|
8 | 8 |
|
9 | 9 | class Metasploit3 < Msf::Post
|
10 | 10 |
|
11 |
| -include Msf::Auxiliary::Report |
12 |
| -include Msf::Post::Windows::LDAP |
13 |
| - |
14 |
| -def initialize(info={}) |
15 |
| - super( update_info( info, |
16 |
| - 'Name' => 'Windows Gather Words from Active Directory', |
17 |
| - 'Description'=> %Q{ |
18 |
| - This module will enumerate all user accounts in the default Active Domain (AD) directory and use |
19 |
| - these as words to seed a wordlist.In cases (like description) where spaces may occur, some extra processing |
20 |
| - is done to generate multiple words in addition to one long one (up to 24 characters).Results are dumped into |
21 |
| - /tmp |
| 11 | + include Msf::Auxiliary::Report |
| 12 | + include Msf::Post::Windows::LDAP |
| 13 | + |
| 14 | + def initialize(info={}) |
| 15 | + super( update_info( info, |
| 16 | + 'Name' => 'Windows Gather Words from Active Directory', |
| 17 | + 'Description' => %Q{ |
| 18 | + This module will enumerate all user accounts in the default Active Domain (AD) directory and use |
| 19 | + these as words to seed a wordlist.In cases (like description) where spaces may occur, some extra processing |
| 20 | + is done to generate multiple words in addition to one long one (up to 24 characters).Results are dumped into |
| 21 | + /tmp |
22 | 22 | },
|
23 |
| - 'License' => MSF_LICENSE, |
24 |
| - 'Author' => [ 'Thomas Ring' ], |
25 |
| - 'Platform' => [ 'win' ], |
| 23 | + 'License' => MSF_LICENSE, |
| 24 | + 'Author' => [ 'Thomas Ring' ], |
| 25 | + 'Platform' => [ 'win' ], |
26 | 26 | 'SessionTypes' => [ 'meterpreter' ],
|
27 |
| - )) |
| 27 | + )) |
28 | 28 |
|
29 |
| - register_options([ |
| 29 | + register_options([ |
30 | 30 | OptString.new('FIELDS', [false, 'Fields to retrieve (ie, sn, givenName, displayName, description, comment)', '']),
|
31 | 31 | ], self.class)
|
32 |
| -end |
| 32 | + end |
33 | 33 |
|
34 |
| -def run |
| 34 | + def run |
35 | 35 |
|
36 |
| - fields = [] |
37 |
| - if(datastore['FIELDS'] == '') |
| 36 | + fields = [] |
| 37 | + if(datastore['FIELDS'] == '') |
38 | 38 | field_str = 'sn,givenName,state,postalCode,physicalDeliveryOfficeName,telephoneNumber,mobile,facsimileTelephoneNumber,displayName,'
|
39 | 39 | field_str << 'title,department,company, streetAddress,sAMAccountName,userAccountControl,comment,description'
|
40 | 40 | fields = field_str.gsub!(/\s+/,'').split(',')
|
41 |
| - else |
| 41 | + else |
42 | 42 | fields = datastore['FIELDS'].gsub(/\s+/,"").split(',')
|
43 |
| - end |
44 |
| - search_filter = '(&(objectClass=organizationalPerson)(objectClass=user)(objectClass=person)(!(objectClass=computer)))' |
45 |
| - max_search = datastore['MAX_SEARCH'] |
46 |
| - begin |
| 43 | + end |
| 44 | + |
| 45 | + search_filter = '(&(objectClass=organizationalPerson)(objectClass=user)(objectClass=person)(!(objectClass=computer)))' |
| 46 | + max_search = datastore['MAX_SEARCH'] |
| 47 | + |
| 48 | + begin |
47 | 49 | q = query(search_filter, max_search, fields)
|
48 | 50 | return if !q or q[:results].empty?
