The Network Execution Tool
This report presents the forensic synthetic code analysis of Pennyw0rth/NetExec, a Python project with 5,737 GitHub stars. SynthScan v2.0 examined 45,742 lines of code across 264 source files, recording 1018 pattern matches distributed across 12 syntactic categories. The overall adjusted score of 27.8 places this repository in the Moderate AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
Longitudinal tracking requires multiple scan runs. Once this repository is re-scanned after new commits land, this chart will visualise how the synthetic code signal evolves over time — enabling you to detect whether AI authorship is growing, stabilising, or being actively corrected by human engineers.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 1018 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | build_collector.py | 22 | except Exception as e: | CODE |
| LOW | build_collector.py | 29 | except Exception as e: | CODE |
| LOW | nxc/database.py | 32 | except Exception as e: | CODE |
| MEDIUM | nxc/database.py | 28 | def open_config(config_path): | CODE |
| LOW | nxc/netexec.py | 68 | except Exception: | CODE |
| LOW | nxc/netexec.py | 123 | except Exception as e: | CODE |
| LOW | nxc/netexec.py | 142 | except Exception as e: | CODE |
| LOW | nxc/logger.py | 174 | except Exception as e: | CODE |
| LOW | nxc/connection.py | 46 | except Exception: | CODE |
| LOW | nxc/connection.py | 67 | except Exception: | CODE |
| LOW | nxc/connection.py | 76 | except Exception: | CODE |
| LOW | nxc/connection.py | 127 | except Exception as e: | CODE |
| LOW | nxc/connection.py | 184 | except Exception as e: | CODE |
| LOW | nxc/connection.py | 206 | except Exception as e: | CODE |
| MEDIUM | nxc/connection.py | 197 | def resolver(self, target): | CODE |
| LOW | nxc/cli.py | 118 | except Exception as e: | STRING |
| LOW | nxc/parsers/ldap_results.py | 54 | except Exception: | CODE |
| MEDIUM | nxc/parsers/ldap_results.py | 39 | def sid_to_str(sid): | CODE |
| LOW | nxc/modules/recyclebin.py | 81 | except Exception as e: | CODE |
| LOW | nxc/modules/smbghost.py | 57 | except Exception as e: | CODE |
| LOW | nxc/modules/sccm-recon6.py | 45 | except Exception as e: | CODE |
| LOW | nxc/modules/sccm-recon6.py | 113 | except Exception as e: | CODE |
| LOW | nxc/modules/sccm-recon6.py | 119 | except Exception as e: | CODE |
| LOW | nxc/modules/ntdsutil.py | 70 | except Exception as e: | CODE |
| LOW | nxc/modules/ntdsutil.py | 82 | except Exception as e: | CODE |
| LOW | nxc/modules/ntdsutil.py | 94 | except Exception as e: | CODE |
| LOW | nxc/modules/ntdsutil.py | 103 | except Exception as e: | CODE |
| LOW | nxc/modules/ntdsutil.py | 136 | except Exception: | CODE |
| LOW | nxc/modules/ntdsutil.py | 170 | except Exception as e: | CODE |
| LOW | nxc/modules/find-computer.py | 66 | except Exception as e: | CODE |
| LOW | nxc/modules/reg-query.py | 63 | except Exception as e: | CODE |
| LOW⚡ | nxc/modules/reg-query.py | 112 | except Exception as e: | CODE |
| LOW | nxc/modules/reg-query.py | 135 | except Exception: | CODE |
| LOW | nxc/modules/reg-query.py | 150 | except Exception: | CODE |
| LOW | nxc/modules/reg-query.py | 159 | except Exception as e: | CODE |
| LOW | nxc/modules/wcc.py | 246 | except Exception as e: | CODE |
| LOW | nxc/modules/wcc.py | 278 | except Exception as e: | CODE |
