Ldap Change Password module - Githubissues

rapid7 / metasploit-framework

Metasploit Framework

https://www.metasploit.com/

Other

34.23k stars 14k forks source link

Ldap Change Password module #19671

Open smashery opened 17 hours ago

smashery commented 17 hours ago

This adds a module, auxiliary/admin/ldap/change_password, for changing/resetting AD passwords over the LDAP protocol.

Actions:

CHANGE: Changing an existing (known password).
RESET: Forcing a password reset by having privileges over the target account.

Works on both standard 389 and SSL-encrypted on 636 (since we use GSS-API encryption)

Verification

Do the test cases below with:

NTLM auth
Existing LDAP session (mostly meaningful for the Reset behaviour, but technically you can run Change from an existing session, as long as you know and set the password)
Kerberos auth

Main use cases:

[ ] Change password for user (happy path)
[ ] Change password for user (failing cases)
[ ] Reset password for user (happy path)
[ ] Reset password for user (failing cases)