Skip to content

Commit f36d786

Browse files
smcintyre-r7smcintyre-r7
authored
Merge pull request rapid7#19696 from smashery/add_user_module
Add user module
2 parents 828725f + f05145d commit f36d786

File tree

9 files changed

+404
-346
lines changed

9 files changed

+404
-346
lines changed

‎docs/metasploit-framework.wiki/Metasploit-Guide-SMB.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -169,7 +169,7 @@ Local File System Commands
169169
This session also works with the following modules:
170170
171171
auxiliary/admin/dcerpc/icpr_cert
172-
auxiliary/admin/dcerpc/samr_computer
172+
auxiliary/admin/dcerpc/samr_account
173173
auxiliary/admin/smb/delete_file
174174
auxiliary/admin/smb/download_file
175175
auxiliary/admin/smb/psexec_ntdsgrab

‎documentation/modules/auxiliary/admin/dcerpc/samr_account.md‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
## Vulnerable Application
2+
Add, lookup and delete user / machine accounts via MS-SAMR. By default standard active directory users can add up to 10
3+
new computers to the domain (MachineAccountQuota). Administrative privileges however are required to delete the created
4+
accounts, or to create/delete user accounts.
5+
6+
## Verification Steps
7+
8+
1. From msfconsole
9+
2. Do: `use auxiliary/admin/dcerpc/samr_account`
10+
3. Set the `RHOSTS`, `SMBUser` and `SMBPass` options
11+
1. Set the `ACCOUNT_NAME` option for `DELETE_ACCOUNT` and `LOOKUP_ACCOUNT` actions
12+
4. Run the module and see that a new machine account was added
13+
14+
## Options
15+
16+
### SMBDomain
17+
18+
The Windows domain to use for authentication. The domain will automatically be identified if this option is left in its
19+
default value.
20+
21+
### ACCOUNT_NAME
22+
23+
The account name to add, lookup or delete. This option is optional for the `ADD_COMPUTER` action, and required for the
24+
`ADD_USER`, `LOOKUP_ACCOUNT` and `DELETE_ACCOUNT` actions. If left blank for `ADD_COMPUTER`, a random, realistic name
25+
will be generated.
26+
27+
### ACCOUNT_PASSWORD
28+
29+
The password for the new account. This option is only used for the `ADD_COMPUTER` and `ADD_USER` actions. If left
30+
blank, a random value will be generated.
31+
32+
## Actions
33+
34+
### ADD_COMPUTER
35+
36+
Add a new computer to the domain. This action will fail with status `STATUS_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED` if the
37+
user has exceeded the maximum number of computer accounts that they are allowed to create.
38+
39+
After the computer account is created, the password will be set for it. If `ACCOUNT_NAME` is set, that value will be
40+
used and the module will fail if the specified name is already in use. If `ACCOUNT_NAME` is *not* set, a random value
41+
will be used.
42+
43+
### ADD_USER
44+
45+
Add a new user to the domain. The account being used to create the new user must have permission to do so.
46+
47+
After the user account is created, the password will be set for it. The `ACCOUNT_NAME` option must be set to the name of
48+
the account to create. The module will fail if the specified name is already in use.
49+
50+
### DELETE_ACCOUNT
51+
52+
Delete a user or computer account from the domain. This action requires that the `ACCOUNT_NAME` option be set.
53+
54+
### LOOKUP_ACCOUNT
55+
56+
Lookup a user or computer account in the domain. This action verifies that the specified account exists, and looks up
57+
its security ID (SID), which includes the relative ID (RID) as the last component.
58+
59+
## Scenarios
60+
61+
### Windows Server 2019
62+
63+
First, a new computer account is created and its details are logged to the database.
64+
65+
```
66+
msf6 auxiliary(admin/dcerpc/samr_account) > set RHOSTS 192.168.159.96
67+
RHOSTS => 192.168.159.96
68+
msf6 auxiliary(admin/dcerpc/samr_account) > set SMBUser aliddle
69+
SMBUser => aliddle
70+
msf6 auxiliary(admin/dcerpc/samr_account) > set SMBPass Password1
71+
SMBPass => Password1
72+
msf6 auxiliary(admin/dcerpc/samr_account) > show options
73+
74+
Module options (auxiliary/admin/dcerpc/samr_account):
75+
76+
Name Current Setting Required Description
77+
---- --------------- -------- -----------
78+
ACCOUNT _NAME no The computer name
79+
ACCOUNT_PASSWORD no The password for the new computer
80+
RHOSTS 192.168.159.96 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
81+
RPORT 445 yes The target port (TCP)
82+
SMBDomain . no The Windows domain to use for authentication
83+
SMBPass Password1 no The password for the specified username
84+
SMBUser aliddle no The username to authenticate as
85+
86+
87+
Auxiliary action:
88+
89+
Name Description
90+
---- -----------
91+
ADD_COMPUTER Add a computer account
92+
93+
94+
msf6 auxiliary(admin/dcerpc/samr_account) > run
95+
[*] Running module against 192.168.159.96
96+
97+
[*] 192.168.159.96:445 - Using automatically identified domain: MSFLAB
98+
[+] 192.168.159.96:445 - Successfully created MSFLAB\DESKTOP-2X8F54QG$ with password MCoDkNALd3SdGR1GoLhqniEkWa8Me9FY
99+
[*] Auxiliary module execution completed
100+
msf6 auxiliary(admin/dcerpc/samr_account) > creds
101+
Credentials
102+
===========
103+
104+
host origin service public private realm private_type JtR Format
105+
---- ------ ------- ------ ------- ----- ------------ ----------
106+
192.168.159.96 192.168.159.96 445/tcp (smb) DESKTOP-2X8F54QG$ MCoDkNALd3SdGR1GoLhqniEkWa8Me9FY MSFLAB Password
107+
108+
msf6 auxiliary(admin/dcerpc/samr_account) >
109+
```