| LOW | nxc/modules/wcc.py | 507 | except Exception: | CODE |
| LOW | nxc/modules/wcc.py | 520 | except Exception as e: | CODE |
| LOW | nxc/modules/wcc.py | 585 | except Exception as e: | CODE |
| LOW | nxc/modules/wcc.py | 606 | except Exception as e: | CODE |
| LOW | nxc/modules/wcc.py | 727 | except Exception as e: | CODE |
| MEDIUM | nxc/modules/wcc.py | 512 | def check_defender_exclusion(self, *spec, options=None): | CODE |
| LOW | nxc/modules/enable_cmdshell.py | 76 | except Exception as e: | CODE |
| LOW | nxc/modules/hyperv-host.py | 50 | except Exception as e: | CODE |
| LOW | nxc/modules/example_module.py | 45 | except Exception as e: | CODE |
| LOW⚡ | nxc/modules/remove-mic.py | 118 | except Exception: | CODE |
| LOW⚡ | nxc/modules/remove-mic.py | 122 | except Exception: | CODE |
| LOW⚡ | nxc/modules/remove-mic.py | 126 | except Exception: | CODE |
| LOW | nxc/modules/spooler.py | 54 | except Exception as e: | CODE |
| LOW | nxc/modules/spooler.py | 98 | except Exception: | CODE |
| LOW | nxc/modules/putty.py | 151 | except Exception as e: | CODE |
| LOW | nxc/modules/putty.py | 169 | except Exception as e: | CODE |
| LOW | nxc/modules/putty.py | 222 | except Exception as e: | CODE |
| LOW | nxc/modules/wdigest.py | 87 | except Exception: | CODE |
| LOW | nxc/modules/shadowrdp.py | 51 | except Exception as e: | CODE |
| LOW | nxc/modules/shadowrdp.py | 81 | except Exception as e: | CODE |
| MEDIUM | nxc/modules/shadowrdp.py | 30 | def on_admin_login(self, context, connection): | CODE |
| LOW⚡ | nxc/modules/wifi.py | 53 | except Exception as e: | CODE |
| LOW⚡ | nxc/modules/wifi.py | 61 | except Exception: | CODE |
| 545 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | nxc/netexec.py | 83 | CODE | |
| LOW | nxc/connection.py | 33 | CODE | |
| LOW | nxc/connection.py | 103 | CODE | |
| LOW | nxc/connection.py | 383 | CODE | |
| LOW | nxc/connection.py | 478 | CODE | |
| LOW | nxc/connection.py | 525 | CODE | |
| LOW | nxc/nxcdb.py | 109 | CODE | |
| LOW | nxc/nxcdb.py | 403 | CODE | |
| LOW | nxc/nxcdb.py | 486 | CODE | |
| LOW | nxc/parsers/ldap_results.py | 5 | CODE | |
| LOW | nxc/parsers/ip.py | 4 | CODE | |
| LOW | nxc/modules/recyclebin.py | 22 | CODE | |
| LOW | nxc/modules/sccm-recon6.py | 96 | CODE | |
| LOW | nxc/modules/find-computer.py | 37 | CODE | |
| LOW | nxc/modules/reg-query.py | 22 | CODE | |
| LOW | nxc/modules/reg-query.py | 77 | CODE | |
| LOW | nxc/modules/wcc.py | 131 | CODE | |
| LOW | nxc/modules/wcc.py | 253 | CODE | |
| LOW | nxc/modules/wcc.py | 538 | CODE | |
| LOW | nxc/modules/wcc.py | 621 | CODE | |
| LOW | nxc/modules/putty.py | 156 | CODE | |
| LOW | nxc/modules/shadowrdp.py | 30 | CODE | |
| LOW | nxc/modules/wifi.py | 18 | CODE | |
| LOW | nxc/modules/impersonate.py | 53 | CODE | |
| LOW | nxc/modules/get-network.py | 81 | CODE | |
| LOW | nxc/modules/enum_cve.py | 57 | CODE | |
| LOW | nxc/modules/mssql_priv.py | 49 | CODE | |
| LOW | nxc/modules/obsolete.py | 32 | CODE | |
| LOW | nxc/modules/group-mem.py | 74 | CODE | |
| LOW | nxc/modules/backup_operator.py | 130 | CODE | |
| LOW | nxc/modules/backup_operator.py | 177 | CODE | |
| LOW | nxc/modules/keepass_trigger.py | 125 | CODE | |
| LOW | nxc/modules/keepass_trigger.py | 183 | CODE | |
| LOW | nxc/modules/keepass_trigger.py | 241 | CODE | |
| LOW | nxc/modules/keepass_trigger.py | 285 | CODE | |
