SAMR Computer Management - Metasploit


This page contains detailed information about how to use the auxiliary/admin/dcerpc/samr_computer metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Table Of Contents
hide

Module Overview

Name: SAMR Computer Management
Module: auxiliary/admin/dcerpc/samr_computer
Source code: modules/auxiliary/admin/dcerpc/samr_computer.rb
Disclosure date: -
Last modification time: 2022-06-28 11:53:05 +0000
Supported architecture(s): -
Supported platform(s): -
Target service / protocol: microsoft-ds, netbios-ssn
Target network port(s): 139, 445
List of CVEs: -

Add, lookup and delete computer accounts via MS-SAMR. By default standard active directory users can add up to 10 new computers to the domain. Administrative privileges however are required to delete the created accounts.

Module Ranking and Traits

Module Ranking:

  • normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.

Side Effects:

  • ioc-in-logs: Module leaves signs of a compromise in a log file (Example: SQL injection data found in HTTP log).

Basic Usage

msf > use auxiliary/admin/dcerpc/samr_computer
msf auxiliary(samr_computer) > show targets
    ... a list of targets ...
msf auxiliary(samr_computer) > set TARGET target-id
msf auxiliary(samr_computer) > show options
    ... show and set options ...
msf auxiliary(samr_computer) > exploit

Required Options

  • RHOSTS: The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit

Knowledge Base

Vulnerable Application

Add, lookup and delete computer accounts via MS-SAMR. By default standard active directory users can add up to 10 new computers to the domain. Administrative privileges however are required to delete the created accounts.

Verification Steps

  1. From msfconsole
  2. Do: use auxiliary/admin/dcerpc/samr_computer
  3. Set the RHOSTS, SMBUser and SMBPass options
    1. Set the COMPUTER_NAME option for DELETE_COMPUTER and LOOKUP_COMPUTER actions
  4. Run the module and see that a new machine account was added

Options

SMBDomain

The Windows domain to use for authentication. The domain will automatically be identified if this option is left in its default value.

COMPUTER_NAME

The computer name to add, lookup or delete. This option is optional for the ADD_COMPUTER action, and required for the LOOKUP_COMPUTER and DELETE_COMPUTER actions.

COMPUTER_PASSWORD

The password for the new computer. This option is only used for the ADD_COMPUTER action. If left blank, a random value will be generated.

Actions

ADD_COMPUTER

Add a new computer to the domain. This action will fail with status STATUS_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED if the user has exceeded the maximum number of computer accounts that they are allowed to create.

After the computer account is created, the password will be set for it. If COMPUTER_NAME is set, that value will be used and the module will fail if the selected name is already in use. If COMPUTER_NAME is not set, a random value will be used.

DELETE_COMPUTER

Delete a computer from the domain. This action requires that the COMPUTER_NAME option be set.

LOOKUP_COMPUTER

Lookup a computer in the domain. This action verifies that the specified computer exists, and looks up its security ID (SID), which includes the relative ID (RID) as the last component.

Scenarios

Windows Server 2019

First, a new computer account is created and its details are logged to the database.

msf6 auxiliary(admin/dcerpc/samr_computer) > set RHOSTS 192.168.159.96
RHOSTS => 192.168.159.96
msf6 auxiliary(admin/dcerpc/samr_computer) > set SMBUser aliddle
SMBUser => aliddle
msf6 auxiliary(admin/dcerpc/samr_computer) > set SMBPass Password1
SMBPass => Password1
msf6 auxiliary(admin/dcerpc/samr_computer) > show options 

Module options (auxiliary/admin/dcerpc/samr_computer):

   Name               Current Setting  Required  Description
   ----               ---------------  --------  -----------
   COMPUTER_NAME                       no        The computer name
   COMPUTER_PASSWORD                   no        The password for the new computer
   RHOSTS             192.168.159.96   yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit
   RPORT              445              yes       The target port (TCP)
   SMBDomain          .                no        The Windows domain to use for authentication
   SMBPass            Password1        no        The password for the specified username
   SMBUser            aliddle          no        The username to authenticate as


Auxiliary action:

   Name          Description
   ----          -----------
   ADD_COMPUTER  Add a computer account


msf6 auxiliary(admin/dcerpc/samr_computer) > run
[*] Running module against 192.168.159.96

