Added LDAP query searching for likely Pre-Windows-2000 computers

[smashery]

This PR implements a search for computer accounts created with the "Assign this computer account as a pre-Windows 2000 computer" checkbox marked. These accounts are initially created with their own computer name (sans dollar-sign, all lowercase) as the password. We also return the logon count attribute; if it's zero, it's highly likely that the password hasn't been changed.

Verification

• In an AD domain, create a new computer, ticking the "Pre-Windows 2000" checkbox
• Start msfconsole
• use ldap_query
• set action ENUM_PRE_WINDOWS_2000_COMPUTERS
• run
• Verify that this account is returned, with the logonCount attribute included.

Demo

msf6 auxiliary(gather/ldap_query) > set action ENUM_PRE_WINDOWS_2000_COMPUTERS
action => ENUM_PRE_WINDOWS_2000_COMPUTERS
msf6 auxiliary(gather/ldap_query) > run rhost=4.237.57.48 username=admin password=Password123 domain=msf.local
[*] Running module against 4.237.57.48

[*] 4.237.57.48:389 Discovered base DN: DC=msf,DC=local
CN=pre2k,CN=Computers,DC=msf,DC=local
=====================================

 Name                Attributes
 ----                ----------
 cn                  pre2k
 logoncount          1
 samaccountname      PRE2K$
 useraccountcontrol  4128

[*] Query returned 1 result.
[*] Auxiliary module execution completed

[adfoster-r7]

Do you think in this scenario the identified computer objects should be registered as a vulnerability in the database? 🤔

[smcintyre-r7]

Probably not. At this point we don't know for sure that the password is weak, and if it is, that should be reported by the module who successfully authenticates with it. Saying that the password was recovered through some means is a more meaningful representation of the vulnerability where as looking for pre-Windows 2000 computers is more akin to target generation.

[smcintyre-r7]

metasploit-framework (S:0 J:0) auxiliary(gather/ldap_query) > run
[*] Running module against 192.168.159.10

[+] Successfully bound to the LDAP server!
[*] 192.168.159.10:389 Discovered base DN: DC=msflab,DC=local
CN=IMINDANGER,CN=Computers,DC=msflab,DC=local
=============================================

 Name                Attributes
 ----                ----------
 cn                  IMINDANGER
 logoncount          0
 samaccountname      IMINDANGER$
 useraccountcontrol  4128

[*] Query returned 1 result.
[*] Auxiliary module execution completed
metasploit-framework (S:0 J:0) auxiliary(gather/ldap_query) >

[smcintyre-r7]

Release Notes

This adds a new LDAP query to enumerate computer accounts that were created with the "pre-Windows 2000 computer" option. These accounts may have weak passwords that can be brute-forced.