Dump remote SAM from within metasploit?

[Dissident85]

Hi all, I was just wondering how I go about dumping the SAM on a remote computer that I have just exploited? For example if I wanted to dump the SAM of a computer that I have physical access to from within Backtrack I would do something like

# bkhive /mnt/win/WINDOWS/system32/config/system key.txt

Then

# samdump2 /mnt/win/WINDOWS/system32/config/sam key.txt

So how would I do the same thing from a shell spawned from with in metasploit? How would I transfer over these programs? I remember reading something somewhere that you can use “debug” in windows to rebuild a program, I cant remember where I read that. but I know it is possible.

I also know there is the samjucer add on for metapeter, but I am having enough trouble using metapeter as it is…

Any help would be greatly appreciated.

[Tully]

"debugging" in windows has nothing to do with this, your trying to get the system file and the sam file onto your box, or you could upload another program like pwdump2 to the box and then pwn the hashes off that way

http://www.ethicalhacker.net/compone...4/topic,533.0/

[Dissident85]

"debugging" in windows has nothing to do with this, your trying to get the system file and the sam file onto your box, or you could upload another program like pwdump2 to the box and then pwn the hashes off that way

http://www.ethicalhacker.net/compone...4/topic,533.0/

yes, but there is a way to use debug to upload those programs... i have seen it done before.. just cant remember how.

also that tute on Ethical Hacker uses "meterpreter" i haven't been able to get the metapeter payload working... but if i did it would be easier to use samjucer

[hawaii67]

Use the meterpreter_reverse_tcp payload, this should work. The meterpreter_reverse_http payload is sometimes instable.

Then type:

meterpreter> use priv
meterpreter> hashdump

[Dissident85]

Use the meterpreter_reverse_tcp payload, this should work. The meterpreter_reverse_http payload is sometimes instable.

Then type:

meterpreter> use priv
meterpreter> hashdump

Ok, ill give that a go...

Also i did some more research and what i found was that using debug you can unassemble a program, then use debug to assemble it again. Which allows you to send a program over a shell. Just having a little trouble finding out how you would pipe the output / send it back.

[Tully]

if you cant get meterpreter working then just start an ftp service on your bt box then ftp from the popped box, simple send/receive

[imported_relik]

Ok, ill give that a go...

Also i did some more research and what i found was that using debug you can unassemble a program, then use debug to assemble it again. Which allows you to send a program over a shell. Just having a little trouble finding out how you would pipe the output / send it back.

Yes theres a way to convert binary to hexadecimal in a specific format and deliver it and use windows debug to convert it back to an executable. Theres a 64kb limit through windows debug... Theres a tool out there that my team wrote that gets past that, its in fast-track, but if you want to convert something like samdump, you can use a tool in the windows-binary folder, its called exe2hex or something like that, just do wine exe2hex <filename> and it will convert it to the format you need to echo into a text file and run debug to covert it.

But for the purposes your talking about, the above commands will dump the SAM for you.