[*] 192.168.159.96:445 - Using automatically identified domain: MSFLAB
[+] 192.168.159.96:445 - Successfully created MSFLAB\DESKTOP-2X8F54QG$ with password MCoDkNALd3SdGR1GoLhqniEkWa8Me9FY
[*] Auxiliary module execution completed
msf6 auxiliary(admin/dcerpc/samr_computer) > creds
Credentials
===========

host            origin          service        public             private                           realm   private_type  JtR Format
----            ------          -------        ------             -------                           -----   ------------  ----------
192.168.159.96  192.168.159.96  445/tcp (smb)  DESKTOP-2X8F54QG$  MCoDkNALd3SdGR1GoLhqniEkWa8Me9FY  MSFLAB  Password      

msf6 auxiliary(admin/dcerpc/samr_computer) >

Go back to menu.

Msfconsole Usage

Here is how the admin/dcerpc/samr_computer auxiliary module looks in the msfconsole:

msf6 > use auxiliary/admin/dcerpc/samr_computer

msf6 auxiliary(admin/dcerpc/samr_computer) > show info

       Name: SAMR Computer Management
     Module: auxiliary/admin/dcerpc/samr_computer
    License: Metasploit Framework License (BSD)
       Rank: Normal

Provided by:
  JaGoTu
  Spencer McIntyre

Module side effects:
 ioc-in-logs

Available actions:
  Name             Description
  ----             -----------
  ADD_COMPUTER     Add a computer account
  DELETE_COMPUTER  Delete a computer account
  LOOKUP_COMPUTER  Lookup a computer account

Check supported:
  No

Basic options:
  Name               Current Setting  Required  Description
  ----               ---------------  --------  -----------
  COMPUTER_NAME                       no        The computer name
  COMPUTER_PASSWORD                   no        The password for the new computer
  RHOSTS                              yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit
  RPORT              445              yes       The target port (TCP)
  SMBDomain          .                no        The Windows domain to use for authentication
  SMBPass                             no        The password for the specified username
  SMBUser                             no        The username to authenticate as

Description:
  Add, lookup and delete computer accounts via MS-SAMR. By default 
  standard active directory users can add up to 10 new computers to 
  the domain. Administrative privileges however are required to delete 
  the created accounts.

References:
  https://github.com/SecureAuthCorp/impacket/blob/master/examples/addcomputer.py

Module Options

This is a complete list of options available in the admin/dcerpc/samr_computer auxiliary module:

msf6 auxiliary(admin/dcerpc/samr_computer) > show options

Module options (auxiliary/admin/dcerpc/samr_computer):

   Name               Current Setting  Required  Description
   ----               ---------------  --------  -----------
   COMPUTER_NAME                       no        The computer name
   COMPUTER_PASSWORD                   no        The password for the new computer
   RHOSTS                              yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit
   RPORT              445              yes       The target port (TCP)
   SMBDomain          .                no        The Windows domain to use for authentication
   SMBPass                             no        The password for the specified username
   SMBUser                             no        The username to authenticate as

Auxiliary action:

   Name          Description
   ----          -----------
   ADD_COMPUTER  Add a computer account

Advanced Options

Here is a complete list of advanced options supported by the admin/dcerpc/samr_computer auxiliary module:

msf6 auxiliary(admin/dcerpc/samr_computer) > show advanced

Module advanced options (auxiliary/admin/dcerpc/samr_computer):

