Add lockout-safe password spraying controls

nxc/cli.py

@@ -129,6 +129,12 @@ def gen_cli_args():
         print(f"{VERSION} - {CODENAME} - {COMMIT} - {DISTANCE}")
         sys.exit(1)
 
+    if getattr(args, "spray_attempts", 1) < 1:
+        parser.error("--spray-attempts must be at least 1")
+
+    if getattr(args, "spray_attempts_explicitly_set", False) and not getattr(args, "spray_window", 0):
+        parser.error("--spray-attempts has no effect without --spray-window; add --spray-window <seconds> (at least the lockout observation window) so attempts are actually paced")
+
     # Multiply output_tries by 10 to enable more fine granural control, see exec methods
     if hasattr(args, "get_output_tries"):
         args.get_output_tries = args.get_output_tries * 10

nxc/config.py

@@ -39,6 +39,7 @@
 host_info_colors = literal_eval(nxc_config.get("nxc", "host_info_colors", fallback=["green", "red", "yellow", "cyan"]))
 check_guest_account = nxc_config.getboolean("nxc", "check_guest_account", fallback=False)
 display_dc = nxc_config.getboolean("nxc", "display_dc", fallback=True)
+abort_on_lockout = int(nxc_config.get("nxc", "abort_on_lockout", fallback=3))
 
 if len(host_info_colors) != 4:
     nxc_logger.error("Config option host_info_colors must have 4 values! Using default values.")

nxc/connection.py

@@ -12,10 +12,11 @@
 from dns import resolver, rdatatype
 from socket import AF_UNSPEC, SOCK_DGRAM, IPPROTO_IP, AI_CANONNAME, getaddrinfo
 
-from nxc.config import pwned_label
+from nxc.config import pwned_label, abort_on_lockout
 from nxc.helpers.logger import highlight
 from nxc.loaders.moduleloader import ModuleLoader
 from nxc.logger import nxc_logger, NXCAdapter
+from nxc.console import nxc_console
 from nxc.context import Context
 from nxc.paths import NXC_PATH
 from nxc.protocols.ldap.laps import laps_search
@@ -28,6 +29,13 @@
 fail_lock = Lock()
 global_failed_logins = 0
 user_failed_logins = {}
+lockout_lock = Lock()
+global_lockouts = 0
+spray_abort_all = False
+
+
+class SprayAbort(Exception):
+    pass
 
 
 def get_host_addr_info(target, force_ipv6, dns_server, dns_tcp, dns_timeout):
@@ -181,6 +189,8 @@ def __init__(self, args, db, target):
             self.proto_flow()
         except FileNotFoundError as e:
             self.logger.error(f"File not found error on target {target}: {e}")
+        except SprayAbort:
+            self.logger.debug("Spray aborted on lockout")
         except Exception as e:
             if "ERROR_DEPENDENT_SERVICES_RUNNING" in str(e):
                 self.logger.error(f"Exception while calling proto_flow() on target {target}: {e}")
@@ -255,14 +265,16 @@ def proto_flow(self):
             self.output_filename = os.path.join(base_log_dir, filename_pattern)
 
             self.print_host_info()
-            if self.login() or (self.username == "" and self.password == "" and self.protocol != "mssql"):
-                self.logger.debug("Calling command arguments")
-                self.call_cmd_args()
-                if self.args.module:
-                    self.load_modules()
-                    self.logger.debug("Calling modules")
-                    self.call_modules()
-            self.disconnect()
+            try:
+                if self.login() or (self.username == "" and self.password == "" and self.protocol != "mssql"):
+                    self.logger.debug("Calling command arguments")
+                    self.call_cmd_args()
+                    if self.args.module:
+                        self.load_modules()
+                        self.logger.debug("Calling modules")
+                        self.call_modules()
+            finally:
+                self.disconnect()
 
     def call_cmd_args(self):
         """Calls all the methods specified by the command line arguments
@@ -340,6 +352,26 @@ def over_fail_limit(self, username):
 
             return False
 
+    def register_lockout(self, username):
+        global global_lockouts, spray_abort_all
+
+        if not abort_on_lockout:
+            return
+
+        with lockout_lock:
+            if spray_abort_all:
+                raise SprayAbort
+
+            global_lockouts += 1
+            if global_lockouts < abort_on_lockout:
+                return
+
+            answer = nxc_console.input(f"[bold red]\\[!] {global_lockouts} lockout responses detected, would you like to quit? \\[Y/n] [/]")
+            if answer.strip().lower() in ("y", "yes", ""):
+                spray_abort_all = True
+                raise SprayAbort
+            global_lockouts = 0
+
     def query_db_creds(self):
         """Queries the database for credentials to be used for authentication.
 
