Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add UserResetInformation to samr.py in USER_INFORMATION_CLASS #1743

Merged
merged 1 commit into from
May 16, 2024
Merged

Add UserResetInformation to samr.py in USER_INFORMATION_CLASS #1743

merged 1 commit into from
May 16, 2024

Conversation

Adamkadaban
Copy link
Contributor

Based on https://github.com/gtworek/PSBits/blob/master/Misc2/ReadResetData.c

I've tested and confirmed this works by modifying the samrdump.py example file.

Relevant code to test:

dce = rpctransport.get_dce_rpc()
dce.connect()
dce.bind(samr.MSRPC_UUID_SAMR)

r = samr.hSamrOpenUser(dce, domainHandle, samr.MAXIMUM_ALLOWED, user['RelativeId'])
info = samr.hSamrQueryInformationUser(dce, r['UserHandle'], samr.USER_INFORMATION_CLASS.UserResetInformation)

# print out security question answers on windows
firstUser = info[0]

print(firstUser['Buffer']['Reset']['ResetData'])

Adamkadaban added a commit to Adamkadaban/NetExec that referenced this pull request May 8, 2024
this module will dump security questions and answers for all users on the machine assuming run as administrator

requires this PR to work: fortra/impacket#1743
@Adamkadaban
Copy link
Contributor Author

A more complete proof of concept can be seen here: Pennyw0rth/NetExec#295

@mpgn
Copy link
Contributor

mpgn commented May 15, 2024

Hello @anadrianmanrique hope you are doing well :)

This PR is useful for netexec as a module is linked to this code.

@anadrianmanrique anadrianmanrique added the medium Medium priority item label May 15, 2024
@anadrianmanrique anadrianmanrique self-assigned this May 15, 2024
@anadrianmanrique anadrianmanrique merged commit 5bccf8d into fortra:master May 16, 2024
9 checks passed
@anadrianmanrique
Copy link
Contributor

It's now merged.Thanks for the PR!

Marshall-Hallenbeck pushed a commit to Adamkadaban/NetExec that referenced this pull request Jun 18, 2024
this module will dump security questions and answers for all users on the machine assuming run as administrator

requires this PR to work: fortra/impacket#1743
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
medium Medium priority item
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants