nccgroup / keimpx Goto Github PK

View Code? Open in Web Editor NEW

256.0 22.0 66.0 3.36 MB

Check for valid credentials across a network over SMB

License: Apache License 2.0

C 2.11% Python 97.81% Makefile 0.08%

keimpx's Introduction

Introduction

keimpx is an open source tool, released under the Apache License 2.0.

It can be used to quickly check for valid credentials across a network over SMB. Credentials can be:

Combination of user / plain-text password.
Combination of user / NTLM hash.
Combination of user / NTLM logon session token.

If any valid credentials are discovered across the network after its attack phase, the user is asked to choose which host to connect to and which valid credentials to use. They will then be provided with an interactive SMB shell where the user can:

Spawn an interactive command prompt.
Navigate through the remote SMB shares: list, upload, download files, create, remove files, etc.
Deploy and undeploy their own services, for instance, a backdoor listening on a TCP port for incoming connections.
List users details, domains and password policy.
More to come, see the issues page.

Dependencies

keimpx is currently developed using Python 3.8 and makes use of the excellent Impacket library from SecureAuth Corporation for much of its functionality. keimpx also makes use of the PyCryptodome library for cryptographic functions.

Installation

To install keimpx, first install Python 3.8. On Windows, you can find the installer at this link. For Linux users, many distributions provide Python 3 and make it available via your package manager (usual package names include python3 and python).

On Linux systems, you may also need to install pip and openssl-dev using your package manager for the next step.

Once you have Python 3.8 installed, use pip to install the required dependencies using this command:

pip install -r requirements.txt

keimpx can then be executed by running on Linux systems:

./keimpx.py [options]

Or if this doesn't work:

python keimpx.py [options]
python3 keimpx.py [options]

On Windows systems, you may need to specify the full path to your Python 3.8 binary, for example:

C:\Python37\bin\python.exe keimpx.py [options]

Please ensure you use the correct path for your system, as this is only an example.

Usage

Let's say you are performing an infrastructure penetration test of a large network, you owned a Windows workstation, escalated your privileges to Administrator or LOCAL SYSTEM and dumped password hashes.

You also enumerated the list of machines within the Windows domain via net command, ping sweep, ARP scan and network traffic sniffing.

Now, what if you want to check for the validity of the dumped hashes without the need to crack them across the whole Windows network over SMB? What if you want to login to one or more system using the dumped NTLM hashes then surf the shares or even spawn a command prompt?

Fire up keimpx and let it do the work for you!

Another scenario where it comes handy is discussed in this blog post.

Help message

keimpx 0.5.1-rc
by Bernardo Damele A. G. <[email protected]>
    
Usage: keimpx.py [options]

Options:
  --version       show program's version number and exit
  -h, --help      show this help message and exit
  -v VERBOSE      Verbosity level: 0-2 (default: 0)
  -t TARGET       Target address
  -l LIST         File with list of targets
  -U USER         User
  -P PASSWORD     Password
  --nt=NTHASH     NT hash
  --lm=LMHASH     LM hash
  -c CREDSFILE    File with list of credentials
  -D DOMAIN       Domain
  -d DOMAINSFILE  File with list of domains
  -p PORT         SMB port: 139 or 445 (default: 445)
  -n NAME         Local hostname
  -T THREADS      Maximum simultaneous connections (default: 10)
  -b              Batch mode: do not ask to get an interactive SMB shell
  -x EXECUTELIST  Execute a list of commands against all hosts

For examples see this wiki page.

Frequently Asked Questions

See this wiki page.

License

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Contributors

Thanks to:

deanx - for developing polenum and some classes ripped from him.
Wh1t3Fox - for updating polenum to make it compatible with newer versions of Impacket.
frego - for his Windows service bind-shell executable and help with the service deploy/undeploy methods.
gera, beto and the rest of the SecureAuth Corporation guys - for developing such amazing Python library and providing it with examples.
NEXUS2345 - for updating and maintaining keimpx.

keimpx's People

Contributors

Stargazers

Watchers

keimpx's Issues

TypeError _removeHandlerRef at each run due to impacket's logging error removal

Exception TypeError: "'NoneType' object is not callable" in function _removeHandlerRef at 0x014BDDB0 ignored

without options or with -h, thist error always its present

i work with windows 7 sp1

Licence and permission to fork and expand?

