-
Notifications
You must be signed in to change notification settings - Fork 300
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add coerce_plus Module #300
base: main
Are you sure you want to change the base?
Conversation
This is really cool! Thanks for the contribution |
Hello, thanks for the PR. For the always to true I think it's better if by default the module will not try to coerce with every possible methods, during a pentest you usually wants one, having 10 coerce from the same machine doesn't bring any value. For the other modules (the deleted ones) I think they shouldn't be deleted since it will break previous tutorial, demo, course on nxc. It can be also useful if you only want to coerce using petitpotam for example (which is not possible in this module). Regards |
Nice addition, but it would be better to have the right name for the option imo :) -METHOD=petitpotam |
actually i want supports shorthand method names. (is not case-sensitive of course) For example: Additionally, you can use the shorthand -M instead of -METHOD.
full names are also acceptable and work just as well:
|
aha ok ok ^^ |
@lodos2005 can you fix the conflicts here? Then I can test and we can get this merged. |
@Marshall-Hallenbeck i guess its fixed. |
I have limited knowledge about RPC, but on my side Coercion with PetitPotam (currently the only one i tested it with) only works against my normal Win 2019 server when setting the auth level to Against the DC it works without the auth level though. |
Printerbug&PetitPotam are now working in my Lab. Will test the others soon |
Only ShadowCoerce & MSEven missing now :) then we are good to go |
Looks like ShadowCoerce has been patched: https://www.bleepingcomputer.com/news/microsoft/microsoft-quietly-fixes-shadowcoerce-windows-ntlm-relay-bug/ |
@mpgn aggreed, i think we should add the files back, just containing a message "This module moved to the new coerce_plus module" on execution. What do you think? EDIT: Changed the word "DEPRECATED" to "REMOVED" (as this fits better imo) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
Everything works as expected now (couldn't test shadow coerce as it seems to be patched and mseven didn't trigger, but behaved like the method from coercer).
@lodos2005 please retest the module on your side, so we are sure nothing broke during the review. After that we should be good to go
All good for me well done @lodos2005 |
I've published the coerce_plus module. I wanted to add the "ms-even" vulnerability as a separate module like the previously submitted "printerbug" vulnerability. However, having a total of 5 modules (petitpotam, dsfcoerce, shadowcoerce, printerbug, and ms-even) felt a bit excessive, especially since some exploits required separate files(project).
Now, we have a single module, coerce_plus, for all 5 coercion methods (petitpotam, dsfcoerce, ms-even, shadowcoerce, and printerbug). This eliminates the need for separate exploit files. The LISTENER parameter should work for all vulnerabilities. I've also added a few extra binding parameters, some of which might be unpatched (😈).