New module to build wordlist from active directory fields

I've usually done this through alternate methods but figured it was just as easy to build it in to cut down on switching back and forth between tools.  The module will pull from a list of fields in Active Directory (note you can customize the list) and generate a wordlist in /tmp for use by JtR, oclHashcat, etc.  In the case (like the active directory description field) where spaces are likely, it will split them up into separate words and combine as one long word (it does similar things for - (phone numbers)).  I've had very good luck (sad) in the past using the words as a seed to cracking.  My ruby foo has gotten very very rusty but hopefully it passes muster (it did pass msftidy).
Like I said my ruby foo has gotten rusty :). I basically translated a perl script I wrote over and merged with existing post module, hence in some places it looks more like perlTy for tips, will keep them in mind.If I need to change any of it let me know.Also, I don't think empty strings are possible due to length checks @ end                                                                                                                                                                                                                                                                          Sent from my BlackBerry 10 smartphone.                                                                                                                                                                                                                                        From: JoshSent: Tuesday, July 8, 2014 7:36 PMTo: rapid7/metasploit-frameworkReply To: rapid7/metasploit-frameworkCc: ringtSubject: Re: [metasploit-framework] New module to build wordlist from active directory fields (#3504)In modules/post/windows/gather/enum_ad_users_to_wordlist.rb:
> +      result.each do |field|
> +         next if field.nil?
> +         next if field =~ /^\s*$/ or field == '-' or field == '' or field.length < 3
> +
> +         field.gsub!(/[\(\)\"]/, '')      # clear up common punctuation in descriptions
> +         field.downcase!            # clear up case
> +         add = 1
> +
> +         tmp = Array.new()
> +         if(field =~ /\s+/)
> +            tmp.push(field.split(/\s+/))
> +            add=0
> +         end
> +         field.gsub!(/\s+/, '')
> +
> +         if(field =~ /-/)

you can avoid this whole construct as you are parsing the field variable multiple times this way.  Instead, something like:

parts = field.split('-') # parts will then always be an array, regardless of whether the split finds any '-'s
tmp = tmp + parts + parts.join unless parts.empty? # there's no += for arrays and << will nest the array
# You could probably also use one of the named array methods, but I would do it this way
# if field was "a-b" this would add a, b, and ab to what's already in tmp, I believe that's what you wanted


similar incarnations can be used for the other splitting chars after '-'

—Reply to this email directly or view it on GitHub.