   Name                     Current Setting    Required  Description
   ----                     ---------------    --------  -----------
   CHOST                                       no        The local client address
   CPORT                                       no        The local client port
   ConnectTimeout           10                 yes       Maximum number of seconds to establish a TCP connection
   DCERPC::ReadTimeout      10                 yes       The number of seconds to wait for DCERPC responses
   NTLM::SendLM             true               yes       Always send the LANMAN response (except when NTLMv2_session is specified)
   NTLM::SendNTLM           true               yes       Activate the 'Negotiate NTLM key' flag, indicating the use of NTLM responses
   NTLM::SendSPN            true               yes       Send an avp of type SPN in the ntlmv2 client blob, this allows authentication on Windows 7+/Server 2008 R2+
                                                         when SPN is required
   NTLM::UseLMKey           false              yes       Activate the 'Negotiate Lan Manager Key' flag, using the LM key when the LM response is sent
   NTLM::UseNTLM2_session   true               yes       Activate the 'Negotiate NTLM2 key' flag, forcing the use of a NTLMv2_session
   NTLM::UseNTLMv2          true               yes       Use NTLMv2 instead of NTLM2_session when 'Negotiate NTLM2' key is true
   Proxies                                     no        A proxy chain of format type:host:port[,type:host:port][...]
   SMB::AlwaysEncrypt       true               yes       Enforces encryption even if the server does not require it (SMB3.x only). Note that when it is set to false,
                                                          the SMB client will still encrypt the communication if the server requires it
   SMB::ChunkSize           500                yes       The chunk size for SMB segments, bigger values will increase speed but break NT 4.0 and SMB signing
   SMB::Native_LM           Windows 2000 5.0   yes       The Native LM to send during authentication
   SMB::Native_OS           Windows 2000 2195  yes       The Native OS to send during authentication
   SMB::ProtocolVersion     1,2,3              yes       One or a list of coma-separated SMB protocol versions to negotiate (e.g. "1" or "1,2" or "2,3,1")
   SMB::VerifySignature     false              yes       Enforces client-side verification of server response signatures
   SMBDirect                true               no        The target port is a raw SMB service (not NetBIOS)
   SMBName                  *SMBSERVER         yes       The NetBIOS hostname (required for port 139 connections)
   SSL                      false              no        Negotiate SSL/TLS for outgoing connections
   SSLCipher                                   no        String for SSL cipher - "DHE-RSA-AES256-SHA" or "ADH"
   SSLServerNameIndication                     no        SSL/TLS Server Name Indication (SNI)
   SSLVerifyMode            PEER               no        SSL verification method (Accepted: CLIENT_ONCE, FAIL_IF_NO_PEER_CERT, NONE, PEER)
   SSLVersion               Auto               yes       Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate) (Accepted: Auto, TLS, SSL
                                                         23, SSL3, TLS1, TLS1.1, TLS1.2)
   VERBOSE                  false              no        Enable detailed status messages
   WORKSPACE                                   no        Specify the workspace for this module

Auxiliary Actions

This is a list of all auxiliary actions that the admin/dcerpc/samr_computer module can do:

msf6 auxiliary(admin/dcerpc/samr_computer) > show actions

Auxiliary actions:

   Name             Description
   ----             -----------
   ADD_COMPUTER     Add a computer account
   DELETE_COMPUTER  Delete a computer account
   LOOKUP_COMPUTER  Lookup a computer account

Evasion Options

Here is the full list of possible evasion options supported by the admin/dcerpc/samr_computer auxiliary module in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 auxiliary(admin/dcerpc/samr_computer) > show evasion

Module evasion options:

   Name                             Current Setting  Required  Description
   ----                             ---------------  --------  -----------
   DCERPC::fake_bind_multi          true             no        Use multi-context bind calls
   DCERPC::fake_bind_multi_append   0                no        Set the number of UUIDs to append the target
   DCERPC::fake_bind_multi_prepend  0                no        Set the number of UUIDs to prepend before the target
   DCERPC::max_frag_size            4096             yes       Set the DCERPC packet fragmentation size
   DCERPC::smb_pipeio               rw               no        Use a different delivery method for accessing named pipes (Accepted: rw, trans)
   SMB::obscure_trans_pipe_level    0                yes       Obscure PIPE string in TransNamedPipe (level 0-3)
   SMB::pad_data_level              0                yes       Place extra padding between headers and data (level 0-3)
   SMB::pad_file_level              0                yes       Obscure path names used in open/create (level 0-3)
   SMB::pipe_evasion                false            yes       Enable segmented read/writes for SMB Pipes
   SMB::pipe_read_max_size          1024             yes       Maximum buffer size for pipe reads
   SMB::pipe_read_min_size          1                yes       Minimum buffer size for pipe reads
   SMB::pipe_write_max_size         1024             yes       Maximum buffer size for pipe writes
   SMB::pipe_write_min_size         1                yes       Minimum buffer size for pipe writes
   TCP::max_send_size               0                no        Maxiumum tcp segment size.  (0 = disable)
   TCP::send_delay                  0                no        Delays inserted before every send.  (0 = disable)

Go back to menu.

