diff --git a/lib/rex/post/meterpreter/extensions/extapi/adsi/adsi.rb b/lib/rex/post/meterpreter/extensions/extapi/adsi/adsi.rb index 048f1f5250..51349308c3 100644 --- a/lib/rex/post/meterpreter/extensions/extapi/adsi/adsi.rb +++ b/lib/rex/post/meterpreter/extensions/extapi/adsi/adsi.rb @@ -20,7 +20,7 @@ class Adsi end # Enumerate all the users in the given domain. - def user_enumerate(domain_name) + def user_enumerate(domain_name, page_size) filter = "(objectClass=user)" fields = [ "samaccountname", @@ -30,7 +30,7 @@ class Adsi "comment" ] - return domain_query(domain_name, filter, fields) + return domain_query(domain_name, filter, page_size, fields) end # Enumerate all the computers in the given domain. @@ -43,7 +43,7 @@ class Adsi "comment" ] - return domain_query(domain_name, filter, fields) + return domain_query(domain_name, filter, page_size, fields) end # @@ -52,16 +52,19 @@ class Adsi # @param domain_name [String] The FQDN of the target domain. # @param filter [String] The filter to apply to the query in # LDAP format. + # @param page_size [Integer] The size of the page of results + # to return. # @param fields [Array] Array of string fields to return for # each result found # # @returns [Hash] Array of field names with associated results. # - def domain_query(domain_name, filter, fields) + def domain_query(domain_name, filter, page_size, fields) request = Packet.create_request('extapi_adsi_domain_query') request.add_tlv(TLV_TYPE_EXT_ADSI_DOMAIN, domain_name) request.add_tlv(TLV_TYPE_EXT_ADSI_FILTER, filter) + request.add_tlv(TLV_TYPE_EXT_ADSI_PAGESIZE, page_size) fields.each do |f| request.add_tlv(TLV_TYPE_EXT_ADSI_FIELD, f) diff --git a/lib/rex/post/meterpreter/extensions/extapi/tlv.rb b/lib/rex/post/meterpreter/extensions/extapi/tlv.rb index 63e8f40f33..eaf1308cbd 100644 --- a/lib/rex/post/meterpreter/extensions/extapi/tlv.rb +++ b/lib/rex/post/meterpreter/extensions/extapi/tlv.rb @@ -45,6 +45,7 @@ TLV_TYPE_EXT_ADSI_FILTER = TLV_META_TYPE_STRING | (TLV_TYPE_E TLV_TYPE_EXT_ADSI_FIELD = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 57) TLV_TYPE_EXT_ADSI_VALUE = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 58) TLV_TYPE_EXT_ADSI_RESULT = TLV_META_TYPE_GROUP | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 59) +TLV_TYPE_EXT_ADSI_PAGESIZE = TLV_META_TYPE_UINT | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 60) end end diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb index 12ab620654..1a6f10c18b 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb @@ -17,6 +17,8 @@ class Console::CommandDispatcher::Extapi::Adsi include Console::CommandDispatcher + DEFAULT_PAGE_SIZE = 200 + # # List of supported commands. # @@ -39,12 +41,13 @@ class Console::CommandDispatcher::Extapi::Adsi # Options for the adsi_user_enum command. # @@adsi_user_enum_opts = Rex::Parser::Arguments.new( - "-h" => [ false, "Help banner" ] + "-h" => [ false, "Help banner" ], + "-s" => [ true, "Result set page size." ] ) def adsi_user_enum_usage print( - "\nUsage: adsi_user_enum [-h]\n\n" + + "\nUsage: adsi_user_enum [-h] [-s pagesize]\n\n" + "Enumerate the users on the target domain.\n\n" + "Enumeration returns information such as the user name, SAM account name, locked\n" + "status, desc, and comment.\n" + @@ -55,8 +58,7 @@ class Console::CommandDispatcher::Extapi::Adsi # Enumerate domain users. # def cmd_adsi_user_enum(*args) - parent_window = nil - include_unknown = false + page_size = DEFAULT_PAGE_SIZE args.unshift("-h") if args.length == 0 @@ -65,12 +67,14 @@ class Console::CommandDispatcher::Extapi::Adsi when "-h" adsi_user_enum_usage return true + when "-s" + page_size = (val || DEFAULT_PAGE_SIZE).to_i end } domain = args.shift - users = client.extapi.adsi.user_enumerate(domain) + users = client.extapi.adsi.user_enumerate(domain, page_size) table = Rex::Ui::Text::Table.new( 'Header' => "#{domain} Users", @@ -97,12 +101,13 @@ class Console::CommandDispatcher::Extapi::Adsi # Options for the adsi_computer_enum command. # @@adsi_computer_enum_opts = Rex::Parser::Arguments.new( - "-h" => [ false, "Help banner" ] + "-h" => [ false, "Help banner" ], + "-s" => [ true, "Result set page size." ] ) def adsi_computer_enum_usage print( - "\nUsage: adsi_computer_enum [-h]\n\n" + + "\nUsage: adsi_computer_enum [-h] [-s pagesize]\n\n" + "Enumerate the computers on the target domain.\n\n" + "Enumeration returns information such as the computer name, desc, and comment.\n" + @@adsi_computer_enum_opts.usage) @@ -112,8 +117,7 @@ class Console::CommandDispatcher::Extapi::Adsi # Enumerate domain computers. # def cmd_adsi_computer_enum(*args) - parent_window = nil - include_unknown = false + page_size = DEFAULT_PAGE_SIZE args.unshift("-h") if args.length == 0 @@ -122,6 +126,8 @@ class Console::CommandDispatcher::Extapi::Adsi when "-h" adsi_computer_enum_usage return true + when "-s" + page_size = (val || DEFAULT_PAGE_SIZE).to_i end } @@ -154,12 +160,13 @@ class Console::CommandDispatcher::Extapi::Adsi # Options for the adsi_domain_query command. # @@adsi_domain_query_opts = Rex::Parser::Arguments.new( - "-h" => [ false, "Help banner" ] + "-h" => [ false, "Help banner" ], + "-s" => [ true, "Result set page size." ] ) def adsi_domain_query_usage print( - "\nUsage: adsi_computer_enum [field 2 [field ..]] [-h]\n\n" + + "\nUsage: adsi_computer_enum [field 2 [field ..]] [-h] [-s size]\n\n" + "Enumerate the objects on the target domain.\n\n" + "Enumeration returns the set of fields that are specified.\n" + @@adsi_domain_query_opts.usage) @@ -169,13 +176,13 @@ class Console::CommandDispatcher::Extapi::Adsi # Enumerate domain computers. # def cmd_adsi_domain_query(*args) - parent_window = nil - include_unknown = false - args.unshift("-h") if args.length < 3 + page_size = DEFAULT_PAGE_SIZE @@adsi_domain_query_opts.parse(args) { |opt, idx, val| case opt + when "-s" + page_size = (val || DEFAULT_PAGE_SIZE).to_i when "-h" adsi_domain_query_usage return true @@ -184,8 +191,9 @@ class Console::CommandDispatcher::Extapi::Adsi domain = args.shift filter = args.shift + args = args.first(args.length - 2) if args.include? "-s" - objects = client.extapi.adsi.domain_query(domain, filter, args) + objects = client.extapi.adsi.domain_query(domain, filter, page_size, args) table = Rex::Ui::Text::Table.new( 'Header' => "#{domain} Objects",