|
49 |
| - |
50 |
| - rescue ::RuntimeError, ::Rex::Post::Meterpreter::RequestError => e |
| 51 | + rescue ::RuntimeError, ::Rex::Post::Meterpreter::RequestError => e |
51 | 52 | # Can't bind or in a network w/ limited accounts
|
52 | 53 | print_error(e.message)
|
53 | 54 | return
|
54 |
| - end |
| 55 | + end |
55 | 56 |
|
56 |
| - wordlist = Hash.new(0) |
57 |
| - q[:results].each do |result| |
| 57 | + wordlist = Hash.new(0) |
| 58 | + q[:results].each do |result| |
58 | 59 | result.each do |field|
|
59 |
| - next unless field.present? |
60 |
| - next if field =~ /^\s*$/ or field == '-' or field == '' or field.length < 3 |
61 |
| - |
62 |
| - field.gsub!(/[\(\)\"]/, '') # clear up common punctuation in descriptions |
63 |
| - field.downcase! # clear up case |
64 |
| - |
65 |
| - tmp = [] |
66 |
| - parts = field.split(/\s+/) |
67 |
| - tmp = tmp + parts + [ parts.join ] unless parts.empty? |
68 |
| - parts = field.split('-') |
69 |
| - tmp = tmp + parts + [ parts.join ] unless parts.empty? |
70 |
| - parts = field.split(',') |
71 |
| - tmp = tmp + parts + [ parts.join ] unless parts.empty? |
72 |
| - parts = field.split('+') |
73 |
| - tmp = tmp + parts + [ parts.join ] unless parts.empty? |
74 |
| - |
75 |
| - # add the entire field if its not too long |
76 |
| - wordlist[field] += 1 if field.length < 24 |
77 |
| - |
78 |
| - if tmp.length > 0 |
79 |
| - tmp = tmp.flatten |
80 |
| - tmp.each do |r| |
81 |
| - next if r.length < 3 or r.length > 24 |
82 |
| - # sub fields can still have unwanted characters due to not chained if (ie, it has dashes and commas) |
83 |
| - r.gsub!(/[\s\,\-\+]/, '') |
84 |
| - wordlist[r] += 1 if r.length < 24 |
85 |
| - end |
86 |
| - end |
| 60 | + next unless field.present? |
| 61 | + next if field =~ /^\s*$/ or field == '-' or field == '' or field.length < 3 |
| 62 | + |
| 63 | + field.gsub!(/[\(\)\"]/, '') # clear up common punctuation in descriptions |
| 64 | + field.downcase! # clear up case |
| 65 | + |
| 66 | + tmp = [] |
| 67 | + parts = field.split(/\s+/) |
| 68 | + tmp = tmp + parts + [ parts.join ] unless parts.empty? |
| 69 | + parts = field.split('-') |
| 70 | + tmp = tmp + parts + [ parts.join ] unless parts.empty? |
| 71 | + parts = field.split(',') |
| 72 | + tmp = tmp + parts + [ parts.join ] unless parts.empty? |
| 73 | + parts = field.split('+') |
| 74 | + tmp = tmp + parts + [ parts.join ] unless parts.empty? |
| 75 | + |
| 76 | + # add the entire field if its not too long |
| 77 | + wordlist[field] += 1 if field.length < 24 |
| 78 | + |
| 79 | + if tmp.length > 0 |
| 80 | + tmp = tmp.flatten |
| 81 | + tmp.each do |r| |
| 82 | + next if r.length < 3 or r.length > 24 |
| 83 | + # sub fields can still have unwanted characters due to not chained if (ie, it has dashes and commas) |
| 84 | + r.gsub!(/[\s\,\-\+]/, '') |
| 85 | + wordlist[r] += 1 if r.length < 24 |
| 86 | + end |
| 87 | + end |
87 | 88 | end # result.each
|
88 |
| - end # q.each |
| 89 | + end # q.each |
89 | 90 |
|
90 |
| - # build array of words to output sorted on frequency |
91 |
| - out = Array.new() |
92 |
| - s = wordlist.sort_by &:last |
93 |
| - s.each do |k, v| |
| 91 | + # build array of words to output sorted on frequency |
| 92 | + out = Array.new() |
| 93 | + s = wordlist.sort_by &:last |
| 94 | + s.each do |k, v| |
94 | 95 | if(k.length > 3)
|
95 |
| - out.push(k) |
96 |
| -# print_status("#{k} ==> #{v}") |
| 96 | + out.push(k) |
| 97 | + # print_status("#{k} ==> #{v}") |
97 | 98 | end
|
98 |
| - end |
99 |
| - wordlist_file = Rex::Quickfile.new("wordlist") |
100 |
| - wordlist_file.write( out.flatten.uniq.join("\n") + "\n" ) |
101 |
| - print_status("Seeded the password database with #{out.length} words into #{wordlist_file.path}...") |
102 |
| - wordlist_file.close |
| 99 | + end |
| 100 | + wordlist_file = Rex::Quickfile.new("wordlist") |
| 101 | + wordlist_file.write( out.flatten.uniq.join("\n") + "\n" ) |
| 102 | + print_status("Seeded the password database with #{out.length} words into #{wordlist_file.path}...") |
| 103 | + wordlist_file.close |
103 | 104 |
|
104 |
| - end |
| 105 | + end |
105 | 106 | end
|
106 | 107 |
|
0 commit comments