Penetration Testing mailing list archives
Re: Copying secret windows file
From: Marco Ivaldi <raptor () mediaservice net>
Date: Thu, 27 Dec 2007 16:08:01 +0100 (ora solare Europa occidentale)
Hi Clone, On Fri, 21 Dec 2007, Clone wrote:
Hello AllWhat is the most sensitive file you could remotely copy from a Windows 2003 server in case you have a remote access available to entire file system through an exploit? I tried copying SAM file from windows system root but that isn't happening. It says being used by some other process. Is there any other way to get this file? The SAM repair file is old and doesn't have my domain password cached(well does that really happens?).
You may dump the current local/domain passwords using the following tools: http://www.foofus.net/fizzgig/pwdump/ http://meshier.com/2007/03/08/auditing-cached-credentials-with-cachedump/ http://www.metasploit.com/projects/antiforensics/SamJuicer.zip [and more]If you can get RDP access or similar and need to recover an actual file that has been locked by Windows (i.e. Exchange email DBs, etc.), you can use the NTBACKUP.EXE utility shipped with modern Windows installations. Just type "ntbackup" at the CMD prompt and follow the wizard...
Otherwise, you could write your own "backup" software using the Shadow Copy (VSS) feature. For more information, take a look here:
http://en.wikipedia.org/wiki/Shadow_Copy http://en.wikipedia.org/wiki/File_locking Hope this helps;) -- Marco Ivaldi, OPST Chief Security Officer Data Security Division @ Mediaservice.net Srl http://mediaservice.net/ ------------------------------------------------------------------------ This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solution FREE today! http://www.cenzic.com/downloads ------------------------------------------------------------------------
Current thread:
- Copying secret windows file Clone (Dec 23)
- Re: Copying secret windows file Shreyas Zare (Dec 27)
- Re: Copying secret windows file Marco Ivaldi (Dec 27)
- <Possible follow-ups>
- Re: Copying secret windows file jwbensley (Dec 27)
- Re: Re: Copying secret windows file cwright (Dec 27)