VMWare Enumerate User Accounts

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##


class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::VIMSoap
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::Scanner

  def initialize
    super(
      'Name'           => 'VMWare Enumerate User Accounts',
      'Description'    => %Q{
        This module will log into the Web API of VMWare and try to enumerate
        all the user accounts. If the VMware instance is connected to one or
        more domains, it will try to enumerate domain users as well.
      },
      'Author'         => ['theLightCosine'],
      'License'        => MSF_LICENSE,
      'DefaultOptions' => { 'SSL' => true }
    )

    register_options(
      [
        Opt::RPORT(443),
        OptString.new('USERNAME', [ true, "The username to Authenticate with.", 'root' ]),
        OptString.new('PASSWORD', [ true, "The password to Authenticate with.", 'password' ])
      ])
  end


  def run_host(ip)
    if vim_do_login(datastore['USERNAME'], datastore['PASSWORD']) == :success
      # Get local Users and Groups
      user_list = vim_get_user_list(nil)
      tmp_users = Rex::Text::Table.new(
        'Header'  => "Users for server #{ip}",
        'Indent'  => 1,
        'Columns' => ['Name', 'Description']
      )
      tmp_groups = Rex::Text::Table.new(
        'Header'  => "Groups for server #{ip}",
        'Indent'  => 1,
        'Columns' => ['Name', 'Description']
      )
      unless user_list.nil?
        case user_list
        when :noresponse
          print_error "Received no response from #{ip}"
        when :expired
          print_error "The login session appears to have expired on #{ip}"
        when :error
          print_error "An error occurred while trying to enumerate the users for #{domain} on #{ip}"
        else
          user_list.each do |obj|
            if obj['group'] == 'true'
              tmp_groups << [obj['principal'], obj['fullName']]
            else
              tmp_users <<  [obj['principal'], obj['fullName']]
            end
          end
          print_good tmp_groups.to_s
          store_loot('host.vmware.groups', "text/plain", datastore['RHOST'], tmp_groups.to_csv , "#{datastore['RHOST']}_esx_groups.txt", "VMWare ESX User Groups")
          print_good tmp_users.to_s
          store_loot('host.vmware.users', "text/plain", datastore['RHOST'], tmp_users.to_csv , "#{datastore['RHOST']}_esx_users.txt", "VMWare ESX Users")
        end
      end

      # Enumerate Domains the Server is connected to
      esx_domains = vim_get_domains
      case esx_domains
      when :noresponse
        print_error "Received no response from #{ip}"
      when :expired
        print_error "The login session appears to have expired on #{ip}"
      when :error
        print_error "An error occurred while trying to enumerate the domains on #{ip}"
      else
        # Enumerate Domain Users and Groups
        esx_domains.each do |domain|
          tmp_dusers = Rex::Text::Table.new(
            'Header'  => "Users for domain #{domain}",
            'Indent'  => 1,
            'Columns' => ['Name', 'Description']
          )

          tmp_dgroups = Rex::Text::Table.new(
            'Header'  => "Groups for domain #{domain}",
            'Indent'  => 1,
            'Columns' => ['Name', 'Description']
          )

          user_list = vim_get_user_list(domain)
          case user_list
          when nil
            next
          when :noresponse
            print_error "Received no response from #{ip}"
          when :expired
            print_error "The login session appears to have expired on #{ip}"
          when :error
            print_error "An error occurred while trying to enumerate the users for #{domain} on #{ip}"
          else
            user_list.each do |obj|
              if obj['group'] == 'true'
                tmp_dgroups << [obj['principal'], obj['fullName']]
              else
                tmp_dusers <<  [obj['principal'], obj['fullName']]
              end
            end
            print_good tmp_dgroups.to_s

            f = store_loot('domain.groups', "text/plain", datastore['RHOST'], tmp_dgroups.to_csv , "#{domain}_esx_groups.txt", "VMWare ESX #{domain} Domain User Groups")
            vprint_status("VMWare domain user groups stored in: #{f}")
            print_good tmp_dusers.to_s
            f = store_loot('domain.users', "text/plain", datastore['RHOST'], tmp_dgroups.to_csv , "#{domain}_esx_users.txt", "VMWare ESX #{domain} Domain Users")
            vprint_status("VMWare users stored in: #{f}")
          end
        end
      end
    else
      print_error "Login failure on #{ip}"
      return
    end
  end
end