feat(smb): add first-pass scope inventory module

[CyberAuth]

Summary

• add a low-privilege SMB scope module for first-pass assessment setup
• export live SMB hosts, relay candidates, blank-authentication hosts, and a detailed CSV in one run
• reuse host information NetExec already collected without sending additional module requests
• serialize concurrent writes, deduplicate overlapping targets, and protect existing output unless OVERWRITE=true

Motivation

NetExec already exposes parts of this workflow through its host banner, --gen-relay-list, and persistent workspace database exports. A first-pass assessment still requires operators to combine those sources or parse terminal output, and blank-authentication results do not have a dedicated export.

This module creates a self-contained per-run snapshot for downstream tooling without rescanning targets. relay.txt is intentionally limited to hosts where SMB signing is not required and NTLM remains enabled, and is documented as a candidate list rather than proof that relay will succeed.

Usage

netexec smb scope.txt -M scope
netexec smb scope.txt -M scope -o OUTPUT=assessment
netexec smb scope.txt -M scope -o OUTPUT=assessment OVERWRITE=true

The module should be run without credentials so authentication failures cannot exclude reachable SMB hosts. Explicit blank credentials remain supported.

Default results are written to a timestamped directory under NXC_PATH/logs:

• hosts.txt: hosts that completed SMB negotiation
• relay.txt: NTLM-enabled hosts where SMB signing is not required
• null-auth.txt: hosts accepting blank SMB authentication
• scope.csv: hostname, domain, OS, SMBv1, signing, NTLM, null/guest authentication, and DC-detection fields

Validation

• ruff check .
• pytest -q tests/test_scope_module.py — 7 passed
• pytest -q --ignore=tests/test_smb_signing.py — 47 passed
• netexec smb -M scope --options
• netexec smb -L lists scope as a low-privilege SMB module

The five tests in tests/test_smb_signing.py currently fail unchanged on the base revision because they pass a smbv1 keyword to _is_signing_required(), whose current signature does not accept it. This change does not modify that method or those tests.

[github-actions]

It looks like the PR template may not have been filled out. The following sections appear to be missing:

• Description

• Type of change

• Setup guide for the review

• Checklist

Please edit your PR description to include them. The template helps reviewers understand and test your changes. Thanks!