rapid7/metasploit-framework — pull request #999 by Meatballs1 (2012-11-01 18:37:29+00:00)
Title: Windows Deployment Service Modules

Windows Deployment Services can be configured with domain credentials for PXEBoot clients to perform unattended installation. These are not visible during a PXE deployment, (but can be observed in clear text by monitoring network traffic).

The main module auxiliary/scanner/windows_deployment_services connects to the DCERPC endpoint and requests the client unattend files for each architecture to pull out the domain credentials stored (these only need to be normal users to access the shares but may be higher privilege). These unattend files are different to the unattend files used to configure the installed operating system, and are generally used to allow access to the RemInst share to obtain the images and second stage unattend files.

The auxiliary/gather/windows_deployment_services_shares module will look for deployment shares on the specified host, retrieve unattend.xml files and pull out any stored credentials. This module is meant as a follow up to the first module to use the credentials gained.

The auxiliary/scanner/pxe/pxe_servers module can be used to stimulate and retrieve PXE boot DHCP/BOOTP traffic to help identify the deployment server.

All of this can be manually done using a VM but is time consuming to cover all architectures, and requires all the TFTP traffic associated with PXEBooting. An added bonus to using the module, is that the RPC endpoint listens and responds even when deployment services is configured to not respond to any computers, or only to known client computers. It will also not register the endpoint as a 'Pending Device' if the service has been configured to require approval.

Whilst SCCM requires Windows Deployment Services, WDS is often not configured, and RPC is not used to distribute credentials. If Windows Deployment Services is installed but not configured it will allow RPC binds but will not response to the RPC request.