I've exploited test machines using metasploit and was able to get the hashes from the SAM file; I've tried running commands as SYSTEM to get them but am unable to do so. I know you can get the hashes with C&A but want more of a portable solution.
It's not a permission issue – Windows keeps an exclusive lock on the SAM file (which, as far as I know, is standard behavior for loaded registry hives), so it is impossible for any other process to open it.
However, recent Windows versions have a feature called "Volume Shadow Copy", which is designed to create read-only snapshots of the entire volume, mostly for backups. The file locks are there to ensure data consistency, so they are unnecessary if a snapshot of the entire filesystem is made. This means that it is possible to create a snapshot of
How exactly to do this depends on your Windows version: XP needs an external program, Vista and 7 have
Alternatively, there are tools such as
Finally, Google brings out this snippet, whose usefulness I cannot rate having never used metasploit myself:
I have found the answer to my question. While grawity did give me a great answer nonetheless; I must say that I have finally found out how to do this with a simple tool.
Obscuresec method overcomes your dificulties locally on any windows powershell 1.0 enabled machine. Leaves out some targets i know, but hey, nice job ! (thank you Chris).
You could use
or from another source (more recent i might add)
For grabbing remote systems SAM and SYSTEM hives use the above mentioned in conjunction with