New module to build wordlist from active directory fields

I've usually done this through alternate methods but figured it was just as easy to build it in to cut down on switching back and forth between tools.  The module will pull from a list of fields in Active Directory (note you can customize the list) and generate a wordlist in /tmp for use by JtR, oclHashcat, etc.  In the case (like the active directory description field) where spaces are likely, it will split them up into separate words and combine as one long word (it does similar things for - (phone numbers)).  I've had very good luck (sad) in the past using the words as a seed to cracking.  My ruby foo has gotten very very rusty but hopefully it passes muster (it did pass msftidy).
Will fix the one clear typo and the && and try to fix the style issues‎ with update tomorrow am.                                                                                                                                                                                                                                                                          Sent from my BlackBerry 10 smartphone.                                                                                                                                                                                                                                        From: JoshSent: Tuesday, July 8, 2014 8:18 PMTo: rapid7/metasploit-frameworkReply To: rapid7/metasploit-frameworkCc: ringtSubject: Re: [metasploit-framework] New module to build wordlist from active directory fields (#3504)In modules/post/windows/gather/enum_ad_users_to_wordlist.rb:
> +      'SessionTypes' => [ 'meterpreter' ],
> +   ))
> +
> +   register_options([
> +      OptString.new('FIELDS', [true, 'Fields to retrieve.', 'sn,givenName,st,postalCode,physicalDeliveryOfficeName,telephoneNumber,mobile,facsimileTelephoneNumber,displayName,title,department,company, streetAddress,sAMAccountName,userAccountControl,comment,description']),
> +      OptString.new('FILTER', [true, 'Search filter.','(&(objectClass=organizationalPerson)(objectClass=user)(objectClass=person)(!(objectClass=computer)))']),
> +   ], self.class)
> +end
> +
> +def run
> +   fields = datastore['FIELDS'].gsub(/\s+/,"").split(',')
> +   search_filter = datastore['FILTER']
> +   max_search = datastore['MAX_SEARCH']
> +   begin
> +      q = query(search_filter, max_search, fields)
> +      if q.nil? or q[:results].empty?

yeah, we have quite a bit of code that needs to be spruced up, some of which was written before anyone had established minimum code standards.  For the most part, we try to follow idiomatic ruby.  This code has enough "violations" that we need it cleaned up before we could merge it. 

—Reply to this email directly or view it on GitHub.