byt3bl33d3r/CrackMapExec

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/helpers/powershell.py line 48
Likely real: Yes, 99% confidence

Found 'subprocess' function 'call' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.

return_code = call(invoke_obfs_command, stdout=devnull, stderr=devnull, shell=True)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/ldap-checker.py line 93
Likely real: Yes, 98% confidence

certificate verification explicitly disabled, insecure connections possible

ssl_sock = ssl.wrap_socket(
                s,
                cert_reqs=ssl.CERT_OPTIONAL,
                suppress_ragged_eofs=False,
                do_handshake_on_connect=False,
            )

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/winrm.py line 179
Likely real: Yes, 98% confidence

Use of weak MD4 hash for security. Consider usedforsecurity=False

178         if ntlm_hash:
179             hash_ntlm = hashlib.new("md4", msMCSAdmPwd.encode("utf-16le")).digest()
180             self.hash = binascii.hexlify(hash_ntlm).decode()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/smb.py line 356
Likely real: Yes, 98% confidence

Use of weak MD4 hash for security. Consider usedforsecurity=False

355         if ntlm_hash:
356             hash_ntlm = hashlib.new("md4", msMCSAdmPwd.encode("utf-16le")).digest()
357             self.hash = binascii.hexlify(hash_ntlm).decode()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/empire_exec.py line 100
Likely real: Yes, 98% confidence

Call to requests with verify=False disabling SSL certificate checks, security issue.

99                 headers=headers,
100                 verify=False,
101             )
102         except ConnectionError:
103             context.log.fail(f"Unable to request stager from Empire's RESTful API")
104             sys.exit(1)
105 
106         if stager_response.status_code not in [200, 201]:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/cmedb.py line 453
Likely real: Yes, 98% confidence

Call to requests with verify=False disabling SSL certificate checks, security issue.

452                         params=url_params,
453                         verify=False,
454                     )
455                     creds = r.json()
456 
457                     for cred in creds["creds"]:
458                         if cred["credtype"] == "token" or cred["credtype"] == "krbtgt" or cred["username"].endswith("$"):
459                             continue

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/cmedb.py line 444
Likely real: Yes, 98% confidence

Call to requests with verify=False disabling SSL certificate checks, security issue.

443                     headers=headers,
444                     verify=False,
445                 )
446                 if r.status_code == 200:
447                     token = r.json()["token"]
448                     url_params = {"token": token}
449                     r = get(
450                         base_url + "/api/creds",

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/empire_exec.py line 62
Likely real: Yes, 98% confidence

Call to requests with verify=False disabling SSL certificate checks, security issue.

61                 data=empire_creds,
62                 verify=False,
63             )
64         except ConnectionError as e:
65             context.log.fail(f"Unable to login to Empire's RESTful API: {e}")
66             sys.exit(1)
67         context.log.debug(f"Response Code: {login_response.status_code}")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/winrm.py line 208
Likely real: Yes, 98% confidence

Call to requests with verify=False disabling SSL certificate checks, security issue.

207                 self.logger.debug(f"winrm create_conn_obj() - Requesting URL: {url}")
208                 res = requests.post(url, verify=False, timeout=self.args.http_timeout)
209                 self.logger.debug("winrm create_conn_obj() - Received response code:" f" {res.status_code}")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/empire_exec.py line 123
Likely real: Yes, 98% confidence

Call to requests with verify=False disabling SSL certificate checks, security issue.

122             headers=headers,
123             verify=False,
124         )
125         context.log.debug(f"Response Code: {download_response.status_code}")
126         # context.log.debug(f"Response Content: {download_response.text}")
127 
128         self.empire_launcher = download_response.text

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/ssh.py line 53
Likely real: Yes, 96% confidence

Paramiko call with policy set to automatically trust the unknown host key.

52         self.conn = paramiko.SSHClient()
53         self.conn.set_missing_host_key_policy(paramiko.AutoAddPolicy())
54

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/ftp.py line 46
Likely real: Yes, 85% confidence

FTP-related functions are being called. FTP is considered insecure. Use SSH/SFTP/SCP or some other encrypted protocol.

45     def create_conn_obj(self):
46         self.conn = FTP()
47         try:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/keepass_trigger.py line 392
Likely real: Yes, 85% confidence

The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the Python documentation recommends using `defusedxml`.

xml_tree = ElementTree.parse(xml_doc_path)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/ftp.py line 6
Likely real: Yes, 82% confidence

A FTP-related module is being imported. FTP is considered insecure. Use SSH/SFTP/SCP or some other encrypted protocol.

