@@ -49,15 +49,6 @@ def initialize(info = {})
4949 )
5050 end
5151
52- def connect_samr ( domain_name , target_user )
53- vprint_status ( 'Connecting to Security Account Manager (SAM) Remote Protocol' )
54- @samr = @tree . open_file ( filename : 'samr' , write : true , read : true )
55-
56- vprint_status ( 'Binding to \\samr...' )
57- @samr . bind ( endpoint : RubySMB ::Dcerpc ::Samr )
58- vprint_good ( 'Bound to \\samr' )
59- end
60-
6152 def connect_samr
6253 vprint_status ( 'Connecting to Security Account Manager (SAM) Remote Protocol' )
6354 @samr = @tree . open_file ( filename : 'samr' , write : true , read : true )
@@ -66,7 +57,7 @@ def connect_samr
6657 @samr . bind ( endpoint : RubySMB ::Dcerpc ::Samr )
6758 vprint_good ( 'Bound to \\samr' )
6859 end
69-
60+
7061 def run
7162 case action . name
7263 when 'CHANGE'
@@ -78,26 +69,25 @@ def run
7869 when 'CHANGE_NTLM'
7970 run_change_ntlm
8071 end
81-
82- rescue RubySMB ::Error ::RubySMBError => e
83- fail_with ( Module ::Failure ::UnexpectedReply , "[#{ e . class } ] #{ e } " )
84- rescue Rex ::ConnectionError => e
85- fail_with ( Module ::Failure ::Unreachable , "[#{ e . class } ] #{ e } " )
86- rescue Msf ::Exploit ::Remote ::MsSamr ::MsSamrError => e
87- fail_with ( Module ::Failure ::BadConfig , "[#{ e . class } ] #{ e } " )
88- rescue ::StandardError => e
89- raise e
90- ensure
91- @samr . close_handle ( @domain_handle ) if @domain_handle
92- @samr . close_handle ( @server_handle ) if @server_handle
93- @samr . close if @samr
94- @tree . disconnect! if @tree
95-
96- # Don't disconnect the client if it's coming from the session so it can be reused
97- unless session
98- simple . client . disconnect! if simple &.client . is_a? ( RubySMB ::Client )
99- disconnect
100- end
72+ rescue RubySMB ::Error ::RubySMBError => e
73+ fail_with ( Module ::Failure ::UnexpectedReply , "[#{ e . class } ] #{ e } " )
74+ rescue Rex ::ConnectionError => e
75+ fail_with ( Module ::Failure ::Unreachable , "[#{ e . class } ] #{ e } " )
76+ rescue Msf ::Exploit ::Remote ::MsSamr ::MsSamrError => e
77+ fail_with ( Module ::Failure ::BadConfig , "[#{ e . class } ] #{ e } " )
78+ rescue ::StandardError => e
79+ raise e
80+ ensure
81+ @samr . close_handle ( @domain_handle ) if @domain_handle
82+ @samr . close_handle ( @server_handle ) if @server_handle
83+ @samr . close if @samr
84+ @tree . disconnect! if @tree
85+
86+ # Don't disconnect the client if it's coming from the session so it can be reused
87+ unless session
88+ simple . client . disconnect! if simple &.client . is_a? ( RubySMB ::Client )
89+ disconnect
90+ end
10191 end
10292
10393 def authenticate ( anonymous_on_expired : false )
@@ -117,10 +107,10 @@ def authenticate(anonymous_on_expired: false)
117107 e . source . is_a? ( ::WindowsError ::ErrorCode ) && [ ::WindowsError ::NTStatus ::STATUS_PASSWORD_EXPIRED , ::WindowsError ::NTStatus ::STATUS_PASSWORD_MUST_CHANGE ] . include? ( e . source ) )
118108 # Password has expired - we'll need to anonymous connect
119109 opts = {
120- : username => '' ,
121- : password => '' ,
122- : domain => '' ,
123- : auth_protocol => Msf ::Exploit ::Remote ::AuthOption ::NTLM
110+ username : '' ,
