] [--query QUERY QUERY]
26+
[--find-delegation] [--trusted-for-delegation] [--password-not-required] [--admin-count] [--users [USERS ...]] [--users-export USERS_EXPORT] [--groups [GROUPS]] [--computers] [--dc-list] [--get-sid]
27+
[--active-users [ACTIVE_USERS ...]] [--pso] [--pass-pol] [--gmsa] [--gmsa-convert-id GMSA_CONVERT_ID] [--gmsa-decrypt-lsa GMSA_DECRYPT_LSA] [--bloodhound] [-c COLLECTION]
2728
target [target ...]
2829
```
2930

@@ -35,17 +36,17 @@ positional arguments:
3536
3637
options:
3738
-h, --help show this help message and exit
38-
-H HASH [HASH ...], --hash HASH [HASH ...]
39+
-H, --hash HASH [HASH ...]
3940
NTLM hash(es) or file(s) containing NTLM hashes
4041
--port PORT LDAP port (default: 389)
41-
--no-smb No smb connection
4242
-d DOMAIN domain to authenticate to
4343
--local-auth authenticate locally to each target
4444
4545
Generic:
4646
Generic options for nxc across protocols
4747
48-
-t THREADS, --threads THREADS
48+
--version Display nxc version
49+
-t, --threads THREADS
4950
set how many concurrent threads to use (default: 256)
5051
--timeout TIMEOUT max timeout in seconds of each thread
5152
--jitter INTERVAL sets a random delay between each authentication
@@ -69,9 +70,9 @@ DNS:
6970
Authentication:
7071
Options for authenticating
7172
72-
-u USERNAME [USERNAME ...], --username USERNAME [USERNAME ...]
73+
-u, --username USERNAME [USERNAME ...]
7374
username(s) or file(s) containing usernames
74-
-p PASSWORD [PASSWORD ...], --password PASSWORD [PASSWORD ...]
75+
-p, --password PASSWORD [PASSWORD ...]
7576
password(s) or file(s) containing passwords
7677
-id CRED_ID [CRED_ID ...]
7778
database credential ID(s) to use for authentication
@@ -92,49 +93,57 @@ Kerberos:
9293
AES key to use for Kerberos Authentication (128 or 256 bits)
9394
--kdcHost KDCHOST FQDN of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter
9495
95-
Servers:
96-
Options for nxc servers
96+
Certificate:
97+
Options for certificate authentication
9798
98-
--server {http,https}
99-
use the selected server (default: https)
100-
--server-host HOST IP to bind the server to (default: 0.0.0.0)
101-
--server-port PORT start the server on the specified port
102-
--connectback-host CHOST
103-
IP for the remote system to connect back to
99+
--pfx-cert PFXCERT Use certificate authentication from pfx file .pfx
100+
--pfx-base64 PFXB64 Use certificate authentication from pfx file encoded in base64
101+
--pfx-pass PFXPASS Password of the pfx certificate
102+
--pem-cert PEMCERT Use certificate authentication from PEM file
103+
--pem-key PEMKEY Private key for the PEM format
104104
105105
Modules:
106106
Options for nxc modules
107107
108-
-M MODULE, --module MODULE
109-
module to use
108+
-M, --module MODULE module to use
110109
-o MODULE_OPTION [MODULE_OPTION ...]
111110
module options
112-
-L, --list-modules list available modules
111+
-L, --list-modules [LIST_MODULES]
112+
list available modules
113113
--options display module options
114114
115115
Retrieve hash on the remote DC:
116116
Options to get hashes from Kerberos
117117
118118
--asreproast ASREPROAST
119119
Output AS_REP response to crack with hashcat to file
120-
--kerberoasting KERBEROASTING
120+
--kerberoasting, --kerberoast KERBEROASTING
121121
Output TGS ticket to crack with hashcat to file
122+
--kerberoast-account KERBEROAST_ACCOUNT [KERBEROAST_ACCOUNT ...]
123+
Target specific accounts for kerberoasting (sAMAccountNames or file containing sAMAccountNames)
124+
--no-preauth-targets NO_PREAUTH_TARGETS
125+
Targeted kerberoastable users
122126
123127
Retrieve useful information on the domain:
124-
Options to to play with Kerberos
125-
128+
--base-dn BASE_DN base DN for search queries
126129
--query QUERY QUERY Query LDAP with a custom filter and attributes
130+
--find-delegation Finds delegation relationships within an Active Directory domain. (Enabled Accounts only)
127131
--trusted-for-delegation
128132
Get the list of users and computers with flag TRUSTED_FOR_DELEGATION
129133
--password-not-required
130134
Get the list of users with flag PASSWD_NOTREQD
131-
--admin-count Get objets that had the value adminCount=1
132-
--users [USERS ...] Enumerate enabled domain users
133-
--groups Enumerate domain groups
135+
--admin-count Get user that had the value adminCount=1
136+
--users [USERS ...] Enumerate domain users
137+
--users-export USERS_EXPORT
138+
Enumerate domain users and export them to the specified file
139+
--groups [GROUPS] Enumerate domain groups, if a group is specified than its members are enumerated
140+
--computers Enumerate domain computers
134141
--dc-list Enumerate Domain Controllers
135142
--get-sid Get domain sid
136143
--active-users [ACTIVE_USERS ...]
137144
Get Active Domain Users Accounts
145+
--pso Get Fine Grained Password Policy/PSOs
146+
--pass-pol Dump password policy
138147
139148
Retrieve gmsa on the remote DC:
140149
Options to play with gmsa
@@ -149,33 +158,44 @@ Bloodhound Scan:
149158
Options to play with Bloodhoud
150159
151160
--bloodhound Perform a Bloodhound scan
152-
-c COLLECTION, --collection COLLECTION
153-
Which information to collect. Supported: Group, LocalAdmin, Session, Trusts, Default, DCOnly, DCOM, RDP, PSRemote, LoggedOn, Container, ObjectProps, ACL, All. You can specify more than one by separating them
154-
with a comma (default: Default)
161+
-c, --collection COLLECTION
162+
Which information to collect. Supported: Group, LocalAdmin, Session, Trusts, Default, DCOnly, DCOM, RDP, PSRemote, LoggedOn, Container, ObjectProps, ACL, All. You can specify more than one by
163+
separating them with a comma (default: Default)
155164
```
156165