@@ -488,6 +520,9 @@ def try_credentials(self, domain, username, owned, secret, cred_type, data=None)
         if self.args.continue_on_success and owned:
             return False
 
+        if self.over_fail_limit(username):
+            return False
+
         if self.args.jitter:
             jitter = self.args.jitter
             if "-" in jitter:
@@ -578,22 +613,44 @@ def login(self):
             if not (username[0] or secret[0] or domain[0]):
                 return False
 
+        # Spray pacing is only exposed by protocols that support it (SMB/LDAP)
+        spray_window = getattr(self.args, "spray_window", 0)
+        spray_attempts = getattr(self.args, "spray_attempts", 1)
+
         if not self.args.no_bruteforce:
             for secr_index, secr in enumerate(secret):
+                if spray_abort_all:
+                    raise SprayAbort
                 for user_index, user in enumerate(username):
+                    if spray_abort_all:
+                        raise SprayAbort
                     if self.try_credentials(domain[user_index], user, owned[user_index], secr, cred_type[secr_index], data[secr_index]):
                         owned[user_index] = True
                         if not self.args.continue_on_success:
                             return True
+                # Pause between rounds so badPwdCount resets before the next batch can trip a lockout
+                completed_batch = (secr_index + 1) % spray_attempts == 0
+                is_last_round = secr_index == len(secret) - 1
+                if spray_window and completed_batch and not is_last_round:
+                    self.logger.info(f"Completed {secr_index + 1} password round(s); sleeping {spray_window} second(s) so the lockout counter resets before the next round")
+                    sleep(spray_window)
         else:
             if len(username) != len(secret):
                 self.logger.error("Number provided of usernames and passwords/hashes do not match!")
                 return False
             for user_index, user in enumerate(username):
+                if spray_abort_all:
+                    raise SprayAbort
                 if self.try_credentials(domain[user_index], user, owned[user_index], secret[user_index], cred_type[user_index], data[user_index]) and not self.args.continue_on_success:
                     owned[user_index] = True
                     if not self.args.continue_on_success:
                         return True
+                # Pause between attempts so badPwdCount resets before the next batch can trip a lockout
+                completed_batch = (user_index + 1) % spray_attempts == 0
+                is_last_attempt = user_index == len(username) - 1
+                if spray_window and completed_batch and not is_last_attempt:
+                    self.logger.info(f"Completed {user_index + 1} attempt(s); sleeping {spray_window} second(s) so the lockout counter resets before the next attempt")
+                    sleep(spray_window)
 
     def mark_pwned(self):
         return highlight(f"({pwned_label})" if self.admin_privs else "")

nxc/data/nxc.conf

@@ -8,6 +8,7 @@ log_mode = False
 host_info_colors = ["green", "red", "yellow", "cyan"]
 check_guest_account = False
 display_dc = True
+abort_on_lockout = 3
 
 [BloodHound]
 bh_enabled = False

nxc/netexec.py

@@ -221,6 +221,9 @@ def main():
     if args.jitter and len(targets) > 1:
         nxc_logger.highlight(highlight("[!] Jitter is only throttling authentications per target!", "red"))
 
+    if getattr(args, "spray_window", 0) and len(targets) > 1:
+        nxc_logger.highlight(highlight("[!] Lockout-safe spray timing is applied PER TARGET. Spraying multiple DCs of the same domain in parallel can still lock accounts - use a single target or --threads 1.", "red"))
+
     try:
         asyncio.run(start_run(protocol_object, args, db, targets))
     finally:

