Metasploit Revealed: Secrets of the Expert Pentester

Obtaining password hashes using hashdump

Once we gain system privileges, we can quickly figure out the login password hashes from the compromised system by issuing the hashdump command, as follows:

Once we have found out the password hashes, we can launch a pass-the-hash attack on the target system.

For more information on pass-the-hash attacks, refer to https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/.

You can refer to an excellent video explaining pass-the-hash attacks and their mitigation at https://www.youtube.com/watch?v=ROvGEk4JG94.