| LOW | nxc/modules/keepass_trigger.py | 379 | CODE | |
| LOW | nxc/modules/iis.py | 38 | CODE | |
| LOW | nxc/modules/handlekatz.py | 53 | CODE | |
| LOW | nxc/modules/enum_ca.py | 39 | CODE | |
| LOW | nxc/modules/groupmembership.py | 33 | CODE | |
| LOW | nxc/modules/laps.py | 29 | CODE | |
| LOW | nxc/modules/coerce_plus.py | 43 | CODE | |
| LOW | nxc/modules/sccm.py | 48 | CODE | |
| LOW | nxc/modules/sccm.py | 125 | CODE | |
| LOW | nxc/modules/sccm.py | 242 | CODE | |
| LOW | nxc/modules/badsuccessor.py | 107 | CODE | |
| LOW | nxc/modules/wam.py | 20 | CODE | |
| LOW | nxc/modules/wam.py | 53 | CODE | |
| LOW | nxc/modules/enum_av.py | 44 | CODE | |
| LOW | nxc/modules/enum_av.py | 63 | CODE | |
| LOW | nxc/modules/slinky.py | 74 | CODE | |
| LOW | nxc/modules/raisechild.py | 84 | CODE | |
| LOW | nxc/modules/raisechild.py | 171 | CODE | |
| LOW | nxc/modules/raisechild.py | 184 | CODE | |
| LOW | nxc/modules/recent_files.py | 19 | CODE | |
| LOW | nxc/modules/dpapi_hash.py | 21 | CODE | |
| LOW | nxc/modules/presence.py | 51 | CODE | |
| LOW | nxc/modules/presence.py | 158 | CODE | |
| LOW | nxc/modules/notepad.py | 92 | CODE | |
| LOW | nxc/modules/notepad.py | 124 | CODE | |
| 163 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | nxc/modules/example_module.py | 0 | concurrent. required if on_admin_login is not present. this gets called on each authenticated connection | STRING |
| HIGH | nxc/modules/groupmembership.py | 0 | concurrent. required if on_admin_login is not present. this gets called on each authenticated connection | STRING |
| HIGH | nxc/modules/get-desc-users.py | 0 | concurrent. required if on_admin_login is not present. this gets called on each authenticated connection | STRING |
| HIGH | nxc/protocols/ftp/database.py | 0 | check if this credential has already been added to the database, if not add it in. | STRING |
| HIGH | nxc/protocols/winrm/database.py | 0 | check if this credential has already been added to the database, if not add it in. | STRING |
| HIGH | nxc/protocols/ldap/database.py | 0 | check if this credential has already been added to the database, if not add it in. | STRING |
| HIGH | nxc/protocols/ssh/database.py | 0 | check if this credential has already been added to the database, if not add it in. | STRING |
| HIGH | nxc/protocols/smb/database.py | 0 | check if this credential has already been added to the database, if not add it in. | STRING |
| HIGH | nxc/protocols/mssql/database.py | 0 | check if this credential has already been added to the database, if not add it in. | STRING |
| HIGH | nxc/protocols/ftp/db_navigator.py | 0 | clear_database this completely destroys all data in the currently connected database you cannot undo this command | STRING |
| HIGH | nxc/protocols/nfs/db_navigator.py | 0 | clear_database this completely destroys all data in the currently connected database you cannot undo this command | STRING |
| HIGH | nxc/protocols/winrm/db_navigator.py | 0 | clear_database this completely destroys all data in the currently connected database you cannot undo this command | STRING |
| HIGH | nxc/protocols/wmi/db_navigator.py | 0 | clear_database this completely destroys all data in the currently connected database you cannot undo this command | STRING |
