Fix all kinds of security issues

[NeffIsBack]

Description

Based on #1243 but got too much so here is a proper description of what happened.

This handles all kinds of security issues:

• Sanitizing the source input on protocol level, focused on the input in enum_host_info() as first line of defense against poisoned data
• Sanitizing sinks where we e.g. write to file or download with a hostname in the file name. This should prevent path traversals as second line of defense
• Uses prepared statements in SQL stuff like accessing the neo4j database in bloodhound cause why not, better be safe
• Should prevent path traversals when downloading folders
• Adds an instruction to the AGENTS.md file so that future PRs hopefully respect sinks and sanitize file names

Codex with gpt 5.6-sol on ultra was used to fix the issues. Have manually reviewed (and fixed where AI was stupid) the code.

Type of change

Insert an "x" inside the brackets for relevant items (do not delete options)

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Deprecation of feature or functionality
• This change requires a documentation update
• This requires a third party update (such as Impacket, Dploot, lsassy, etc)
• This PR was created with the assistance of AI (list what type of assistance, tool(s)/model(s) in the description)

Setup guide for the review

TEST EVERYTHING

Screenshots (if appropriate):

Example of basic path operations still working:

Checklist:

Insert an "x" inside the brackets for completed and relevant items (do not delete options)

• I have ran Ruff against my changes (poetry: poetry run ruff check ., use --fix to automatically fix what it can)
• I have added or updated the tests/e2e_commands.txt file if necessary (new modules or features are required to be added to the e2e tests)
• If reliant on changes of third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
• I have linked relevant sources that describes the added technique (blog posts, documentation, etc)
• I have performed a self-review of my own code (not an AI review)
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)

[Marshall-Hallenbeck]

I didn't test it but the code looks good.

[NeffIsBack]

Ironically the LLM didn't find and patch the security issue in spider_plus yet. Gonna fix that tomorrow and double check that everything we know of has been caught.

[mpgn]

are we all sure about all split(".", 1)[1] ?

[NeffIsBack]

are we all sure about all split(".", 1)[1] ?

It's probably unnecessary since we are always taking the first element anyway (and I can revert it if you want), but I think it is supposed to prevent breaking the domain apart where it should remain one blob.

[mpgn]

One of the new tests in this PR currently fails: test_smb_hosts_file_sanitizes_at_sink_without_mutating_values.

The --generate-hosts-file sink in print_host_info() writes self.hostname / self.targetDomain directly, without sanitizing at the sink, so it relies entirely on source-level sanitization. The test feeds raw values and shows the newline injection is still possible at the sink — the single hosts line gets split into several:

$ uv run pytest "tests/test_sanitize.py::test_smb_hosts_file_sanitizes_at_sink_without_mutating_values" -vv

>       assert (tmp_path / "hosts").read_text().splitlines() == ["192.0.2.1     .._.._HOST_._evil__ .._.._HOST_"]
E       AssertionError: assert ['192.0.2.1     ../../HOST', '.[evil]', ' ../../HOST', ''] == ['192.0.2.1     .._.._HOST_._evil__ .._.._HOST_']
E         At index 0 diff: '192.0.2.1     ../../HOST' != '192.0.2.1     .._.._HOST_._evil__ .._.._HOST_'
E         Left contains 3 more items, first extra item: '.[evil]'
E         Full diff:
E         - ['192.0.2.1     .._.._HOST_._evil__ .._.._HOST_']
E         + ['192.0.2.1     ../../HOST', '.[evil]', ' ../../HOST', '']

FAILED tests/test_sanitize.py::test_smb_hosts_file_sanitizes_at_sink_without_mutating_values
1 failed in 1.10s

In the real flow the source is sanitized in enum_host_info(), so the generated hosts file is safe in practice — but the second (sink) layer of defense the PR advertises is missing for this specific sink (same applies to the --generate-krb5-file block, which writes self.domain raw). Sanitizing at the write site (e.g. sanitize_dns(self.hostname, ...) / sanitize_dns(self.targetDomain, ...) before building the line) would make this test pass and close the gap.

The other 73 tests in tests/test_sanitize.py pass, and ruff check is clean on the changed files.

(review by opus 4.8 ^^)

[NeffIsBack]

Yeah sol also really really wanted me to sanitize this part, but I refused so far because this is kind of the entire point of sanitizing the sources. The krb/host file sanitization added a LOT of really uggly code. I will recheck

[mpgn]

in this case this is just the test that fail, maybe remove it