bug/bundler_fix
Stuart Morgan 2015-12-18 02:01:38 +00:00
parent 38b6ad4dbf
commit f13ca17de0
1 changed files with 104 additions and 103 deletions

View File

@ -34,7 +34,7 @@ class Metasploit3 < Msf::Post
max_search = datastore['MAX_SEARCH'] max_search = datastore['MAX_SEARCH']
db, dbfile = create_sqlite_db db, dbfile = create_sqlite_db
print_status "Database created: #{dbfile.to_s}" print_status "Database created: #{dbfile}"
# Download the list of groups from Active Directory # Download the list of groups from Active Directory
vprint_status "Retrieving AD Groups" vprint_status "Retrieving AD Groups"
@ -43,7 +43,7 @@ class Metasploit3 < Msf::Post
group_fields = ['distinguishedName', 'objectSid', 'samAccountType', 'sAMAccountName', 'whenChanged', 'whenCreated', 'description'] group_fields = ['distinguishedName', 'objectSid', 'samAccountType', 'sAMAccountName', 'whenChanged', 'whenCreated', 'description']
groups = query(group_filter, max_search, group_fields) groups = query(group_filter, max_search, group_fields)
rescue ::RuntimeError, ::Rex::Post::Meterpreter::RequestError => e rescue ::RuntimeError, ::Rex::Post::Meterpreter::RequestError => e
print_error("Error(Group): #{e.message.to_s}") print_error("Error(Group): #{e.message}")
return return
end end
@ -61,60 +61,60 @@ class Metasploit3 < Msf::Post
begin begin
# Perform the ADSI query to retrieve the effective users in each group (recursion) # Perform the ADSI query to retrieve the effective users in each group (recursion)
vprint_status "Retrieving members of #{individual_group[3][:value].to_s}" vprint_status "Retrieving members of #{individual_group[3][:value]}"
users_filter = "(&(objectCategory=person)(objectClass=user)(memberof:1.2.840.113556.1.4.1941:=#{individual_group[0][:value].to_s}))" users_filter = "(&(objectCategory=person)(objectClass=user)(memberof:1.2.840.113556.1.4.1941:=#{individual_group[0][:value]}))"
users_in_group = query(users_filter, max_search, users_fields) users_in_group = query(users_filter, max_search, users_fields)
next if users_in_group.nil? || users_in_group[:results].empty? next if users_in_group.nil? || users_in_group[:results].empty?
group_sid, group_rid = sid_hex_to_string(individual_group[1][:value]) group_sid, group_rid = sid_hex_to_string(individual_group[1][:value])
# Add the group to the database # Add the group to the database
sql_param_group = { :rid => group_rid.to_i, sql_param_group = { rid: group_rid.to_i,
:distinguishedName => individual_group[0][:value].to_s, distinguishedName: individual_group[0][:value].to_s,
:sAMAccountName => individual_group[3][:value].to_s, sAMAccountName: individual_group[3][:value].to_s,
:whenChanged => individual_group[4][:value].to_s, whenChanged: individual_group[4][:value].to_s,
:whenCreated => individual_group[5][:value].to_s, whenCreated: individual_group[5][:value].to_s,
:description => individual_group[6][:value].to_s description: individual_group[6][:value].to_s
} }
run_sqlite_query(db, 'ad_groups', sql_param_group) run_sqlite_query(db, 'ad_groups', sql_param_group)
# Go through each of the users in the group # Go through each of the users in the group
users_in_group[:results].each do |group_user| users_in_group[:results].each do |group_user|
user_sid, user_rid = sid_hex_to_string(group_user[1][:value]) user_sid, user_rid = sid_hex_to_string(group_user[1][:value])
print_line "Group [#{individual_group[3][:value].to_s}][#{group_rid.to_s}] has member [#{group_user[3][:value].to_s}][#{user_rid.to_s}]" print_line "Group [#{individual_group[3][:value]}][#{group_rid}] has member [#{group_user[3][:value]}][#{user_rid}]"
# Add the group to the database # Add the group to the database
sql_param_user = { :rid => user_rid.to_i, sql_param_user = { rid: user_rid.to_i,
:distinguishedName => group_user[0][:value].to_s, distinguishedName: group_user[0][:value].to_s,
:sAMAccountName => group_user[3][:value].to_s, sAMAccountName: group_user[3][:value].to_s,
:displayName => group_user[4][:value].to_s, displayName: group_user[4][:value].to_s,
:description => group_user[5][:value].to_s, description: group_user[5][:value].to_s,
:logonCount => group_user[6][:value].to_i, logonCount: group_user[6][:value].to_i,
:userPrincipalName => group_user[8][:value].to_s, userPrincipalName: group_user[8][:value].to_s,
:whenChanged => group_user[8][:value].to_s, whenChanged: group_user[8][:value].to_s,
:whenCreated => group_user[8][:value].to_s, whenCreated: group_user[8][:value].to_s,
:primaryGroupID => group_user[9][:value].to_i, primaryGroupID: group_user[9][:value].to_i,
:badPwdCount => group_user[10][:value].to_i badPwdCount: group_user[10][:value].to_i
} }
run_sqlite_query(db, 'ad_users', sql_param_user) run_sqlite_query(db, 'ad_users', sql_param_user)
# Now associate the user with the group # Now associate the user with the group
sql_param_mapping = { :user_rid => user_rid.to_i, sql_param_mapping = { user_rid: user_rid.to_i,
:group_rid => group_rid.to_i group_rid: group_rid.to_i
} }
run_sqlite_query(db, 'ad_mapping', sql_param_mapping) run_sqlite_query(db, 'ad_mapping', sql_param_mapping)
group_counter += 1 group_counter += 1
end end
rescue ::RuntimeError, ::Rex::Post::Meterpreter::RequestError => e rescue ::RuntimeError, ::Rex::Post::Meterpreter::RequestError => e
print_error("Error(Users): #{e.message.to_s}") print_error("Error(Users): #{e.message}")
return return
end end
end end
print_status "Enumerated #{group_counter} group(s)" print_status "Enumerated #{group_counter} group(s)"
if db and db.close if db && db.close
f = ::File.size(dbfile.to_s) f = ::File.size(dbfile.to_s)
print_status "Database closed: #{dbfile.to_s} at #{f} byte(s)" print_status "Database closed: #{dbfile} at #{f} byte(s)"
end end
end end
@ -170,7 +170,7 @@ class Metasploit3 < Msf::Post
return db, filename return db, filename
rescue SQLite3::Exception => e rescue SQLite3::Exception => e
print_error("Error(Database): #{e.message.to_s}") print_error("Error(Database): #{e.message}")
return return
end end
end end
@ -187,8 +187,9 @@ class Metasploit3 < Msf::Post
sid << rid.to_i.to_s sid << rid.to_i.to_s
sid += data.unpack("bbbbbbbbV*")[8..-1] sid += data.unpack("bbbbbbbbV*")[8..-1]
final_sid = "S-" + sid.join('-') final_sid = "S-" + sid.join('-')
return final_sid, sid[-1] [final_sid, sid[-1]]
end end
def byte2hex(b) def byte2hex(b)
ret = '%x' % (b.to_i & 0xff) ret = '%x' % (b.to_i & 0xff)
ret = '0' + ret if ret.length < 2 ret = '0' + ret if ret.length < 2