Vulnerable Application

Add, lookup and delete user / machine accounts via MS-SAMR. By default standard active directory users can add up to 10 new computers to the domain (MachineAccountQuota). Administrative privileges however are required to delete the created accounts, or to create/delete user accounts.

Verification Steps

1. From msfconsole

2. Do: use auxiliary/admin/dcerpc/samr_account

3. Set the RHOSTS, SMBUser and SMBPass options

   1. Set the ACCOUNT_NAME option for DELETE_ACCOUNT and LOOKUP_ACCOUNT actions

4. Run the module and see that a new machine account was added

Options

SMBDomain

The Windows domain to use for authentication. The domain will automatically be identified if this option is left in its default value.

ACCOUNT_NAME

The account name to add, lookup or delete. This option is optional for the ADD_COMPUTER action, and required for the ADD_USER, LOOKUP_ACCOUNT and DELETE_ACCOUNT actions. If left blank for ADD_COMPUTER, a random, realistic name will be generated.

ACCOUNT_PASSWORD

The password for the new account. This option is only used for the ADD_COMPUTER and ADD_USER actions. If left blank, a random value will be generated.

Actions

ADD_COMPUTER

Add a new computer to the domain. This action will fail with status STATUS_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED if the user has exceeded the maximum number of computer accounts that they are allowed to create.

After the computer account is created, the password will be set for it. If ACCOUNT_NAME is set, that value will be used and the module will fail if the specified name is already in use. If ACCOUNT_NAME is not set, a random value will be used.

ADD_USER

Add a new user to the domain. The account being used to create the new user must have permission to do so.

After the user account is created, the password will be set for it. The ACCOUNT_NAME option must be set to the name of the account to create. The module will fail if the specified name is already in use.

DELETE_ACCOUNT

Delete a user or computer account from the domain. This action requires that the ACCOUNT_NAME option be set.

LOOKUP_ACCOUNT

Lookup a user or computer account in the domain. This action verifies that the specified account exists, and looks up its security ID (SID), which includes the relative ID (RID) as the last component.

Scenarios

Windows Server 2019

First, a new computer account is created and its details are logged to the database.

msf auxiliary(admin/dcerpc/samr_account) > set RHOSTS 192.168.159.96
RHOSTS => 192.168.159.96
msf auxiliary(admin/dcerpc/samr_account) > set SMBUser aliddle
SMBUser => aliddle
msf auxiliary(admin/dcerpc/samr_account) > set SMBPass Password1
SMBPass => Password1
msf auxiliary(admin/dcerpc/samr_account) > show options

Module options (auxiliary/admin/dcerpc/samr_account):

   Name              Current Setting  Required  Description
   ----              ---------------  --------  -----------
   ACCOUNT _NAME                      no        The computer name
   ACCOUNT_PASSWORD                   no        The password for the new computer
   RHOSTS            192.168.159.96   yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT             445              yes       The target port (TCP)
   SMBDomain         .                no        The Windows domain to use for authentication
   SMBPass           Password1        no        The password for the specified username
   SMBUser           aliddle          no        The username to authenticate as


Auxiliary action:

   Name          Description
   ----          -----------
   ADD_COMPUTER  Add a computer account


msf auxiliary(admin/dcerpc/samr_account) > run
[*] Running module against 192.168.159.96

[*] 192.168.159.96:445 - Using automatically identified domain: MSFLAB
[+] 192.168.159.96:445 - Successfully created MSFLAB\DESKTOP-2X8F54QG$ with password MCoDkNALd3SdGR1GoLhqniEkWa8Me9FY
[*] Auxiliary module execution completed
msf auxiliary(admin/dcerpc/samr_account) > creds
Credentials
===========

host            origin          service        public             private                           realm   private_type  JtR Format
----            ------          -------        ------             -------                           -----   ------------  ----------
192.168.159.96  192.168.159.96  445/tcp (smb)  DESKTOP-2X8F54QG$  MCoDkNALd3SdGR1GoLhqniEkWa8Me9FY  MSFLAB  Password

msf auxiliary(admin/dcerpc/samr_account) >