Windows Manage List Shadow Copies
This module will attempt to list any Volume Shadow Copies on the system. This is based on the VSSOwn Script originally posted by Tim Tomes and Mark Baggett. Works on win2k3 and later.
Rank
- Normal
Authors
- thelightcosine < thelightcosine [at] metasploit.com >
Vulnerability References
Development
Similar Modules
- post/windows/manage/add_user_domain
- post/windows/manage/autoroute
- post/windows/manage/delete_user
- post/windows/manage/download_exec
- post/windows/manage/enable_rdp
- post/windows/manage/inject_ca
- post/windows/manage/inject_host
- post/windows/manage/migrate
- post/windows/manage/multi_meterpreter_inject
- post/windows/manage/nbd_server
Usage Information
$ msfconsole
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use post/windows/manage/vss_list
msf post(vss_list) > set SESSION [INTEGER]
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use post/windows/manage/vss_list
msf post(vss_list) > set SESSION [INTEGER]
Module Options
| SESSION | The session to run this module on. |
| VERBOSE | Enable detailed status messages |
| WORKSPACE | Specify the workspace for this module |