5 from cme.logger import CMEAdapter
6 from ftplib import FTP, error_reply, error_temp, error_perm, error_proto
7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/cmedb.py line 440
Likely real: Yes, 74% confidence

Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation.

r = post(
                    base_url + "/api/admin/login",
                    json=payload,
                    headers=headers,
                    verify=False,
                )

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/empire_exec.py line 59
Likely real: Yes, 74% confidence

Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation.

login_response = requests.post(
                f"{base_url}/token",
                data=empire_creds,
                verify=False,
            )

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/empire_exec.py line 96
Likely real: Yes, 74% confidence

Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation.

stager_response = requests.post(
                f"{base_url}/api/v2/stagers?save=False",
                json=data,
                headers=headers,
                verify=False,
            )

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/empire_exec.py line 120
Likely real: Yes, 74% confidence

Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation.

download_response = requests.get(
            f"{base_url}{download_uri}",
            headers=headers,
            verify=False,
        )

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/cmedb.py line 449
Likely real: Yes, 74% confidence

Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation.

r = get(
                        base_url + "/api/creds",
                        headers=headers,
                        params=url_params,
                        verify=False,
                    )

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/protocols/winrm.py line 208
Likely real: Yes, 73% confidence

Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation.

res = requests.post(url, verify=False, timeout=self.args.http_timeout)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/veeam_dump.py line 144
Likely real: Yes, 53% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

return connection.execute("powershell.exe -e {} -OutputFormat Text".format(psScipt_b64), True)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/veeam_dump.py line 136
Likely real: Yes, 53% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

return connection.execute("powershell.exe -e {} -OutputFormat Text".format(psScipt_b64), True)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/procdump.py line 77
Likely real: Yes, 53% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

p = connection.execute(command, True)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/handlekatz.py line 85
Likely real: Yes, 53% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

p = connection.execute(command, True)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/hash_spider.py line 88
Likely real: Yes, 53% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

cursor.execute(
                "UPDATE admin_users SET password = ? WHERE username LIKE '" + username + "%'",
                [password],
            )

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/hash_spider.py line 101
Likely real: Yes, 53% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

cursor.execute(
                "UPDATE admin_users SET hash = ? WHERE username LIKE '" + username + "%'",
                [nthash],
            )

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/hash_spider.py line 127
Likely real: Yes, 53% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

cursor.execute(
        "UPDATE admin_users SET password = ? WHERE username LIKE '" + username + "%'",
        [password],
    )

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/hash_spider.py line 131
Likely real: Yes, 53% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

cursor.execute(
        "UPDATE admin_users SET hash = ? WHERE username LIKE '" + username + "%'",
        [nthash],
    )

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/hash_spider.py line 197
Likely real: Yes, 53% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

cursor.execute(f"UPDATE admin_users SET hash = NULL WHERE username LIKE '{username}'")

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/hash_spider.py line 245
Likely real: Yes, 53% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

cursor.execute(f"SELECT * FROM pc_and_admins WHERE pc_name = '{pc[0]}' AND dumped NOT LIKE 'TRUE'")

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/hash_spider.py line 256
Likely real: Yes, 53% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

cursor.execute("UPDATE pc_and_admins SET dumped = 'TRUE' WHERE pc_name LIKE '" + pc[0] + "%'")

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/impersonate.py line 44
Likely real: Yes, 53% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

return connection.execute(command, True)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/impersonate.py line 87
Likely real: Yes, 53% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

for line in connection.execute(command, True, methods=["smbexec"]).splitlines():

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/keepass_discover.py line 66
Likely real: Yes, 53% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

search_keepass_files_output = connection.execute(search_keepass_files_cmd, True).split("\r\n")

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/msol.py line 49
Likely real: Yes, 53% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

return connection.execute(command, True)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/ntdsutil.py line 48
Likely real: Yes, 53% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

p = connection.execute(command, True)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/ntdsutil.py line 99
Likely real: Yes, 53% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

p = connection.execute(command, True)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/pi.py line 68
Likely real: Yes, 53% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

for line in connection.execute(command, True, methods=["smbexec"]).splitlines():

