Skip to content

Conversation

@lodos2005
Copy link
Contributor

Description

This PR completely refactors the keepass_discover module, removing its dependency on PowerShell and introducing a more efficient, tiered search strategy.

  • Key Changes: Native Process Enumeration: Process discovery now uses impacket's TSTS.LegacyAPI instead of Get-Process.
  • Tiered File Search: A new fast search (FILES) checks only common KeePass installation and configuration directories. The existing deep search (DEEP_FILES) now uses the native connection.spider() method for a comprehensive scan.
  • Improved Module Options: DEFAULT: The new default option, combines process discovery with a fast file search. ALL: Combines process discovery with a deep file search for the most thorough scan.

Type of change

Insert an "x" inside the brackets for relevant items (do not delete options)

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Deprecation of feature or functionality
  • This change requires a documentation update
  • This requires a third party update (such as Impacket, Dploot, lsassy, etc)

Screenshots (if appropriate):

Screenshot 2025-09-11 at 02 13 54

Checklist:

Insert an "x" inside the brackets for completed and relevant items (do not delete options)

  • I have ran Ruff against my changes (via poetry: poetry run python -m ruff check . --preview, use --fix to automatically fix what it can)
  • I have added or updated the tests/e2e_commands.txt file if necessary (new modules or features are required to be added to the e2e tests)
  • New and existing e2e tests pass locally with my changes
  • If reliant on changes of third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)

This commit refactors the keepass_discover module to improve performance and flexibility. It replaces external PowerShell commands with native impacket functions for process and file discovery. A new tiered file search strategy allows for a fast scan of default locations or a comprehensive deep scan. Module options have been updated to reflect this new, more efficient logic.


Signed-off-by: Hakan Yavuz <[email protected]>
@NeffIsBack
Copy link
Member

Nice! Thanks for the PR!

@NeffIsBack NeffIsBack added the enhancement New feature or request label Sep 10, 2025
@Dfte
Copy link
Contributor

Dfte commented Sep 28, 2025

Hey man! Thank you for the PR. I believe we should keep the Get-Process cmd thing because if RDP is not enabled on the remote host because if it's not, the named pipe won't be reachable.

This is the message I output with the --tasklist option:

image

So can you modify the PR to add this:

try:
     # get process via TST
except:
     #  If pipe not reachable (RDP disabled)
else:
    # Then get process via powershell / cmd

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants