diff --git a/modules/post/windows/gather/credentials/gpp.rb b/modules/post/windows/gather/credentials/gpp.rb index 9ebe76123b..ff3c923791 100644 --- a/modules/post/windows/gather/credentials/gpp.rb +++ b/modules/post/windows/gather/credentials/gpp.rb @@ -210,6 +210,18 @@ class MetasploitModule < Msf::Post end end + def adsi_query(domain, adsi_filter, adsi_fields) + return "" unless session.core.use("extapi") + + query_result = session.extapi.adsi.domain_query(domain, adsi_filter, 255, 255, adsi_fields) + + if query_result[:results].empty? + return "" # adsi query failed + else + return query_result[:results] + end + end + def gpp_xml_file(path) begin data = read_file(path) @@ -217,6 +229,7 @@ class MetasploitModule < Msf::Post spath = path.split('\\') retobj = { :dc => spath[2], + :guid => spath[6], :path => path, :xml => data } @@ -225,6 +238,18 @@ class MetasploitModule < Msf::Post else retobj[:domain] = spath[4] end + + adsi_filter_gpo = "(&(objectCategory=groupPolicyContainer)(name=#{retobj[:guid]}))" + adsi_field_gpo = ['displayname', 'name'] + + gpo_adsi = adsi_query(retobj[:domain], adsi_filter_gpo, adsi_field_gpo) + + unless gpo_adsi.empty? + gpo_name = gpo_adsi[0][0][:value] + gpo_guid = gpo_adsi[0][1][:value] + retobj[:name] = gpo_name if retobj[:guid] == gpo_guid + end + return retobj rescue Rex::Post::Meterpreter::RequestError => e print_error "Received error code #{e.code} when reading #{path}" @@ -241,7 +266,8 @@ class MetasploitModule < Msf::Post tables = Rex::Parser::GPP.create_tables(results, filetype, xmlfile[:domain], xmlfile[:dc]) tables.each do |table| - print_good table.to_s + table << ['NAME', xmlfile[:name]] if xmlfile.member?(:name) + print_good " #{table.to_s}\n\n" end results.each do |result|