nxc/protocols/ldap.py

@@ -375,6 +375,11 @@ def kerberos_login(self, domain, username, password="", ntlm_hash="", aesKey="",
                 f"{self.domain}\\{self.username}{used_ccache} {error!s}",
                 color="magenta" if error in ldap_error_status else "red",
             )
+            if error == "KDC_ERR_CLIENT_REVOKED":
+                self.inc_failed_login(self.username)
+                self.register_lockout(self.username)
+            elif error not in ldap_error_status:
+                self.inc_failed_login(self.username)
             return False
         except (KeyError, KerberosException, OSError) as e:
             self.logger.fail(
@@ -422,20 +427,33 @@ def kerberos_login(self, domain, username, password="", ntlm_hash="", aesKey="",
                         f"{self.domain}\\{self.username}{' from ccache' if useCache else f':{process_secret(kerb_pass)}'} {error!s}",
                         color="magenta" if error in ldap_error_status else "red",
                     )
+                    if error == "KDC_ERR_CLIENT_REVOKED":
+                        self.inc_failed_login(self.username)
+                        self.register_lockout(self.username)
+                    elif error not in ldap_error_status:
+                        self.inc_failed_login(self.username)
                     return False
                 except Exception as e:
                     error_code = str(e).split()[-2][:-1]
                     self.logger.fail(
                         f"{self.domain}\\{self.username}:{process_secret(self.password)} {ldap_error_status.get(error_code, '')}",
                         color="magenta" if error_code in ldap_error_status else "red",
                     )
+                    if error_code in ("775", "KDC_ERR_CLIENT_REVOKED"):
+                        self.inc_failed_login(self.username)
+                        self.register_lockout(self.username)
+                    elif error_code not in ldap_error_status:
+                        self.inc_failed_login(self.username)
                     return False
             else:
                 error_code = str(e).split()[-2][:-1]
                 self.logger.fail(
                     f"{self.domain}\\{self.username}{' from ccache' if useCache else f':{process_secret(kerb_pass)}'} {error_code!s}",
                     color="magenta" if error_code in ldap_error_status else "red",
                 )
+                self.inc_failed_login(self.username)
+                if error_code in ("775", "KDC_ERR_CLIENT_REVOKED"):
+                    self.register_lockout(self.username)
                 return False
 
     def plaintext_login(self, domain, username, password):
@@ -513,6 +531,9 @@ def plaintext_login(self, domain, username, password):
                     f"{self.domain}\\{self.username}:{process_secret(self.password)} {ldap_error_status.get(error_code, '')}",
                     color="magenta" if (error_code in ldap_error_status and error_code != 1) else "red",
                 )
+            self.inc_failed_login(self.username)
+            if error_code in ("775", "KDC_ERR_CLIENT_REVOKED"):
+                self.register_lockout(self.username)
             return False
         except OSError as e:
             self.logger.fail(f"{self.domain}\\{self.username}:{process_secret(self.password)} {'Error connecting to the domain, are you sure LDAP service is running on the target?'} \nError: {e}")
@@ -607,6 +628,9 @@ def hash_login(self, domain, username, ntlm_hash):
                     f"{self.domain}\\{self.username}:{process_secret(nthash)} {ldap_error_status.get(error_code, '')}",
                     color="magenta" if (error_code in ldap_error_status and error_code != 1) else "red",
                 )
+            self.inc_failed_login(self.username)
+            if error_code in ("775", "KDC_ERR_CLIENT_REVOKED"):
+                self.register_lockout(self.username)
             return False
         except OSError as e:
             self.logger.fail(f"{self.domain}\\{self.username}:{process_secret(self.password)} {'Error connecting to the domain, are you sure LDAP service is running on the target?'} \nError: {e}")

nxc/protocols/ldap/proto_args.py

@@ -9,6 +9,8 @@ def proto_args(parser, parents):
     dgroup.add_argument("--simple-bind", action="store_true", help="Use simple bind authentication (no signing/sealing)")
     ldap_parser.add_argument("--port", type=int, default=389, action=DefaultTrackingAction, help="LDAP port")
     ldap_parser.add_argument("--ldap-timeout", type=int, default=3, help="LDAP connection timeout")
+    ldap_parser.add_argument("--spray-window", metavar="SECONDS", dest="spray_window", type=float, default=0, action=DefaultTrackingAction, help="seconds to wait between password rounds so the domain badPwdCount resets; set to at least the lockout Observation Window")
+    ldap_parser.add_argument("--spray-attempts", metavar="N", dest="spray_attempts", type=int, default=1, action=DefaultTrackingAction, help="passwords to try per user before waiting --spray-window (MUST stay below the lockout threshold; default 1 = wait after every password)")
     ldap_parser.add_argument("-d", metavar="DOMAIN", dest="domain", type=str, default=None, help="domain to authenticate to")
 
