Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[DNS] Add DNS args #196

Merged
merged 48 commits into from May 20, 2024
Merged

[DNS] Add DNS args #196

merged 48 commits into from May 20, 2024

Conversation

XiaoliChan
Copy link
Contributor

@XiaoliChan XiaoliChan commented Mar 4, 2024

Changelog:

  • Fixed NetExec LDAP is using System's DNS #184
  • Fixed lots of connection stuff which is use kdcHost
  • Allow using force IPv6 with -6
  • Allow specify DNS server with --dns-server
  • Allow using tcp DNS query with --dns-tcp
  • Set DNS query timeout with --dns-timeout
  • Auto resolve DC IP and set it as kdcHost, which means you can play with kerberos stuff without set /etc/hosts files

image

@mpgn
Copy link
Collaborator

mpgn commented Mar 4, 2024

awesome, you did it ! 🎉

@mpgn
Copy link
Collaborator

mpgn commented Mar 4, 2024

image

@mpgn
Copy link
Collaborator

mpgn commented Mar 4, 2024

Before
image

After
image

mpgn
mpgn previously approved these changes Mar 4, 2024
@mpgn mpgn added this to the v1.2.0 milestone Mar 4, 2024
@mpgn mpgn added the enhancement New feature or request label Mar 4, 2024
@mpgn mpgn marked this pull request as ready for review March 4, 2024 20:58
@bmigette
Copy link

bmigette commented Mar 4, 2024

Tested working for me

┌──(babadmin㉿kakali) - 23:44:04 - [/tmp/NetExec]
└─$ poetry run nxc --dns-server 172.16.188.10 ldap 172.16.188.10 -u wario -p XXXXX --users
SMB         172.16.188.10   445    DC01             [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:company.com) (signing:True) (SMBv1:False)
LDAP        172.16.188.10   389    DC01             [+] company.com\wario:XXXXX
LDAP        172.16.188.10   389    DC01             [*] Total of records returned 13
LDAP        172.16.188.10   389    DC01             Administrator                  Built-in account for administering the computer/domain
LDAP        172.16.188.10   389    DC01             Guest                          Built-in account for guest access to the computer/domain
LDAP        172.16.188.10   389    DC01             company                        company
LDAP        172.16.188.10   389    DC01             krbtgt                         Key Distribution Center Service Account
LDAP        172.16.188.10   389    DC01             leon
LDAP        172.16.188.10   389    DC01             joe
LDAP        172.16.188.10   389    DC01             peach
LDAP        172.16.188.10   389    DC01             mario
LDAP        172.16.188.10   389    DC01             wario
LDAP        172.16.188.10   389    DC01             yoshi

@XiaoliChan
Copy link
Contributor Author

@mpgn current is not ready, I want to play with kdchost, it would be useful

@NeffIsBack
Copy link
Contributor

NeffIsBack commented Mar 5, 2024

This is amazing! It finally solves the dns problem, even without setting a dns server!
@bmigette can you try if that also works for you without setting it manually?

image

@NeffIsBack NeffIsBack added the bug-fix This Pull Request fixes a bug label Mar 5, 2024
nxc/protocols/wmi.py Outdated Show resolved Hide resolved
@XiaoliChan
Copy link
Contributor Author

XiaoliChan commented Mar 5, 2024

With this PR, now we can play with Kerberos more easily than before (except DCOM)
image

image

@XiaoliChan
Copy link
Contributor Author

MSSQL Current is not changed, will change it after #136 is merged

@Marshall-Hallenbeck
Copy link
Collaborator

@XiaoliChan yo this is awesome!

XiaoliChan and others added 7 commits March 9, 2024 01:52
Signed-off-by: XiaoliChan <30458572+XiaoliChan@users.noreply.github.com>
Signed-off-by: XiaoliChan <30458572+XiaoliChan@users.noreply.github.com>
Signed-off-by: XiaoliChan <30458572+XiaoliChan@users.noreply.github.com>
Signed-off-by: XiaoliChan <30458572+XiaoliChan@users.noreply.github.com>
@NeffIsBack NeffIsBack removed their assignment Apr 27, 2024
@Marshall-Hallenbeck
Copy link
Collaborator

@NeffIsBack I started looking at renaming the variables and unfortunately it's just everywhere. I think we should create an issue to fix the naming conventions everywhere, and just merge this PR as it.

@NeffIsBack
Copy link
Contributor

Then let's rename the newly created variables to use the old ones. I just don't want to have duplicate variables.

@Marshall-Hallenbeck
Copy link
Collaborator

Marshall-Hallenbeck commented May 7, 2024

Then let's rename the newly created variables to use the old ones. I just don't want to have duplicate variables.

There's so many that overlap I'm just going to try to do as many as I can.

Not going to update it myself. I'll fix it across the project after this is merged.

@NeffIsBack
Copy link
Contributor

@XiaoliChan i removed the remoteHost variable for now and made some formatting changes. Can you check if everything looks good to you?
Also using wmi and kerberos always shows a successful login, despite providing wrong credentials:
image

@NeffIsBack
Copy link
Contributor

@Marshall-Hallenbeck can you run the test suite against the PR? Just to make sure there didn't something which i missed with the manual review & testing. The last fix (see above) can be tested manually when fixed.

@Marshall-Hallenbeck
Copy link
Collaborator

I ran it before, but I can run it again. Just gotta make sure the new test cases are in the e2e tests.

@NeffIsBack NeffIsBack self-assigned this May 14, 2024
@Marshall-Hallenbeck
Copy link
Collaborator

Fixed some final stuff and running tests now

@NeffIsBack
Copy link
Contributor

I think 95ac1af destroyed the normal login 😅
image

@Marshall-Hallenbeck
Copy link
Collaborator

I think 95ac1af destroyed the normal login 😅 image

Yeah it did... lemme try to fix it lol.

@NeffIsBack NeffIsBack added the reviewed code Label for when a static code review was done label May 19, 2024
Copy link
Contributor

@NeffIsBack NeffIsBack left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Commit 47b1c1f solved remaining issue:
image

Tests ran through fine now. @Marshall-Hallenbeck would merge now if there isn't anything left to do

@Marshall-Hallenbeck
Copy link
Collaborator

Tests look good from my side, merging now. It's been a long time coming and I'm excited to finally get this in!

@Marshall-Hallenbeck Marshall-Hallenbeck merged commit d0a4afe into Pennyw0rth:main May 20, 2024
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug-fix This Pull Request fixes a bug enhancement New feature or request reviewed code Label for when a static code review was done
Projects
None yet
Development

Successfully merging this pull request may close these issues.

NetExec LDAP is using System's DNS
5 participants