Is there any module that can tell if the server is a workgroup, member server or a domain controller?

[flamecopper]

For eample, if it detects port 389 , 3268. It also shows a common name of AD-WIN.OFFICE.LOCALNET.
Is there any module that we can do to identify the potential methods of silver, gold ticket and kerberoasting?

[bcoles]

Is there any module that we can do to identify the potential methods of silver, gold ticket and kerberoasting?

You can use the Gather Ticket Granting Service (TGS) tickets for User Service Principal Names (SPN) module:

• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/get_user_spns.py

You may also want to look at the Kerberos Domain User Enumeration module:

• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/kerberos_enumusers.rb

[flamecopper]

Thanks, commonly we will need to use these command:
net user /domain -> this is a domain user
net user user-one /domain -> show the avaliable domain users
.\Rubeus.exe brute /users:users.txt /passwords:passwords.txt /domain:jurassic.park /outfile:jurassic_passwords.txt

Any in MSF?

[bcoles]

Thanks, commonly we will need to use these command:
net user /domain -> this is a domain user
net user user-one /domain -> show the avaliable domain users

You can drop to a shell from Meterpreter with the shell command. This will allow you to run commands.

.\Rubeus.exe brute /users:users.txt /passwords:passwords.txt /domain:jurassic.park /outfile:jurassic_passwords.txt

There are many login brute force modules, although I'm not sure about Kerberos brute forcing. You can find these in auxiliary/scanner, such as:

• modules/auxiliary/scanner/smb/smb_login.rb
• modules/auxiliary/scanner/winrm/winrm_login.rb

Any in MSF?

There are many post exploitation modules to gather information. You will find these in post/*/gather, such as:

• modules/post/windows/gather/enum_domain_users.rb

You can find documentation here:

• https://docs.metasploit.com/

You can find module documentation here:

• https://github.com/rapid7/metasploit-framework/tree/master/documentation/modules

[flamecopper]

Is there any module that we can do to identify the potential methods of silver, gold ticket and kerberoasting?

You can use the Gather Ticket Granting Service (TGS) tickets for User Service Principal Names (SPN) module:

• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/get_user_spns.py

You may also want to look at the Kerberos Domain User Enumeration module:

• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/kerberos_enumusers.rb

Hi BColes,

I am facing a situation whereby I am need to do pivoting to get access to the server that is domain controller.
Is there a way whereby I can "login" to the pivoted server with MSF console.
I was able to RDP from the first host, after RDP again within that host.
I managed to find that Username and Password of that pivoted host after bruteforce.
#16232
Reason why I ask is because I can't do it via the exploit method, although I found a remote code execution vulnerability and it crash. I would like to run some post exploit using metasploit.

TLDR: In short, is there a way to "login" with metasploit if you already know the username and password beforehand?