Shadow Copies
A Shadow Copy, also known as Volume Shadow Service (VSS)
is a Microsoft backup technology
that allows creation of snapshots of files or entire volumes.
To manage volume shadow copies,
the Microsoft signed binary vshadow.exe is offered as part of the Windows SDK.
As domain admins, we have the ability to abuse the vshadow utility
to create a Shadow Copy that will allow us to extract the Active Directory Database
NTDS.dit database file.
Once we’ve obtained a copy of said database,
we can extract every user credential offline on our local Kali machine.
To start off, we’ve connected as the jeffadmin domain admin user
to the DC1 domain controller and launched from an elevated prompt
the vshadow utility with -nw options to disable writers,
which speeds up backup creation
and include the -p option to store the copy on disk.
Once the snapshot has been taken successfully,
we should take note of the shadow copy device name.
We’ll now copy the whole AD Database from the shadow copy
to the C: drive root folder by specifying the shadow copy device name
and append the full ntds.dit path.
As a last ingredient, to correctly extract the content of ntds.dit,
we need to save the SYSTEM hive from the Windows registry.
We can accomplish this with the reg utility and the save argument.
Once the two .bak files are moved to our Kali machine,
we can continue extracting the credential materials
with the secretsdump tool from the impacket suite.
We’ll supply the ntds database and the system hive
via -ntds and -system respectively,
along with the LOCAL keyword to parse the files locally.
Great! We managed to obtain NTLM hashes and Kerberos keys for every AD user,
which can now be further cracked or used as-is through pass-the-hash attacks.