Add SeMachineAccountPrivilege to maq module by serwiz · Pull Request #1083 · Pennyw0rth/NetExec

serwiz · 2026-01-24T23:12:16Z

Description

I recently spent some time working on SeMachineAccountPrivilege enumeration, following the discussion and initial work introduced in PR #1029 by @Blatzy.
Based on that, I’m proposing this PR, which integrates the check directly into the MAQ module and makes it especially useful during internal penetration tests.

The idea is to keep everything dynamic and reliable, by:

retrieving the gPLink values applied to the Domain Controllers OU
parsing the corresponding GptTmpl.inf files to locate SeMachineAccountPrivilege
extracting the associated SIDs and resolving them via LSA LookupSid

This avoids hardcoded assumptions and provides a clearer picture of how the privilege is actually configured on Domain Controllers.

Type of change

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
Deprecation of feature or functionality
This change requires a documentation update
This requires a third party update (such as Impacket, Dploot, lsassy, etc)

Setup guide for the review

OS: Debian (Linux)
Python: 3.11 (running NetExec from source)
Installed dependencies: standard NetExec dependencies (no extra third-party required)
Domain Controller: Windows Server 2022
No special configuration

The feature relies on:

LDAP access to query the Domain Controllers OU gPLink
SMB access to SYSVOL to read GPO files (GptTmpl.inf)
LSA/RPC access (\pipe\lsarpc) to resolve SIDs to names via LookupSid

Screenshots:

Debug

Checklist:

I have ran Ruff against my changes (via poetry: poetry run python -m ruff check . --preview, use --fix to automatically fix what it can)
I have added or updated the tests/e2e_commands.txt file if necessary (new modules or features are required to be added to the e2e tests)
New and existing e2e tests pass locally with my changes
If reliant on changes of third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
I have performed a self-review of my own code
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)

…t SID translation.

mpgn · 2026-01-26T10:44:37Z

Nice addition

NeffIsBack · 2026-01-27T06:17:25Z

Looks cool, thanks for the PR! Probably the better way to integrate the GPO parsing.

Blatzy · 2026-01-31T21:30:27Z

Hey ! Really nice, good trick to enumerate which GPO is relevant, I will close my PR since yours looks perfect.

…some debug output

NeffIsBack · 2026-02-07T03:57:29Z

This looks like it breaks on the first GPO it found with the privilege. We should probably iterate through all existing GPOs and check if there are multiple occurrences, so we don't miss any.

… display

serwiz · 2026-02-07T13:58:39Z

You're right. Now it can support multiple GPO.

I'm also investigating to improve the permission check based on the microsoft documentation:

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/add-workstations-to-domain

Suggestion: It could also be useful to retrieve the nTSecurityDescriptor on container and OU, to determine who is allowed to create computer objects. This can bypass both the SeMachineAccountPrivilege user right ("Add workstations to domain") and MachineAccountQuota.

mpgn · 2026-02-08T21:47:11Z

Interesting, could be usefull to get the level of the GPO

(GPO) domain.lab > Domain Controller > "Default Domain Controller POlicy"
(GPO) domain.lab > Custom XXX
(GPO) domain.lab > Servers > Custom 2 xxx

serwiz · 2026-02-10T18:51:22Z

Since the current scope only includes GPOs linked to the Domain Controllers OU,
I'm wondering whether this information would still be relevant.

Interesting, could be usefull to get the level of the GPO

(GPO) domain.lab > Domain Controller > "Default Domain Controller POlicy"
(GPO) domain.lab > Custom XXX
(GPO) domain.lab > Servers > Custom 2 xxx

azoxlpf · 2026-05-28T14:37:23Z

+                    sessions.setdefault(sid, {"Username": ""})
+
+                try:
+                    # Handle RPC connection


Is there a reason you're using LSA RPC here instead of LDAP for SID resolution? This module is already ldap-only, (objectSid={sid}) + sAMAccountName would be simpler (see badsuccessor.py)

e.g :

resp = connection.search(searchFilter=f"(objectSid={sid})", attributes=["sAMAccountName"])

azoxlpf · 2026-05-28T14:43:33Z

+            return
+
+        # Extract GUIDS from the output using regex
+        guids = re.findall(r"(?i)cn=\{([0-9a-f\-]{36})\}", entries[0]["gPLink"])


