unable to dump hashes in win7 with meterpreter

I got a meterpreter session on a win7 box; however, I'm unable to use hashdump. I get insufficient privileges. So I tried to use the "keylogrecorder" script, but I need to migrate to winlogon.exe for that, and again, I'm unable to migrate due to insufficient prvs. I used "getprivs," and "set priv" then tried again with same results. I noticed that "getsystem" is not avaiable.... the user that I got my meterpreter session is member of the admin group, yet I'm not able to get any of this command working. I wonder if is b/c UAC, which can be turned off. Is there any script that turn off UAC?...... any help appreciated

Code:

---

meterpreter > use priv
Loading extension priv...success.

---

Code:

---

meterpreter > run hashdump[*] Obtaining the boot key...[*] Calculating the hboot key using SYSKEY b9106b7575965755275b237fe2b54acd...
[-] Meterpreter Exception: Rex::Post::Meterpreter::RequestError stdapi_registry_create_key: Operation failed: 5
[-] This script requires the use of a SYSTEM user context (hint: migrate into service process)
meterpreter >

---

thanks

My bet would be UAC. You could try disabling it manually on the box [since it is your system, right? ;)] for troubleshooting purposes. I have heard that it is theoretically possible to disable UAC remotely, but have never seen a proof of concept.

Quote:

---

Originally Posted by westin

My bet would be UAC. You could try disabling it manually on the box [since it is your system, right? ;)] for troubleshooting purposes. I have heard that it is theoretically possible to disable UAC remotely, but have never seen a proof of concept.

---

I've google for it, but nothing.... but I'm looking for different ways to dump the hashes... I'll let you know