‎documentation/modules/auxiliary/admin/dcerpc/samr_computer.md‎

Lines changed: 0 additions & 100 deletions
This file was deleted.

‎documentation/modules/auxiliary/admin/ldap/rbcd.md‎

Lines changed: 33 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -62,14 +62,14 @@ PropagationFlags : None
6262

6363
## Module usage
6464

65-
The `admin/dcerpc/samr_computer` module is generally used to first create a computer account, which requires no permissions:
65+
The `admin/dcerpc/samr_account` module is generally used to first create a computer account, which by default, all user accounts in a domain can perform:
6666

6767
1. From msfconsole
68-
2. Do: `use auxiliary/admin/dcerpc/samr_computer`
68+
2. Do: `use auxiliary/admin/dcerpc/samr_account`
6969
3. Set the `RHOSTS`, `SMBUser` and `SMBPass` options
70-
a. For the `ADD_COMPUTER` action, if you don't specify `COMPUTER_NAME` or `COMPUTER_PASSWORD` - one will be generated automatically
71-
b. For the `DELETE_COMPUTER` action, set the `COMPUTER_NAME` option
72-
c. For the `LOOKUP_COMPUTER` action, set the `COMPUTER_NAME` option
70+
a. For the `ADD_COMPUTER` action, if you don't specify `ACCOUNT_NAME` or `ACCOUNT_PASSWORD` - one will be generated automatically
71+
b. For the `DELETE_ACCOUNT` action, set the `ACCOUNT_NAME` option
72+
c. For the `LOOKUP_ACCOUNT` action, set the `ACCOUNT_NAME` option
7373
4. Run the module and see that a new machine account was added
7474

7575
Then the `auxiliary/admin/ldap/rbcd` can be used:
@@ -121,19 +121,30 @@ with the Service for User (S4U) Kerberos extension.
121121
First create the computer account:
122122