Error Messages

This module may fail with the following error messages:

Error Messages

Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.

Unable to authenticate ([<E.CLASS>] <E>).

Here is a relevant code snippet related to the "Unable to authenticate ([<E.CLASS>] <E>)." error message:

69:	    end
70:	
71:	    begin
72:	      smb_login
73:	    rescue Rex::Proto::SMB::Exceptions::Error, RubySMB::Error::RubySMBError => e
74:	      fail_with(Failure::NoAccess, "Unable to authenticate ([#{e.class}] #{e}).")
75:	    end
76:	    report_service(
77:	      host: rhost,
78:	      port: rport,
79:	      host_name: simple.client.default_name,

Unable to connect to the remote IPC$ share ([<E.CLASS>] <E>).

Here is a relevant code snippet related to the "Unable to connect to the remote IPC$ share ([<E.CLASS>] <E>)." error message:

83:	    )
84:	
85:	    begin
86:	      @tree = simple.client.tree_connect("\\\\#{sock.peerhost}\\IPC$")
87:	    rescue RubySMB::Error::RubySMBError => e
88:	      fail_with(Failure::Unreachable, "Unable to connect to the remote IPC$ share ([#{e.class}] #{e}).")
89:	    end
90:	
91:	    begin
92:	      @samr = connect_samr
93:	      @server_handle = @samr.samr_connect

Connection failed (DCERPC fault: <E.STATUS_NAME>)

Here is a relevant code snippet related to the "Connection failed (DCERPC fault: <E.STATUS_NAME>)" error message:

91:	    begin
92:	      @samr = connect_samr
93:	      @server_handle = @samr.samr_connect
94:	    rescue RubySMB::Dcerpc::Error::FaultError => e
95:	      elog(e.message, error: e)
96:	      fail_with(Failure::UnexpectedReply, "Connection failed (DCERPC fault: #{e.status_name})")
97:	    end
98:	
99:	    if datastore['SMBDomain'].blank? || datastore['SMBDomain'] == '.'
100:	      all_domains = @samr.samr_enumerate_domains_in_sam_server(server_handle: @server_handle).map(&:to_s).map(&:encode)
101:	      all_domains.delete('Builtin')

No domains were found on the SAM server.

Here is a relevant code snippet related to the "No domains were found on the SAM server." error message:

98:	
99:	    if datastore['SMBDomain'].blank? || datastore['SMBDomain'] == '.'
100:	      all_domains = @samr.samr_enumerate_domains_in_sam_server(server_handle: @server_handle).map(&:to_s).map(&:encode)
101:	      all_domains.delete('Builtin')
102:	      if all_domains.empty?
103:	        fail_with(Failure::NotFound, 'No domains were found on the SAM server.')
104:	      elsif all_domains.length > 1
105:	        print_status("Enumerated domains: #{all_domains.join(', ')}")
106:	        fail_with(Failure::BadConfig, 'The SAM server has more than one domain, the target must be specified.')
107:	      end
108:

The SAM server has more than one domain, the target must be specified.

Here is a relevant code snippet related to the "The SAM server has more than one domain, the target must be specified." error message:

101:	      all_domains.delete('Builtin')
102:	      if all_domains.empty?
103:	        fail_with(Failure::NotFound, 'No domains were found on the SAM server.')
104:	      elsif all_domains.length > 1
105:	        print_status("Enumerated domains: #{all_domains.join(', ')}")
106:	        fail_with(Failure::BadConfig, 'The SAM server has more than one domain, the target must be specified.')
107:	      end
108:	
109:	      @domain_name = all_domains.first
110:	      print_status("Using automatically identified domain: #{@domain_name}")
111:	    else

Could not find an unused computer name.

Here is a relevant code snippet related to the "Could not find an unused computer name." error message:

132:	      computer_name = random_hostname
133:	      4.downto(0) do |attempt|
134:	        break if @samr.samr_lookup_names_in_domain(domain_handle: @domain_handle, names: [ computer_name ]).nil?
135:	
136:	        computer_name = random_hostname
137:	        fail_with(Failure::BadConfig, 'Could not find an unused computer name.') if attempt == 0
138:	      end
139:	    else
140:	      computer_name = datastore['COMPUTER_NAME']
141:	      if @samr.samr_lookup_names_in_domain(domain_handle: @domain_handle, names: [ computer_name ])
142:	        fail_with(Failure::BadConfig, 'The specified computer name already exists.')

