@@ -71,7 +71,7 @@ def initialize
71
71
register_advanced_options (
72
72
[
73
73
OptString . new ( 'AD_DOMAIN' , [ false , "Optional AD domain to prepend to usernames" , '' ] ) ,
74
- OptBool . new ( 'ENUM_DOMAIN' , [ true , "Automatically enumerate AD domain using NTLM authentication" , true ] ) ,
74
+ OptBool . new ( 'ENUM_DOMAIN' , [ true , "Automatically enumerate AD domain using NTLM authentication" , false ] ) ,
75
75
OptBool . new ( 'SSL' , [ true , "Negotiate SSL for outgoing connections" , true ] )
76
76
] , self . class )
77
77
@@ -118,14 +118,14 @@ def run
118
118
119
119
domain = nil
120
120
121
- if datastore [ 'AD_DOMAIN' ] . nil? or datastore [ 'AD_DOMAIN' ] == ''
122
- if datastore [ 'ENUM_DOMAIN' ]
123
- domain = get_ad_domain
124
- end
125
- else
121
+ if datastore [ 'AD_DOMAIN' ] and not datastore [ 'AD_DOMAIN' ] . empty?
126
122
domain = datastore [ 'AD_DOMAIN' ]
127
123
end
128
124
125
+ if ( ( datastore [ 'AD_DOMAIN' ] . nil? or datastore [ 'AD_DOMAIN' ] == '' ) and datastore [ 'ENUM_DOMAIN' ] )
126
+ domain = get_ad_domain
127
+ end
128
+
129
129
begin
130
130
each_user_pass do |user , pass |
131
131
vprint_status ( "#{ msg } Trying #{ user } : #{ pass } " )
@@ -164,7 +164,7 @@ def try_user_pass(opts)
164
164
'method' => 'POST' ,
165
165
'headers' => headers ,
166
166
'data' => data
167
- } , 25 )
167
+ } )
168
168
169
169
rescue ::Rex ::ConnectionError , Errno ::ECONNREFUSED , Errno ::ETIMEDOUT
170
170
print_error ( "#{ msg } HTTP Connection Failed, Aborting" )
@@ -240,31 +240,30 @@ def get_ad_domain
240
240
241
241
domain = nil
242
242
243
- begin
244
- urls . each do | url |
243
+ urls . each do | url |
244
+ begin
245
245
res = send_request_cgi ( {
246
246
'encode' => true ,
247
247
'uri' => "/#{ url } " ,
248
248
'method' => 'GET' ,
249
249
'headers' => { "Authorization" => "NTLM TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw==" }
250
250
} )
251
+ rescue ::Rex ::ConnectionError , Errno ::ECONNREFUSED , Errno ::ETIMEDOUT
252
+ vprint_error ( "#{ msg } HTTP Connection Failed" )
253
+ next
254
+ end
251
255
252
- if not res
253
- print_error ( "#{ msg } HTTP Connection Error, Aborting" )
254
- return nil
255
- end
256
-
257
- if res and res . code == 401 and res [ 'WWW-Authenticate' ] . match ( /^NTLM/i )
258
- hash = res [ 'WWW-Authenticate' ] . split ( 'NTLM ' ) [ 1 ]
259
- domain = Rex ::Proto ::NTLM ::Message . parse ( Rex ::Text . decode_base64 ( hash ) ) [ :target_name ] . value ( ) . gsub ( /\0 / , '' )
260
- print_good ( "Found target domain: " + domain )
261
- return domain
262
- end
256
+ if not res
257
+ vprint_error ( "#{ msg } HTTP Connection Timeout" )
258
+ next
263
259
end
264
260
265
- rescue ::Rex ::ConnectionError , Errno ::ECONNREFUSED , Errno ::ETIMEDOUT
266
- print_error ( "#{ msg } HTTP Connection Failed, Aborting" )
267
- return nil
261
+ if res and res . code == 401 and res [ 'WWW-Authenticate' ] . match ( /^NTLM/i )
262
+ hash = res [ 'WWW-Authenticate' ] . split ( 'NTLM ' ) [ 1 ]
263
+ domain = Rex ::Proto ::NTLM ::Message . parse ( Rex ::Text . decode_base64 ( hash ) ) [ :target_name ] . value ( ) . gsub ( /\0 / , '' )
264
+ print_good ( "Found target domain: " + domain )
265
+ return domain
266
+ end
268
267
end
269
268
270
269
return domain
0 commit comments