Hey,
Was thinking of using your project as the basis of a tool I am working on for extracting data from Windows (and deciphering it) over SMB? I notice Keimpx has pre-existing regkey functionality and file upload/download features, so would it be alright if I forked it and added a bunch of stuff to it? Original code will be left untouched as I wont need to modify much of that, just add a bunch of new stuff.

Recursive get of files/directories

If I want to rip a directory of files, or even a directory of sub directories, it would be nice if this were possible from keimpx itself

improvement: show the domain name in the end results

Hi,
today keimpx only shows the username\hash\password combination.
during red team engagement we do alot of domain-user-hash\password rotation, and though the end output today is useful, it still requires to QA the result becaue it doesnt show with what domain (when domains are specified from a file), was used in a successful login.
thanks,
Roy

BloodHound Ingestor integration

Add support for BloodHound ingestion using https://github.com/fox-it/BloodHound.py

Implement hashdump command

Add the 'hashdump' option to to save a copy of the Windows registry hives for SAM, SECURITY, and SYSTEM if possible, then call creddump to dump the LANMAN/NTLM hashes, view cached credentials, and decrypt LSA secrets.

Execute the specified resource file

Allow the user to provide a resource file with a list of OS commands to execute on all (or some) hosts where he has got at least one valid pair of credentials.

Support to read/write/delete registry keys

Port here psexec.exe implementation

bethus has committed a reimplementation in Python of psexec.exe, it uses RemCom on the server (victim) side.

The main advantage of psexec.exe/RemCom over the current keimpx's service bind shell (under contrib/) is that it uses named pipe to communicate with the server (victim) hence no extra TCP port is needed on the server side - all the traffic, including the OS commands, is over 139/tcp or 445/tcp.

Accept users from a file and password from another file then bruteforce

Make it read a list of users and a list of passwords and try them.

Output results to a xml/html/csv file

Add option to output results to a xml/html/csv file

Python 3 support

Add Kerberos support

Maybe update the project with kerberos support? thanks!

Restructure smbshell

smbshell is currently extremely complicated and needs to be simplified to improve maintainability.

Currently, the plan is to make each of the command execution and utility scripts independent and pass the SMB connections through object instantiation instead. This should improve memory usage and performance while making the code easier to maintain in the long term.

Release tarball

It would be nice if you provide a release tarball (incl. version number) of keimpx. This would make it easier to pack keimpx for distribution.

Thanks

Implement sniffer mode

Implement sniffer mode in which the tool sniffs on all (?) network interfaces for SMB authentication packets and dumps the NTLM session tokens to a file or similar behavior.

Automatically discover hosts

Automatically discover hosts via:

ping sweep
ARP scan
Browse list
More?

Not working with the latest version of impacket

On a Kali system with python-impacket (0.9.18-0kali1), keimpx complains about the version of impacket due to import errors:

$ keimpx 
You need to install Python Impacket library first.
Get it from Core Security's Google Code repository:
sudo apt-get -y remove python-impacket # to remove the system-installed outdated version of the library
cd /tmp
svn checkout http://impacket.googlecode.com/svn/trunk/ impacket
cd impacket
python setup.py build
sudo python setup.py install

keimpx has not evolved for a long time and is not working with the current version of impacket. Will you continue to maintain keimpx or shall we consider it abandoned ?

This ticket is prompted by https://bugs.kali.org/view.php?id=4007

Accept IP ranges

User + NTLM hash not working?

Is this the right syntax? Seems to be a local exception before it sends anything.

No LM hash available for this user

./keimpx.py -t x.x.x.x -U localadmin --nt=admin_ntlm_hash

keimpx 0.3-dev
by Bernardo Damele A. G. <[email protected]>

Exception in thread Thread-1:
Traceback (most recent call last):
File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/threading.py", line 552, in __bootstrap_inner
self.run()
File "./keimpx.py", line 1855, in run
user, password, lmhash, nthash = credential.getCredentials()
TypeError: 'NoneType' object is not iterable

No credentials worked on any target

nccgroup / keimpx Goto Github PK

keimpx's Introduction

Introduction

Dependencies

Installation

Usage

Help message

Frequently Asked Questions

License

Contributors

keimpx's People

Contributors

Stargazers

Watchers

Forkers

keimpx's Issues

Recommend Projects

Recommend Topics

Recommend Org