     egroup = ldap_parser.add_argument_group("Retrieve hash on the remote DC", "Options to get hashes from Kerberos")

nxc/protocols/smb.py

@@ -103,6 +103,7 @@
     "STATUS_PASSWORD_MUST_CHANGE",
     "STATUS_ACCESS_DENIED",
     "STATUS_NO_SUCH_FILE",
+    "STATUS_ACCOUNT_LOCKED_OUT",
     "KDC_ERR_CLIENT_REVOKED",
     "KDC_ERR_PREAUTH_FAILED",
 ]
@@ -491,6 +492,10 @@ def kerberos_login(self, domain, username, password="", ntlm_hash="", aesKey="",
                 f"{domain}\\{self.username}{used_ccache} {error} {f'({desc})' if self.args.verbose else ''}",
                 color="magenta" if error in smb_error_status else "red",
             )
+            if error == "KDC_ERR_CLIENT_REVOKED":
+                self.inc_failed_login(username)
+                self.register_lockout(username)
+                return False
             if error not in smb_error_status:
                 self.inc_failed_login(username)
             return False
@@ -546,6 +551,10 @@ def plaintext_login(self, domain, username, password):
                 f'{domain}\\{self.username}:{process_secret(self.password)} {error} {f"({desc})" if self.args.verbose else ""}',
                 color="magenta" if error in smb_error_status else "red",
             )
+            if error == "STATUS_ACCOUNT_LOCKED_OUT":
+                self.inc_failed_login(username)
+                self.register_lockout(username)
+                return False
             if error in ["STATUS_PASSWORD_MUST_CHANGE", "STATUS_PASSWORD_EXPIRED", "STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT"] and self.args.module == ["change-password"]:
                 return True
             if error not in smb_error_status:
@@ -613,6 +622,10 @@ def hash_login(self, domain, username, ntlm_hash):
                 f"{domain}\\{self.username}:{process_secret(self.hash)} {error} {f'({desc})' if self.args.verbose else ''}",
                 color="magenta" if error in smb_error_status else "red",
             )
+            if error == "STATUS_ACCOUNT_LOCKED_OUT":
+                self.inc_failed_login(self.username)
+                self.register_lockout(self.username)
+                return False
             if error in ["STATUS_PASSWORD_MUST_CHANGE", "STATUS_PASSWORD_EXPIRED", "STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT"] and self.args.module == ["change-password"]:
                 return True
             if error not in smb_error_status:

nxc/protocols/smb/proto_args.py

@@ -17,6 +17,8 @@ def proto_args(parser, parents):
     dgroup.add_argument("--local-auth", action="store_true", help="authenticate locally to each target")
 
     smb_parser.add_argument("--port", type=int, default=445, help="SMB port")
+    smb_parser.add_argument("--spray-window", metavar="SECONDS", dest="spray_window", type=float, default=0, action=DefaultTrackingAction, help="seconds to wait between password rounds so the domain badPwdCount resets; set to at least the lockout Observation Window")
+    smb_parser.add_argument("--spray-attempts", metavar="N", dest="spray_attempts", type=int, default=1, action=DefaultTrackingAction, help="passwords to try per user before waiting --spray-window (MUST stay below the lockout threshold; default 1 = wait after every password)")
     smb_parser.add_argument("--share", metavar="SHARE", default="C$", help="specify a share")
     smb_parser.add_argument("--smb-server-port", default="445", help="specify a server port for SMB", type=int)
     smb_parser.add_argument("--no-smbv1", action="store_true", help="Force to disable SMBv1 in connection")

tests/e2e_commands.txt

@@ -71,6 +71,7 @@ netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --wmi-query
 netexec --jitter 2 smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS
 netexec --jitter 1-3 smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS
 netexec --jitter 2-2 smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS
+netexec --spray-window 1 --spray-attempts 1 --continue-on-success smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS
 ##### SMB Modules
 netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -L
 netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M add-computer -o NAME="BADPC" PASSWORD="Password1"