[netexec] feat: add NetExec injector with contracts, helpers and tests (#170) by Seb-MIGUEL · Pull Request #188 · OpenAEV-Platform/injectors

Seb-MIGUEL · 2026-03-05T15:39:18Z

Summary

Add full NetExec injector supporting SMB, LDAP, WinRM, SSH, FTP, MSSQL, RDP, VNC, WMI protocols
Support for base commands, options (e.g. --asreproast, --kerberoasting, --shares) and modules (e.g. spider_plus, mssql_priv)
Structured output parsing with domain-specific finding types (credentials, usernames, shares, groups, vulnerabilities, etc.)
Catalog compatibility via manifest metadata
Unit tests for contracts, command builder, output parser and credential extractors

Test plan

Unit tests pass (contracts, helpers, credential extractors, output parser)
Manual testing against live GOAD lab (SMB, LDAP with various options)
Docker image builds and runs successfully
Injector registers correctly with OpenAEV platform
Structured findings are properly extracted and displayed

Closes #170

Add the netexec injector module including: - Protocol-based contracts (SMB, SSH, FTP, etc.) with module support - Command builder, output parser and process helpers - Credential extractors and modules registry - Docker and configuration setup - Updated root .gitignore to exclude local dev files

89 tests covering: - Contract ID parsing (base, option, module families) - Command builder (credentials, options, modules, security) - Output parser (filtering, dispatching, asset mapping) - Credential extractors (SAM, LSA, NTDS, shares, groups, vulns)

Add manifest-metadata.json and [tool.cmw] section required by the OpenAEV catalog to discover and deploy the injector via the UI. Also align pyproject.toml to PEP 621 format, standardize docker-compose.yml with variable substitution, and add .env.sample.

ncarenton · 2026-03-08T17:18:58Z

+    if input_data is not None:
+        kwargs["input"] = input_data
+
+    result = subprocess.run(cmd, **kwargs)


subprocess.run(cmd, **kwargs) has no timeout. If netexec hangs on a slow/unreachable target, the thread running this inject will never terminate. Should we add a configurable timeout here (e.g. timeout read from config, defaulting to 3600s) and handle subprocess.TimeoutExpired with a clean error, similar to what the AWS injector does in pacu_executor.py?

Hey @ncarenton good point, I didn't see neither on nuclei/Nmap nor Shodan don't you think we should define this kind of global injector good practices and applied them to the whole injectors and add it through something like "good_practices.md" to avoid that in the next injectors and the previous ones ?

ncarenton · 2026-03-08T17:26:51Z

+        options = parsed_data.get("options") if parsed_data else None
+        extra_args = parsed_data.get("extra_args") if parsed_data else None
+
+        self.helper.injector_logger.info("Data: " + str(content))


Two places might leak credentials:

line 90 logs the raw content dict which includes credentials

lines 100–113 pass command_args=cmd to build_execution_message,
and cmd contains ["-p", "P@ssw0rd!", "-H", "aad3b435..."], so credentials are sent to the OpenAEV API.

Should we scrub credential fields before logging, and strip args following -p, -H, --password etc. from cmd before passing it to build_execution_message?

Hey @ncarenton good point again, same feedback as the previous, that's a global "concern" to the whole injectors we could provide the "good practice" here and then apply on the others. About credentials we have planned on the roadmap "vertical 2" to add new kind of credentials assets which will involve integration team to define the best way to handle it

…t cleaned up

…sed.family

…reds extractors

…emented

Kakudou · 2026-03-18T21:20:47Z

The injector is well loaded:
Before start:

After Start:

The tests still green:

All the contracts:

Before we had a credentials leak, in both logs and output:

Now, we have redacted value (except for the final ouput of the command, i think we must keep this one):

But, still a point i'm not sure about, once an execution ended in success, as seen in this trace:

The UI still show, "Unknown Result" no "Execution" and no "terminal view".

The only output visible is the callback of the command in "Inject Execution Details"

Also, i haven't tested all the contracts, since i don't have a lab for.

Kakudou

I block my own contribution.
I'm not sure if its a desired behavior to only have output in "Inject Execution Details" or if i need to fix that point too.

@Seb-MIGUEL , @ncarenton

Edit: Also, a really important information:
This PR OpenAEV-Platform/client-python#192 is mandatory befor the actual one !
Since netexec use the new ContractOutputType like Credentials in contract_output,py`

Seb-MIGUEL · 2026-03-20T09:52:58Z

I block my own contribution. I'm not sure if its a desired behavior to only have output in "Inject Execution Details" or if i need to fix that point too.

@Seb-MIGUEL , @ncarenton

Edit: Also, a really important information: This PR OpenAEV-Platform/client-python#192 is mandatory befor the actual one ! Since netexec use the new ContractOutputType like Credentials in contract_output,py`

Hey so sorry I didn't seen the tagged !

It's normal for injector the traces are only available in Inject Execution Details and never on endpoints tab.