| HIGH | nxc/protocols/ldap/db_navigator.py | 0 | clear_database this completely destroys all data in the currently connected database you cannot undo this command | STRING |
| HIGH | nxc/protocols/vnc/db_navigator.py | 0 | clear_database this completely destroys all data in the currently connected database you cannot undo this command | STRING |
| HIGH | nxc/protocols/rdp/db_navigator.py | 0 | clear_database this completely destroys all data in the currently connected database you cannot undo this command | STRING |
| HIGH | nxc/protocols/ssh/db_navigator.py | 0 | clear_database this completely destroys all data in the currently connected database you cannot undo this command | STRING |
| HIGH | nxc/protocols/smb/db_navigator.py | 0 | clear_database this completely destroys all data in the currently connected database you cannot undo this command | STRING |
| HIGH | nxc/protocols/mssql/db_navigator.py | 0 | clear_database this completely destroys all data in the currently connected database you cannot undo this command | STRING |
| HIGH | nxc/protocols/nfs/database.py | 0 | check if this check result has already been added to the database, if not, add it in. | STRING |
| HIGH | nxc/protocols/ldap/database.py | 0 | check if this check result has already been added to the database, if not, add it in. | STRING |
| HIGH | nxc/protocols/ssh/database.py | 0 | check if this check result has already been added to the database, if not, add it in. | STRING |
| HIGH | nxc/protocols/smb/database.py | 0 | check if this check result has already been added to the database, if not, add it in. | STRING |
| HIGH | nxc/protocols/winrm/database.py | 0 | check if this host has already been added to the database, if not, add it in. todo: return inserted or updated row ids a | STRING |
| HIGH | nxc/protocols/rdp/database.py | 0 | check if this host has already been added to the database, if not, add it in. todo: return inserted or updated row ids a | STRING |
| HIGH | nxc/protocols/mssql/database.py | 0 | check if this host has already been added to the database, if not, add it in. todo: return inserted or updated row ids a | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | nxc/modules/group-mem.py | 44 | CODE | |
| MEDIUM | nxc/modules/group-mem.py | 45 | CODE | |
| MEDIUM | nxc/modules/group-mem.py | 47 | CODE | |
| MEDIUM | nxc/modules/group-mem.py | 49 | CODE | |
| MEDIUM | nxc/modules/group-mem.py | 54 | CODE | |
| MEDIUM | nxc/modules/group-mem.py | 55 | CODE | |
| MEDIUM | nxc/modules/group-mem.py | 58 | CODE | |
| MEDIUM | nxc/modules/group-mem.py | 59 | CODE | |
| MEDIUM | nxc/modules/group-mem.py | 60 | CODE | |
| MEDIUM | nxc/modules/group-mem.py | 63 | CODE | |
| MEDIUM | nxc/modules/group-mem.py | 64 | CODE | |
| MEDIUM | nxc/modules/group-mem.py | 65 | CODE | |
| MEDIUM | nxc/modules/group-mem.py | 67 | CODE | |
| MEDIUM | nxc/modules/firefox.py | 30 | CODE | |
| MEDIUM | nxc/modules/firefox.py | 31 | CODE | |
| MEDIUM | nxc/modules/firefox.py | 32 | CODE | |
| MEDIUM | nxc/modules/firefox.py | 33 | CODE | |
| MEDIUM | nxc/modules/firefox.py | 34 | CODE | |
| MEDIUM | nxc/modules/firefox.py | 35 | CODE | |
| MEDIUM | nxc/modules/firefox.py | 36 | CODE | |
| MEDIUM | nxc/modules/firefox.py | 37 | CODE | |
| MEDIUM | nxc/modules/firefox.py | 38 | CODE | |
| MEDIUM | nxc/modules/firefox.py | 40 | CODE | |
| MEDIUM | nxc/modules/firefox.py | 52 | CODE | |
| MEDIUM | nxc/modules/firefox.py | 67 | CODE | |