111+ password : '' ,
112+ domain : '' ,
113+ auth_protocol : Msf ::Exploit ::Remote ::AuthOption ::NTLM
124114 }
125115 disconnect
126116 connect
@@ -129,7 +119,6 @@ def authenticate(anonymous_on_expired: false)
129119 raise
130120 end
131121 end
132-
133122 rescue Rex ::Proto ::SMB ::Exceptions ::Error , RubySMB ::Error ::RubySMBError => e
134123 fail_with ( Module ::Failure ::NoAccess , "Unable to authenticate ([#{ e . class } ] #{ e } )." )
135124 end
@@ -152,7 +141,6 @@ def authenticate(anonymous_on_expired: false)
152141 end
153142
154143 connect_samr
155-
156144 end
157145
158146 def parse_ntlm_from_config
@@ -168,8 +156,8 @@ def parse_ntlm_from_config
168156 fail_with ( Msf ::Exploit ::Failure ::BadConfig , 'Invalid value for NEW_NTLM' )
169157 end
170158
171- new_nt = Rex ::Text :: hex_to_raw ( new_nt )
172- new_lm = Rex ::Text :: hex_to_raw ( new_lm ) unless new_lm . nil?
159+ new_nt = Rex ::Text . hex_to_raw ( new_nt )
160+ new_lm = Rex ::Text . hex_to_raw ( new_lm ) unless new_lm . nil?
173161 fail_with ( Msf ::Exploit ::Failure ::BadConfig , 'Invalid NT hash value in NEW_NTLM' ) unless new_nt . length == 16
174162 fail_with ( Msf ::Exploit ::Failure ::BadConfig , 'Invalid LM hash value in NEW_NTLM' ) unless new_lm . nil? || new_nt . length == 16
175163
@@ -187,7 +175,7 @@ def get_user_handle(domain, username)
187175
188176 @samr . samr_open_user ( domain_handle : @domain_handle , user_id : rid )
189177 rescue RubySMB ::Dcerpc ::Error ::SamrError => e
190- fail_with ( Msf ::Exploit ::Failure ::BadConfig , " #{ e } " )
178+ fail_with ( Msf ::Exploit ::Failure ::BadConfig , e . to_s )
191179 end
192180
193181 def run_change_ntlm
@@ -201,17 +189,17 @@ def run_change_ntlm
201189 user_handle = get_user_handle ( datastore [ 'SMBDomain' ] , datastore [ 'SMBUser' ] )
202190
203191 @samr . samr_change_password_user ( user_handle : user_handle ,
204- old_password : datastore [ 'SMBPass' ] ,
205- new_nt_hash : new_nt ,
206- new_lm_hash : new_lm )
192+ old_password : datastore [ 'SMBPass' ] ,
193+ new_nt_hash : new_nt ,
194+ new_lm_hash : new_lm )
207195
208196 print_good ( "Successfully changed password for #{ datastore [ 'SMBUser' ] } " )
209- print_warning ( " AES Kerberos keys will not be available until user changes their password" )
197+ print_warning ( ' AES Kerberos keys will not be available until user changes their password' )
210198 end
211199
212200 def run_reset_ntlm
213201 fail_with ( Module ::Failure ::BadConfig , "Must set TARGET_USER, or use CHANGE/CHANGE_NTLM to reset this user's own password" ) if datastore [ 'TARGET_USER' ] . blank?
214- new_nt , new_lm = parse_ntlm_from_config
202+ new_nt , = parse_ntlm_from_config
215203 print_status ( 'Resetting NTLM' )
216204 authenticate ( anonymous_on_expired : false )
217205
@@ -233,7 +221,7 @@ def run_reset_ntlm
233221 )
234222
235223 print_good ( "Successfully reset password for #{ datastore [ 'TARGET_USER' ] } " )
236- print_warning ( " AES Kerberos keys will not be available until user changes their password" )
224+ print_warning ( ' AES Kerberos keys will not be available until user changes their password' )
237225 end
238226
239227 def run_reset
0 commit comments