VMkatz

VMkatz Too Big to Steal You are three weeks into a red team engagement. You land on a NAS attached to the virtualization cluster — hundreds of gigabytes of .vmdk, .vmsn, .sav sitting right there. But your link does 200 KB/s. Exfiltrating a single 100 GB disk would take six days. VMkatz exists...

PsExec NTDS.dit And SYSTEM Hive Download Utility

This module authenticates to an Active Directory Domain Controller and creates a volume shadow copy of the %SYSTEMDRIVE%. It then pulls down copies of the ntds.dit file as well as the SYSTEM hive and stores them. The ntds.dit and SYSTEM hive copy can be used in combination with other tools for...