123123
```msf
124-
msf6 auxiliary(admin/dcerpc/samr_computer) > show options
124+
msf6 auxiliary(admin/dcerpc/samr_account) > show options
125125
126-
Module options (auxiliary/admin/dcerpc/samr_computer):
126+
Name Current Setting Required Description
127+
---- --------------- -------- -----------
128+
ACCOUNT_NAME no The account name
129+
ACCOUNT_PASSWORD no The password for the new account
127130
128-
Name Current Setting Required Description
129-
---- --------------- -------- -----------
130-
COMPUTER_NAME no The computer name
131-
COMPUTER_PASSWORD no The password for the new computer
132-
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
133-
RPORT 445 yes The target port (TCP)
134-
SMBDomain . no The Windows domain to use for authentication
135-
SMBPass no The password for the specified username
136-
SMBUser no The username to authenticate as
131+
132+
Used when connecting via an existing SESSION:
133+
134+
Name Current Setting Required Description
135+
---- --------------- -------- -----------
136+
SESSION no The session to run this module on
137+
138+
139+
Used when making a new connection via RHOSTS:
140+
141+
Name Current Setting Required Description
142+
---- --------------- -------- -----------
143+
RHOSTS no The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
144+
RPORT 445 yes The target port (TCP)
145+
SMBDomain . no The Windows domain to use for authentication
146+
SMBPass no The password for the specified username
147+
SMBUser no The username to authenticate as
137148
138149
139150
Auxiliary action:
@@ -143,21 +154,21 @@ Auxiliary action:
143154
ADD_COMPUTER Add a computer account
144155
145156
146-
msf6 auxiliary(admin/dcerpc/samr_computer) > set RHOSTS 192.168.159.10
157+
msf6 auxiliary(admin/dcerpc/samr_account) > set RHOSTS 192.168.159.10
147158
RHOSTS => 192.168.159.10
148-
msf6 auxiliary(admin/dcerpc/samr_computer) > set SMBUser sandy
159+
msf6 auxiliary(admin/dcerpc/samr_account) > set SMBUser sandy
149160
SMBUser => sandy
150-
msf6 auxiliary(admin/dcerpc/samr_computer) > set SMBPass Password1!
161+
msf6 auxiliary(admin/dcerpc/samr_account) > set SMBPass Password1!
151162
SMBPass => Password1!
152-
msf6 auxiliary(admin/dcerpc/samr_computer) > run
163+
msf6 auxiliary(admin/dcerpc/samr_account) > run
153164
[*] Running module against 192.168.159.10
154165
155166
[*] 192.168.159.10:445 - Using automatically identified domain: MSFLAB
156167
[+] 192.168.159.10:445 - Successfully created MSFLAB\DESKTOP-QLSTR9NW$
157168
[+] 192.168.159.10:445 - Password: A2HPEkkQzdxQirylqIj7BxqwB7kuUMrT
158169
[+] 192.168.159.10:445 - SID: S-1-5-21-3402587289-1488798532-3618296993-1655
159170
[*] Auxiliary module execution completed
160-
msf6 auxiliary(admin/dcerpc/samr_computer) > use auxiliary/admin/ldap/rbcd
171+
msf6 auxiliary(admin/dcerpc/samr_account) > use auxiliary/admin/ldap/rbcd
161172
```
162173

163174
Now use the RBCD module to read the current value of `msDS-AllowedToActOnBehalfOfOtherIdentity`:
@@ -181,7 +192,7 @@ msf6 auxiliary(admin/ldap/rbcd) > read
181192
[*] Auxiliary module execution completed
182193
```
183194

184-
Writing a new `msDS-AllowedToActOnBehalfOfOtherIdentity` value using the computer account created by `admin/dcerpc/samr_computer`:
195+
Writing a new `msDS-AllowedToActOnBehalfOfOtherIdentity` value using the computer account created by `admin/dcerpc/samr_account`:
185196

186197
```msf
187198
msf6 auxiliary(admin/ldap/rbcd) > set DELEGATE_FROM DESKTOP-QLSTR9NW$

‎documentation/modules/auxiliary/scanner/smb/smb_login.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,7 @@ Local File System Commands
138138
This session also works with the following modules:
139139
140140
auxiliary/admin/dcerpc/icpr_cert
141-
auxiliary/admin/dcerpc/samr_computer
141+
auxiliary/admin/dcerpc/samr_account
142142
auxiliary/admin/smb/delete_file
143143
auxiliary/admin/smb/download_file
144144
auxiliary/admin/smb/psexec_ntdsgrab

0 commit comments

Comments
 (0)