1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::Common
8
  include Msf::Post::Windows::Registry
9
  include Msf::Post::Windows::NetAPI
10
  include Msf::Post::Windows::Accounts
11

12
  def initialize(info = {})
13
    super(
14
      update_info(
15
        info,
16
        'Name'	=> 'Windows Gather Enumerate Active Domain Users',
17
        'Description' => %q{
18
          This module will enumerate computers included in the primary Domain and attempt
19
          to list all locations the targeted user has sessions on. If the HOST option is specified
20
          the module will target only that host. If the HOST is specified and USER is set to nil, all users
21
          logged into that host will be returned.'
22
        },
23
        'License' => MSF_LICENSE,
24
        'Author' => [
25
          'Etienne Stalmans <etienne[at]sensepost.com>',
26
          'Ben Campbell'
27
        ],
28
        'Platform' => [ 'win' ],
29
        'SessionTypes' => [ 'meterpreter' ],
30
        'Notes' => {
31
          'Stability' => [CRASH_SAFE],
32
          'SideEffects' => [],
33
          'Reliability' => []
34
        }
35
      )
36
    )
37
    register_options(
38
      [
39
        OptString.new('USER', [false, 'Target User for NetSessionEnum']),
40
        OptString.new('HOST', [false, 'Target a specific host']),
41
      ]
42
    )
43
  end
44

45
  def run
46
    sessions = []
47
    user = datastore['USER']
48
    host = datastore['HOST']
49

50
    if host
51
      if user
52
        print_status("Attempting to identify #{user} on #{host}...")
53
      else
54
        print_status("Attempting to get all logged in users on #{host}...")
55
      end
56
      sessions = net_session_enum(host, user)
57
    elsif user
58
      # Domain must be NETBIOS style rather than DNS style
59
      domain = get_domain
60

61
      if domain.blank?
62
        fail_with(Failure::Unknown, 'Machine is not part of a domain.')
63
      else
64
        domain = domain.split('.').first.upcase
65
        print_status("Using domain: #{domain}")
66
        print_status('Getting list of domain hosts...')
67
      end
68

69
      hosts = net_server_enum(SV_TYPE_ALL, domain)
70

71
      if hosts
72
        len = hosts.count
73
        print_status("#{len} host(s) found")
74

75
        hosts.each do |host|
76
          sessions << net_session_enum(host[:name], user)
77
        end
78
      end
79

80
      sessions.flatten!
81
    else
82
      fail_with(Failure::BadConfig, 'Invalid options, either HOST or USER must be specified.')
83
    end
84

85
    if sessions.nil? || (sessions.count == 0)
86
      fail_with(Failure::Unknown, 'No sessions found')
87
    else
88
      print_status("#{sessions.count} session(s) identified")
89

90
      sessions.each do |s|
91
        if s
92
          print_good("#{s[:username]} logged in at #{s[:hostname]} and has been idle for #{s[:idletime]} seconds")
93
        end
94
      end
95
    end
96
  end
97
end
98

99