Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place. Commercial Alternative to JupyterHub.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
require 'ruby_smb/dcerpc/client'
7

8
class MetasploitModule < Msf::Auxiliary
9
  include Msf::Exploit::Remote::SMB::Client::Authenticated
10
  include Msf::Exploit::Remote::DCERPC
11
  include Msf::Auxiliary::Report
12
  include Msf::Exploit::Remote::MsSamr::Account
13
  include Msf::OptionalSession::SMB
14
  include Msf::Exploit::Deprecated
15

16
  moved_from 'auxiliary/admin/dcerpc/samr_computer'
17

18
  def initialize(info = {})
19
    super(
20
      update_info(
21
        info,
22
        'Name' => 'SAMR Account Management',
23
        'Description' => %q{
24
          Add, lookup and delete user / machine accounts via MS-SAMR. By default
25
          standard active directory users can add up to 10 new computers to the
26
          domain (MachineAccountQuota). Administrative privileges however are required
27
          to delete the created accounts, or to create/delete user accounts.
28
        },
29
        'License' => MSF_LICENSE,
30
        'Author' => [
31
          'JaGoTu', # @jagotu Original Impacket code
32
          'Spencer McIntyre',
33
          'smashery'
34
        ],
35
        'References' => [
36
          ['URL', 'https://github.com/SecureAuthCorp/impacket/blob/master/examples/addcomputer.py'],
37
        ],
38
        'Notes' => {
39
          'Reliability' => [],
40
          'Stability' => [],
41
          'SideEffects' => [ IOC_IN_LOGS ],
42
          'AKA' => ['samr_computer', 'samr_user']
43
        },
44
        'Actions' => [
45
          [ 'ADD_COMPUTER', { 'Description' => 'Add a computer account' } ],
46
          [ 'ADD_USER', { 'Description' => 'Add a user account' } ],
47
          [ 'DELETE_ACCOUNT', { 'Description' => 'Delete a computer or user account' } ],
48
          [ 'LOOKUP_ACCOUNT', { 'Description' => 'Lookup a computer or user account' } ]
49
        ],
50
        'DefaultAction' => 'ADD_COMPUTER'
51
      )
52
    )
53

54
    register_options([
55
      Opt::RPORT(445)
56
    ])
57
  end
58

59
  def run
60
    send("action_#{action.name.downcase}")
61
  rescue MsSamrConnectionError => e
62
    fail_with(Failure::Unreachable, e.message)
63
  rescue MsSamrAuthenticationError => e
64
    fail_with(Failure::NoAccess, e.message)
65
  rescue MsSamrNotFoundError => e
66
    fail_with(Failure::NotFound, e.message)
67
  rescue MsSamrBadConfigError => e
68
    fail_with(Failure::BadConfig, e.message)
69
  rescue MsSamrUnexpectedReplyError => e
70
    fail_with(Failure::UnexpectedReply, e.message)
71
  rescue MsSamrUnknownError => e
72
    fail_with(Failure::Unknown, e.message)
73
  rescue SmbIpcAuthenticationError => e
74
    fail_with(Failure::Unknown, e.message)
75
  end
76

77
  def action_add_user
78
    fail_with(Failure::BadConfig, 'This action requires ACCOUNT_NAME to be specified.') if datastore['ACCOUNT_NAME'].blank?
79
    print_status('Adding user')
80
    with_ipc_tree do |opts|
81
      add_account(:user, opts)
82
    end
83
  end
84

85
  def action_add_computer
86
    print_status('Adding computer')
87
    with_ipc_tree do |opts|
88
      add_account(:computer, opts)
89
    end
90
  end
91

92
  def action_delete_account
93
    fail_with(Failure::BadConfig, 'This action requires ACCOUNT_NAME to be specified.') if datastore['ACCOUNT_NAME'].blank?
94
    with_ipc_tree do |opts|
95
      delete_account(opts)
96
    end
97
  end
98

99
  def action_lookup_account
100
    fail_with(Failure::BadConfig, 'This action requires ACCOUNT_NAME to be specified.') if datastore['ACCOUNT_NAME'].blank?
101
    with_ipc_tree do |opts|
102
      lookup_account(opts)
103
    end
104
  end
105

106
  # @yieldparam options [Hash] If a SMB session is present, a hash with the IPC tree present. Empty hash otherwise.
107
  # @return [void]
108
  def with_ipc_tree
109
    opts = {}
110
    if session
111
      print_status("Using existing session #{session.sid}")
112
      self.simple = session.simple_client
113
      opts[:tree] = simple.client.tree_connect("\\\\#{session.client.dispatcher.tcp_socket.peerhost}\\IPC$")
114
    end
115

116
    yield opts
117
  ensure
118
    opts[:tree].disconnect! if opts[:tree]
119
  end
120
end
121

122