Enum Ad Users -> Database

Dumps AD Users to the database. Tries to detect Disabled and Locked out accounts from the userAccountControl. Disabled appears to be set here, but normal account lockouts don't seem to set in the flags. 

Not sure where Metasploit::Credentials stores that info, or how it uses it, doesn't bother showing it with creds... :)

n.b. I tried using smb_login with DB_ALL_USERS true, but that didn't seem to work...
```
msf post(enum_ad_users) > show options

Module options (post/windows/gather/enum_ad_users):

   Name        Current Setting  Required  Description
   ----        ---------------  --------  -----------
   DOMAIN                       no        The domain to query or distinguished name (e.g. DC=test,DC=com)
   MAX_SEARCH  500              yes       Maximum values to retrieve, 0 for all.
   SESSION     8                yes       The session to run this module on.
   STORE_LOOT  false            yes       Store file in loot.

msf post(enum_ad_users) > rerun
[*] Reloading module...

Domain Users
============

 sAMAccountName  userAccountControl
 --------------  ------------------
 Administrator   66048
 Guest           66082
 krbtgt          514
 user01          66048
 user02          66048
 user03          66048
 user04          66048
 user05          66048
 user06          66048
 user07          66048
 user08          66048
 user09          66048
 user10          66048
 reception       512
 pwned           546
 lockout_man     512

[*] Post module execution completed
msf post(enum_ad_users) > creds
Credentials
===========

host          service        public         private  realm                 private_type
----          -------        ------         -------  -----                 ------------
172.16.80.10  445/tcp (smb)  user04                  metasploitable.local  
172.16.80.10  445/tcp (smb)  user05                  metasploitable.local  
172.16.80.10  445/tcp (smb)  user06                  metasploitable.local  
172.16.80.10  445/tcp (smb)  user07                  metasploitable.local  
172.16.80.10  445/tcp (smb)  user08                  metasploitable.local  
172.16.80.10  445/tcp (smb)  user09                  metasploitable.local  
172.16.80.10  445/tcp (smb)  user10                  metasploitable.local  
172.16.80.10  445/tcp (smb)  reception               metasploitable.local  
172.16.80.10  445/tcp (smb)  pwned                   metasploitable.local  
172.16.80.10  445/tcp (smb)  lockout_man             metasploitable.local  
172.16.80.10  445/tcp (smb)  Administrator           metasploitable.local  
172.16.80.10  445/tcp (smb)  Guest                   metasploitable.local  
172.16.80.10  445/tcp (smb)  krbtgt                  metasploitable.local  
172.16.80.10  445/tcp (smb)  user01                  metasploitable.local  
172.16.80.10  445/tcp (smb)  user02                  metasploitable.local  
172.16.80.10  445/tcp (smb)  user03                  metasploitable.local  

msf post(enum_ad_users) > 
```


## Verification
* Run on a Domain Joined PC
* Check the output of 'creds' afterwards



Store `uac.to_i` in a local as you're doing it more than once.  In cases like this I would refer to the parameter `uac` as `formatted_uac` and `formatted_uac.to_i` as `uac` since this is a parsing function.

```ruby
  def parse_user_account_control(formatted_uac)
    res = {}
    uac = formatted_uac.to_i
    disabled = (uac & 0x02) > 0
    lockout = (uac & 0x10) > 0
  end