6.2. Dumping Usernames and Passwords

In the preceding example, we grabbed password hashes by logging what a user typed. We can also use Meterpreter to obtain the usernames and password hashes on a local file system without the use of keyloggers.

6.2.1. Extracting the Password Hashes

In this attack, we’ll leverage the hashdump post exploitation module in Meterpreter to extract the username and password hashes from the system. Microsoft typically stores hashes on LAN Manager (LM), NT LAN Manager (NTLM), and NT LAN Manager v2 (NTLMv2).