Add a DiskShadow module to automate NTDS.dit dumping via DiskShadow over WinRM

[0xbaas]

When we have Backup Operators privileges on a domain controller, NetExec’s backup_operator module can retrieve hashes from the local SAM. However, retrieving domain account hashes requires access to both NTDS.dit and the SYSTEM hive.

Because NTDS.dit is locked while the domain controller is running, obtaining these files through DiskShadow currently requires several manual steps (https://github.com/k4sth4/SeBackupPrivilege). I've built a WinRM module that automates this process remotely.

(Optional): Suggest A Solution

I have built an ntds_shadow module that confirms SeBackupPrivilege, creates a DiskShadow snapshot, downloads NTDS.dit and the SYSTEM hive, and removes the remote artifacts and shadow copy afterward.

Hash extraction is out of scope, but the module prints the exact secretsdump command needed to process the downloaded files which is better imo.

The implementation includes tests and has been manually validated across multiple labs. Claude assisted with parts of the development, but I reviewed and tested the code myself.

--

[NeffIsBack]

Hi and thanks for the feature suggestion!

How would an extraction over WinRM look like? Do you need the DLL on the target system or can you simply execute commands to create the backup files?

[0xbaas]

No they are not needed. The module only uses built-in Windows tools.

[NeffIsBack]

Sounds good, feel free to open up a PR so that we can take a look at it :)