Skip to content

Refactor TSCH_EXEC and SMBEXEC#1250

Merged
NeffIsBack merged 6 commits into
Pennyw0rth:mainfrom
azoxlpf:refactor/tsch-smb-exec
May 27, 2026
Merged

Refactor TSCH_EXEC and SMBEXEC#1250
NeffIsBack merged 6 commits into
Pennyw0rth:mainfrom
azoxlpf:refactor/tsch-smb-exec

Conversation

@azoxlpf
Copy link
Copy Markdown
Contributor

@azoxlpf azoxlpf commented May 27, 2026

Description

Following #1191, this PR cleans up TSCH_EXEC and SMBEXEC by removing duplicate authentication parameters (username, password, hashes, share_name, etc.) and the legacy manual RPC transport setup, since NXCRPCConnection now handles credentials via the SMB connection object. Call sites in smb.py and schtask_as.py are updated accordingly, and unused execute_fileless code is removed from SMBEXEC

Type of change

Insert an "x" inside the brackets for relevant items (do not delete options)

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Deprecation of feature or functionality
  • This change requires a documentation update
  • This requires a third party update (such as Impacket, Dploot, lsassy, etc)
  • This PR was created with the assistance of AI (list what type of assistance, tool(s)/model(s) in the description)

Setup guide for the review

  • nxc smb <IP> -u <user> -p '<pass>' --exec-method smbexec -x whoami

  • nxc smb <IP> -u <user> -p '<pass>' --exec-method smbexec -x whoami --no-output

  • nxc smb <IP> -u <user> -p '<pass>' --exec-method smbexec -X "Get-Date; hostname"

  • nxc smb <IP> -u <user> -p '<pass>' --exec-method atexec -x whoami

  • nxc smb <IP> -u <user> -p '<pass>' --exec-method atexec -x whoami --no-output

  • nxc smb <IP> -u <user> -p '<pass>' --exec-method atexec -X "hostname; whoami"

  • nxc smb <IP> -u <user> -p '<pass>' -M schtask_as -o USER=Administrator CMD=whoami

  • nxc smb <IP> -u <user> -p '<pass>' -M schtask_as -o USER=Administrator CMD=whoami SILENTCOMMAND=True

Screenshots (if appropriate):

I ran several tests, and it sounds good to me :

image

Checklist:

Insert an "x" inside the brackets for completed and relevant items (do not delete options)

  • I have ran Ruff against my changes (poetry: poetry run ruff check ., use --fix to automatically fix what it can)
  • I have added or updated the tests/e2e_commands.txt file if necessary (new modules or features are required to be added to the e2e tests)
  • If reliant on changes of third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
  • I have linked relevant sources that describes the added technique (blog posts, documentation, etc)
  • I have performed a self-review of my own code (not an AI review)
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)

@NeffIsBack NeffIsBack changed the title Refactor SCH_EXEC and SMBEXEC Refactor TSCH_EXEC and SMBEXEC May 27, 2026
Copy link
Copy Markdown
Member

@NeffIsBack NeffIsBack left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As always thanks for the work! All looking much cleaner now, LGTM:

Image

@NeffIsBack NeffIsBack merged commit b7c0f65 into Pennyw0rth:main May 27, 2026
5 checks passed
@azoxlpf azoxlpf deleted the refactor/tsch-smb-exec branch May 27, 2026 15:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants