search

gentilkiwi / mimikatz

A little tool to play with Windows security
http://blog.gentilkiwi.com/mimikatz
19.3k stars 3.7k forks source link

Dump ms-FVE-RecoveryInformation (Bitlocker Recovery Information) with DCSync #371

Closed matrix closed 3 years ago

matrix commented 3 years ago

Hi,

I modified lsadump::dcsync to dump the ms-FVE-RecoveryInformation class (Bitlocker Recovery Information).

I also added "szOID_ANSI_currentValue" to "kuhl_m_lsadump_dcsync_oids_export", as I haven't found a way to directly call that object using the parameters set up for dcsync.

Thanks

gentilkiwi commented 3 years ago

It seems very good for me :) Just edited one part, more about coding rule.

Could you please post some example / outpout of result on your test env ?

matrix commented 3 years ago

very well :) below is an example using

lsadump::dcsync /domain:[REDACTED] /all /export

mimikatz - dcsync bitlocker dump