Add user module

[smashery]

This modifies the existing samr_computer account to enable adding user accounts as well.

Verification

List the steps needed to make sure this thing works

• Start msfconsole
• use auxiliary/scanner/smb/smb_login
• set action ADD_USER
• set account_name new.user
• Optionally set account_password
• run
• Verify that it creates an account, and that the account's login works
• Also check lookup_account and delete_account actions

Demo

msf6 auxiliary(admin/dcerpc/samr_account) > run rhost=192.168.20.99 smbdomain=pod7.local smbuser=Administrator smbpass=Password1! account_name=new.user1
[*] Running module against 192.168.20.99

[*] 192.168.20.99:445 - Adding user
[+] 192.168.20.99:445 - Successfully created pod7.local\new.user1
[+] 192.168.20.99:445 -   Password: BqRGEq4bwhXGiqMliSFvikavxGuthhkI
[+] 192.168.20.99:445 -   SID:      S-1-5-21-3780203507-609619018-965709381-1111
[*] Auxiliary module execution completed

msf6 auxiliary(admin/dcerpc/samr_account) > set action LOOKUP_ACCOUNT
action => LOOKUP_ACCOUNT
msf6 auxiliary(admin/dcerpc/samr_account) > run rhost=192.168.20.99 smbdomain=pod7.local smbuser=Administrator smbpass=Password1! account_name=new.user2
[*] Running module against 192.168.20.99
                                                                                                                                                                                                                                                                                                                                                                                          [+] 192.168.20.99:445 - Found pod7.local\new.user2 (SID: S-1-5-21-3780203507-609619018-965709381-1113)

msf6 auxiliary(admin/dcerpc/samr_account) > set action DELETE_ACCOUNT
action => DELETE_ACCOUNT
msf6 auxiliary(admin/dcerpc/samr_account) > run rhost=192.168.20.99 smbdomain=pod7.local smbuser=Administrator smbpass=Password1! account_name=new.user2
[*] Running module against 192.168.20.99
                                                                                                                                                                                                                                                                                                                                                                                          [+] 192.168.20.99:445 - The specified account has been deleted.
[*] Auxiliary module execution completed

msf6 auxiliary(admin/dcerpc/samr_account) > run rhost=192.168.20.99 smbdomain=pod7.local smbuser=Administrator smbpass=Password1! account_name=new.user2
[*] Running module against 192.168.20.99

[-] 192.168.20.99:445 - Auxiliary aborted due to failure: bad-config: The specified account was not found.
[*] Auxiliary module execution completed

[adfoster-r7]

If you're renaming the module you'll want to add additional moved_from metadata iirc

  include Msf::Exploit::Deprecated

  moved_from 'auxiliary/admin/dcerpc/samr_computer'

[smashery]

That's nice! Thanks for the heads up.

[smcintyre-r7]

Everything looks good to me here. I'm just going to push a tweak to the documentation for the ADD_USER action before I land this.

Testing Output

metasploit-framework.pr (S:0 J:0) auxiliary(admin/dcerpc/samr_account) > run
[*] Running module against 192.168.159.10

[*] 192.168.159.10:445 - Adding computer
[*] 192.168.159.10:445 - Connecting to Security Account Manager (SAM) Remote Protocol
[*] 192.168.159.10:445 - Binding to \samr...
[+] 192.168.159.10:445 - Bound to \samr
[+] 192.168.159.10:445 - Successfully created msflab.local\DESKTOP-QCOK1YN4$
[+] 192.168.159.10:445 -   Password: a1xHGSb7uTBaLkn1Y0EF3RTJBpr9eFLf
[+] 192.168.159.10:445 -   SID:      S-1-5-21-3978004297-3499718965-4169012971-4202
[*] Auxiliary module execution completed
metasploit-framework.pr (S:0 J:0) auxiliary(admin/dcerpc/samr_account) > set ACCOUNT_NAME
ACCOUNT_NAME => 
metasploit-framework.pr (S:0 J:0) auxiliary(admin/dcerpc/samr_account) > set ACCOUNT_NAME SullivanCGoal
ACCOUNT_NAME => SullivanCGoal
metasploit-framework.pr (S:0 J:0) auxiliary(admin/dcerpc/samr_account) > set ACTION ADD_USER
ACTION => ADD_USER
metasploit-framework.pr (S:0 J:0) auxiliary(admin/dcerpc/samr_account) > run
[*] Running module against 192.168.159.10