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/keepass_trigger.py line 163
Likely real: Yes, 52% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

connection.execute(add_trigger_script_cmd)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/keepass_trigger.py line 238
Likely real: Yes, 52% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

connection.execute(restart_keepass_script_cmd)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/keepass_trigger.py line 286
Likely real: Yes, 52% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

connection.execute(remove_export_command_str, True)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/keepass_trigger.py line 308
Likely real: Yes, 52% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

connection.execute(remove_export_command_str, True)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/keepass_trigger.py line 323
Likely real: Yes, 52% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

connection.execute(remove_trigger_script_command_str, True)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/keepass_trigger.py line 386
Likely real: Yes, 52% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

connection.execute(script_execute_cmd, True)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/keepass_trigger.py line 388
Likely real: Yes, 52% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

connection.execute(remove_remote_temp_script_cmd)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/nanodump.py line 145
Likely real: Yes, 52% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

p = self.connection.execute(command, display_output)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/nanodump.py line 196
Likely real: Yes, 52% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

self.connection.execute(f"del {self.tmp_dir + nano_log_name}")

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/nanodump.py line 269
Likely real: Yes, 52% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

self.connection.execute(f"del {self.tmp_dir + self.nano}")

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/teams_localdb.py line 46
Likely real: Yes, 52% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

c.execute("SELECT value FROM cookies WHERE name = '" + name + "'")

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/data/default.pem line 1
Likely real: Uncertain, 45% confidence

Private Key detected. This is a sensitive credential and should not be hardcoded here. Instead, store this in a separate, private file.

-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDLRxCDVVXmjcFW

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/helpers/powershell.py line 48
Likely real: Uncertain, 33% confidence

subprocess call with shell=True identified, security issue.

47         with open(os.devnull, "w") as devnull:
48             return_code = call(invoke_obfs_command, stdout=devnull, stderr=devnull, shell=True)
49

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Dockerfile line 22
Likely real: Probably noise, 22% confidence

By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.

ENTRYPOINT [ "cme" ]

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/protocols/ldap/laps.py line 216
Likely real: Yes, 100% confidence

Detected a python logger call with a potential hardcoded secret 'Cannot unpack msLAPS-EncryptedPassword blob due to error %s' % str(e) being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information.

logging.error('Cannot unpack msLAPS-EncryptedPassword blob due to error %s' % str(e))

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/protocols/smb.py line 356
Likely real: Yes, 100% confidence

Detected use of an insecure MD4 or MD5 hash function. These functions have known vulnerabilities and are considered deprecated. Consider using 'SHA256' or a similar function instead.

hash_ntlm = hashlib.new("md4", msMCSAdmPwd.encode("utf-16le")).digest()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/protocols/smb/firefox.py line 195
Likely real: Yes, 100% confidence

Detected DES cipher or Triple DES algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use a secure symmetric cipher from the cryptodome package instead. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.

cipher = DES3.new(key=key, mode=DES3.MODE_CBC, iv=iv)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/protocols/smb/firefox.py line 224
Likely real: Yes, 100% confidence

Detected DES cipher or Triple DES algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use a secure symmetric cipher from the cryptodome package instead. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.

cipher = DES3.new(key=key, mode=DES3.MODE_CBC, iv=iv)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/protocols/winrm.py line 179
Likely real: Yes, 100% confidence

Detected use of an insecure MD4 or MD5 hash function. These functions have known vulnerabilities and are considered deprecated. Consider using 'SHA256' or a similar function instead.

hash_ntlm = hashlib.new("md4", msMCSAdmPwd.encode("utf-16le")).digest()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/servers/http.py line 74
Likely real: Yes, 100% confidence

'ssl.wrap_socket()' is deprecated. This function creates an insecure socket without server name indication or hostname matching. Instead, create an SSL context using 'ssl.SSLContext()' and use that to wrap a socket.

self.server.socket = ssl.wrap_socket(self.server.socket, certfile=self.cert_path, server_side=True)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/ldap-checker.py line 93
Likely real: Yes, 100% confidence

'ssl.wrap_socket()' is deprecated. This function creates an insecure socket without server name indication or hostname matching. Instead, create an SSL context using 'ssl.SSLContext()' and use that to wrap a socket.

ssl_sock = ssl.wrap_socket(
                s,
                cert_reqs=ssl.CERT_OPTIONAL,
                suppress_ragged_eofs=False,
                do_handshake_on_connect=False,
            )

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/protocols/smb.py line 1712
Likely real: Yes, 99% confidence

Detected MD4 hash algorithm which is considered insecure. MD4 is not collision resistant and is therefore not suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.

ntlm_hash = MD4.new()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/protocols/ldap.py line 1372
Likely real: Yes, 99% confidence

Detected MD4 hash algorithm which is considered insecure. MD4 is not collision resistant and is therefore not suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.

ntlm_hash = MD4.new()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/protocols/ldap.py line 1289
Likely real: Yes, 99% confidence

Detected MD4 hash algorithm which is considered insecure. MD4 is not collision resistant and is therefore not suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.

ntlm_hash = MD4.new()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/smb.py line 1712
Likely real: Yes, 98% confidence

Use of insecure MD2, MD4, MD5, or SHA1 hash function.

