diff --git a/nxc/protocols/smb.py b/nxc/protocols/smb.py index dbf342c7c6..a03d939fd1 100755 --- a/nxc/protocols/smb.py +++ b/nxc/protocols/smb.py @@ -2490,13 +2490,13 @@ def add_hash(secret_type, secret, host_id): else: add_hash.nt_lm_secrets += 1 - # Log the secret based on args - if self.args.enabled: - if "Enabled" in secret: - secret = " ".join(secret.split(" ")[:-1]) - self.logger.highlight(secret) - else: - secret = " ".join(secret.split(" ")[:-1]) if " " in secret else secret + is_enabled_account = secret.endswith(" (status=Enabled)") + is_trust_key = " (Incoming" in secret or " (Outgoing" in secret + is_current_trust_key = is_trust_key and ", previous)" not in secret + for status in (" (status=Enabled)", " (status=Disabled)", " (status=N/A)"): + secret = secret.removesuffix(status) + + if not self.args.enabled or is_enabled_account or is_current_trust_key: self.logger.highlight(secret) # Filter out computer accounts, history hashes and kerberos keys for adding to db @@ -2548,18 +2548,27 @@ def add_hash(secret_type, secret, host_id): outputFileName=self.output_filename, justUser=self.args.userntds if self.args.userntds else None, printUserStatus=True, + trustKeys=self.args.trust_keys, + justTrustKeys=self.args.just_trust_keys, + domainFQDN=self.targetDomain, perSecretCallback=lambda secret_type, secret: add_hash(secret_type, secret, host_id), ) try: - self.logger.success("Dumping the NTDS, this could take a while so go grab a redbull...") + if self.args.just_trust_keys: + self.logger.success("Dumping the trust keys, this could take a while so go grab a redbull...") + else: + self.logger.success("Dumping the NTDS, this could take a while so go grab a redbull...") NTDS.dump() ntds_outfile = f"{self.output_filename}.ntds" - self.logger.success(f"Dumped {highlight(add_hash.nt_lm_secrets)} NTDS hashes to {ntds_outfile} of which {highlight(add_hash.added_to_db)} were added to the database") - if self.args.kerberos_keys: - self.logger.success(f"Dumped {highlight(add_hash.kerb_secrets)} Kerberos keys to {ntds_outfile}.kerberos") - self.logger.display("To extract only enabled accounts from the output file, run the following command: ") - self.logger.display(f"grep -iv disabled {ntds_outfile} | cut -d ':' -f1") + if self.args.just_trust_keys: + self.logger.success(f"Dumped {highlight(add_hash.nt_lm_secrets)} trust keys to {ntds_outfile}") + else: + self.logger.success(f"Dumped {highlight(add_hash.nt_lm_secrets)} NTDS hashes to {ntds_outfile} of which {highlight(add_hash.added_to_db)} were added to the database") + if self.args.kerberos_keys: + self.logger.success(f"Dumped {highlight(add_hash.kerb_secrets)} Kerberos keys to {ntds_outfile}.kerberos") + self.logger.display("To extract only enabled accounts from the output file, run the following command: ") + self.logger.display(f"grep -iv disabled {ntds_outfile} | cut -d ':' -f1") except Exception as e: # if str(e).find('ERROR_DS_DRA_BAD_DN') >= 0: # We don't store the resume file if this error happened, since this error is related to lack diff --git a/nxc/protocols/smb/proto_args.py b/nxc/protocols/smb/proto_args.py index 5fbb6f93ec..8086018a34 100644 --- a/nxc/protocols/smb/proto_args.py +++ b/nxc/protocols/smb/proto_args.py @@ -38,10 +38,14 @@ def proto_args(parser, parents): # NTDS options kerb_keys_arg = cred_gathering_group.add_argument("--kerberos-keys", action=get_conditional_action(_StoreTrueAction), make_required=[], help="Also dump Kerberos AES and DES keys from target DC (NTDS.dit)") exclusive = cred_gathering_group.add_mutually_exclusive_group() - enabled_arg = exclusive.add_argument("--enabled", action=get_conditional_action(_StoreTrueAction), make_required=[], help="Only dump enabled targets from DC (NTDS.dit)") + enabled_arg = exclusive.add_argument("--enabled", action=get_conditional_action(_StoreTrueAction), make_required=[], help="Only dump enabled targets from DC (NTDS.dit), and current trust keys") kerb_keys_arg.make_required = [ntds_arg] enabled_arg.make_required = [ntds_arg] cred_gathering_group.add_argument("--user", dest="userntds", type=str, help="Dump selected user from DC (NTDS.dit)") + trust_keys_arg = cred_gathering_group.add_argument("--trust-keys", action=get_conditional_action(_StoreTrueAction), make_required=[], default=True, help="Dump Trusted Domain Object (TDO) secrets and derive inter-realm Kerberos/RC4 keys (NTDS.dit), default True") + just_trust_keys_arg = cred_gathering_group.add_argument("--just-trust-keys", action=get_conditional_action(_StoreTrueAction), make_required=[], help="Like --trust-keys but dump ONLY the trust keys, skipping every account secret (NTDS.dit)") + trust_keys_arg.make_required = [ntds_arg] + just_trust_keys_arg.make_required = [ntds_arg] cred_gathering_group.add_argument("--dpapi", choices={"cookies", "nosystem"}, nargs="*", help="dump DPAPI secrets from target systems, can dump cookies if you add 'cookies', will not dump SYSTEM dpapi if you add nosystem") cred_gathering_group.add_argument("--sccm", choices={"wmi", "disk"}, nargs="?", const="disk", help="dump SCCM secrets from target systems") cred_gathering_group.add_argument("--mkfile", action="store", help="DPAPI option. File with masterkeys in form of {GUID}:SHA1") diff --git a/tests/e2e_commands.txt b/tests/e2e_commands.txt index 99ff30c4d1..06aa1eb9de 100644 --- a/tests/e2e_commands.txt +++ b/tests/e2e_commands.txt @@ -32,6 +32,8 @@ netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --ntds netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --ntds --history netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --ntds --enabled netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --ntds --kerberos-keys +netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --ntds --trust-keys +netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --ntds --just-trust-keys netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --lsa netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --dpapi netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --sccm