157-
## Modules
166+
## Low Privilege Modules
158167

159168
```plain
160-
LOW PRIVILEGE MODULES
169+
ENUMERATION
161170
[*] adcs Find PKI Enrollment Services in Active Directory and Certificate Templates Names
171+
[*] badsuccessor Check if vulnerable to bad successor attack (DMSA)
172+
[*] certipy-find certipy find command with options to export the result to text/csv/json. Default: Show only vulnerable templates
162173
[*] daclread Read and backup the Discretionary Access Control List of objects. Be careful, this module cannot read the DACLS recursively, see more explanation in the options.
163-
[*] enum_trusts Extract all Trust Relationships, Trusting Direction, and Trust Transitivity
174+
[*] dump-computers Dumps all computers in the domain
175+
[*] entra-id Find the Entra ID sync server
176+
[*] enum_trusts [REMOVED] Extract all Trust Relationships, Trusting Direction, and Trust Transitivity
164177
[*] find-computer Finds computers in the domain via the provided text
165-
[*] get-desc-users Get description of the users. May contained password
166178
[*] get-network Query all DNS records with the corresponding IP from the domain.
167-
[*] get-unixUserPassword Get unixUserPassword attribute from all users in ldap
168-
[*] get-userPassword Get userPassword attribute from all users in ldap
169-
[*] group-mem Retrieves all the members within a Group
179+
[*] group-mem [REMOVED] Retrieves all the members within a Group
170180
[*] groupmembership Query the groups to which a user belongs.
171-
[*] laps Retrieves all LAPS passwords which the account has read permissions for.
172-
[*] ldap-checker Checks whether LDAP signing and binding are required and / or enforced
181+
[*] ldap-checker [REMOVED] Checks whether LDAP signing and channel binding are required and / or enforced
173182
[*] maq Retrieves the MachineAccountQuota domain-level attribute
174183
[*] obsolete Extract all obsolete operating systems from LDAP
175184
[*] pso Module to get the Fine Grained Password Policy/PSOs
185+
[*] sccm Find a SCCM infrastructure in the Active Directory
176186
[*] subnets Retrieves the different Sites and Subnets of an Active Directory
177-
[*] user-desc Get user descriptions stored in Active Directory
178187
[*] whoami Get details of provided user
188+
189+
CREDENTIAL_DUMPING
190+
[*] get-desc-users Get description of the users. May contain password
191+
[*] get-info-users Get the info field of all users. May contain password
192+
[*] get-unixUserPassword Get unixUserPassword attribute from all users in ldap
193+
[*] get-userPassword Get userPassword attribute from all users in ldap
194+
[*] laps Retrieves all LAPS passwords which the account has read permissions for.
195+
[*] user-desc Get user descriptions stored in Active Directory
196+
197+
PRIVILEGE_ESCALATION
198+
[*] pre2k Identify pre-created computer accounts, save the results to a file, and obtain TGTs for each
179199
```
180200