And other thing a PR on back/frontend side is mandatory too to add the contractoutputtype to pass through client-python to injector + a frontend item unlock: OpenAEV-Platform/openaev#5092

That's why I wanted to add a dedicated major release as it's a huge a lot of new content added through that injector with the whole workflow

Kakudou · 2026-03-23T08:22:56Z

And other thing a PR on back/frontend side is mandatory too to add the contractoutputtype to pass through client-python to injector + a frontend item unlock: OpenAEV-Platform/openaev#5092

That's why I wanted to add a dedicated major release as it's a huge a lot of new content added through that injector with the whole workflow

Thanks, will let it as "Request Changes" and 'Do Not Merge' until the required PR(s) are merged !

Seb-MIGUEL added 5 commits March 5, 2026 15:58

fix: always send execution_output_structured in callback

0ad35cb

fix: sort imports and remove unused imports

cbd5e75

Seb-MIGUEL linked an issue Mar 5, 2026 that may be closed by this pull request

Add Netexec Injector #170

Closed

Seb-MIGUEL changed the title ~~[netexec] feat: add NetExec injector with contracts, helpers and tests~~ [netexec] feat: add NetExec injector with contracts, helpers and tests (#170) Mar 5, 2026

ncarenton reviewed Mar 8, 2026

View reviewed changes

ncarenton requested a review from mariot March 8, 2026 20:03

Kakudou self-requested a review March 11, 2026 07:32

ncarenton added the do not merge Do not merge this PR until this tag will be removed label Mar 16, 2026

ncarenton changed the base branch from main to release/current March 17, 2026 08:17

Kakudou added 9 commits March 18, 2026 17:34

🙈 fix(security): redact credentials from log output and api callbacks

5dc6461

🔒 fix(security): add 300s timeout to subprocess.run

de7a9de

🥅 fix(file removal): if execute_netexec raised an error the file wasn…

a4f6ff7

…t cleaned up

👌 refactor(contract_family): use contract_family variable instead par…

b30d06d

…sed.family

🥅 fix(except catch): log full traceback for easier debugging later on

d9c509f

👌 refactor(dupe regex): deduplicate compiled regex patterns used in c…

27f4ac1

…reds extractors

👌 refactor(hinting): correct the type hint to accept also str as impl…

2090dec

…emented

👌 refactor(): remove what look like an old todo comment

aa6ba8b

👌 refacto(type_hinting):Remove the 'from typing'

1cd9cbe

Kakudou requested changes Mar 18, 2026

View reviewed changes

🚨 fix(isort, black): fix isort, black

839b465

Kakudou force-pushed the issue/170-add-netexec-injector branch from 2b8d454 to 839b465 Compare March 18, 2026 21:31

Kakudou self-assigned this Mar 18, 2026

🙈 fix(woops): Remove my breakpoint :D

80c2ec1

Kakudou added the filigran team use to identify PR from the Filigran team label Mar 23, 2026

savacano28 mentioned this pull request Mar 30, 2026

[backend/frontend] feat(netexec): add NetExec injector integration with 12 new finding types (#4989) OpenAEV-Platform/openaev#5092

Merged

4 tasks

ncarenton merged commit 6fdfc36 into release/current Apr 8, 2026
15 checks passed

ncarenton deleted the issue/170-add-netexec-injector branch April 8, 2026 07:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[netexec] feat: add NetExec injector with contracts, helpers and tests (#170)#188

[netexec] feat: add NetExec injector with contracts, helpers and tests (#170)#188
ncarenton merged 16 commits intorelease/currentfrom
issue/170-add-netexec-injector

Seb-MIGUEL commented Mar 5, 2026

Uh oh!

ncarenton Mar 8, 2026

Uh oh!

Seb-MIGUEL Mar 9, 2026 •

edited

Loading

Uh oh!

ncarenton Mar 8, 2026

Uh oh!

Seb-MIGUEL Mar 9, 2026

Uh oh!

Kakudou commented Mar 18, 2026

Uh oh!

Kakudou left a comment •

edited

Loading

Uh oh!

Seb-MIGUEL commented Mar 20, 2026 •

edited

Loading

Uh oh!

Kakudou commented Mar 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Seb-MIGUEL commented Mar 5, 2026

Summary

Test plan

Uh oh!

ncarenton Mar 8, 2026

Choose a reason for hiding this comment

Uh oh!

Seb-MIGUEL Mar 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ncarenton Mar 8, 2026

Choose a reason for hiding this comment

Uh oh!

Seb-MIGUEL Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Kakudou commented Mar 18, 2026

Uh oh!

Kakudou left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Seb-MIGUEL commented Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Kakudou commented Mar 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Seb-MIGUEL Mar 9, 2026 •

edited

Loading

Kakudou left a comment •

edited

Loading

Seb-MIGUEL commented Mar 20, 2026 •

edited

Loading