metasploit-framework/modules/auxiliary/scanner/snmp/snmp_enumusers.rb

##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Auxiliary

  include Msf::Exploit::Remote::SNMPClient
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::Scanner

  def initialize
    super(
      'Name'        => 'SNMP Windows Username Enumeration',
      'Description' => "This module will use LanManager/psProcessUsername OID values to enumerate local user accounts on a Windows/Solaris system via SNMP",
      'Author'      => ['tebo[at]attackresearch.com'],
      'License'     => MSF_LICENSE
    )

  end

  def run_host(ip)
    begin
      snmp = connect_snmp

      sys_desc = snmp.get_value('sysDescr.0')
      @users = []
      case sys_desc
      when /Windows/
        snmp.walk("1.3.6.1.4.1.77.1.2.25") do |row|
          row.each { |val| @users << val.value.to_s }
        end
      when /Sun/
        snmp.walk("1.3.6.1.4.1.42.3.12.1.8") do |row|
          row.each { |val| @users << val.value.to_s }
        end
      end
      unless @users.empty?
        @users.sort!
        @users.uniq!
        print_good("#{ip} Found Users: #{@users.size} users: #{@users.join(', ')}")
      end

      disconnect_snmp

      report_note(
        :host => rhost,
        :port => datastore['RPORT'],
        :proto => 'udp',
        :sname => 'snmp',
        :update => :unique_data,
        :type => 'snmp.users',
        :data => @users
      )


    rescue ::SNMP::UnsupportedVersion
    rescue ::SNMP::RequestTimeout
    rescue ::Interrupt
      raise $!
    rescue ::Exception => e
      print_error("Unknown error: #{e.class} #{e}")
    end

  end

end