Commit Graph

221 Commits (72d9587a50a300813b3aa15f0cb144e16fa66579)

Author SHA1 Message Date
Tod Beardsley b09fab13f0 Fix one flubbed author address 2014-07-11 13:50:37 -05:00
jvazquez-r7 8937fbb2f5 Fix email format 2014-07-11 12:45:23 -05:00
scriptjunkie 5fe8814af6
Land #3330 adding admin check to smb_login 2014-06-15 14:42:26 -05:00
Tom Sellers a47b883083 Remove redundant simple.connect
Remove redundant simple.connect. Thanks @jlee-r7
2014-05-02 12:46:50 -05:00
Tom Sellers b2eeaef475 Add admin check to smb_login
The attached updates changes smb_login to detect if the newly discovered user is an administrator.  It is based on code from Brandon McCann "zeknox" submitted in PR #1373, the associated changes, and the newer PR #2656.
The changes should correct a few issues with PR #1373 and #2656 and address Redmine bug #8773.

Specifically it:

 - Fixes the admin detection code by using simple.disconnect(<share>) instead of disconnect()
 - Adds support for detecting if the remote host will allow connects using any domain name when one of the new status codes is returned
 - Dealt with the issue in PR #2656 where the username was prefixed with a '\'


Verification

Be connected to a database
Run this against a machine with a known user and admin user
See that the admin user is reported correctly
See that the non-admin user is reported correctly
Check the output of creds
Select a target that requires a domain in order to authenticate
In the stored credentials, with CHECK_ADMIN enabled, see that the domain name is, in fact, preserved in the reporting

To validate that the remote domain ignores domain value use the following command from a windows system:

net use \\<hostip>\admin$ /user:<random_value>\<username>   <password>
2014-05-02 06:16:21 -05:00
Zinterax fb39e422aa Fix smb_login calling nonexistent method
When a Rex::Proto::SMB::Exceptions::InvalidWordCount exception is thrown by this module, it attempts to call the nonexistent method error_reason and throws a NoMethodError:

Auxiliary failed: NoMethodError undefined method `error_reason' for #<Rex::Proto::SMB::Exceptions::InvalidWordCount:0x007f48fcda0e48>

This changes uses the built in method get_error to return an error code.

[-] x.x.x.x:445 SMB - [1/1] - \\Domain - FAILED LOGIN (xxxxxxxx) xxxx : xxxxx [STATUS_WAIT_0]
2014-04-28 09:28:29 -04:00
James Lee ee413ac385
Remove previously deprecated modules 2014-04-20 22:15:44 -05:00
Tod Beardsley 062175128b
Update @Meatballs and @FireFart in authors.rb 2014-04-09 10:46:10 -05:00
William Vu b79920ba8f
Land #3089, InvalidWordCount fix for smb_login
[FixRM #8730]
2014-03-19 16:12:56 -05:00
David Maloney da0c37cee2
Land #2684, Meatballs PSExec refactor 2014-03-14 13:01:20 -05:00
Tod Beardsley 206660ddde
Recreate the intent of cfebdae from @parzamendi-r7
The idea was to rescue on a NoReply instead of just fail, and was part
of a fix in #2656.