| MEDIUM | nxc/modules/ntlm_reflection.py | 52 | CODE | |
| MEDIUM | nxc/modules/ntlm_reflection.py | 53 | CODE | |
| MEDIUM | nxc/modules/ntlm_reflection.py | 54 | CODE | |
| MEDIUM | nxc/modules/ntlm_reflection.py | 55 | CODE | |
| MEDIUM | nxc/modules/ntlm_reflection.py | 56 | CODE | |
| MEDIUM | nxc/modules/ntlm_reflection.py | 57 | CODE | |
| MEDIUM | nxc/modules/ntlm_reflection.py | 59 | CODE | |
| MEDIUM | nxc/modules/ntlm_reflection.py | 60 | CODE | |
| MEDIUM | nxc/modules/ntlm_reflection.py | 62 | CODE | |
| MEDIUM | nxc/modules/ldap-checker.py | 178 | CODE | |
| MEDIUM | nxc/modules/ldap-checker.py | 179 | CODE | |
| MEDIUM | nxc/modules/ldap-checker.py | 180 | CODE | |
| MEDIUM | nxc/modules/ldap-checker.py | 183 | CODE | |
| MEDIUM | nxc/modules/ldap-checker.py | 187 | CODE | |
| MEDIUM | nxc/modules/ldap-checker.py | 194 | CODE | |
| MEDIUM | nxc/modules/ldap-checker.py | 224 | CODE | |
| MEDIUM | nxc/modules/ldap-checker.py | 225 | CODE | |
| MEDIUM | nxc/modules/ldap-checker.py | 240 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | nxc/modules/recyclebin.py | 70 | # Create the export path | COMMENT |
| MEDIUM | nxc/modules/bitlocker.py | 79 | # Create a DCOM connection | COMMENT |
| MEDIUM | nxc/modules/pre2k.py | 32 | # Define the search filter | COMMENT |
| MEDIUM | nxc/modules/spider_plus.py | 354 | # Create the subdirectories based on the share name and file path. | COMMENT |
| MEDIUM | nxc/modules/daclread.py | 215 | # Initialize module variables | COMMENT |
| MEDIUM | nxc/modules/daclread.py | 335 | # This function is called before any writing action (write, remove or restore) | COMMENT |
| MEDIUM | nxc/modules/ms17-010.py | 120 | # Define the NetBIOS header | COMMENT |
| MEDIUM | nxc/modules/ms17-010.py | 126 | # Define the SMB header | COMMENT |
| MEDIUM | nxc/modules/ms17-010.py | 142 | # Define the negotiate_proto_request | COMMENT |
| MEDIUM⚡ | nxc/modules/ms17-010.py | 163 | # Define the NetBIOS bytes | COMMENT |
| MEDIUM⚡ | nxc/modules/ms17-010.py | 169 | # Define the SMB header bytes | COMMENT |
| MEDIUM | nxc/modules/ms17-010.py | 185 | # Define the session setup andx request bytes | COMMENT |
| MEDIUM | nxc/modules/ms17-010.py | 244 | # Create the IPC string | COMMENT |
| MEDIUM | nxc/modules/ms17-010.py | 357 | # Define the netbios section of the SMB request | COMMENT |
| MEDIUM | nxc/modules/ms17-010.py | 363 | # Define the SMB header section of the SMB request | COMMENT |
| MEDIUM | nxc/modules/ms17-010.py | 379 | # Define the trans2 request section of the SMB request | COMMENT |
| MEDIUM | nxc/protocols/ldap.py | 1165 | # Create the format string for each row | COMMENT |
| MEDIUM | nxc/protocols/smb.py | 1297 | # Create the template for formatting | COMMENT |
| MEDIUM | nxc/protocols/smb.py | 1430 | # Create the template for formatting | COMMENT |
| MEDIUM | nxc/protocols/ldap/laps.py | 52 | # Create the baseDN | COMMENT |
| MEDIUM | nxc/protocols/ldap/laps.py | 125 | # Create the baseDN | COMMENT |
| MEDIUM | nxc/protocols/ldap/bloodhound.py | 42 | # Create a domain controller object | COMMENT |
| MEDIUM | nxc/protocols/ldap/bloodhound.py | 44 | # Create an object resolver | COMMENT |
| MEDIUM | nxc/helpers/powershell.py | 191 | # The following code gives us some control over where and how Invoke-PSInject does its thang | COMMENT |
