feat(netexec): emit file findings from spider_plus share spidering (#390) - #387
feat(netexec): emit file findings from spider_plus share spidering (#390)#387Seb-MIGUEL wants to merge 2 commits into
Conversation
The spider_plus module enumerates files on readable SMB shares, but it prints
only aggregate stats to stdout -- the per-file list is written to a JSON
metadata file per target. Read that metadata back into structured `file`
findings so the attack path can chain a discovered share to the files exposed
on it (e.g. a share holding a script with a hard-coded password).
- output_registry: map spider_plus to {text, file}.
- contract_outputs: declare the `files` output element (ContractOutputType.File).
- command builder: force a controlled OUTPUT_FOLDER for spider_plus (overriding
any user-supplied one) so the injector knows where to read the metadata.
- openaev_netexec: read the metadata folder after execution, merge the files
into the structured outputs, and clean the folder up.
- spider_plus_parser: flatten the {share: {path: meta}} metadata into file
findings, keeping file_name (basename), path (directory), share and host as
distinct fields so a share-hosted file links back to its share finding and
local files (no share) stay distinguishable.
Requires the `file` output type from client-python. Part of the attack-path
file finding work (OpenAEV #6647).
|
🤖 [AI-generated] Hey @Seb-MIGUEL! 👋 Thanks a lot for opening PR #387 — the spider_plus file-findings work looks really solid and the write-up of the parsing/output-folder handling is genuinely a pleasure to read! 🙏 I just had a quick look and there's one gap that could help reviewers and the release process: the PR doesn't seem to be linked to an issue in this repository (only a cross-repo reference to OpenAEV #6647 and client-python#322 are mentioned). I haven't changed anything in your description or title — just a gentle suggestion:
No rush at all — thanks again for contributing to the project! 🚀 |
guzmud
left a comment
guzmud
left a comment
There was a problem hiding this comment.
LGTM!
Self-note: anticipate a refactor of the netexec codebase regarding the use of tempfile and of pathlib at some point
Seb-MIGUEL
changed the title
4 participants
Closes #390
Emits structured
filefindings from the NetExecspider_plusmodule.Why
spider_plusrecursively enumerates files on readable SMB shares — exactly the attack step where a red team turns share access into loot (e.g. asecret.ps1onSYSVOLholding a hard-coded password). Until now the module produced only generictextoutput, so those files never became findings and could not appear in the attack-path graph.This unlocks the kill-chain: nmap → 445 → SMB → enum shares (
sharefinding) → spider_plus (filefindings on that share).The catch, and how it's handled
spider_plusprints only aggregate stats to stdout; the per-file list is written to a JSON metadata file per target (<ip>.json) in its output folder. So this cannot go through the stdout parser:OUTPUT_FOLDERforspider_plus(overriding any user-supplied one) so the injector knows where to read the metadata back from.openaev_netexecreads every<ip>.json, merges the files into the structured outputs asfiles, then cleans the folder up.spider_plus_parserflattens the{share: {path: meta}}metadata into file findings, keepingfile_name(basename),path(directory),shareandhostas distinct fields — so a share-hosted file links back to itssharefinding, and local files (no share, e.g. FTP/NFS--lslater) stay distinguishable.Tests
test_spider_plus_parser: basename/directory split, top-level vs nested files, same basename kept distinct per share, asset-id mapping, missing/malformed metadata.test_netexec_command_builder:spider_plusforces the controlledOUTPUT_FOLDERand overrides a user-supplied one.Dependency
Requires the
fileoutput type added in client-python (OpenAEV-Platform/client-python#322) —contract_outputsreferencesContractOutputType.File. Part of the attack-path file finding work (OpenAEV #6647).