smashery commented 1 week ago

This PR adds some features to the windows_secrets_dump module, and fixes a bug.

Add the ability to perform a DCSync for an individual user or group.
Add the ability to only request Users (rather than also computers) or vice versa
Incidentally fixed a bug wherein the DC was queried multiple times for the same information, if there are other DCs present in the environment.

Verification

List the steps needed to make sure this thing works

[x] Start msfconsole
[x] use windows_secrets_dump
[x] Test the settings for KRB_TYPES (request users only, or computers only, or both)
[x] Test the settings for KRB_USERS (request an individual group, or user, or a comma-separated list of either)
[x] Verify the fix for the multi-DCSync query (multiple DCs should only result in a single query per user)

smcintyre-r7 commented 1 week ago

I've landed the RubySMB changes, so once this is updated to pull them in, I can get this merged too.

smcintyre-r7 commented 4 days ago

Release Notes

This updates the DOMAIN action of the auxiliary/gather/windows_secrets_dump module to allow individual users or groups to be targeted.