New module to build wordlist from active directory fields

I've usually done this through alternate methods but figured it was just as easy to build it in to cut down on switching back and forth between tools.  The module will pull from a list of fields in Active Directory (note you can customize the list) and generate a wordlist in /tmp for use by JtR, oclHashcat, etc.  In the case (like the active directory description field) where spaces are likely, it will split them up into separate words and combine as one long word (it does similar things for - (phone numbers)).  I've had very good luck (sad) in the past using the words as a seed to cracking.  My ruby foo has gotten very very rusty but hopefully it passes muster (it did pass msftidy).
I lifed that portion from a similarly named module                                                                                                                                                                                                                                                                          Sent from my BlackBerry 10 smartphone.                                                                                                                                                                                                                                        From: JoshSent: Tuesday, July 8, 2014 7:12 PMTo: rapid7/metasploit-frameworkReply To: rapid7/metasploit-frameworkCc: ringtSubject: Re: [metasploit-framework] New module to build wordlist from active directory fields (#3504)In modules/post/windows/gather/enum_ad_users_to_wordlist.rb:
> +      'SessionTypes' => [ 'meterpreter' ],
> +   ))
> +
> +   register_options([
> +      OptString.new('FIELDS', [true, 'Fields to retrieve.', 'sn,givenName,st,postalCode,physicalDeliveryOfficeName,telephoneNumber,mobile,facsimileTelephoneNumber,displayName,title,department,company, streetAddress,sAMAccountName,userAccountControl,comment,description']),
> +      OptString.new('FILTER', [true, 'Search filter.','(&(objectClass=organizationalPerson)(objectClass=user)(objectClass=person)(!(objectClass=computer)))']),
> +   ], self.class)
> +end
> +
> +def run
> +   fields = datastore['FIELDS'].gsub(/\s+/,"").split(',')
> +   search_filter = datastore['FILTER']
> +   max_search = datastore['MAX_SEARCH']
> +   begin
> +      q = query(search_filter, max_search, fields)
> +      if q.nil? or q[:results].empty?

if !q or q[:results].empty?

or better yet:

  if q && !q[:results].empty?
    # do all that stuff
  end
end # this would be the end of the function


this way, no matter what happens you'll just return the result of the last line, which you don't care about anyways it seems

—Reply to this email directly or view it on GitHub.