Added the tspkg module by E1A · Pull Request #940 · Pennyw0rth/NetExec

E1A · 2025-09-29T19:23:41Z

Description

This PR introduces a new module that enables the AllowDefaultCredentials registry key so cleartext creds can be dumped with tspkg

The module supports three actions:

enable: Creates/sets the registry key and values required for TSPKG/CredSSP credential delegation, enabling credential dumping
disable: Removes the registry key and subkeys associated with AllowDefaultCredentials
check: Queries the registry to confirm whether the key is present and enabled

Type of change

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
Deprecation of feature or functionality
This change requires a documentation update
This requires a third party update (such as Impacket, Dploot, lsassy, etc)

Setup guide for the review

Get administrative access to a Windows machine over SMB.
Run the tspkg module with the ACTION option:

enable - Creates/sets the AllowDefaultCredentials registry key and values.
disable - Deletes the registry entries created by the module.
check - Confirms whether the registry key is enabled and logs any SPN values.
dump lsass with lsassy (see screenshot)

Tested against Windows Server 2019. Confirmed that enabling adds the correct DWORD and SPN subkey, disabling removes them, and check accurately returns the expected registry state

Screenshots (if appropriate):

Ignore prox its, something with proxychains in my GOAD setup

Checklist:

I have ran Ruff against my changes (via poetry: poetry run python -m ruff check . --preview, use --fix to automatically fix what it can)
I have added or updated the tests/e2e_commands.txt file if necessary (new modules or features are required to be added to the e2e tests)
New and existing e2e tests pass locally with my changes
If reliant on changes of third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
I have performed a self-review of my own code
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)

E1A · 2025-09-29T19:26:08Z

*Some parts are copied from the wdigest module, both modules achieve the same results

Signed-off-by: E1A <57531297+E1A@users.noreply.github.com>

Dfte · 2025-09-30T09:02:42Z

Wow that's hot and definitely something I wasn't aware of! Will take a look :)! Thanks for the PR! One thing I'd already do is make "check" the default behaviour tho. @NeffIsBack I believe we should do the same for each and every "registry keys" related modules

Dfte · 2025-09-30T14:06:01Z

Just looked at it, there are two things ruff complains about:

White dash here:

Missing newline at the end of the module:

With tspkg enabled:

Without tspkg enabled:

So the code works.

About the structure of the module I guess you can make it quite simplier factorizing it, have a generic :

remote_ops = RemoteOperations(smbconnection, False)
remote_ops.enableRegistry()
...

And a:

if self.action=check:
    ans = rrp.hOpenLocalMachine(remote_ops._RemoteOperations__rrp) 
    ReadSubKey....
elif self.Action=add:
    ans = rrp.hOpenLocalMachine(remote_ops._RemoteOperations__rrp)
    CreateSubkey....
elif self.Action=remove:
    ans = rrp.hOpenLocalMachine(remote_ops._RemoteOperations__rrp) 
    RemoveSubKeys....

Cause right now you are duplicating code and that's not necessary.

…default behaviour

E1A · 2025-09-30T16:21:48Z

NeffIsBack · 2025-10-01T13:14:18Z

Thanks for the PR!

@NeffIsBack I believe we should do the same for each and every "registry keys" related modules

Yep, definitely a good idea, but actually i don't think there are thaaat many that simply changes reg keys.

E1A · 2025-10-09T10:47:18Z

Can this be merged?

NeffIsBack · 2025-10-09T17:19:35Z

Can this be merged?

Unfortunately my time at the moment is very limited. We'll have to wait until i had time to review it, but there are still quite a lot of other PRs that are waiting in queue.

E1A · 2026-01-31T17:26:28Z

No rush but have you been able to look at the module?

NeffIsBack · 2026-02-01T06:34:28Z

No rush but have you been able to look at the module?

Not yet. There are still a ton of PRs that will come first because they waited even longer. Bear with me, we will get to it one day :D

azoxlpf · 2026-05-29T10:29:04Z

+
+    name = "tspkg"
+    description = (
+        "Creates, removes or inspects the AllowDefaultCredentials registry entry"


Please add a space between the two description strings (or use a single string)

azoxlpf · 2026-05-29T10:40:20Z

+    def on_admin_login(self, context, connection):
+        self._manage_allow_default_credentials(context, connection.conn)
+
+    def _parse_dword(self, data):


Please remove _parse_dword and use int(data) like wdigest.py, unless you have a repro where impacket returns non-int DWORDs on your targets

azoxlpf · 2026-05-29T10:48:26Z

+                rrp.hBaseRegSetValue(remote_ops._RemoteOperations__rrp, key_handle, "ConcatenateDefaults_AllowDefault\x00", rrp.REG_DWORD, 1)
+
+                # create (or open) subkey and add SPN entry as value "1"
+                try:


