rapid7/metasploit-framework — pull request #1024 by R3dy (2012-11-06 23:40:11+00:00)
Title: Added new standalone tool ntds_hashextract.rb

ntds_hashextract.rb
--------------------------

Is a standalone tool that extracts AD password hashes from an exported datable and a SYSTEM hive file.

Royces-MacBook-Pro:tools r3dy$ ./ntds_hashextract.rb
USAGE: ./ntds_hashextract.rb [datatable] [SYSTEM HIVE]

Royces-MacBook-Pro:tools r3dy$

As far as I can tell it works perfectly as long as the datatable was properly exported from NTDS.dit using Libesedb or equivalent tools.