1711                     currentPassword = blob["CurrentPassword"][:-2]
1712                     ntlm_hash = MD4.new()
1713                     ntlm_hash.update(currentPassword)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/ldap.py line 1372
Likely real: Yes, 98% confidence

Use of insecure MD2, MD4, MD5, or SHA1 hash function.

1371                 currentPassword = blob["CurrentPassword"][:-2]
1372                 ntlm_hash = MD4.new()
1373                 ntlm_hash.update(currentPassword)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/ldap.py line 1289
Likely real: Yes, 98% confidence

Use of insecure MD2, MD4, MD5, or SHA1 hash function.

1288                         currentPassword = blob["CurrentPassword"][:-2]
1289                         ntlm_hash = MD4.new()
1290                         ntlm_hash.update(currentPassword)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/ssh.py line 179
Likely real: Yes, 97% confidence

Possible shell injection via Paramiko call, check inputs are properly sanitized.

178             command = payload if payload is not None else self.args.execute
179             stdin, stdout, stderr = self.conn.exec_command(command)
180         except AttributeError:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/ssh.py line 146
Likely real: Yes, 97% confidence

Possible shell injection via Paramiko call, check inputs are properly sanitized.

145             else:
146                 stdin, stdout, stderr = self.conn.exec_command("id")
147                 output = stdout.read().decode("utf-8")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/ssh.py line 77
Likely real: Yes, 97% confidence

Possible shell injection via Paramiko call, check inputs are properly sanitized.

76             return True
77         stdin, stdout, stderr = self.conn.exec_command("sudo -ln | grep 'NOPASSWD: ALL'")
78         if stdout.read().decode("utf-8").find("NOPASSWD: ALL") != -1:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/ssh.py line 72
Likely real: Yes, 97% confidence

Possible shell injection via Paramiko call, check inputs are properly sanitized.

71         # but that might be too much of an opsec concern - maybe add in a flag to do more checks?
72         stdin, stdout, stderr = self.conn.exec_command("id")
73         if stdout.read().decode("utf-8").find("uid=0(root)") != -1:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/ssh.py line 46
Likely real: Yes, 97% confidence

Possible shell injection via Paramiko call, check inputs are properly sanitized.

45         if self.args.remote_enum:
46             stdin, stdout, stderr = self.conn.exec_command("uname -r")
47             self.server_os = stdout.read().decode("utf-8")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/keepass_trigger.py line 392
Likely real: Yes, 56% confidence

Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

391         xml_doc_path = os.path.abspath(self.local_export_path + "/" + self.export_name)
392         xml_tree = ElementTree.parse(xml_doc_path)
393         root = xml_tree.getroot()

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'oscrypto' has no version lock — supply chain risk

oscrypto = {'git': 'https://github.com/NeffIsBack/oscrypto'}

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'impacket' has no version lock — supply chain risk

impacket = {'git': 'https://github.com/mpgn/impacket.git', 'branch': 'gkdi'}

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/protocols/smb/firefox.py line 215
Likely real: Yes, 53% confidence

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

hp = sha1(global_salt + master_password).digest()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/protocols/smb/firefox.py line 217
Likely real: Yes, 53% confidence

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

chp = sha1(hp + entry_salt).digest()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/protocols/smb/firefox.py line 236
Likely real: Yes, 53% confidence

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

k = sha1(global_salt + master_password).digest()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/hash_spider.py line 197
Likely real: Yes, 52% confidence

Detected possible formatted SQL query. Use parameterized queries instead.

cursor.execute(f"UPDATE admin_users SET hash = NULL WHERE username LIKE '{username}'")

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/hash_spider.py line 245
Likely real: Yes, 52% confidence

Detected possible formatted SQL query. Use parameterized queries instead.

cursor.execute(f"SELECT * FROM pc_and_admins WHERE pc_name = '{pc[0]}' AND dumped NOT LIKE 'TRUE'")

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/keepass_trigger.py line 163
Likely real: Yes, 52% confidence

Detected possible formatted SQL query. Use parameterized queries instead.

connection.execute(add_trigger_script_cmd)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/keepass_trigger.py line 238
Likely real: Yes, 52% confidence

Detected possible formatted SQL query. Use parameterized queries instead.

connection.execute(restart_keepass_script_cmd)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/keepass_trigger.py line 388
Likely real: Yes, 52% confidence

Detected possible formatted SQL query. Use parameterized queries instead.

