Cobalt Strike BOF that Add a user to localgroup by samr.
Build
git clone https://github.com/AgeloVito/adduserbysamr-bof.git
make
And load adduserbysamr.cna
Usage
beacon> help adduserbysamr
Use: adduserbysamr [username] [password] [groupName]
e.g: adduserbysamr sysadmin [email protected]
adduserbysamr sysadmin [email protected] Administrators
adduserbysamr sysadmin [email protected] "Remote Desktop Users"
Add a user to localgroup by samr, groupName is "Administrators" by default, do not use it at AD.
Refence
https://loong716.top/posts/MS_SAMR_Tips/
https://idiotc4t.com/redteam-research/netuseradd-ni-xiang
https://learn.microsoft.com/zh-cn/windows/win32/secmgmt/built-in-and-account-domains