181201
## Examples

‎content/tools/framework/netexec/nxc-rdp/index.md‎

Lines changed: 31 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,11 @@ Install [NetExec]({{< ref "../netexec" >}}).
1818
## Usage
1919

2020
```plain
21-
netexec rdp [-h] [-t THREADS] [--timeout TIMEOUT] [--jitter INTERVAL] [--verbose] [--debug] [--no-progress] [--log LOG] [-6] [--dns-server DNS_SERVER] [--dns-tcp] [--dns-timeout DNS_TIMEOUT] [-u USERNAME [USERNAME ...]]
22-
[-p PASSWORD [PASSWORD ...]] [-id CRED_ID [CRED_ID ...]] [--ignore-pw-decoding] [--no-bruteforce] [--continue-on-success] [--gfail-limit LIMIT] [--ufail-limit LIMIT] [--fail-limit LIMIT] [-k] [--use-kcache]
23-
[--aesKey AESKEY [AESKEY ...]] [--kdcHost KDCHOST] [--server {https,http}] [--server-host HOST] [--server-port PORT] [--connectback-host CHOST] [-M MODULE] [-o MODULE_OPTION [MODULE_OPTION ...]] [-L] [--options]
24-
[-H HASH [HASH ...]] [--port PORT] [--rdp-timeout RDP_TIMEOUT] [--nla-screenshot] [-d DOMAIN | --local-auth] [--screenshot] [--screentime SCREENTIME] [--res RES]
21+
netexec rdp [-h] [--version] [-t THREADS] [--timeout TIMEOUT] [--jitter INTERVAL] [--verbose] [--debug] [--no-progress] [--log LOG] [-6] [--dns-server DNS_SERVER] [--dns-tcp] [--dns-timeout DNS_TIMEOUT]
22+
[-u USERNAME [USERNAME ...]] [-p PASSWORD [PASSWORD ...]] [-id CRED_ID [CRED_ID ...]] [--ignore-pw-decoding] [--no-bruteforce] [--continue-on-success] [--gfail-limit LIMIT] [--ufail-limit LIMIT]
23+
[--fail-limit LIMIT] [-k] [--use-kcache] [--aesKey AESKEY [AESKEY ...]] [--kdcHost KDCHOST] [--pfx-cert PFXCERT] [--pfx-base64 PFXB64] [--pfx-pass PFXPASS] [--pem-cert PEMCERT] [--pem-key PEMKEY]
24+
[-M MODULE] [-o MODULE_OPTION [MODULE_OPTION ...]] [-L [LIST_MODULES]] [--options] [-H HASH [HASH ...]] [--port PORT] [--rdp-timeout RDP_TIMEOUT] [--nla-screenshot] [-d DOMAIN | --local-auth]
25+
[--screenshot] [--screentime SCREENTIME] [--res RES] [-x COMMAND] [-X PS_COMMAND] [--cmd-delay CMD_DELAY] [--clipboard-delay CLIPBOARD_DELAY] [--no-output]
2526
target [target ...]
2627
```
2728