If the Domain Controllers OU has no linked GPO this will raise KeyError. Please use entries[0].get("gPLink", "") and bail out early if it's empty.

azoxlpf · 2026-05-28T14:44:55Z

+
+        for guid in guids:
+            # Accessing the GPO in the SYSVOL share to parse GptTmpl.inf
+            path = ntpath.join(connection.targetDomain, "Policies", f"{{{guid}}}", "MACHINE", "Microsoft", "Windows NT", "SecEdit", "GptTmpl.inf",)


Please drop the trailing comma, it's not needed and looks like a leftover from a tuple

azoxlpf · 2026-05-28T14:55:53Z

@@ -19,10 +29,157 @@ def options(self, context, module_options):
        """No options available"""

    name = "maq"


Please move name, description, supported_protocols and category above options() to match the rest of the modules (see raisechild.py)

azoxlpf · 2026-05-28T15:10:56Z

+                return ""
+
+        # Just handle smb connection
+        def connect_smb(connection):


Please move connect_smb (and resolve_gpo) out of get_SeMachineAccountPrivilege and make them methods of the class easier to read.

azoxlpf · 2026-05-28T15:18:59Z

+
+            else:
+                context.log.fail("No SID(s) found in SeMachineAccountPrivilege")
+


Please call smb.logoff() after you're done reading SYSVOL.

azoxlpf · 2026-05-28T16:04:04Z

+            entries = parse_result_attributes(ldap_response)
+        except Exception as e:
+            context.logger.debug(f"Exception raised while looking for gPLink: {e}")
+            exit(1)


Hmm imo should simply be a return

GHWX8660 and others added 2 commits January 23, 2026 00:38

Added SeMachineAccountPrivilige check to MAQ module. Need to implemen…

8f6d2af

…t SID translation.

Added SID translation for more understanding

0e08d74

serwiz requested review from Marshall-Hallenbeck, NeffIsBack, mpgn and zblurx as code owners January 24, 2026 23:12

serwiz changed the title ~~Maq/privileges~~ Add SeMachineAccountPrivilege to maq module Jan 24, 2026

NeffIsBack added the enhancement New feature or request label Jan 27, 2026

Blatzy mentioned this pull request Jan 31, 2026

Check-Add-Computer : New module for checking SeMachineAccountPrivilege #1029

Closed

13 tasks

serwiz added 2 commits February 1, 2026 14:34

Correcting cross domain check to access the correct GPO PATH and add …

d0fced5

…some debug output

Correcting stacktrace error due to invalid sids tab initialisation.

df1db95

mpgn previously approved these changes Feb 6, 2026

View reviewed changes

serwiz added 2 commits February 7, 2026 14:31

Enhanced: can support mutiple SeMachineAccountPrivilege with detailed…

84b4831

… display

Change final display. More readable.

80d38c1

serwiz dismissed mpgn’s stale review via 80d38c1 February 7, 2026 13:42

Did ruff check and all passed now.

83be316

azoxlpf suggested changes May 28, 2026

View reviewed changes

		@@ -19,10 +29,157 @@ def options(self, context, module_options):
		"""No options available"""

		name = "maq"


		else:
		context.log.fail("No SID(s) found in SeMachineAccountPrivilege")

Conversation

serwiz commented Jan 24, 2026

Description

Type of change

Setup guide for the review

Screenshots:

Checklist:

Uh oh!

mpgn commented Jan 26, 2026

Uh oh!

NeffIsBack commented Jan 27, 2026

Uh oh!

Blatzy commented Jan 31, 2026

Uh oh!

NeffIsBack commented Feb 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

serwiz commented Feb 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mpgn commented Feb 8, 2026

Uh oh!

serwiz commented Feb 10, 2026

Uh oh!

azoxlpf May 28, 2026

Choose a reason for hiding this comment

Uh oh!

azoxlpf May 28, 2026

Choose a reason for hiding this comment

Uh oh!

azoxlpf May 28, 2026

Choose a reason for hiding this comment

Uh oh!

azoxlpf May 28, 2026

Choose a reason for hiding this comment

Uh oh!

azoxlpf May 28, 2026

Choose a reason for hiding this comment

Uh oh!

azoxlpf May 28, 2026

Choose a reason for hiding this comment

Uh oh!

azoxlpf May 28, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

NeffIsBack commented Feb 7, 2026 •

edited

Loading

serwiz commented Feb 7, 2026 •

edited

Loading