Data Collection Commands

5 Data Collection commands from the Post-Exploitation category, each with its placeholders, supported authentication methods and upstream references.

Tools covered: impacket-ntfs-read, nxc, smbclient

• Impacket NTFS-Read (Offline NTDS Browse) Browse a raw NTFS image (e.g. a VSS shadow copy of C:\Windows\NTDS) offline as if it were a filesystem. Use…
• NetExec RDP Screenshot Capture a screenshot of the current RDP login screen / desktop without authenticating into a session. Useful…
• NetExec SMB BitLocker Recovery Keys Retrieve BitLocker recovery keys stored in Active Directory
• NetExec WMI bitlocker Module Pull BitLocker recovery keys from a host over WMI. Faster than the SMB equivalent in environments where…
• SMBClient Recursive Download Download folder recursively from SMB share