carnal0wnage [Shared Reader]

Wednesday, June 30, 2010

more with rpcclient

Got asked to help remotely locate local admins on boxes on a network.

rpcclient $> enumalsgroups
Usage: enumalsgroups builtin|domain [access mask]

rpcclient $> enumalsgroups builtin

group:[Administrators] rid:[0x220]

group:[Backup Operators] rid:[0x227]

group:[Guests] rid:[0x222]

group:[Network Configuration Operators] rid:[0x22c]

group:[Power Users] rid:[0x223]

group:[Remote Desktop Users] rid:[0x22b]

group:[Replicator] rid:[0x228]

group:[Users] rid:[0x221]

Now you would think that doing a querygroup would give you the right output, but actually you get a:

rpcclient $> querygroup 0x220

Honestly I have no idea why this doesn't work, it *should*. If anyone knows why it doesn't I know more than one person who would like to know.

Anyway it takes one more step but you can do it this way:

rpcclient $> queryaliasmem
Usage: queryaliasmem builtin|domain rid [access mask]

rpcclient $> queryaliasmem builtin 0x220



Then you can look up who those SIDs belong to

rpcclient $> lookupsids

Usage: lookupsids [sid1 [sid2 [...]]]

rpcclient $> lookupsids S-1-5-21-1214440339- 1383384898-839522115-500
S-1-5-21-1214440339-1383384898-839522115-500 PC\Administrator (1)

rpcclient $> lookupsids
S-1-5-21-1214440339-1383384898-839522115-1003 PC\user (1)

rpcclient $> lookupsids
S-1-5-21-2392188729-2485841371-4291725810-512 rpc_api_pipe: Remote machine pipe \lsarpc fnum 0x4001 returned critical error. Error was Call timed out: server did not respond after 10000 milliseconds result was NT_STATUS_IO_TIMEOUT

Not sure about the 512 (its a MS built-in account I think) but the 1003 was the user I added to the local admins group.


dre said...

I don't think that this will show non-Administrator accounts that have cloned fixed/variable ("F"/"V") values in the registry.

You would have to inspect the registry and look for cloned F/V values of current Administrator accounts in all of the other accounts.

Rainbow Attacks said...

Hi, I have a question, Is it possible to enter NTLM / LM Password Hash instead of Alpha numeric password in RPC Client and then login in remote machine ?

CG said...

not without patching an smbclient or winexe client. foofus had one, not sure if it still works or not.

however, the standard pentest tools, core,canvas,metasploit will take a hash.

pentestmonkey said...

An alternative way to list group members from Linux is to use "/usr/bin/net" (part of the package samba-common-bin on Ubuntu).

$ net rpc group members administrators -I -Uuser%pass
FOO\Enterprise Admins
FOO\Domain Admins

enum4linux will list group members for you (it's a wrapper around rpcclient and other tools).