connection.execute(remove_remote_temp_script_cmd)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/crackmapexec.yml line 36
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/upload-artifact@master

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/crackmapexec.yml line 31
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/upload-artifact@master

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/crackmapexec.yml line 23
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/setup-python@v4

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/crackmapexec.yml line 21
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/checkout@v3

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/crackmapexec-test.yml line 22
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/setup-python@v4

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/crackmapexec-test.yml line 20
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/checkout@v3

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/keepass_trigger.py line 369
Likely real: Yes, 52% confidence

Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

368         try:
369             keepass_config_xml_root = ElementTree.fromstring(buffer.getvalue())
370         except Exception as e:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/gpp_password.py line 50
Likely real: Yes, 52% confidence

Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

49                     connection.conn.getFile("SYSVOL", path, buf.write)
50                     xml = ET.fromstring(buf.getvalue())
51                     sections = []

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/gpp_autologin.py line 37
Likely real: Yes, 52% confidence

Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

36                     connection.conn.getFile("SYSVOL", path, buf.write)
37                     xml = ET.fromstring(buf.getvalue())
38

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/nanodump.py line 196
Likely real: Yes, 52% confidence

Detected possible formatted SQL query. Use parameterized queries instead.

self.connection.execute(f"del {self.tmp_dir + nano_log_name}")

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/modules/nanodump.py line 269
Likely real: Yes, 52% confidence

Detected possible formatted SQL query. Use parameterized queries instead.

self.connection.execute(f"del {self.tmp_dir + self.nano}")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/smb/firefox.py line 215
Likely real: Uncertain, 49% confidence

Use of weak SHA1 hash for security. Consider usedforsecurity=False

214             # See http://www.drh-consultancy.demon.co.uk/key3.html
215             hp = sha1(global_salt + master_password).digest()
216             pes = entry_salt + "\x00".encode() * (20 - len(entry_salt))

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/smb/firefox.py line 217
Likely real: Uncertain, 49% confidence

Use of weak SHA1 hash for security. Consider usedforsecurity=False

216             pes = entry_salt + "\x00".encode() * (20 - len(entry_salt))
217             chp = sha1(hp + entry_salt).digest()
218             k1 = hmac.new(chp, pes + entry_salt, sha1).digest()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/smb/firefox.py line 236
Likely real: Uncertain, 49% confidence

Use of weak SHA1 hash for security. Consider usedforsecurity=False

235 
236             k = sha1(global_salt + master_password).digest()
237             key = pbkdf2_hmac("sha256", k, entry_salt, iteration_count, dklen=key_length)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/ssh.py line 154
Likely real: Uncertain, 46% confidence

Function call with shell=True parameter identified, possible security issue.

153 
154             self.db.add_loggedin_relation(cred_id, host_id, shell=shell_access)
155

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/teams_localdb.py line 46
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

45             c = conn.cursor()
46             c.execute("SELECT value FROM cookies WHERE name = '" + name + "'")
47             row = c.fetchone()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/hash_spider.py line 128
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

127     cursor.execute(
128         "UPDATE admin_users SET password = ? WHERE username LIKE '" + username + "%'",
129         [password],

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/hash_spider.py line 102
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

101             cursor.execute(
102                 "UPDATE admin_users SET hash = ? WHERE username LIKE '" + username + "%'",
103                 [nthash],

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/hash_spider.py line 89
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

88             cursor.execute(
89                 "UPDATE admin_users SET password = ? WHERE username LIKE '" + username + "%'",
90                 [password],

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/get_netconnections.py line 30
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

29         data = []
30         cards = connection.wmi(f"select DNSDomainSuffixSearchOrder, IPAddress from win32_networkadapterconfiguration")
31         if cards:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/enum_dns.py line 48
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

47             output = connection.wmi(
48                 f"Select TextRepresentation FROM MicrosoftDNS_ResourceRecord WHERE DomainName = {domain}",
49                 "root\\microsoftdns",

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/hash_spider.py line 132
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

131     cursor.execute(
132         "UPDATE admin_users SET hash = ? WHERE username LIKE '" + username + "%'",
133         [nthash],

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/hash_spider.py line 197
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

196             context.log.fail("Couldn't connect to remote host. Password likely expired/changed. Removing from DB.")
197             cursor.execute(f"UPDATE admin_users SET hash = NULL WHERE username LIKE '{username}'")
198             return False

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/hash_spider.py line 245
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

244                 if user[0] in pc[1]:
245                     cursor.execute(f"SELECT * FROM pc_and_admins WHERE pc_name = '{pc[0]}' AND dumped NOT LIKE 'TRUE'")
246                     more_to_dump = cursor.fetchall()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/mssql_priv.py line 185
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

184     def get_databases(self, exec_as="") -> list:
185         res = self.query_and_get_output(exec_as + "SELECT name FROM master..sysdatabases")
186         self.revert_context(exec_as)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/wmi/wmiexec_event.py line 164
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

163         eventFilter.CreatorSID =  [1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0]
164         eventFilter.Query = f'select * from __TimerEvent where TimerID = "{self.__instanceID}" '
165         eventFilter.QueryLanguage = 'WQL'

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/mssql/mssqlexec.py line 76
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

75         try:
76             self.mssql_conn.sql_query(f"SELECT * FROM OPENROWSET(BULK N'{remote}', SINGLE_BLOB) rs")
77             data = self.mssql_conn.rows[0]["BulkColumn"]

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/hash_spider.py line 256
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

255                             self.run_lsassy(context, connection, cursor)
256                             cursor.execute("UPDATE pc_and_admins SET dumped = 'TRUE' WHERE pc_name LIKE '" + pc[0] + "%'")
257

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/mssql_priv.py line 193
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

192     def is_dbowner(self, database, exec_as="") -> bool:
193         query = f"""select rp.name as database_role
194       from [{database}].sys.database_role_members drm
195       join [{database}].sys.database_principals rp
196         on (drm.role_principal_id = rp.principal_id)
197       join [{database}].sys.database_principals mp
198         on (drm.member_principal_id = mp.principal_id)
199       where rp.name = 'db_owner' and mp.name = SYSTEM_USER"""
200         self.context.log.debug(f"Query: {query}")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/ssh/db_navigator.py line 29
Likely real: Uncertain, 45% confidence

Function call with shell=True parameter identified, possible security issue.

28             total_users = self.db.get_loggedin_relations(cred_id=cred_id)
29             total_shell = total_users = self.db.get_loggedin_relations(cred_id=cred_id, shell=True)
30

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/protocols/smb/database.py line 946
Likely real: Uncertain, 45% confidence

Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.

new_row = dict(((column, context[column]) for column in ('name', 'description')))

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/protocols/smb/database.py line 960
Likely real: Uncertain, 45% confidence

Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.

new_row = dict(((column, context[column]) for column in ('host_id', 'check_id', 'secure', 'reasons')))

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/servers/smb.py line 16
Likely real: Uncertain, 37% confidence

Possible binding to all interfaces.

15         share_path="/tmp/cme_hosted",
16         listen_address="0.0.0.0",
17         listen_port=445,
18         verbose=False,
19     ):
20         try:
21             threading.Thread.__init__(self)
22             self.server = smbserver.SimpleSMBServer(listen_address, listen_port)
23             self.server.addShare(share_name.upper(), share_path)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/cli.py line 91
Likely real: Uncertain, 37% confidence

Possible binding to all interfaces.

90         type=str,
91         default="0.0.0.0",
92         metavar="HOST",

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/nanodump.py line 68
Likely real: Probably noise, 25% confidence

Probable insecure usage of temp file/directory.

67                 if not os.path.exists("/tmp/cme/"):
68                     os.mkdir("/tmp/cme/")
69                 self.nano_path = "/tmp/cme/"

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/impersonate.py line 49
Likely real: Probably noise, 25% confidence

Probable insecure usage of temp file/directory.

48         if self.useembeded:
49             file_to_upload = "/tmp/Impersonate.exe"
50             with open(file_to_upload, 'wb') as impersonate:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/keepass_trigger.py line 44
Likely real: Probably noise, 25% confidence

Probable insecure usage of temp file/directory.

43         self.keepass_binary_path = "C:\\Program Files\\KeePass Password Safe 2\\KeePass.exe"
44         self.local_export_path = "/tmp"
45         self.trigger_name = "export_database"

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/msol.py line 53
Likely real: Probably noise, 25% confidence

Probable insecure usage of temp file/directory.

52         if self.use_embedded:
53             file_to_upload = "/tmp/msol.ps1"
54             with open(file_to_upload, "w") as msol:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/nanodump.py line 67
Likely real: Probably noise, 25% confidence

Probable insecure usage of temp file/directory.

66             else:
67                 if not os.path.exists("/tmp/cme/"):
68                     os.mkdir("/tmp/cme/")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/teams_localdb.py line 23
Likely real: Probably noise, 25% confidence

Probable insecure usage of temp file/directory.

22         paths = connection.spider("C$", folder="Users", regex=["[a-zA-Z0-9]*"], depth=0)
23         with open("/tmp/teams_cookies2.txt", "wb") as f:
24             for path in paths:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/nanodump.py line 69
Likely real: Probably noise, 25% confidence

Probable insecure usage of temp file/directory.

