live smb regdump command

What it does

Dumps and parses the registry remotely over SMB. Connection is set up using the current user's context. registry hive files will be deleted after command finishes (best effort)

Remarks

None

Requirements

• A user context that has admin rights to the remote machine
• Remote registry service available
• The same user can read the resulting hive files

Subcommands

None

Switches

• host: Target hostname or IP.
• url: SMB connection URL. Please consult the Connection URL section
• --json : Output results in JSON format
• -o or --outfile : Writes the secrets to the specified file

Examples

• pypykatz live smb regdump win2019ad.test.corp: Dumps and parses the registry and prints the results to console.