Skip to content

v1.2.0

Choose a tag to compare

View all tags
@uziii2208 uziii2208 released this 22 Aug 02:39
· 29 commits to master since this release
v1.2.0
81b5571

What's Changed

New Features

  • !shares - SMB Share Scout: Self-contained share enumeration running entirely inside the remote PowerShell session. Discovers local shares via Win32_Share, probes ~20 common UNC paths for read/write access, scans ACLs for overly permissive entries (Everyone, Authenticated Users), detects sensitive files in SYSVOL/NETLOGON including GPP cPassword auto-detection (CVE-2014-1812), and reports open files and active SMB sessions. Supports -q for quick local-only mode and explicit [HOST..] targeting with AD-based auto-discovery.

  • !sessions - Session & Network Snapshot: Active logon session enumeration via Win32_LogonSession/Win32_LoggedOnUser with session type classification (Interactive/RDP/Network/Service). Covers RDP client MRU and saved credentials from registry, Kerberos ticket cache (klist) with TGT flagging, established TCP connections with process attribution and external IP detection, listening port inventory with service labels, named pipe exposure with sensitive pipe flagging (lsass, spoolss, samr, epmapper...), and SYSTEM-level scheduled tasks. Supports -q for logon sessions + RDP MRU only.

Hardening (3584ce5)

  • run_sync - Memory Cap: Enforced a 1 MB output ceiling on synchronous command accumulation. Streams exceeding the limit are truncated and the runspace is interrupted to prevent OOM from anomalous remote endpoints.
  • !download - Stream Guard: !download chunk accumulator now enforces a configurable memory cap (PWNRM_MAX_DL, default 256 MB). Overflow raises a RuntimeError and surfaces immediately rather than crashing silently.
  • SPNEGO/Kerberos - Exception Hardening: Replaced bare except: clauses in NTLM and Kerberos unwrap routines with except Exception: to prevent silent swallowing of fatal decryption failures and RC4 keystream desynchronization.
  • Session Directory - Windows ACL: _PWNRM_DIR now explicitly strips inherited ACEs and grants exclusive (OI)(CI)F rights to the current user via icacls on Windows, mirroring the existing 0o700 POSIX enforcement.

Refactor (64da5ba)

  • Transport - Request Timeouts: Enforced an explicit timeout=30 across all transport adapters (BasicTransport, ClientCertTransport, SPNEGOTransport, KerberosTransport, CredSSPTransport) to prevent uninterruptible client hangs on unresponsive targets.
  • Utils - Certificate String Normalization: get_server_certificate() now strips PEM headers and all whitespace in a single re.sub() pass, correctly handling cross-platform line endings (\r\n) that the previous str.replace() approach missed.
  • Utils - load_pfx() Windows ACL: PFX temp directory now applies the same icacls exclusive-access hardening as _PWNRM_DIR, consistent across platforms.

Full Changelog: v1.1.1...v1.2.0

Assets 2
Loading