Make some text more precise #7

NeffIsBack · 2023-09-09T17:28:20Z

Change some help and fail messages to better bring across what is happening in the background

…ent the effect

cme/protocols/smb/atexec.py

Marshall-Hallenbeck

There's a few spots where you say "(maybe command executed!)" - why is this? Like, technically why - is it a high chance it executed? I'm not sure we should get the user's hopes up with a small chance at execution. Rather, maybe we should try to confirm execution?
I know a lot of places in the code are iffy about if something worked or not, maybe we should come up with a "maybe it worked, but we can't tell" error?

cme/protocols/smb/atexec.py

cme/protocols/smb/mmcexec.py

cme/protocols/smb/smbexec.py

cme/protocols/wmi/wmiexec.py

cme/protocols/wmi/wmiexec_event.py

cme/protocols/smb/mmcexec.py

cme/protocols/smb/atexec.py

NeffIsBack · 2023-09-09T21:56:32Z

There's a few spots where you say "(maybe command executed!)" - why is this? Like, technically why - is it a high chance it executed? I'm not sure we should get the user's hopes up with a small chance at execution. Rather, maybe we should try to confirm execution? I know a lot of places in the code are iffy about if something worked or not, maybe we should come up with a "maybe it worked, but we can't tell" error?

From my understanding this is because it tries to execute the code on the host, but sometimes fails too read the output properly (most often i encountered just a time out, but this can very well be an AV as well). Any idea how we could improve it?
Also probably something @XiaoliChan can help with

XiaoliChan · 2023-09-10T01:35:59Z

There's a few spots where you say "(maybe command executed!)" - why is this? Like, technically why - is it a high chance it executed? I'm not sure we should get the user's hopes up with a small chance at execution. Rather, maybe we should try to confirm execution?
I know a lot of places in the code are iffy about if something worked or not, maybe we should come up with a "maybe it worked, but we can't tell" error?

Yes just like @NeffIsBack said, sometimes it got detection by AV software and you never know about it(the impacket has no error), I can 100% confirm these situation always happens

Marshall-Hallenbeck · 2023-09-10T01:50:57Z

There's a few spots where you say "(maybe command executed!)" - why is this? Like, technically why - is it a high chance it executed? I'm not sure we should get the user's hopes up with a small chance at execution. Rather, maybe we should try to confirm execution?
I know a lot of places in the code are iffy about if something worked or not, maybe we should come up with a "maybe it worked, but we can't tell" error?

Yes just like @NeffIsBack said, sometimes it got detection by AV software and you never know about it(the impacket has no error), I can 100% confirm these situation always happens

This is true about our SMB exec, etc - but we don't have this same alert for users. I think if there's an error that we don't know about, and we can't be at least 90% sure that it executed, we should just return the network error. Does that make sense?

XiaoliChan · 2023-09-10T02:17:41Z

This is true about our SMB exec, etc - but we don't have this same alert for users. I think if there's an error that we don't know about, and we can't be at least 90% sure that it executed, we should just return the network error. Does that make sense?

Yes, it will, if get other types of exception, it will output the error log in debug log
https://github.com/Pennyw0rth/CrackMapExec/blob/master/cme/protocols/smb/smbexec.py#L183

NeffIsBack · 2023-09-10T10:16:39Z

Yes, it will, if get other types of exception, it will output the error log in debug log https://github.com/Pennyw0rth/CrackMapExec/blob/master/cme/protocols/smb/smbexec.py#L183

Do you know what happens when AV catches the exec method? Does that trigger the "tries" exception with just the file missing or is this one of the other exceptions then? If this triggers one of the other exec methods we could just inform, that the command probably executed, but the timeout was just too short

XiaoliChan · 2023-09-10T11:07:13Z

Do you know what happens when AV catches the exec method?

AV have many many way to catch it, like block RPC access, remove the results files

Does that trigger the "tries" exception with just the file missing or is this one of the other exceptions then? If this triggers one of the other exec methods we could just inform, that the command probably executed, but the timeout was just too short

It always raises "STATUS_OBJECT_NAME_NOT_FOUND" when can't find the result files, I can confirm this.

NeffIsBack · 2023-09-10T11:10:28Z

Does that trigger the "tries" exception with just the file missing or is this one of the other exceptions then? If this triggers one of the other exec methods we could just inform, that the command probably executed, but the timeout was just too short

It always raises "STATUS_OBJECT_NAME_NOT_FOUND" when can't find the result files, I can confirm this.

Okay, then it nearly always will be a simple timeout and AV will result in another exception correct? I will write that more explicit then to be clear that it most likely did execute

XiaoliChan · 2023-09-10T11:13:31Z

Okay, then it nearly always will be a simple timeout and AV will result in another exception correct? I will write that more explicit then to be clear that it most likely did execute

Yes, sometimes is like if you executed the command with result output, and the command has executed, but the AV remove the result file, in this case, the command was executed

But I never meet the something like "connection timeout" before

NeffIsBack · 2023-09-12T10:37:56Z

Hmm okay, for me i had several times the problem, that the command executed but i set the threshhold too low. So it executed but didn't show the output because it tried to grab the file too fast.

Marshall-Hallenbeck · 2023-09-13T19:12:24Z

cme/protocols/smb/atexec.py

@@ -38,6 +38,8 @@ def __init__(
        self.__doKerberos = doKerberos
        self.__kdcHost = kdcHost
        self.__tries = tries
+        self.__output = None


Should probably rename this "__output_filename"

Marshall-Hallenbeck · 2023-09-13T19:13:09Z

cme/protocols/smb/atexec.py

@@ -114,11 +116,12 @@ def gen_xml(self, command, tmpFileName, fileless=False):
      <Command>cmd.exe</Command>
 """
        if self.__retOutput:
+            self.__output = "\\Windows\\Temp\\" + gen_random_string(6)


Would we want the folder to be a variable, so users can pass in their own temp location?

I think this would be another feature. Probably great to add but should be done seperatly imo

Would we want the folder to be a variable, so users can pass in their own temp location?

Yes, as @NeffIsBack said, this is another feature

Marshall-Hallenbeck · 2023-09-13T19:14:35Z

cme/protocols/smb/atexec.py

                        break
                    except Exception as e:
                        if tries >= self.__tries:
-                            self.logger.fail(f'ATEXEC: Get output file error, maybe got detected by AV software, please increase the number of tries with the option "--get-output-tries". If it\'s still failing maybe something is blocking the schedule job, try another exec method')
+                            self.logger.fail(f"ATEXEC: Couldn't retrieve output file, maybe got detected by AV. Please increase the number of tries with the option '--get-output-tries'. If it's still failing, try the wmi protocol or another exec method")


ATEXEC: Could not retrieve output file, it may have been detected by AV. Please increase the number of tries with the option '--get-output-tries'. If it is still failing, try the 'wmi' protocol or another exec method

Marshall-Hallenbeck · 2023-09-13T19:15:35Z

cme/protocols/smb/atexec.py

                            break
                        if str(e).find("STATUS_BAD_NETWORK_NAME") >0 :
-                            self.logger.fail(f'ATEXEC: Get ouput failed, target has blocked ADMIN$ access (maybe command executed!)')
+                            self.logger.fail(f"ATEXEC: Get output failed, target has blocked {self.__share} access (maybe command executed!)")


ATEXEC: Getting the output file failed - target has blocked access to the share: {self.__share} (but the command may have executed!)

Marshall-Hallenbeck · 2023-09-13T19:16:10Z

cme/protocols/smb/mmcexec.py

@@ -252,10 +252,10 @@ def get_output_remote(self):
                break
            except Exception as e:
                if tries >= self.__tries:
-                    self.logger.fail(f'MMCEXEC: Get output file error, maybe got detected by AV software, please increase the number of tries with the option "--get-output-tries". If it\'s still failing maybe something is blocking the schedule job, try another exec method')
+                    self.logger.fail(f"MMCEXEC: Couldn't retrieve output file, maybe got detected by AV. Please increase the number of tries with the option '--get-output-tries'. If it's still failing, try the wmi protocol or another exec method")


MMCEXEC: Could not retrieve output file, it may have been detected by AV. Please increase the number of tries with the option '--get-output-tries'. If it is still failing, try the 'wmi' protocol or another exec method

Marshall-Hallenbeck · 2023-09-13T19:16:22Z

cme/protocols/smb/mmcexec.py

                    break
                if str(e).find("STATUS_BAD_NETWORK_NAME") >0 :
-                    self.logger.fail(f'MMCEXEC: Get ouput failed, target has blocked {self.__share} access (maybe command executed!)')
+                    self.logger.fail(f"MMCEXEC: Get output failed, target has blocked {self.__share} access (maybe command executed!)")


MMCEXEC: Getting the output file failed - target has blocked access to the share: {self.__share} (but the command may have executed!)

Marshall-Hallenbeck · 2023-09-13T19:16:46Z

cme/protocols/smb/smbexec.py

                    break
                if str(e).find("STATUS_BAD_NETWORK_NAME") >0 :
-                    self.logger.fail(f'SMBEXEC: Get ouput failed, target has blocked {self.__share} access (maybe command executed!)')
+                    self.logger.fail(f"SMBEXEC: Get output failed, target has blocked {self.__share} access (maybe command executed!)")


