local msrpc = require "msrpc" local smb = require "smb" local stdnse = require "stdnse" local string = require "string" local table = require "table" description = [[ Obtains a list of groups from the remote Windows system, as well as a list of the group's users. This works similarly to enum.exe with the /G switch. The following MSRPC functions in SAMR are used to find a list of groups and the RIDs of their users. Keep in mind that MSRPC refers to groups as "Aliases". * Bind: bind to the SAMR service. * Connect4: get a connect_handle. * EnumDomains: get a list of the domains. * LookupDomain: get the RID of the domains. * OpenDomain: get a handle for each domain. * EnumDomainAliases: get the list of groups in the domain. * OpenAlias: get a handle to each group. * GetMembersInAlias: get the RIDs of the members in the groups. * Close: close the alias handle. * Close: close the domain handle. * Close: close the connect handle. Once the RIDs have been termined, the * Bind: bind to the LSA service. * OpenPolicy2: get a policy handle. * LookupSids2: convert SIDs to usernames. I (Ron Bowes) originally looked into the possibility of using the SAMR function LookupRids2 to convert RIDs to usernames, but the function seemed to return a fault no matter what I tried. Since enum.exe also switches to LSA to convert RIDs to usernames, I figured they had the same issue and I do the same thing. ]] --- -- @usage -- nmap --script smb-enum-users.nse -p445 -- sudo nmap -sU -sS --script smb-enum-users.nse -p U:137,T:139 -- -- @output -- Host script results: -- | smb-enum-groups: -- | | WINDOWS2003\HelpServicesGroup: SUPPORT_388945a0 -- | | WINDOWS2003\IIS_WPG: SYSTEM, SERVICE, NETWORK SERVICE, IWAM_WINDOWS2003 -- | | WINDOWS2003\TelnetClients: -- | | Builtin\Print Operators: -- | | Builtin\Replicator: -- | | Builtin\Network Configuration Operators: -- | | Builtin\Performance Monitor Users: -- | | Builtin\Users: INTERACTIVE, Authenticated Users, ron, ASPNET, test -- | | Builtin\Power Users: -- | | Builtin\Backup Operators: -- | | Builtin\Remote Desktop Users: -- | | Builtin\Administrators: Administrator, ron, test -- | | Builtin\Performance Log Users: NETWORK SERVICE -- | | Builtin\Guests: Guest, IUSR_WINDOWS2003 -- |_ |_ Builtin\Distributed COM Users: ----------------------------------------------------------------------- author = "Ron Bowes" copyright = "Ron Bowes" license = "Same as Nmap--See http://nmap.org/book/man-legal.html" categories = {"discovery","intrusive"} dependencies = {"smb-brute"} hostrule = function(host) return smb.get_port(host) ~= nil end action = function(host) local status, groups = msrpc.samr_enum_groups(host) if(not(status)) then return stdnse.format_output(false, "Couldn't enumerate groups: " .. groups) end local response = {} for domain_name, domain_data in pairs(groups) do for rid, group_data in pairs(domain_data) do local members = group_data['members'] if(#members > 0) then members = stdnse.strjoin(", ", group_data['members']) else members = "" end table.insert(response, string.format("%s\\%s (RID: %s): %s", domain_name, group_data['name'], rid, members)) end end return stdnse.format_output(true, response) end