For consistency, swap the try/except order: try hBaseRegOpenKey first, then hBaseRegCreateKey on DCERPCException (mirror L65–70).

azoxlpf · 2026-05-29T10:52:59Z

+                    subkey_handle = ans["phkResult"]
+
+                rrp.hBaseRegSetValue(remote_ops._RemoteOperations__rrp, subkey_handle, "1\x00", rrp.REG_SZ, "*\x00")
+


You must initialize data = None before the try

azoxlpf · 2026-05-29T10:53:58Z

+        else:
+            if module_options["ACTION"].lower() not in ["enable", "disable", "check"]:
+                context.log.fail("Invalid value for ACTION option! (allowed: enable, disable, check)")
+                exit(1)


Please return instead of exit(1)

azoxlpf · 2026-05-29T10:56:43Z

+                    try:
+                        rrp.hBaseRegDeleteValue(remote_ops._RemoteOperations__rrp, sub_handle, "1\x00")
+                        context.log.debug("Deleted subkey value '1'")
+                    except Exception:


Please catch DCERPCException instead of bare Exception here (and in the other delete blocks) to stay consistent with the rest of the module and avoid swallowing unrelated errors

azoxlpf · 2026-05-29T10:57:13Z

+                    try:
+                        rrp.hBaseRegDeleteKey(remote_ops._RemoteOperations__rrp, key_handle, "AllowDefaultCredentials")
+                        context.log.debug("Deleted AllowDefaultCredentials subkey")
+                    except Exception:


azoxlpf · 2026-05-29T12:12:07Z

@@ -0,0 +1,171 @@
+from impacket.dcerpc.v5.rpcrt import DCERPCException
+from impacket.dcerpc.v5 import rrp
+from impacket.examples.secretsdump import RemoteOperations


Please don't use RemoteOperations. We already have a dedicated helper, NXCRPCConnection (rpc.py), which is the standard way to do remote registry in NetExec

azoxlpf · 2026-05-29T12:13:41Z

+        return None
+
+    def _manage_allow_default_credentials(self, context, smbconnection):
+        remote_ops = RemoteOperations(smbconnection, False)


See above and please switch to :

connection.trigger_winreg() dce = NXCRPCConnection(connection).connect(r"\winreg", rrp.MSRPC_UUID_RRP)

azoxlpf · 2026-05-29T12:15:45Z

+            self.action = module_options["ACTION"].lower()
+
+    def on_admin_login(self, context, connection):
+        self._manage_allow_default_credentials(context, connection.conn)


To use NXCRPCConnection, please pass connection instead of connection.conn

added the tspkg module

050392c

E1A requested review from Marshall-Hallenbeck, NeffIsBack, mpgn and zblurx as code owners September 29, 2025 19:23

Modified descriptions

8ce5d02

Signed-off-by: E1A <57531297+E1A@users.noreply.github.com>

Implemented feedback of the structure, ruff fixes and make check the …

4301f88

…default behaviour

E1A mentioned this pull request Sep 30, 2025

Added an wiki for the tspkg module Pennyw0rth/NetExec-Wiki#74

Open

NeffIsBack added the new module label Oct 1, 2025

Merge branch 'main' into main

5fa3233

E1A force-pushed the main branch from 8f79b6d to 5fa3233 Compare March 12, 2026 19:37

azoxlpf suggested changes May 29, 2026

View reviewed changes

Merge branch 'Pennyw0rth:main' into main

815a1fd

		subkey_handle = ans["phkResult"]

		rrp.hBaseRegSetValue(remote_ops._RemoteOperations__rrp, subkey_handle, "1\x00", rrp.REG_SZ, "*\x00")

Conversation

E1A commented Sep 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Type of change

Setup guide for the review

Screenshots (if appropriate):

Checklist:

Uh oh!

E1A commented Sep 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Dfte commented Sep 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Dfte commented Sep 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

E1A commented Sep 30, 2025

Uh oh!

NeffIsBack commented Oct 1, 2025

Uh oh!

E1A commented Oct 9, 2025

Uh oh!

NeffIsBack commented Oct 9, 2025

Uh oh!

E1A commented Jan 31, 2026

Uh oh!

NeffIsBack commented Feb 1, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

E1A commented Sep 29, 2025 •

edited

Loading

E1A commented Sep 29, 2025 •

edited

Loading

Dfte commented Sep 30, 2025 •

edited

Loading

Dfte commented Sep 30, 2025 •

edited

Loading