diff --git a/payloads/SAM Dumper/README.md b/payloads/SAM Dumper/README.md new file mode 100644 index 0000000..79e14d5 --- /dev/null +++ b/payloads/SAM Dumper/README.md @@ -0,0 +1,22 @@ +# SAM Dumper + +### Description: + +#### 1: Sam_Dumper.ino:
+A small but useful powershell script which works by dumping all the SAM, System, Security files from windows registry and sending them on +remote location.
+ +**Instuctions:**
+Before using it make sure the WebHook.site hook is set in SAM_Dumper.ino which you will find in the payload. After you will receive the dumps +they will be base64 encoded you can decode them by saving them in file and using following command in powershell which i have used to encode them.
+ +1. Save Base64 encoded dump into file e.g; SAM.base64. +2. Use certutils to decode the file with following command
+**"certutil.exe -decode SAM.base64 SAM.plain"** +3. Do the same with reset of the files and use your favourite LM/NTLM password Cracker to get passwords oPhCrack, Hashcat, Cain&Able etc. + + +**Tested on:**
+**OS**: Windows 10|8|7
+**User**: Admin
+**Hardware**: ATtiny85 (Chinese)