Re: PSEXEC - Pass the Hash - Domain Credentials

[HD Moore <hdm () metasploit com>]

On 1/30/2010 5:28 PM, troy () defendit com au wrote:
> Meterpreter can not dump cached credentials, so I use smb_relay and get
> the impersonated account to map to my smb_relay and capture the challenge
> response. Which looks like:

As jcran said, those tokens are not the raw LM/NTLM hash, they are the
hash encrypted against the challenge ID. Normally, you would just set
SMBPASS LMHASH:NTLMHASH, but in this case you still don't have the raw
hashes to work with. One way to solve this is by using your SMB relayed
session to run hashdump, then use those hashes with PTH.

-HD
_______________________________________________
https://mail.metasploit.com/mailman/listinfo/framework