Security Slice

smart_hashdump

smart_hashdump

⚠ Use on Domain Controllers only. Use the regular hashdump for non-DCs.

Description

This will dump local accounts from the SAM Database. If the target host is a Domain Controller, it will dump the Domain Account Database using the proper technique depending on privilege level, OS and role of the host.

PlatformWindows
AuthorCarlos Perez
LicenseBSD 3-Clause
URLsmart_hashdump.rb

Usage

Basic options:
  Name       Current Setting  Required  Description
  ----       ---------------  --------  -----------
  GETSYSTEM  false            no        Attempt to get SYSTEM privilege on the target host.
  SESSION                     yes       The session to run this module on

Examples

run post/windows/gather/smart_hashdump

This is all there is to it.

Blog Posts