Enumerate User and Groups Change a User Password SMB Access from

From rpcclient, enumerate user and group settings: Change a user's password on the Windows system Linux Cheat Sheet
using rpcclient with the chgpasswd3 username
• enumdomusers: Enumerate users
oldpass newpass command. POCKET REFERENCE GUIDE
• enumalsgroups domain: Enumerate domain
groups
SANS Institute
rpcclient $> chgpasswd3 josh oldpass Prepared exclusively for SANS SEC504
• enumalsgroups builtin: Enumerate local
newpass
system groups
• enumdomains: Enumerate domain information Purpose
• enumprivs: Enumerate user system privileges
Enumerate Password Policy Information Accessing Windows systems through the SMB and
• lookupnames username: Identify the SID for
the username RPC protocols from Linux systems can be complex.
Use rpcclient to enumerate Windows password Use this guide as a quick reference to simplify this
• queryuser RID#: Identify user information
for the given user relative ID number policy information with the getdompwinfo and task.
getusrdompwinfo RID# commands:
Create a New User
rpcclient $> getdompwinfo What to use this sheet for
min_password_length: 5
Create a new user on the remote Windows system As an analyst, you may be called upon to interrogate
password_properties: 0x00000000
using rpcclient with the createdomuser Windows workstation or server systems from a Linux
rpcclient $> getusrdompwinfo 1000
username command. min_password_length: 5 host. This could be following an attack when you
&info.password_properties: need to pivot from Linux to Windows, when you are
rpcclient $> createdomuser username 0xb7d1c734 (3083978548) assessing target systems using Slingshot Linux, or
rpcclient $> setuserinfo2 username 24 0: DOMAIN_PASSWORD_COMPLEX any other situation where you have a Linux terminal
'NewPassword' 0: DOMAIN_PASSWORD_NO_ANON_CHANGE and need to access a Windows system.
1: DOMAIN_PASSWORD_NO_CLEAR_CHANGE
This cheat sheet covers several tools for collecting
In this example, the 24 value represents necessary 0: DOMAIN_PASSWORD_LOCKOUT_ADMINS
Windows system information from a Linux host.
Windows information class constant to set a user 1: DOMAIN_PASSWORD_STORE_CLEARTEXT
password. The value will always be 24 when setting a 1: DOMAIN_REFUSE_PASSWORD_CHANGE
password. Authentication Required
In this output we see that getdompwinfo reveals the
Create a New Share minimum password length of 5. In order to use the smbclient and rpcclient
Running getusrdompwinfo followed by a user RID tools, you will need to authenticate to the Windows
Create a new share on the remote Windows system (the first standard user is RID 1000, which can be target. Specify a username with -U username. Both
using rpcclient with the netshareadd command. determined with queryuser) indicates a collection of tools will prompt for a password. Alternatively, you
password settings, including that the server does not can specify the --pw-nt-hash argument, and
rpcclient $> netshareadd "C:\Windows" enforce a password complexity policy supply the NT hash value at the password prompt to
"Windows" 10 "Windows Share"
(DOMAIN_PASSWORD_COMPLEX is 0). conduct a pass-the-hash attack instead.
 Enumerate Windows File Shares Retrieve Files from Windows File Share Connect to Windows RPC Endpoint

Use smbclient to enumerate a list of file shares: Use smbclient to retrieve files from a Windows file Connect to a target Windows system through the
share, similar to an FTP client: RPC endpoint to interrogate system information
$ smbclient -L ip -U username using rpcclient:
$ smbclient -U username //ip/share
You will be required to authenticate to the server. $ rpcclient -U username ip
Replace ip with the IP address or host name of the After authenticating you will see a smb :\> prompt.
target system; replace username with a valid Use the following commands to navigate and access After authenticating you will see a rpclient $>
username (using domain\\username syntax for a the file share: prompt. Here you can issue RPC interrogation
domain user). commands to retrieve information from the server.
• ls: List files and directories
• cd directory: Change to a specified Enumerate Windows System Information
Protocol Negotiation Failed Troubleshooting directory
From the rpcclient prompt, enumerate Windows
• get filename: Retrieve a file
By default smbclient will connect using SMBv1. If system information using the srvinfo command:
• mget file1 file2: Retrieve multiple files
you receive the error message protocol negotiation • put filename: Upload a file
failed when connecting, add the argument -m SMB2 rpcclient $> srvinfo
• mput file1 file2: Upload multiple files 10.10.0.1 Wk Sv NT PtB LMB
or -m SMB3 to specify SMBv2 or SMBv3 as the
• mkdir directory: Make a directory Sec504Student
minimum security protocol to use when accessing the
• more filename: Examine the contents of a platform_id : 500
server. os version : 10.0
text file
• tar c all.tar: Retrieve all of the files in server type : 0x51003
$ smbclient -L ip -U username -m SMB2
the current share directory and subdirectories
into a local tar file called all.tar Enumerate Shortcut
You can use this feature to evaluate what the
minimum SMB version is for the server: • exit: Close the session
From the rpcclient prompt, you can enumerate
$ smbclient -L ip -U username -m NT1 system information using several of the enum
Run Noninteractively
$ smbclient -L ip -U username -m SMB2 commands. To get a list, type enum followed by the
$ smbclient -L ip -U username -m SMB3 All rpcclient commands can be run Tab key twice at the rpcclient prompt:
noninteractively with the -c argument, allowing you rpcclient $> enum<TabTab>
If all succeed, then the server supports all versions of to redirect the output to a file, or pipe to another enumalsgroups enumdomusers
SMB (including legacy versions, which exposes the command-line tool: enummonitors enumprocs
server to attack). If one or more fail, the next one enumdata enumdrivers enumports ...
that succeeds is the minimum SMB version $ rpcclient -U username ip -c
supported. "enumdomusers" > domusers.txt