使用ntds_hashextractDumpntds密码

原文：https://www.pentestgeek.com/2012/11/16/dumping-domain-password-hashes-using-metasploit-ntds_hashextract-rb/
ntds_hashextract.rb是一个可以从NTDS.dit 导出的时间表中快速提取密码hash的工具。
第一步：安装Libesedb包
[color=blue]wget http://libesedb.googlecode.com/files/libesedb-alpha-20120102.tar.gz
tar xvzf libesedb-alpha-20120102.tar.gz
cd libesedb-20120102
./configure
make && make install[/color]
第二步：从NTDS.dit中到处表
应该在本地准备一份NTDS.dit和SYSTEM registry hive文件
[img]http://dl2.iteye.com/upload/attachment/0101/6849/76d3870d-1ec9-3af2-b01d-7611a9b1ca88.png[/img]
使用[color=blue]esedbexport[/color]，将会生成一个叫ntds.export的新文件夹
[img]http://dl2.iteye.com/upload/attachment/0101/6851/c6b43ad3-3d0f-329b-b004-2c5d0b7889de.png[/img]
第三步：dump hash
[color=blue]ruby /opt/metasploit/msf3/tools/ntds_hashextract.rb ntds.export datatable.3 sys[/color]
[img]http://dl2.iteye.com/upload/attachment/0101/6853/856be75a-3740-3d52-9d02-d3986848b78a.png[/img]