πŸ†• Dump with BackupOperator Priv

{% hint style="success" %}
You don't need to local admin privilege on the remote target if you are in SeBackupPrivilege
{% endhint %}

If the controlled user has the SeBackupPrivilege, it can dump SAM, SYSTEM, SECURITY and therefore the NTDS.dit on the target system. No admin privs needed!

nxc smb <ip> -u <username> -p <password> -M backup_operator