rapid7/metasploit-framework — pull request #3265 by Meatballs1 (2014-04-15 20:21:45+00:00)
Title: Windows Post Manage Change Password

This module attempts to change the password of a user on the current machine or domain, or on a remote host.

It is mostly useful if you have an account that needs a password change to allow a login but dont have RDP or physical access.

Alternatives are smbpasswd, pspasswd or CTRL+ALT+DELETE and specifying the host in the domain section but these may not always be straightforwards to deploy.

ACCESS_DENIED is the most likely error message, we didn't always work out why these were being returned in test environment but might be overcome with a valid user that can auth to box by performing `net use \\rhost\IPC$ /user:User Password1` beforehand.

## Verification

- [ ] With SMBDomain unset it should chanve the password of a local user
- [ ] With SMBDomain set to the domain it should change the password of a domain user
- [ ] With SMBDomain set to an IP/Netbios name it should change the local user of a remote host

## Example
```
msf auxiliary(smb_login) > setg SMBUser administrator
SMBUser => administrator
smsf auxiliary(smb_login) > set SMBPass WonkyTonky1
SMBPass => WonkyTonky1
msf auxiliary(smb_login) > set RHOSTS 192.168.1.27
RHOSTS => 192.168.1.27
msf auxiliary(smb_login) > run

[*] 192.168.1.27:445 SMB - Starting SMB login bruteforce
[*] 192.168.1.27:445 - FAILED LOGIN, VALID CREDENTIALS (Windows 8.1 Enterprise Evaluation 9600) administrator : WonkyTonky1 [STATUS_PASSWORD_MUST_CHANGE]

msf auxiliary(smb_login) > sessions

Active sessions
===============

Id Type Information Connection
-- ---- ----------- ----------
2 meterpreter x86/win32 IE8Win7\testadmin @ IE8WIN7 192.168.1.100:8686 -> 192.168.1.23:49187 (192.168.1.23)

msf auxiliary(smb_login) > use post/windows/manage/change_password
msf post(change_password) > set SMBDomain 192.168.1.27
SMBDomain => 192.168.1.27
msf post(change_password) > set SMBUser Administrator
SMBUser => Administrator
msf post(change_password) > set OLD_PASSWORD WonkyTonky1
OLD_PASSWORD => WonkyTonky1
msf post(change_password) > set NEW_PASSWORD Hello12345
NEW_PASSWORD => Hello12345
msf post(change_password) > set SESSION 2
SESSION => 2
rmsf post(change_password) > run

[*] Changing 192.168.1.27\Administrator password to Hello12345...
[-] Password change failed, NERR_PasswordTooShort.
[*] Post module execution completed
msf post(change_password) > set NEW_PASSWORD SuperDuperWow!
NEW_PASSWORD => SuperDuperWow!
msf post(change_password) > run

[*] Changing 192.168.1.27\Administrator password to SuperDuperWow!...
[+] Password change successful.
[*] Post module execution completed
msf post(change_password) > previous
semsf auxiliary(smb_login) > set SMBPass SuperDuperWow!
SMBPass => SuperDuperWow!
msf auxiliary(smb_login) > run

[*] 192.168.1.27:445 SMB - Starting SMB login bruteforce
[+] 192.168.1.27:445 - SUCCESSFUL LOGIN (Windows 8.1 Enterprise Evaluation 9600) administrator : SuperDuperWow! [STATUS_SUCCESS]
[*] Username is case insensitive
[*] Domain is ignored
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
```