@@ -33,7 +34,7 @@ positional arguments:
3334
3435
options:
3536
-h, --help show this help message and exit
36-
-H HASH [HASH ...], --hash HASH [HASH ...]
37+
-H, --hash HASH [HASH ...]
3738
NTLM hash(es) or file(s) containing NTLM hashes
3839
--port PORT RDP port (default: 3389)
3940
--rdp-timeout RDP_TIMEOUT
@@ -45,7 +46,8 @@ options:
4546
Generic:
4647
Generic options for nxc across protocols
4748
48-
-t THREADS, --threads THREADS
49+
--version Display nxc version
50+
-t, --threads THREADS
4951
set how many concurrent threads to use (default: 256)
5052
--timeout TIMEOUT max timeout in seconds of each thread
5153
--jitter INTERVAL sets a random delay between each authentication
@@ -69,9 +71,9 @@ DNS:
6971
Authentication:
7072
Options for authenticating
7173
72-
-u USERNAME [USERNAME ...], --username USERNAME [USERNAME ...]
74+
-u, --username USERNAME [USERNAME ...]
7375
username(s) or file(s) containing usernames
74-
-p PASSWORD [PASSWORD ...], --password PASSWORD [PASSWORD ...]
76+
-p, --password PASSWORD [PASSWORD ...]
7577
password(s) or file(s) containing passwords
7678
-id CRED_ID [CRED_ID ...]
7779
database credential ID(s) to use for authentication
@@ -92,24 +94,23 @@ Kerberos:
9294
AES key to use for Kerberos Authentication (128 or 256 bits)
9395
--kdcHost KDCHOST FQDN of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter
9496
95-
Servers:
96-
Options for nxc servers
97+
Certificate:
98+
Options for certificate authentication
9799
98-
--server {https,http}
99-
use the selected server (default: https)
100-
--server-host HOST IP to bind the server to (default: 0.0.0.0)
101-
--server-port PORT start the server on the specified port
102-
--connectback-host CHOST
103-
IP for the remote system to connect back to
100+
--pfx-cert PFXCERT Use certificate authentication from pfx file .pfx
101+
--pfx-base64 PFXB64 Use certificate authentication from pfx file encoded in base64
102+
--pfx-pass PFXPASS Password of the pfx certificate
103+
--pem-cert PEMCERT Use certificate authentication from PEM file
104+
--pem-key PEMKEY Private key for the PEM format
104105
105106
Modules:
106107
Options for nxc modules
107108
108-
-M MODULE, --module MODULE
109-
module to use
109+
-M, --module MODULE module to use
110110
-o MODULE_OPTION [MODULE_OPTION ...]
111111
module options
112-
-L, --list-modules list available modules
112+
-L, --list-modules [LIST_MODULES]
113+
list available modules
113114
--options display module options
114115
115116
Screenshot:
@@ -119,6 +120,17 @@ Screenshot:
119120
--screentime SCREENTIME
120121
Time to wait for desktop image (default: 10)
121122
--res RES Resolution in WIDTHxHEIGHT format (default: 1024x768)
123+
124+
Command Execution:
125+
Options for executing commands
126+
127+
-x COMMAND execute the specified command
128+
-X PS_COMMAND execute the specified PowerShell command
129+
--cmd-delay CMD_DELAY
130+
Sleep time before executing command (default: 5)
131+
--clipboard-delay CLIPBOARD_DELAY
132+
Maximum time to wait for clipboard initialization (seconds) (default: 30)
133+
--no-output do not retrieve command output
122134
```
123135

124136
## Examples

0 commit comments

Comments
 (0)