+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Pentesting and Forensics (https://hackforums.net/forumdisplay.php?fid=231)
+---- Thread: Memory dump on a windows pc with UAC enabled? (/showthread.php?tid=5395197)
Memory dump on a windows pc with UAC enabled? - chaose_marine - Sep 3, 2016
I was thinking through some ideas so i could write come exploit scripts 😏 with the help of volatility and I've ran in to a problem, how would i go about getting a memory dump of a windows (7) PC that has UAC enabled.
I've seen plenty of tools which get memory dumps, but have yet to find a way to get a memory dump with UAC.
Are there any tools out there that any one knows of that can do this?
Or
Is there a way to get a memory dump with Python?
* - craig131 - Sep 3, 2016
Yeah, UAC does not take kindly to that kind of thing. The Invoke-BypassUAC.ps1 script on Powershell Empire (it's also a metasploit module 'bypassuac') can be used to get around it.
* - chaose_marine - Sep 5, 2016
(Sep 3, 2016 09:18 PM)craig131 Wrote: Yeah, UAC does not take kindly to that kind of thing. The Invoke-BypassUAC.ps1 script on Powershell Empire (it's also a metasploit module 'bypassuac') can be used to get around it.
Thanks for the reply man. Personally I've tried to avoid metasploit as much as i can so i could learn the ins and outs first hand so i'm lacking in that department, could you maybe go into a little more detail on how i could do this?
Also would i be able to call this said script from in python?
Thank you
* - phuqer - Sep 5, 2016
As mentioned before its a powershell script which can be run in powershell empire.
Do some searching on powershell empire.
* - chaose_marine - Sep 7, 2016
(Sep 5, 2016 04:20 PM)phuqer Wrote: As mentioned before its a powershell script which can be run in powershell empire.
Do some searching on powershell empire.
Cool, Thanks for the help