76 lines
5.9 KiB
Markdown
76 lines
5.9 KiB
Markdown
# NetExec execution review
|
|
|
|
Reviewed upstream revision: `89a698d93dfc101e7104d42523aac4765372cd7d`.
|
|
This is an interface/architecture review, not copied NetExec implementation code.
|
|
RPCScope continues to invoke the operator's installed executable.
|
|
|
|
## Findings and implementation
|
|
|
|
| Finding | RPCScope change |
|
|
| --- | --- |
|
|
| NetExec starts a protocol object per target in a thread pool, default 256 workers. | 256 lightweight discovery workers; bounded live-host batches for heavier checks. |
|
|
| Our old runner launched one NetExec process for every host/check pair. | One process per module/live-host batch, amortizing imports and initialization. |
|
|
| Full enum4linux `-A` preceded the dedicated probes. | Dedicated probes first; normal CLI leaves full enumeration to `--deep`. RPC dump remains enabled. |
|
|
| NetExec supports multiple modules per SMB session, but its module loop does not isolate arbitrary callback exceptions. | Keep unrelated modules in separate processes; no automatic retry of failed probes. |
|
|
| All five selected `coerce_plus` bind methods can use `METHOD=All` without a listener. | Combine only the complete, unchanged five-method selection. Subsets stay separate. Each method still has its own result record. |
|
|
| Current NetExec uses ACL-based share checks and opts into file writes with `--file-write-check`. Older versions offered `--no-write-check`. | Inspect installed help, select a known read-only mode, otherwise skip with an explicit error. Never enable file-write testing. |
|
|
| Admin checking adds an SCM RPC exchange; our adapters use `on_login`, not `on_admin_login`. | Use `--no-admin-check` only when the installed CLI advertises support. |
|
|
| NetExec may catch individual host exceptions and still exit zero. | Attribute known host exceptions and mark that host's check failed/unknown without invalidating other hosts. |
|
|
| Console output can contain credential echoes, truncated module labels and unrecognized messages. | Index by canonical IP/module/port once per batch; allow known label truncation; require documented full negative markers. |
|
|
| Reviewed MS17-010 and SMBGhost modules create IPv4 sockets. | MS17-010 stays IPv4-gated. SMBGhost has been replaced by a native IPv4/IPv6 negotiation capability probe; its old positive is no longer a CVE suspicion. |
|
|
| Local socket limits and noisy subprocesses could produce misleading outcomes or excessive temporary output. | Report local resource exhaustion as an execution failure, and actively stop over-limit output. |
|
|
|
|
## Execution and budgets
|
|
|
|
```text
|
|
scope -> TCP discovery -> NetExec inventory (open SMB listeners only)
|
|
-> same-module NetExec check batches (live, eligible hosts only)
|
|
-> bounded host pipelines: native / optional MSF / RPC / optional deep enum
|
|
-> evidence-backed reports
|
|
```
|
|
|
|
`--jobs` bounds each check batch and the later host pool; these phases do not
|
|
multiply their concurrency. Batches contain no more than 128 targets, even with
|
|
a larger jobs limit, and no more hosts than can execute in one NetExec thread
|
|
wave. A single-check process receives one check timeout. The combined five-bind
|
|
process receives five check timeouts in total; individual methods are not
|
|
independently timed inside that external process. Global batch failures remain
|
|
unknown/partial. Positive evidence is not inferred from process exit alone.
|
|
|
|
The core library keeps legacy isolated execution and full enum defaults for
|
|
compatibility. CLI defaults select batching and leave full enum to `--deep`.
|
|
`--isolated-checks` is a diagnostic fallback, not an automatic retry policy.
|
|
|
|
## Verification and limits
|
|
|
|
The mocked 32-live-host recommended scan now executes 24 NetExec check invocations
|
|
instead of the old 352 (six module groups, four eight-host batches), plus native
|
|
compression capability and LongLogon precondition checks. The earlier batching
|
|
version used 28 processes. All twelve
|
|
selected results per host remain represented; inventory and capability-help
|
|
invocations are separate from this count. This is not a wall-clock benchmark.
|
|
|
|
Tests cover batching, selection boundaries, per-host result isolation, zero-exit
|
|
errors, cancellation, read-only share compatibility, output caps, and resource
|
|
failures. External tools are absent on the development host. Real version
|
|
interoperability, network throughput, and detection sensitivity/specificity are
|
|
not established by mocks and need an authorized, patched/unpatched lab matrix.
|
|
No live target scan was performed for this review.
|
|
|
|
A bare `nxc smb` connection/banner scan does less work than twelve selected
|
|
checks plus RPC/deep enumeration. The optimization removes avoidable overhead;
|
|
it does not remove the protocol work or turn heuristic findings into patch
|
|
proof. No scanner can promise flawless results across every network/tool build.
|
|
|
|
## Primary sources
|
|
|
|
- [Threaded target runner](https://github.com/Pennyw0rth/NetExec/blob/89a698d93dfc101e7104d42523aac4765372cd7d/nxc/netexec.py)
|
|
- [CLI worker default](https://github.com/Pennyw0rth/NetExec/blob/89a698d93dfc101e7104d42523aac4765372cd7d/nxc/cli.py)
|
|
- [Connection/module callback flow](https://github.com/Pennyw0rth/NetExec/blob/89a698d93dfc101e7104d42523aac4765372cd7d/nxc/connection.py)
|
|
- [SMB CLI and share options](https://github.com/Pennyw0rth/NetExec/blob/89a698d93dfc101e7104d42523aac4765372cd7d/nxc/protocols/smb/proto_args.py)
|
|
- [Share and admin checks](https://github.com/Pennyw0rth/NetExec/blob/89a698d93dfc101e7104d42523aac4765372cd7d/nxc/protocols/smb.py)
|
|
- [Combined bind-method interface](https://github.com/Pennyw0rth/NetExec/blob/89a698d93dfc101e7104d42523aac4765372cd7d/nxc/modules/coerce_plus.py)
|
|
- [Logger format](https://github.com/Pennyw0rth/NetExec/blob/89a698d93dfc101e7104d42523aac4765372cd7d/nxc/logger.py)
|
|
- [MS17-010 IPv4 implementation](https://github.com/Pennyw0rth/NetExec/blob/89a698d93dfc101e7104d42523aac4765372cd7d/nxc/modules/ms17-010.py)
|
|
- [SMBGhost IPv4 implementation](https://github.com/Pennyw0rth/NetExec/blob/89a698d93dfc101e7104d42523aac4765372cd7d/nxc/modules/smbghost.py)
|