badpwdcount feature from CME missing

[senderend]

it seems the badpwdcount output has been removed when enumerating users with --users

CME output:

NXC output:

is this a bug, or was the feature removed/moved elsewhere? couldn't find any mention of badpwdcount in the nxc wiki.

[Marshall-Hallenbeck]

I've got #214 and #215 open to change the SMB & LDAP --users, since when we changed how it worked it removed some stuff. I'll see if adding the bad password count as a default along with the last pw set still looks good.

[Marshall-Hallenbeck]

@allendemoura please check the issue/203 branch and let me know if that is good

[senderend]

looks good! here's the output of master and issue/203 next to one another for your development pleasure:

and here's a check to see if the pw count is updating accurately (yes!):

blown away by your responsiveness! love this tool and look forward to contributing to it when i have more time.

on another note, i saw that you have several branches working on LDAP. i wanst able to get anything off the DC in this lab despite LDAP ports being open on it. i assumed it was the design of the lab as LDAP wasnt necessary to solve it, but worth asking, is LDAP working in the current master release? i didnt see anything suggesting otherwise in the issues section but thought i'd ask to be sure.

thanks again 🤘

[senderend]

oops, just noticed that the new branch does not prepend the domain (medtech.com) to domain users. its pictured above but i missed it on first glance.

[Marshall-Hallenbeck]

@allendemoura glad to know it's working, thanks for pointing this out!

LDAP is definitely working, my branch is about getting the --users functionality on par with the SMB version, and a few of the other ones are related to reducing dependencies and improving output, but the connection should work.

Yeah as for printing the domain, we actually removed it because the domain is printed in the lines above, and removing it from the username output saves a lot of space if there's longer usernames.

[NeffIsBack]

oops, just noticed that the new branch does not prepend the domain (medtech.com) to domain users. its pictured above but i missed it on first glance.

yes we removed it as it is always the local host that is returned, so it isn't even correct to prepend the domain (for example for the local Administrator on a non DC)

[senderend]

understood, good point. less clutter sounds good to me!

[senderend]

is this something that'll be merged to master immediately or will it wait for a new release?

[Marshall-Hallenbeck]

is this something that'll be merged to master immediately or will it wait for a new release?

the SMB one is already merge to main :)

[senderend]

awesome. whats your (PyPI) release schedule looking like? should i --force an install thru pipx to get the latest main? scared of nuking my configs or messing something up as i'm in the middle of a lab (pipx upgrade just tells me i already have 1.1.0)

[Marshall-Hallenbeck]

awesome. whats your (PyPI) release schedule looking like? should i --force an install thru pipx to get the latest main? scared of nuking my configs or messing something up as i'm in the middle of a lab (pipx upgrade just tells me i already have 1.1.0)

We don't release to PyPi due to some packaging issues.

Yeah, just force reinstall - it shouldn't nuke your config. You can backup your ~/.nxc/ folder if you are worried about that, though.

[senderend]

ah ok thank you. i'll be using nxc a lot, so i'm curious, where do the pipx releases come from, just the gh repo releases? should i be using --force to update in general, or do you plan on continuing releases here on the repo?

[NeffIsBack]

So we do releases as a stable, packaged fixed points, which also serves the purpose of summing up what has been done in the release notes. If you want the latest changes always install with pipx install git+https://github.com/Pennyw0rth/NetExec. This way you can force to pull the latest commits from github by using pipx reinstall netexec as it remembers its origin.

As @Marshall-Hallenbeck mentioned we can't publish to pypi because we rely directly on github commits where we pull some dependencies from:

NetExec/pyproject.toml

Line 46 in fb8c4bc

impacket = { git = "https://github.com/Pennyw0rth/impacket.git", branch = "gkdi" }

NetExec/pyproject.toml

Line 64 in fb8c4bc

oscrypto = { git = "https://github.com/Pennyw0rth/oscrypto" } # Pypi version currently broken, see: https://github.com/wbond/oscrypto/issues/78 (as of 9/23)

As long as these two aren't resolved:
fortra/impacket#1721
wbond/oscrypto#78

[NeffIsBack]

Config changes are generally not overwritten, just added if they are missing. Sometimes there are database changes if you would wanna use nxcdb, but then we will make sure that you don't lose data (worst case you would have to checkout an old version and use the nxcdb from there).

[senderend]

awesome. thanks for the clarification, and thanks for your time!