[SeeRM #8730]
2014-03-11 14:30:01 -05:00
sho-luv f7af9780dc
Rescue InvalidWordCount error
This is a cherry-pick of commit ea86da2 from PR #2656
2014-03-11 14:17:36 -05:00
Royce Davis 0e7074c139 Modififed output for smb_enumshares module 2014-02-14 13:39:13 -06:00
Royce Davis 6dc9840064 Modified output for smb_enumshares 2014-02-14 13:12:52 -06:00
sinn3r f471f50092 ms08_067_check.rb is deprecated.
[SeeRM #8755]
2014-01-26 12:22:13 -06:00
William Vu 7c52f9b496 Update description to use %q{} 2014-01-13 14:42:25 -06:00
William Vu fc616c4413 Clean up formatting 2014-01-09 14:16:31 -06:00
sho-luv a8fcf13972 Added credits and clean initialize
Added wvu to creds as he did most of work. ;)
2014-01-08 21:16:09 -05:00
William Vu 8993c74083 Fix even moar outstanding issues 2014-01-08 19:38:54 -06:00
William Vu 1dd29d3b64 Fix moar outstanding issues 2014-01-08 18:11:18 -06:00
William Vu 945a2a296a Fix outstanding issues 2014-01-08 17:09:41 -06:00
sho-luv 35ac9712ab Added auxiliary check for MS08_067
I simply copied the check from ms08_0867_netapi.rb and put them in
a auxiliary check so I could scan for it. This was done because
Nmap's check is not safe and this is more stable.
2014-01-08 16:41:44 -05:00
Meatballs dd9bb459bf
PSEXEC Refactor
Move peer into mixin
PSEXEC should use the psexec mixin
2013-11-24 16:24:05 +00:00
Tod Beardsley c83262f4bd
Resplat another common boilerplate. 2013-10-15 14:07:48 -05:00
Tod Beardsley 23d058067a
Redo the boilerplate / splat
[SeeRM #8496]
2013-10-15 13:51:57 -05:00
James Lee 813013fef5 Make defaults sane for the lockoutable smb_login
See #2376
2013-10-04 15:53:16 -05:00
James Lee f73c18ccd9 Store the Array, not human-readable version
[SeeRM #8389]
2013-09-09 16:44:47 -05:00
Tab Assassin 41e4375e43 Retab modules 2013-08-30 16:28:54 -05:00
Rich Lundeen 9d032760ac changed description back 2013-07-24 11:51:06 -07:00
Rich Lundeen e89e2af9dc changed to chomp 2013-07-24 11:09:00 -07:00
Rich Lundeen 3854d08dd9 Fixed smb_enumshares to support dir list in SRVSVC 2013-07-23 21:36:26 -07:00
sinn3r 279787d942 Make this error less verbose too 2013-07-11 17:36:11 -05:00
sinn3r 0906345af4 Ah, typo 2013-07-11 16:53:39 -05:00
sinn3r eb1905025d I bet having ip:rport will make more sense 2013-07-11 16:45:52 -05:00
sinn3r 0a9c1bcfff Too verbose by default drives users nuts, go easy on that. 2013-07-11 13:41:22 -05:00
sinn3r 55dbfc9281 shares_info should only run if there's shares found 2013-07-11 13:36:26 -05:00
sinn3r 14b3e6440c Check nil 2013-07-11 13:31:30 -05:00
sinn3r ca0880428f Make sure module is awre of USE_SRVSVC_ONLY if that kicks in 2013-07-11 11:08:09 -05:00
sinn3r a6ce629c3c Capture a 0xC00000BB condition, plus some other fixes 2013-07-11 10:52:58 -05:00
sinn3r 3e229fe236 [SeeRM:#1233] - Upgrade smb_enumshares to show directories & files
[SeeRM:#1233] - This is an upgrade based on ringt's code in PR #2017.
As a pentester, it's useful to obtain additional information such as
device type, access rights, folders, and files, etc when doing a share
enumeration.  I have also enhanced exception handling to avoid shutting
errors up, which is better for debugging purposes.
2013-07-11 00:06:25 -05:00
James Lee 2160718250 Fix file header comment
[See #1555]
2013-03-07 17:53:19 -06:00
James Lee 49f00acc11 Fix nil deref when dnsdomain is empty 2013-02-19 11:24:05 -06:00
jvazquez-r7 e32bd8d4e0 Comma deleted 2013-01-25 11:44:08 +01:00
Rob Fuller a204f6fd1b variable typo 2013-01-25 02:18:20 -05:00
Rob Fuller 976e59954c update description 2013-01-25 02:14:42 -05:00
Rob Fuller a9821fce29 add action option for domain user enum 2013-01-25 02:08:30 -05:00
sinn3r 6e6e90d733 Cosmetic changes 2013-01-15 11:36:49 -06:00
sinn3r a06d49a8be Return symbols
STOP_ON_SUCCESS is being ignored because the module's login function
doesn't pass a symbol to the mixin.  This addresses that.
2013-01-15 11:25:02 -06:00
Joshua J. Drake 3ceb313752 Fixes format string issue in smb_login - FixRM #7657 2013-01-07 22:17:49 -06:00
Joshua J. Drake c74d258509 Revert "Fixes format string issue in smb_login - FixRM #7657"
Will replay on separate branch.

This reverts commit a12b628ccc.
2013-01-07 22:03:57 -06:00