post/windows/gather/hashdump throws error

[haxpak]

[*] Dumping password hashes...


[-] Post failed: ActiveRecord::RecordInvalid Validation failed: Session can't be blank
[-] Call stack:
[-]   /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/validations.rb:79:in `raise_record_invalid'
[-]   /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/validations.rb:43:in `save!'
[-]   /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/attribute_methods/dirty.rb:29:in `save!'
[-]   /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/transactions.rb:291:in `block in save!'
[-]   /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/transactions.rb:351:in `block in with_transaction_returning_status'
[-]   /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/connection_adapters/abstract/database_statements.rb:213:in `block in transaction'
[-]   /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/connection_adapters/abstract/transaction.rb:184:in `within_new_transaction'
[-]   /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/connection_adapters/abstract/database_statements.rb:213:in `transaction'
[-]   /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/transactions.rb:220:in `transaction'
[-]   /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/transactions.rb:348:in `with_transaction_returning_status'
[-]   /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/transactions.rb:291:in `save!'
[-]   /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/persistence.rb:51:in `create!'
[-]   /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/relation.rb:151:in `block in create!'
[-]   /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/relation.rb:302:in `scoping'
[-]   /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/relation.rb:151:in `create!'
[-]   /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/relation.rb:159:in `first_or_create!'
[-]   /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/metasploit-credential-3.0.3/lib/metasploit/credential/creation.rb:446:in `block in create_credential_origin_session'
[-]   /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/metasploit-credential-3.0.3/lib/metasploit/credential/creation.rb:621:in `retry_transaction'
[-]   /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/metasploit-credential-3.0.3/lib/metasploit/credential/creation.rb:445:in `create_credential_origin_session'
[-]   /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/metasploit-credential-3.0.3/lib/metasploit/credential/creation.rb:358:in `create_credential_origin'
[-]   /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/metasploit-credential-3.0.3/lib/metasploit/credential/creation.rb:119:in `create_credential'
[-]   /usr/share/metasploit-framework/lib/metasploit/framework/data_service/proxy/credential_data_proxy.rb:6:in `block in create_credential'
[-]   /usr/share/metasploit-framework/lib/metasploit/framework/data_service/proxy/core.rb:166:in `data_service_operation'
[-]   /usr/share/metasploit-framework/lib/metasploit/framework/data_service/proxy/credential_data_proxy.rb:5:in `create_credential'
[-]   /usr/share/metasploit-framework/lib/msf/core/auxiliary/report.rb:34:in `create_credential'
[-]   /usr/share/metasploit-framework/modules/post/windows/gather/hashdump.rb:95:in `block in run'
[-]   /usr/share/metasploit-framework/modules/post/windows/gather/hashdump.rb:87:in `each'
[-]   /usr/share/metasploit-framework/modules/post/windows/gather/hashdump.rb:87:in `run'

Steps to reproduce

How'd you do it?

1. Connect to client using meterpreter/x64/reverse_https
2. on meterpreter obtain system -> getsystem
3. bg
4. use post/windows/gather/hashdump
5. set session 1 (session number of active meterpreter session)
6. run

Expected behavior

We should see the hashdump on the screen and also stored in the postgres

What happens instead?

[08/17/2019 11:25:49] [e(0)] core: /usr/share/metasploit-framework/lib/msf/ui/console/command_dispatcher/post.rb:122:in `cmd_run'
[08/17/2019 11:25:49] [e(0)] core: /usr/share/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:523:in `run_command'
[08/17/2019 11:25:49] [e(0)] core: /usr/share/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:474:in `block in run_single'
[08/17/2019 11:25:49] [e(0)] core: /usr/share/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:468:in `each'
[08/17/2019 11:25:49] [e(0)] core: /usr/share/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:468:in `run_single'
[08/17/2019 11:25:49] [e(0)] core: /usr/share/metasploit-framework/lib/rex/ui/text/shell.rb:151:in `run'
[08/17/2019 11:25:49] [e(0)] core: /usr/share/metasploit-framework/lib/metasploit/framework/command/console.rb:48:in `start'
[08/17/2019 11:25:49] [e(0)] core: /usr/share/metasploit-framework/lib/metasploit/framework/command/base.rb:82:in `start'
[08/17/2019 11:25:49] [e(0)] core: /usr/bin/msfconsole:49:in `<main>'
[08/17/2019 11:25:49] [e(0)] core: Post failed: ActiveRecord::RecordInvalid Validation failed: Session can't be blank

OS

Kali Linux

[bwatters-r7]

Can you tell us the target OS and what your database service is (remote/local/none)?

msf5 post(windows/gather/hashdump) > db_status
[*] postgresql selected, no connection

Or

msf5 exploit(windows/smb/psexec) > db_status
[*] Connected to remote_data_service: (https://localhost:5443). Connection type: http. Connection name: local-https-data-service.

I ran it with both the remote DB connection and local disconnected against windows 10x64 and it worked for both.

meterpreter > sysinfo
Computer        : WIN10X64_1511
OS              : Windows 10 (Build 10586).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter > getsystem
...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).
meterpreter > background
[*] Backgrounding session 3...
msf5 exploit(windows/smb/psexec) > use post/windows/gather/hashdump 
msf5 post(windows/gather/hashdump) > set session 3
session => 3
msf5 post(windows/gather/hashdump) > run

[*] Obtaining the boot key...
[*] Calculating the hboot key using SYSKEY 3afb4f40e2ad2583812554f817f390c5...
[*] Obtaining the user list and keys...
[*] Decrypting user keys...
[*] Dumping password hints...

No users with password hints on this system

[*] Dumping password hashes...
[redacted]
[*] Post module execution completed
msf5 post(windows/gather/hashdump) > 

[bcoles]

This issue may be related to #10129. The second part of the issue was never resolved.

That is, the Validation failed: Session can't be blank. See log for more details. error is still thrown if the database is connected after receiving a session.

[bcook-r7]

@haxpak did you reconnect or disconnect the database while framework was running when doing this? Or was the database always connected?

[github-actions]

Hi!

This issue has been left open with no activity for a while now.

We get a lot of issues, so we currently close issues after 60 days of inactivity. It’s been at least 30 days since the last update here.
If we missed this issue or if you want to keep it open, please reply here. You can also add the label "not stale" to keep this issue open!

As a friendly reminder: the best way to see this issue, or any other, fixed is to open a Pull Request.

[github-actions]

Hi again!

It’s been 60 days since anything happened on this issue, so we are going to close it.
Please keep in mind that I’m only a robot, so if I’ve closed this issue in error please feel free to reopen this issue or create a new one if you need anything else.

As a friendly reminder: the best way to see this issue, or any other, fixed is to open a Pull Request.