Timeroast module

[Disgame]

Description

I want to add the timeroast attack based on the research from SecuraBV as a module for NXC. This attack operates without requiring authentication and exploits the Microsoft NTP protocol to request password hashes for any computer or trust account from a Domain Controller/NTP Server.
These can be cracked offline with hashcat beta (-m 31300) https://hashcat.net/beta/ + hashcat/hashcat#3629
or the timercrack.py provided by SecuraBV https://github.com/SecuraBV/Timeroast/blob/main/extra-scripts/timecrack.py

More information: https://www.secura.com/uploads/whitepapers/Secura-WP-Timeroasting-v3.pdf

Current problem is that the protocol “NTP” is missing as an option in NXC or an alternative to use it without a protocol? Therefore it uses smb

Type of change

• New feature (non-breaking change which adds functionality)

How Has This Been Tested?

Tested it in my Active Directory Lab with a Kali 2024.1 as Client and Windows Server 2022 as DC
Client with python3.11.8

Add the computer account with e.g.:
impacket-addcomputer domain/user:pw -computer-name "timeroast" -computer-pass "timeroast" -dc-ip ip
or
GUI, Computers -> New -> Computer -> name -> "timeroast" -> Click "Assign this computer account as a pre-Windows 2000 computer" -> OK (password will be the first 14 characters of your computer name without the $)

poetry run nxc smb ip -M timeroast

Screenshots (if appropriate):

Checklist:

• I have ran Ruff against my changes (via poetry: poetry run python -m ruff check . --preview, use --fix to automatically fix what it can)
• I have added or updated the tests/e2e_commands.txt file if necessary
• New and existing e2e tests pass locally with my changes
• My code follows the style guidelines of this project (should be covered by Ruff above)
• If reliant on third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)

[Marshall-Hallenbeck]

I'm working with @Disgame on this, we'll convert it to a full PR when it's ready