rapid7/metasploit-framework — pull request #1188 by Meatballs1 (2012-12-20 16:41:35+00:00)
Title: Post Module: Enumerate AD Computers

Connects to the default AD server and authenticates with the current threads security context.

Retrieves a list of known computers from the AD directory.

http://dev.metasploit.com/redmine/issues/7473

This is quite a slow method, but should give better response than enum_computers as 'net view' rarely gives a definitive list of devices.

As such the user can limit the search size, and a progress . is added for each retrieved entry.

Added wldap32 to railgun definitions.

Currently this module will only work on x64 meterpreter due to a bug in railgun which causes meterpreter to crash when calling API functions that use cdecl calling convention:

http://dev.metasploit.com/redmine/issues/7639

[*] Connecting to default LDAP server
[*] Querying default naming context
[*] Entries retrieved: 1
.
[*] Default Naming Context DC=test,DC=lab
[*] Querying computer objects - Please wait...
[*] Entries retrieved: 3
...
AD Computers
============

dNSHostName distinguishedName description operatingSystem
----------- ----------------- ----------- ---------------
DC-Win2k8-1.test.lab CN=DC-WIN2K8-1,OU=Domain Controllers,DC=test,DC=lab Windows Server 2008 R2 Enterprise
WIN7X86.test.lab CN=WIN7X86,CN=Computers,DC=test,DC=lab test1 Windows 7 Ultimate
WIN7-X64.test.lab CN=WIN7-X64,CN=Computers,DC=test,DC=lab blark Windows 7 Professional

[*] Results saved to: C:/Documents and Settings/user/.msf4/loot/20121220162536_default_192.168.5.221_windows.ad.compu_527644.txt
[*] Post module execution completed