The specified computer name already exists.

Here is a relevant code snippet related to the "The specified computer name already exists." error message:

137:	        fail_with(Failure::BadConfig, 'Could not find an unused computer name.') if attempt == 0
138:	      end
139:	    else
140:	      computer_name = datastore['COMPUTER_NAME']
141:	      if @samr.samr_lookup_names_in_domain(domain_handle: @domain_handle, names: [ computer_name ])
142:	        fail_with(Failure::BadConfig, 'The specified computer name already exists.')
143:	      end
144:	    end
145:	
146:	    result = @samr.samr_create_user2_in_domain(
147:	      domain_handle: @domain_handle,

This action requires COMPUTER_NAME to be specified.

Here is a relevant code snippet related to the "This action requires COMPUTER_NAME to be specified." error message:

190:	    print_good("Successfully created #{@domain_name}\\#{computer_name} with password #{password}")
191:	    report_creds(@domain_name, computer_name, password)
192:	  end
193:	
194:	  def action_delete_computer
195:	    fail_with(Failure::BadConfig, 'This action requires COMPUTER_NAME to be specified.') if datastore['COMPUTER_NAME'].blank?
196:	    computer_name = datastore['COMPUTER_NAME']
197:	
198:	    details = @samr.samr_lookup_names_in_domain(domain_handle: @domain_handle, names: [ computer_name ])
199:	    fail_with(Failure::BadConfig, 'The specified computer was not found.') if details.nil?
200:	    details = details[computer_name]

The specified computer was not found.

Here is a relevant code snippet related to the "The specified computer was not found." error message:

194:	  def action_delete_computer
195:	    fail_with(Failure::BadConfig, 'This action requires COMPUTER_NAME to be specified.') if datastore['COMPUTER_NAME'].blank?
196:	    computer_name = datastore['COMPUTER_NAME']
197:	
198:	    details = @samr.samr_lookup_names_in_domain(domain_handle: @domain_handle, names: [ computer_name ])
199:	    fail_with(Failure::BadConfig, 'The specified computer was not found.') if details.nil?
200:	    details = details[computer_name]
201:	
202:	    handle = @samr.samr_open_user(domain_handle: @domain_handle, user_id: details[:rid])
203:	    @samr.samr_delete_user(user_handle: handle)
204:	    print_good('The specified computer has been deleted.')

This action requires COMPUTER_NAME to be specified.

Here is a relevant code snippet related to the "This action requires COMPUTER_NAME to be specified." error message:

203:	    @samr.samr_delete_user(user_handle: handle)
204:	    print_good('The specified computer has been deleted.')
205:	  end
206:	
207:	  def action_lookup_computer
208:	    fail_with(Failure::BadConfig, 'This action requires COMPUTER_NAME to be specified.') if datastore['COMPUTER_NAME'].blank?
209:	    computer_name = datastore['COMPUTER_NAME']
210:	
211:	    details = @samr.samr_lookup_names_in_domain(domain_handle: @domain_handle, names: [ computer_name ])
212:	    if details.nil?
213:	      print_error('The specified computer was not found.')

The specified computer was not found.

Here is a relevant code snippet related to the "The specified computer was not found." error message:

208:	    fail_with(Failure::BadConfig, 'This action requires COMPUTER_NAME to be specified.') if datastore['COMPUTER_NAME'].blank?
209:	    computer_name = datastore['COMPUTER_NAME']
210:	
211:	    details = @samr.samr_lookup_names_in_domain(domain_handle: @domain_handle, names: [ computer_name ])
212:	    if details.nil?
213:	      print_error('The specified computer was not found.')
214:	      return
215:	    end
216:	    details = details[computer_name]
217:	    sid = @samr.samr_rid_to_sid(object_handle: @domain_handle, rid: details[:rid]).to_s
218:	    print_good("Found #{@domain_name}\\#{computer_name} (SID: #{sid})")

Go back to menu.

References

See Also

Check also the following modules related to this module:

Authors

  • JaGoTu
  • Spencer McIntyre

Version

This page has been produced using Metasploit Framework version 6.2.23-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.