[*] 192.168.159.10:445 - Adding user
[*] 192.168.159.10:445 - Connecting to Security Account Manager (SAM) Remote Protocol
[*] 192.168.159.10:445 - Binding to \samr...
[+] 192.168.159.10:445 - Bound to \samr
[+] 192.168.159.10:445 - Successfully created msflab.local\SullivanCGoal
[+] 192.168.159.10:445 -   Password: psZXxliWjuESCUeXPSKoYA1gbFqBf3oT
[+] 192.168.159.10:445 -   SID:      S-1-5-21-3978004297-3499718965-4169012971-4203
[*] Auxiliary module execution completed
metasploit-framework.pr (S:0 J:0) auxiliary(admin/dcerpc/samr_account) > lookup_account
[*] Running module against 192.168.159.10

[*] 192.168.159.10:445 - Connecting to Security Account Manager (SAM) Remote Protocol
[*] 192.168.159.10:445 - Binding to \samr...
[+] 192.168.159.10:445 - Bound to \samr
[+] 192.168.159.10:445 - Found msflab.local\SullivanCGoal (SID: S-1-5-21-3978004297-3499718965-4169012971-4203)
[*] Auxiliary module execution completed
metasploit-framework.pr (S:0 J:0) auxiliary(admin/dcerpc/samr_account) > lookup_account ACCOUNT_NAME=DESKTOP-QCOK1YN4$
[*] Running module against 192.168.159.10

[*] 192.168.159.10:445 - Connecting to Security Account Manager (SAM) Remote Protocol
[*] 192.168.159.10:445 - Binding to \samr...
[+] 192.168.159.10:445 - Bound to \samr
[+] 192.168.159.10:445 - Found msflab.local\DESKTOP-QCOK1YN4$ (SID: S-1-5-21-3978004297-3499718965-4169012971-4202)
[*] Auxiliary module execution completed
metasploit-framework.pr (S:0 J:0) auxiliary(admin/dcerpc/samr_account) > delete_account
[*] Running module against 192.168.159.10

[*] 192.168.159.10:445 - Connecting to Security Account Manager (SAM) Remote Protocol
[*] 192.168.159.10:445 - Binding to \samr...
[+] 192.168.159.10:445 - Bound to \samr
[+] 192.168.159.10:445 - The specified account has been deleted.
[*] Auxiliary module execution completed
metasploit-framework.pr (S:0 J:0) auxiliary(admin/dcerpc/samr_account) > lookup_account
[*] Running module against 192.168.159.10

[*] 192.168.159.10:445 - Connecting to Security Account Manager (SAM) Remote Protocol
[*] 192.168.159.10:445 - Binding to \samr...
[+] 192.168.159.10:445 - Bound to \samr
[-] 192.168.159.10:445 - Auxiliary aborted due to failure: not-found: The account was not found.
[*] Auxiliary module execution completed
metasploit-framework.pr (S:0 J:0) auxiliary(admin/dcerpc/samr_account) > unset ACCOUNT_NAME
Unsetting ACCOUNT_NAME...
metasploit-framework.pr (S:0 J:0) auxiliary(admin/dcerpc/samr_account) > add_user
[*] Running module against 192.168.159.10

[-] 192.168.159.10:445 - Auxiliary aborted due to failure: bad-config: This action requires ACCOUNT_NAME to be specified.
[*] Auxiliary module execution completed
metasploit-framework.pr (S:0 J:0) auxiliary(admin/dcerpc/samr_account) >

[smcintyre-r7]

Release Notes

This updates replaces the existing samr_computer module with a more general one that can also be used to add user accounts to active directory if the operator has the necessary permissions.