68                     os.mkdir("/tmp/cme/")
69                 self.nano_path = "/tmp/cme/"
70

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/pi.py line 38
Likely real: Probably noise, 25% confidence

Probable insecure usage of temp file/directory.

37         if self.useembeded:
38             file_to_upload = "/tmp/pi.exe"
39             with open(file_to_upload, 'wb') as pm:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/procdump.py line 39
Likely real: Probably noise, 25% confidence

Probable insecure usage of temp file/directory.

38         self.procdump = "procdump.exe"
39         self.procdump_path = "/tmp/"
40         self.dir_result = self.procdump_path

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/scuffy.py line 50
Likely real: Probably noise, 25% confidence

Probable insecure usage of temp file/directory.

49         self.scf_name = module_options["NAME"]
50         self.scf_path = f"/tmp/{self.scf_name}.scf"
51         self.file_path = ntpath.join("\\", f"{self.scf_name}.scf")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/slinky.py line 51
Likely real: Probably noise, 25% confidence

Probable insecure usage of temp file/directory.

50         self.lnk_name = module_options["NAME"]
51         self.lnk_path = f"/tmp/{self.lnk_name}.lnk"
52         self.file_path = ntpath.join("\\", f"{self.lnk_name}.lnk")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/spider_plus.py line 533
Likely real: Probably noise, 25% confidence

Probable insecure usage of temp file/directory.

532         self.max_file_size = int(module_options.get("MAX_FILE_SIZE", 50 * 1024))
533         self.output_folder = module_options.get("OUTPUT_FOLDER", os.path.join("/tmp", "cme_spider_plus"))
534

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/smb/atexec.py line 190
Likely real: Probably noise, 25% confidence

Probable insecure usage of temp file/directory.

189                     try:
190                         with open(os.path.join("/tmp", "cme_hosted", tmpFileName), "r") as output:
191                             self.output_callback(output.read())

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/paths.py line 6
Likely real: Probably noise, 25% confidence

Probable insecure usage of temp file/directory.

5 CME_PATH = os.path.expanduser("~/.cme")
6 TMP_PATH = os.path.join("/tmp", "cme_hosted")
7 if os.name == "nt":

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/teams_localdb.py line 44
Likely real: Probably noise, 25% confidence

Probable insecure usage of temp file/directory.

43         try:
44             conn = sqlite3.connect("/tmp/teams_cookies2.txt")
45             c = conn.cursor()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/handlekatz.py line 37
Likely real: Probably noise, 25% confidence

Probable insecure usage of temp file/directory.

36         self.handlekatz = "handlekatz.exe"
37         self.handlekatz_path = "/tmp/"
38         self.dir_result = self.handlekatz_path

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/drop-sc.py line 48
Likely real: Probably noise, 25% confidence

Probable insecure usage of temp file/directory.

47         if not self.cleanup:
48             self.scfile_path = f"/tmp/{self.filename}.searchConnector-ms"
49             scfile = open(self.scfile_path, "w")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/smb/mmcexec.py line 237
Likely real: Probably noise, 25% confidence

Probable insecure usage of temp file/directory.

236             try:
237                 with open(path_join("/tmp", "cme_hosted", self.__output), "r") as output:
238                     self.output_callback(output.read())

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/servers/smb.py line 15
Likely real: Probably noise, 25% confidence

Probable insecure usage of temp file/directory.

14         share_name,
15         share_path="/tmp/cme_hosted",
16         listen_address="0.0.0.0",
17         listen_port=445,
18         verbose=False,
19     ):
20         try:
21             threading.Thread.__init__(self)
22             self.server = smbserver.SimpleSMBServer(listen_address, listen_port)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/smb/wmiexec.py line 150
Likely real: Probably noise, 25% confidence

Probable insecure usage of temp file/directory.

149             try:
150                 with open(os.path.join("/tmp", "cme_hosted", self.__output), "r") as output:
151                     self.output_callback(output.read())

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/smb/smbexec.py line 234
Likely real: Probably noise, 25% confidence

Probable insecure usage of temp file/directory.

233             try:
234                 with open(path_join("/tmp", "cme_hosted", self.__output), "rb") as output:
235                     self.output_callback(output.read())

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/smb/smbexec.py line 199
Likely real: Probably noise, 25% confidence

Probable insecure usage of temp file/directory.

