Skip to content

Commit 825604d

Browse files
zeroSteinerzeroSteiner
committed
Add docs and a configurable password
1 parent 78f2ea3 commit 825604d

File tree

2 files changed

+118
-4
lines changed

2 files changed

+118
-4
lines changed

‎documentation/modules/auxiliary/admin/dcerpc/samr_computer.md‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
## Vulnerable Application
2+
Add, lookup and delete computer accounts via MS-SAMR. By default standard active directory users can add up to 10 new
3+
computers to the domain. Administrative privileges however are required to delete the created accounts.
4+
5+
## Verification Steps
6+
7+
1. From msfconsole
8+
2. Do: `use auxiliary/admin/dcerpc/samr_computer`
9+
3. Set the `RHOSTS`, `SMBUser` and `SMBPass` options
10+
1. Set the `COMPUTER_NAME` option for `DELETE_COMPUTER` and `LOOKUP_COMPUTER` actions
11+
4. Run the module and see that a new machine account was added
12+
13+
## Options
14+
15+
### SMBDomain
16+
17+
The Windows domain to use for authentication. If the target server has more than one domain present on it, this option
18+
must be set to the target domain. If the target server has only one domain present on it, the domain will automatically
19+
be identified.
20+
21+
### COMPUTER_NAME
22+
23+
The computer name to add, lookup or delete. This option is optional for the `ADD_COMPUTER` action, and required for the
24+
`LOOKUP_COMPUTER` and `DELETE_COMPUTER` actions.
25+
26+
### COMPUTER_PASSWORD
27+
28+
The password for the new computer. This option is only used for the `ADD_COMPUTER` action. If left blank, a random value
29+
will be generated.
30+
31+
## Actions
32+
33+
### ADD_COMPUTER
34+
35+
Add a new computer to the domain. This action will fail with status `STATUS_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED` if the
36+
user has exceeded the maximum number of computer accounts that they are allowed to create.
37+
38+
After the computer account is created, the password will be set for it. If `COMPUTER_NAME` is set, that value will be
39+
used and the module will fail if the selected name is already in use. If `COMPUTER_NAME` is *not* set, a random value
40+
will be used.
41+
42+
### DELETE_COMPUTER
43+
44+
Delete a computer from the domain. This action requires that the `COMPUTER_NAME` option be set.
45+
46+
### LOOKUP_COMPUTER
47+
48+
Lookup a computer in the domain. This action verifies that the specified computer exists, and looks up its security ID
49+
(SID), which includes the relative ID (RID) as the last component.
50+
51+
## Scenarios
52+
53+
### Windows Server 2019
54+
55+
First, a new computer account is created and its details are logged to the database.
56+
57+
```
58+
msf6 auxiliary(admin/dcerpc/samr_computer) > set RHOSTS 192.168.159.96
59+
RHOSTS => 192.168.159.96
60+
msf6 auxiliary(admin/dcerpc/samr_computer) > set SMBUser aliddle
61+
SMBUser => aliddle
62+
msf6 auxiliary(admin/dcerpc/samr_computer) > set SMBPass Password1
63+
SMBPass => Password1
64+
msf6 auxiliary(admin/dcerpc/samr_computer) > show options
65+
66+
Module options (auxiliary/admin/dcerpc/samr_computer):
67+
68+
Name Current Setting Required Description
69+
---- --------------- -------- -----------
70+
COMPUTER_NAME no The computer name
71+
RHOSTS 192.168.159.96 yes The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit
72+
RPORT 445 yes The target port (TCP)
73+
SMBDomain . no The Windows domain to use for authentication
74+
SMBPass Password1 no The password for the specified username
75+
SMBUser aliddle no The username to authenticate as
76+
77+
78+
Auxiliary action:
79+
80+
Name Description
81+
---- -----------
82+
ADD_COMPUTER Add a computer account
83+
84+
85+
msf6 auxiliary(admin/dcerpc/samr_computer) > run
86+
[*] Running module against 192.168.159.96
87+
88+
[*] 192.168.159.96:445 - Using automatically identified domain: MSFLAB
89+
[+] 192.168.159.96:445 - Successfully created MSFLAB\DESKTOP-2X8F54QG$ with password MCoDkNALd3SdGR1GoLhqniEkWa8Me9FY
90+
[*] Auxiliary module execution completed
91+
msf6 auxiliary(admin/dcerpc/samr_computer) > creds
92+
Credentials
93+
===========
94+
95+
host origin service public private realm private_type JtR Format
96+
---- ------ ------- ------ ------- ----- ------------ ----------
97+
192.168.159.96 192.168.159.96 445/tcp (smb) DESKTOP-2X8F54QG$ MCoDkNALd3SdGR1GoLhqniEkWa8Me9FY MSFLAB Password
98+
99+
msf6 auxiliary(admin/dcerpc/samr_computer) >
100+
```

‎modules/auxiliary/admin/dcerpc/samr_computer.rb‎

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,14 @@ def initialize(info = {})
1616
info,
1717
'Name' => 'SAMR Computer Management',
1818
'Description' => %q{
19+
Add, lookup and delete computer accounts via MS-SAMR. By default
20+
standard active directory users can add up to 10 new computers to the
21+
domain. Administrative privileges however are required to delete the
22+
created accounts.
1923
},
2024
'License' => MSF_LICENSE,
2125
'Author' => [
22-
'Alberto Solino', # Original Impacket code # todo: verify this author credit
26+
'JaGoTu', # @jagotu Original Impacket code
2327
'Spencer McIntyre',
2428
],
2529
'References' => [
@@ -41,6 +45,7 @@ def initialize(info = {})
4145

4246
register_options([
4347
OptString.new('COMPUTER_NAME', [ false, 'The computer name' ]),
48+
OptString.new('COMPUTER_PASSWORD', [ false, 'The password for the new computer' ], conditions: %w[ACTION == ADD_COMPUTER]),
4449
Opt::RPORT(445)
4550
])
4651
end
@@ -83,8 +88,13 @@ def run
8388
fail_with(Failure::Unreachable, "Unable to connect to the remote IPC$ share ([#{e.class}] #{e}).")
8489
end
8590

86-
@samr = connect_samr
87-
@server_handle = @samr.samr_connect
91+
begin
92+
@samr = connect_samr
93+
@server_handle = @samr.samr_connect
94+
rescue RubySMB::Dcerpc::Error::FaultError => e
95+
elog(e.message, error: e)
96+
fail_with(Failure::UnexpectedReply, "Connection failed (DCERPC fault: #{e.status_name})")
97+
end
8898

8999
if datastore['SMBDomain'].blank? || datastore['SMBDomain'] == '.'
90100
all_domains = @samr.samr_enumerate_domains_in_sam_server(server_handle: @server_handle).map(&:to_s).map(&:encode)
@@ -138,7 +148,11 @@ def action_add_computer
138148
)
139149

140150
user_handle = result[:user_handle]
141-
password = Rex::Text.rand_text_alphanumeric(32)
151+
if datastore['COMPUTER_PASSWORD'].blank?
152+
password = Rex::Text.rand_text_alphanumeric(32)
153+
else
154+
password = datastore['COMPUTER_PASSWORD']
155+
end
142156

143157
user_info = RubySMB::Dcerpc::Samr::SamprUserInfoBuffer.new(
144158
tag: RubySMB::Dcerpc::Samr::USER_INTERNAL4_INFORMATION_NEW,

0 commit comments

Comments
 (0)