SMBEXEC: Getting the output file failed - target has blocked access to the share: {self.__share} (but the command may have executed!)

Marshall-Hallenbeck · 2023-09-13T19:16:55Z

cme/protocols/smb/smbexec.py

@@ -170,10 +170,10 @@ def get_output_remote(self):
                break
            except Exception as e:
                if tries >= self.__tries:
-                    self.logger.fail(f'SMBEXEC: Get output file error, maybe got detected by AV software, please increase the number of tries with the option "--get-output-tries". If it\'s still failing maybe something is blocking the schedule job, try another exec method')
+                    self.logger.fail(f"SMBEXEC: Couldn't retrieve output file, maybe got detected by AV. Please increase the number of tries with the option '--get-output-tries'. If it's still failing, try the wmi protocol or another exec method")


SMBEXEC: Could not retrieve output file, it may have been detected by AV. Please increase the number of tries with the option '--get-output-tries'. If it is still failing, try the 'wmi' protocol or another exec method

Marshall-Hallenbeck

LGTM

NeffIsBack added 3 commits September 9, 2023 19:19

Add us to cli output

0e528ae

Make exec fail messages more precise

2400bc6

Change wmi --interval-time to --exec-timeout to more accuratly repres…

4a739a0

…ent the effect

NeffIsBack added the documentation Improvements or additions to documentation label Sep 9, 2023

Typo

2119d37

Marshall-Hallenbeck reviewed Sep 9, 2023

View reviewed changes

cme/protocols/smb/atexec.py Outdated Show resolved Hide resolved

Replacing single quotes with double quotes in strings

95ac793

Marshall-Hallenbeck reviewed Sep 9, 2023

View reviewed changes

Fix spelling mistakes and formatting

fe517be

NeffIsBack requested a review from Marshall-Hallenbeck September 9, 2023 21:56

NeffIsBack added 2 commits September 10, 2023 12:18

Replace double quote with single quote

ba51e30

Enable using any share with atexec

47199d6

Marshall-Hallenbeck requested changes Sep 13, 2023

View reviewed changes

Improve feedback text for the user

473c4b1

Marshall-Hallenbeck approved these changes Sep 14, 2023

View reviewed changes

Marshall-Hallenbeck merged commit 95fcb55 into main Sep 14, 2023
17 checks passed

NeffIsBack deleted the neff-text-improvements branch September 14, 2023 21:27

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Make some text more precise #7

Make some text more precise #7

NeffIsBack commented Sep 9, 2023

Marshall-Hallenbeck left a comment

NeffIsBack commented Sep 9, 2023

XiaoliChan commented Sep 10, 2023

Marshall-Hallenbeck commented Sep 10, 2023

XiaoliChan commented Sep 10, 2023 •

edited

Loading

NeffIsBack commented Sep 10, 2023

XiaoliChan commented Sep 10, 2023 •

edited

Loading

NeffIsBack commented Sep 10, 2023

XiaoliChan commented Sep 10, 2023 •

edited

Loading

NeffIsBack commented Sep 12, 2023

Marshall-Hallenbeck Sep 13, 2023

Marshall-Hallenbeck Sep 13, 2023

NeffIsBack Sep 13, 2023

XiaoliChan Sep 14, 2023

Marshall-Hallenbeck Sep 13, 2023

Marshall-Hallenbeck Sep 13, 2023

Marshall-Hallenbeck Sep 13, 2023

Marshall-Hallenbeck Sep 13, 2023

Marshall-Hallenbeck Sep 13, 2023

Marshall-Hallenbeck Sep 13, 2023

Marshall-Hallenbeck left a comment

Make some text more precise #7

Make some text more precise #7

Conversation

NeffIsBack commented Sep 9, 2023

Marshall-Hallenbeck left a comment

Choose a reason for hiding this comment

NeffIsBack commented Sep 9, 2023

XiaoliChan commented Sep 10, 2023

Marshall-Hallenbeck commented Sep 10, 2023

XiaoliChan commented Sep 10, 2023 • edited Loading

NeffIsBack commented Sep 10, 2023

XiaoliChan commented Sep 10, 2023 • edited Loading

NeffIsBack commented Sep 10, 2023

XiaoliChan commented Sep 10, 2023 • edited Loading

NeffIsBack commented Sep 12, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Marshall-Hallenbeck left a comment

Choose a reason for hiding this comment

XiaoliChan commented Sep 10, 2023 •

edited

Loading

XiaoliChan commented Sep 10, 2023 •

edited

Loading

XiaoliChan commented Sep 10, 2023 •

edited

Loading