CloudCopy
CloudCopy implements a cloud version of the Shadow Copy attack to extract domain user hashes from AWS-hosted domain controllers by creating and mounting volume snapshots.
CloudCopy
CloudCopy implements a cloud version of the Shadow Copy attack to extract domain user hashes from AWS-hosted domain controllers by creating and mounting volume snapshots.
CloudCopy Description
CloudCopy is a cloud-based implementation of the Shadow Copy attack technique specifically designed to target domain controllers running in AWS environments. The tool exploits AWS EC2 permissions to extract domain user credentials from Active Directory systems. The attack methodology involves leveraging EC2:CreateSnapshot permissions to create snapshots of domain controller volumes, then mounting these snapshots to attacker-controlled instances. This allows extraction of critical Active Directory files including NTDS.dit and SYSTEM registry hive files. The tool operates in two modes: Profile mode for unencrypted volumes and Manual mode for encrypted volumes. The attack process includes creating snapshots of target instances, modifying snapshot permissions, launching new EC2 instances with the stolen snapshots, and extracting authentication data for use with credential dumping tools like Impacket's secretsdump. CloudCopy demonstrates how cloud infrastructure permissions can be abused to perform traditional on-premises attacks in cloud environments, specifically targeting Windows domain controllers hosted on AWS EC2 instances.
CloudCopy FAQ
Common questions about CloudCopy including features, pricing, alternatives, and user reviews.
CloudCopy is CloudCopy implements a cloud version of the Shadow Copy attack to extract domain user hashes from AWS-hosted domain controllers by creating and mounting volume snapshots. It is a Security Operations solution designed to help security teams with Post Exploitation, Red Team, AWS.