| MEDIUM | nxc/helpers/rpc.py | 74 | # Create a new SMB conn if we don't have one already or | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | nxc/modules/wcc.py | 401 | def check_last_successful_update(self): | CODE |
| LOW | nxc/modules/wcc.py | 423 | def check_guest_account_disabled(self): | CODE |
| LOW | nxc/modules/enable_cmdshell.py | 47 | def backup_show_advanced_options(self): | CODE |
| LOW | nxc/modules/enable_cmdshell.py | 53 | def restore_show_advanced_options(self): | CODE |
| LOW | nxc/modules/impersonate.py | 49 | def list_available_primary_tokens(self, _, connection): | CODE |
| LOW | nxc/modules/mssql_priv.py | 161 | def perform_impersonation_check(self, user: User, grantors=None): | CODE |
| LOW | nxc/modules/enum_av.py | 44 | def _detect_installed_services(self, context, connection, target): | CODE |
| LOW | nxc/modules/gpp_privileges.py | 174 | def initialize_ldap_connection(self, connection): | CODE |
| LOW | nxc/modules/mremoteng.py | 184 | def extract_remoteng_passwords(self, encrypted_password, encryption_attributes: MRemoteNgEncryptionAttributes): | CODE |
| LOW | nxc/modules/add-computer.py | 142 | def _samr_set_workstation_trust(self, dce, domain_handle, user_handle): | CODE |
| LOW | nxc/modules/ldap-checker.py | 123 | def does_ldaps_complete_handshake(self, context, dc_ip): | CODE |
| LOW | nxc/modules/vnc.py | 105 | def vnc_client_proxyconf_extract(self, dploot_conn, remote_ops=None): | CODE |
| LOW | nxc/modules/ms17-010.py | 75 | def generate_smb_proto_payload(self, *protos): | CODE |
| LOW | nxc/modules/ms17-010.py | 100 | def calculate_doublepulsar_xor_key(self, s): | CODE |
| LOW⚡ | nxc/modules/ms17-010.py | 159 | def session_setup_andx_request(self): | CODE |
| LOW | nxc/modules/ms17-010.py | 208 | def tree_connect_andx_request(self, ip, userid): | CODE |
| LOW | nxc/modules/winscp.py | 54 | def user_object_to_name_mapper(self, context, connection, all_user_objects): | STRING |
| LOW | nxc/modules/winscp.py | 118 | def registry_session_extractor(self, context, connection, user_object, sessionName): | STRING |
| LOW⚡ | nxc/modules/winscp.py | 146 | def find_all_logged_in_users_in_registry(self, context, connection): | CODE |
| LOW | nxc/protocols/ldap.py | 812 | def resolve_and_display_hostname(name, domain_name=None): | CODE |
| LOW | nxc/protocols/ldap.py | 1705 | def _collect_adcs_for_bloodhound(self, timestamp): | CODE |
| LOW | nxc/protocols/ftp/database.py | 280 | def remove_loggedin_relations(self, cred_id=None, host_id=None): | CODE |
| LOW | nxc/protocols/winrm/database.py | 376 | def remove_loggedin_relations(self, user_id=None, host_id=None): | CODE |
| LOW | nxc/protocols/ldap/bloodhound.py | 113 | def resolve_collection_methods(methods, logger): | CODE |
| LOW | nxc/protocols/ssh/database.py | 412 | def remove_loggedin_relations(self, cred_id=None, host_id=None): | CODE |
| LOW | nxc/protocols/smb/samruser.py | 144 | def old_large_int_to_datetime(large_int): | CODE |
| LOW⚡ | nxc/protocols/smb/firefox.py | 241 | def is_master_password_correct(self, key_data, master_password=b""): | CODE |
| LOW | nxc/protocols/smb/database.py | 679 | def get_users_with_share_access(self, host_id, share_name, permissions): | CODE |
| LOW | nxc/protocols/smb/database.py | 829 | def remove_loggedin_relations(self, user_id=None, host_id=None): | CODE |
