While attempting to pull hashes from memory on a Windows 10 system using Meterpreter hashdump, you receive the following error: "priv_passwd_get_sam_hashes: Operation failed: The parameter is incorrect." What could you do to obtain the hashes from memory?

Question

While attempting to pull hashes from memory on a Windows 10 system using Meterpreter hashdump, you receive the following error: "priv_passwd_get_sam_hashes: Operation failed: The parameter is incorrect." What could you do to obtain the hashes from memory?

Accepted Answer

Migrate to the lsass.exe process and then run hashdump

Answer

Restart Metasploit with root privileges

Answer

Run the getprivs command in Meterpreter and then run hashdump

Answer

Run the command again, since it sometimes takes a few tries for commands to run properly

Crowdly

While attempting to pull hashes from memory on a Windows 10 system using Meterpr...

Want instant access to all verified answers on moodle.excomunicado.fun?