@@ -92,44 +92,50 @@ def run
92
92
# Get a list of windows users, groups, and computer accounts using SUSER_NAME()
93
93
print_status ( "Brute forcing #{ datastore [ 'FuzzNum' ] } RIDs through the SQL Server, be patient..." )
94
94
win_domain_user_list = get_win_domain_users ( windows_domain_sid )
95
+
96
+ disconnect
97
+
95
98
if win_domain_user_list . nil? || win_domain_user_list . empty?
96
99
print_error ( 'Sorry, no Windows domain accounts were found, or DC could not be contacted.' )
97
- disconnect
98
100
return
99
- else
100
-
101
- # Print number of objects found and write to a file
102
- print_good ( "#{ win_domain_user_list . length } user accounts, groups, and computer accounts were found." )
101
+ end
103
102
104
- win_domain_user_list . sort . each do |windows_login |
105
- vprint_status ( " - #{ windows_login } " )
106
- end
103
+ # Print number of objects found and write to a file
104
+ print_good ( "#{ win_domain_user_list . length } user accounts, groups, and computer accounts were found." )
107
105
108
- # Create table for report
109
- windows_domain_login_table = Rex ::Ui ::Text ::Table . new (
110
- 'Header' => 'Windows Domain Accounts' ,
111
- 'Ident' => 1 ,
112
- 'Columns' => [ 'name' ]
113
- )
106
+ win_domain_user_list . sort . each do |windows_login |
107
+ vprint_status ( " - #{ windows_login } " )
108
+ end
114
109
115
- # Add brute forced names to table
116
- win_domain_user_list . each do |object_name |
117
- windows_domain_login_table << [ object_name ]
118
- end
110
+ # Create table for report
111
+ windows_domain_login_table = Rex ::Ui ::Text ::Table . new (
112
+ 'Header' => 'Windows Domain Accounts' ,
113
+ 'Ident' => 1 ,
114
+ 'Columns' => [ 'name' ]
115
+ )
119
116
120
- # Create output file
121
- this_service = report_service (
122
- :host => rhost ,
123
- :port => rport ,
124
- :name => 'mssql' ,
125
- :proto => 'tcp'
126
- )
127
- filename = "#{ datastore [ 'RHOST' ] } -#{ datastore [ 'RPORT' ] } _windows_domain_accounts.csv"
128
- path = store_loot ( "windows_domain_accounts" , "text/plain" , datastore [ 'RHOST' ] , windows_domain_login_table . to_csv , filename , "SQL Server query results" , this_service )
129
- print_status ( "Query results have been saved to: #{ path } " )
117
+ # Add brute forced names to table
118
+ win_domain_user_list . each do |object_name |
119
+ windows_domain_login_table << [ object_name ]
130
120
end
131
121
132
- disconnect
122
+ # Create output file
123
+ this_service = report_service (
124
+ :host => rhost ,
125
+ :port => rport ,
126
+ :name => 'mssql' ,
127
+ :proto => 'tcp'
128
+ )
129
+ file_name = "#{ datastore [ 'RHOST' ] } -#{ datastore [ 'RPORT' ] } _windows_domain_accounts.csv"
130
+ path = store_loot (
131
+ 'mssql.domain.accounts' ,
132
+ 'text/plain' ,
133
+ datastore [ 'RHOST' ] ,
134
+ windows_domain_login_table . to_csv ,
135
+ file_name ,
136
+ 'Domain Users enumerated through SQL Server' ,
137
+ this_service )
138
+ print_status ( "Query results have been saved to: #{ path } " )
133
139
end
134
140
135
141
# Checks if user is a sysadmin
0 commit comments