| LOW⚡ | nxc/protocols/smb/dpapi.py | 49 | def collect_masterkeys_from_target(context, target, dploot_connection, user=True, system=True): | CODE |
| LOW⚡ | nxc/protocols/smb/dpapi.py | 91 | def upgrade_to_dploot_connection(target, connection=None): | CODE |
| LOW | nxc/protocols/mssql/database.py | 349 | def remove_loggedin_relations(self, user_id=None, host_id=None): | CODE |
| LOW | nxc/helpers/negotiate_parser.py | 39 | def decode_tds_info_error_msgtext(data, offset): | CODE |
| LOW | nxc/helpers/rpc.py | 92 | def create_from_string_binding(self, string_binding, target_ip=None, set_remote_host=None, anonymous_rpc=False): | CODE |
| LOW | tests/test_smb_database.py | 145 | def test_remove_admin_relation(): | CODE |
| LOW | tests/test_smb_database.py | 189 | def test_remove_group_relations(): | CODE |
| LOW | tests/test_smb_database.py | 205 | def test_get_domain_controllers(): | CODE |
| LOW⚡ | tests/test_smb_database.py | 221 | def test_get_shares_by_access(): | CODE |
| LOW⚡ | tests/test_smb_database.py | 225 | def test_get_users_with_share_access(): | CODE |
| LOW⚡ | tests/test_smb_database.py | 229 | def test_add_domain_backupkey(): | CODE |
| LOW⚡ | tests/test_smb_database.py | 233 | def test_get_domain_backupkey(): | CODE |
| LOW⚡ | tests/test_smb_database.py | 237 | def test_is_dpapi_secret_valid(): | CODE |
| LOW⚡ | tests/test_smb_database.py | 249 | def test_add_loggedin_relation(): | CODE |
| LOW⚡ | tests/test_smb_database.py | 253 | def test_get_loggedin_relations(): | CODE |
| LOW⚡ | tests/test_smb_database.py | 257 | def test_remove_loggedin_relations(): | CODE |
| LOW⚡ | tests/test_smb_database.py | 261 | def test_get_keys_returns_empty_for_smb(db): | CODE |
| LOW⚡ | tests/test_smb_database.py | 270 | def test_get_keys_all_and_by_id_fallback(db): | CODE |
| LOW⚡ | tests/test_smb_database.py | 276 | def test_write_list_empty_entries(tmp_path): | CODE |
| LOW | tests/test_smb_database.py | 293 | def test_do_export_keys_empty_guard(db, tmp_path): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | nxc/config.py | 18 | # Check if there are any missing options in the config file | COMMENT |
| LOW⚡ | nxc/modules/reg-query.py | 110 | # Check if value exists | COMMENT |
| LOW⚡ | nxc/modules/reg-query.py | 121 | # Check if value exists | COMMENT |
| LOW⚡ | nxc/modules/reg-query.py | 123 | # Check if value exists | COMMENT |
| LOW | nxc/modules/spooler.py | 62 | # Display results. | COMMENT |
| LOW | nxc/modules/sccm.py | 77 | # Print results | COMMENT |
| LOW | nxc/modules/presence.py | 152 | # Check if process SID matches any admin user SID | COMMENT |
| LOW | nxc/modules/presence.py | 174 | # Check if SID and LogonType are found, then check if SID matches any admin user | COMMENT |
| LOW | nxc/modules/notepad.py | 152 | # Read the file into a buffer | COMMENT |
| LOW | nxc/modules/mssql_dumper.py | 122 | # Check if any of the cells in the row match any of the regex patterns | COMMENT |
| LOW | nxc/modules/lockscreendoors.py | 73 | # Check if the description is as expected | COMMENT |
| LOW | nxc/modules/spider_plus.py | 281 | # Check if proceeding with download attempt. | COMMENT |
| LOW | nxc/modules/spider_plus.py | 301 | # Check if the remote file is readable. | COMMENT |
| LOW | nxc/modules/spider_plus.py | 308 | # Check if the file is already downloaded and up-to-date. | COMMENT |