198 
199         with open(path_join("/tmp", "cme_hosted", self.__batchFile), "w") as batch_file:
200             batch_file.write(command)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/smb/smbexec.py line 121
Likely real: Probably noise, 25% confidence

Probable insecure usage of temp file/directory.

120 
121         with open(path_join("/tmp", "cme_hosted", self.__batchFile), "w") as batch_file:
122             batch_file.write(command)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/empire_exec.py line 96
Likely real: Probably noise, 22% confidence

Call to requests without timeout

95         try:
96             stager_response = requests.post(
97                 f"{base_url}/api/v2/stagers?save=False",
98                 json=data,
99                 headers=headers,
100                 verify=False,
101             )
102         except ConnectionError:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/empire_exec.py line 120
Likely real: Probably noise, 22% confidence

Call to requests without timeout

119 
120         download_response = requests.get(
121             f"{base_url}{download_uri}",
122             headers=headers,
123             verify=False,
124         )
125         context.log.debug(f"Response Code: {download_response.status_code}")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/empire_exec.py line 59
Likely real: Probably noise, 22% confidence

Call to requests without timeout

58         try:
59             login_response = requests.post(
60                 f"{base_url}/token",
61                 data=empire_creds,
62                 verify=False,
63             )
64         except ConnectionError as e:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/cmedb.py line 449
Likely real: Probably noise, 22% confidence

Call to requests without timeout

448                     url_params = {"token": token}
449                     r = get(
450                         base_url + "/api/creds",
451                         headers=headers,
452                         params=url_params,
453                         verify=False,
454                     )
455                     creds = r.json()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/cmedb.py line 440
Likely real: Probably noise, 22% confidence

Call to requests without timeout

439             try:
440                 r = post(
441                     base_url + "/api/admin/login",
442                     json=payload,
443                     headers=headers,
444                     verify=False,
445                 )
446                 if r.status_code == 200:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /cme/protocols/ftp.py line 46
Likely real: Yes, 98% confidence

The 'FTP' class sends information unencrypted. Consider using the 'FTP_TLS' class instead.

self.conn = FTP()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/servers/http.py line 74
Likely real: Yes, 95% confidence

ssl.wrap_socket call with no SSL/TLS protocol version specified, the default SSLv23 could be insecure, possible security issue.

73             if server_type == "https":
74                 self.server.socket = ssl.wrap_socket(self.server.socket, certfile=self.cert_path, server_side=True)
75

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/ldap-checker.py line 93
Likely real: Yes, 95% confidence

ssl.wrap_socket call with no SSL/TLS protocol version specified, the default SSLv23 could be insecure, possible security issue.

92             s.settimeout(5)
93             ssl_sock = ssl.wrap_socket(
94                 s,
95                 cert_reqs=ssl.CERT_OPTIONAL,
96                 suppress_ragged_eofs=False,
97                 do_handshake_on_connect=False,
98             )
99             ssl_sock.connect((dcIp, 636))

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/bh_owned.py line 40
Likely real: Yes, 95% confidence

Possible hardcoded password: 'neo4j'

39         self.neo4j_user = "neo4j"
40         self.neo4j_pass = "neo4j"
41

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/smb/mmcexec.py line 75
Likely real: Yes, 95% confidence

Possible hardcoded password: 'C:\'

74         self.__shell = "c:\\windows\\system32\\cmd.exe"
75         self.__pwd = "C:\\"
76         self.__quit = None

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/smb/wmiexec.py line 46
Likely real: Yes, 95% confidence

Possible hardcoded password: 'C:\'

45         self.__shell = "cmd.exe /Q /c "
46         self.__pwd = "C:\\"
47         self.__aesKey = aesKey

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/keepass_trigger.py line 9
Likely real: Yes, 85% confidence

Using ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

8 from io import BytesIO, StringIO
9 from xml.etree import ElementTree
10 from cme.helpers.powershell import get_ps_script

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/rdp.py line 116
Likely real: Yes, 52% confidence

Possible hardcoded password: 'pass'

115         self.target = RDPTarget(ip=self.host, domain="FAKE", port=self.args.port, timeout=self.args.rdp_timeout)
116         self.auth = NTLMCredential(secret="pass", username="user", domain="FAKE", stype=asyauthSecret.PASS)
117

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/gpp_autologin.py line 4
Likely real: Yes, 51% confidence

Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

3 
4 import xml.etree.ElementTree as ET
5 from io import BytesIO

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/modules/gpp_password.py line 4
Likely real: Yes, 51% confidence

Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

3 
4 import xml.etree.ElementTree as ET
5 from Cryptodome.Cipher import AES

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /cme/protocols/ldap.py line 316
Likely real: Uncertain, 45% confidence