rapid7/metasploit-framework — pull request #4392 by Meatballs1 (2014-12-13 20:51:59+00:00)
Title: Enum Ad Users -> Database

Dumps AD Users to the database. Tries to detect Disabled and Locked out accounts from the userAccountControl. Disabled appears to be set here, but normal account lockouts don't seem to set in the flags.

Not sure where Metasploit::Credentials stores that info, or how it uses it, doesn't bother showing it with creds... :)

```
msf post(enum_ad_users) > show options

Module options (post/windows/gather/enum_ad_users):

Name Current Setting Required Description
---- --------------- -------- -----------
DOMAIN no The domain to query or distinguished name (e.g. DC=test,DC=com)
MAX_SEARCH 500 yes Maximum values to retrieve, 0 for all.
SESSION 8 yes The session to run this module on.
STORE_LOOT false yes Store file in loot.

msf post(enum_ad_users) > rerun
[*] Reloading module...

Domain Users
============

sAMAccountName userAccountControl
-------------- ------------------
Administrator 66048
Guest 66082
krbtgt 514
user01 66048
user02 66048
user03 66048
user04 66048
user05 66048
user06 66048
user07 66048
user08 66048
user09 66048
user10 66048
reception 512
pwned 546
lockout_man 512

[*] Post module execution completed
msf post(enum_ad_users) > creds
Credentials
===========

host service public private realm private_type
---- ------- ------ ------- ----- ------------
172.16.80.10 445/tcp (smb) user04 metasploitable.local
172.16.80.10 445/tcp (smb) user05 metasploitable.local
172.16.80.10 445/tcp (smb) user06 metasploitable.local
172.16.80.10 445/tcp (smb) user07 metasploitable.local
172.16.80.10 445/tcp (smb) user08 metasploitable.local
172.16.80.10 445/tcp (smb) user09 metasploitable.local
172.16.80.10 445/tcp (smb) user10 metasploitable.local
172.16.80.10 445/tcp (smb) reception metasploitable.local
172.16.80.10 445/tcp (smb) pwned metasploitable.local
172.16.80.10 445/tcp (smb) lockout_man metasploitable.local
172.16.80.10 445/tcp (smb) Administrator metasploitable.local
172.16.80.10 445/tcp (smb) Guest metasploitable.local
172.16.80.10 445/tcp (smb) krbtgt metasploitable.local
172.16.80.10 445/tcp (smb) user01 metasploitable.local
172.16.80.10 445/tcp (smb) user02 metasploitable.local
172.16.80.10 445/tcp (smb) user03 metasploitable.local

msf post(enum_ad_users) >
```

## Verification
* Run on a Domain Joined PC
* Check the output of 'creds' afterwards