| LOW | nxc/modules/spider_plus.py | 368 | # Check if the file is empty and should not be. | COMMENT |
| LOW⚡ | nxc/modules/veeam.py | 112 | # Check if we found an SQL Server of some kind | COMMENT |
| LOW⚡ | nxc/protocols/ldap.py | 918 | # Check if we can resolve the trusted domain's DC using DNS | COMMENT |
| LOW | nxc/protocols/smb.py | 228 | # Check if the host is a valid IP address, if not we parse the FQDN in the Exception | COMMENT |
| LOW | nxc/protocols/smb.py | 1328 | # Check if we need to filter for usernames | COMMENT |
| LOW | nxc/protocols/smb.py | 138 | self.smbv1 = None # Check if SMBv1 is supported | CODE |
| LOW | nxc/protocols/smb.py | 139 | self.smbv3 = None # Check if SMBv3 is supported | CODE |
| LOW⚡ | nxc/protocols/nfs.py | 141 | # Check if root escape is possible | COMMENT |
| LOW | nxc/protocols/nfs.py | 414 | # Write the file data to the local file | COMMENT |
| LOW | nxc/protocols/nfs.py | 432 | # Check if local file is exist | COMMENT |
| LOW | nxc/protocols/nfs.py | 615 | # Check if "." is already the root directory | COMMENT |
| LOW | nxc/protocols/ftp.py | 124 | # Check if the current connection is ASCII (ASCII does not support .size()) | COMMENT |
| LOW | nxc/protocols/ftp.py | 128 | # Check if the file exists | COMMENT |
| LOW | nxc/protocols/ftp.py | 140 | # Check if the file was downloaded | COMMENT |
| LOW | nxc/protocols/ftp.py | 156 | # Check if the file was uploaded | COMMENT |
| LOW | nxc/protocols/ldap/laps.py | 212 | # Check if item is in cache | COMMENT |
| LOW | nxc/helpers/misc.py | 135 | # Check if it's CE based on version string | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | nxc/modules/mssql_coerce.py | 59 | f"SELECT * FROM sys.fn_xe_file_target_read_file ('\\\\{self.listener}\\file','\\\\{self.listener}\\file',null, | CODE |
| HIGH | nxc/protocols/mssql.py | 564 | get_owner_command = f"icacls C:\\windows\\temp\\{sam_storename} /grant {self.username}:F && icacls C:\\windows\\ | CODE |
| HIGH | nxc/protocols/mssql.py | 599 | get_owner_command = f"icacls C:\\windows\\temp\\{security_storename} /grant {self.username}:F && icacls C:\\wind | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | nxc/helpers/powershell.py | 62 | Obfuscates a PowerShell script. Args: ---- path_to_script (str): The path to the PowerShell script | STRING |
| HIGH | nxc/helpers/bloodhound.py | 2 | Adds a user to the BloodHound graph database. Args: ---- user (str or list): The username of the user o | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | nxc/modules/remove-mic.py | 1 | # Original Author: | COMMENT |
| LOW | nxc/protocols/wmi/wmiexec_event.py | 1 | # Author: xiaolichan # noqa: ERA001 | COMMENT |
| LOW | nxc/protocols/wmi/wmiexec.py | 1 | # Author: xiaolichan # noqa: ERA001 | COMMENT |
| LOW | nxc/protocols/smb/mmcexec.py | 1 | # Copyright (c) 2003-2016 CORE Security Technologies | COMMENT |
| LOW | nxc/helpers/pfx.py | 1 | # SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | nxc/protocols/smb.py | 2021 | CODE | |
| LOW | nxc/protocols/smb/mmcexec.py | 62 | CODE | |
| LOW | nxc/protocols/smb/smbspider.py | 24 | CODE | |
| LOW | nxc/protocols/smb/atexec.py | 16 | CODE | |
| LOW | nxc/protocols/smb/wmiexec.py | 13 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | nxc/parsers/ldap_results.py | 28 | # If we can't decode the value, we'll just return the bytes | COMMENT |