Record · corpus.blog/posts/01a08788-95a7-7029-88cb-9ffb80ccb973

Offline Extraction of Symantec Account Connectivity Credentials (ACCs)

itm4n.github.io · published 14 June 2025

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at itm4n.github.io Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
External links: 7
Words captured: 3,597

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://www.mdsec.co.uk/2024/12/extracting-account-connectivity-credentials-accs-from-symantec-management-agent-aka-altiris/

mdsec.co.uk

https://knowledge.broadcom.com/external/article/171889/failed-to-perform-reregister-read-storag.html

knowledge.broadcom.com

https://github.com/hasherezade/pe-bear

github.com

https://learn.microsoft.com/en-us/windows/win32/api/olectl/

learn.microsoft.com

https://learn.microsoft.com/en-us/dotnet/api/system.security.securestring

learn.microsoft.com

https://learn.microsoft.com/en-us/dotnet/fundamentals/reflection/reflection

learn.microsoft.com

https://github.com/itm4n/Pentest-Windows/tree/main/SMAStorageDump

github.com

Elsewhere on itm4n.github.io (15)

Checking for Symantec Account Connectivity Credentials (ACCs) with PrivescCheck Read at the source ↗

itm4n.github.io

https://itm4n.github.io/assets/posts/2025-06-15-offline-extraction-of-symantec-account-connectivity-credentials/evilaltiris-high-decrypt-access-denied.png

itm4n.github.io

https://itm4n.github.io/assets/posts/2025-06-15-offline-extraction-of-symantec-account-connectivity-credentials/hxd-sample-ldb-file.png

itm4n.github.io

https://itm4n.github.io/assets/posts/2025-06-11-checking-symantec-account-credentials-privesccheck/client-policy-file-accs.png

itm4n.github.io

https://itm4n.github.io/assets/posts/2025-06-15-offline-extraction-of-symantec-account-connectivity-credentials/kb-article-cause.png

itm4n.github.io

https://itm4n.github.io/assets/posts/2025-06-15-offline-extraction-of-symantec-account-connectivity-credentials/kb-article-issue-entry-6.png

itm4n.github.io

https://itm4n.github.io/assets/posts/2025-06-15-offline-extraction-of-symantec-account-connectivity-credentials/findstr-readitemstr.png

itm4n.github.io

https://itm4n.github.io/assets/posts/2025-06-15-offline-extraction-of-symantec-account-connectivity-credentials/dnspy-agentstorage-class.png

itm4n.github.io

https://itm4n.github.io/assets/posts/2025-06-15-offline-extraction-of-symantec-account-connectivity-credentials/diagram-agent-storage-ctor.png

itm4n.github.io

https://itm4n.github.io/assets/posts/2025-06-15-offline-extraction-of-symantec-account-connectivity-credentials/pe-bear-agent-dll-exports.png

itm4n.github.io

https://itm4n.github.io/assets/posts/2025-06-15-offline-extraction-of-symantec-account-connectivity-credentials/ghidra-agent-dll-ordinal-100.png

itm4n.github.io

https://itm4n.github.io/assets/posts/2025-06-15-offline-extraction-of-symantec-account-connectivity-credentials/poc-agentstorage-enumitems.png

itm4n.github.io

https://itm4n.github.io/assets/posts/2025-06-15-offline-extraction-of-symantec-account-connectivity-credentials/poc-agentstorage-readitemstr.png

itm4n.github.io

https://itm4n.github.io/assets/posts/2025-06-15-offline-extraction-of-symantec-account-connectivity-credentials/poc-agentstorage-decryptdata.png

itm4n.github.io

https://itm4n.github.io/assets/posts/2025-06-15-offline-extraction-of-symantec-account-connectivity-credentials/poc-smastoragedump.png

itm4n.github.io