CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!
CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!
Path: blob/master/documentation/modules/auxiliary/scanner/smb/smb_enum_gpp.md
Views: 1904
Vulnerable Application
This module enumerates files from target domain controllers and connects to them via SMB. It then looks for Group Policy Preference XML files containing local/domain user accounts and passwords and decrypts them using Microsoft's public AES key. This module has been tested successfully on a Win2k8 R2 Domain Controller.
Test Environment
This vulnerability was patched in 2014 but Group Policy Preference files can still be found in modern environments. Because of that it is necessary to have a means to test this vulnerability in a contrived way.
Starting from a Windows Server that has been configured as an Active Directory Domain Controller:
Navigate to:
%SystemRoot%\SYSVOL\sysvol$domain\Policieswhere$domainis the name of the domain.Create a subfolder. These folders typically use UUIDs within braces (e.g.
{31B2F340-016D-11D2-945F-00C04FB984F9}) but the name does not matter for testing purposes.In the new a new file (and the necessary parent folders)
MACHINE\Preferences\Groups\Groups.xml.Place the contents below in the new
Groups.xmlfile.
This example XML data was taken from the unit test.
Verification Steps
Example steps in this format (is also in the PR):
Start msfconsole
Do:
use auxiliary/scanner/smb/smb_enum_gppDo:
set RHOSTS ...Do:
set SMBUser ...Do:
set SMBPass ...Do:
run
Windows Server 2019 (Test Setup)
The following example use the contrived setup from the "Test Environment" section.