feat(smb): add sswmi (WMI shadow snapshot) dump method to --sam/--lsa/--ntds

[hakimonr]

Description

Adds sswmi as a new dump method for --sam, --lsa and --ntds on the SMB protocol, plus --sswmi-volume to pick the remote volume. Closes #1360.

The idea came from an engagement where the current methods (regdump/secdump/vss) were all blocked by the EDR, while impacket-secretsdump -use-remoteSSWMI went through without any alert. That method creates a shadow snapshot via WMI (Win32_ShadowCopy) and downloads the hives over SMB — no code execution on the target. impacket already ships this (RemoteOperations.createSSandDownloadWMI) in the version NetExec pins, so no new dependency is required.

AI assistance: the implementation was drafted with help from DeepSeek V4 Flash (current version). The code was reviewed, tested and validated by me against a live target (details in the Setup guide below).

Technique reference: impacket's -use-remoteSSWMI (https://github.com/fortra/impacket/blob/master/examples/secretsdump.py) and the underlying RemoteOperations.createSSandDownloadWMI (https://github.com/fortra/impacket/blob/master/impacket/examples/secretsdump.py).

Type of change

Insert an "x" inside the brackets for relevant items (do not delete options)

• New feature (non-breaking change which adds functionality)
• Bug fix (non-breaking change which fixes an issue)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Deprecation of feature or functionality
• This change requires a documentation update
• This requires a third party update (such as Impacket, Dploot, lsassy, etc)
• This PR was created with the assistance of AI (list what type of assistance, tool(s)/model(s) in the description)

Setup guide for the review

Tested against a Windows 10 IoT Enterprise LTSC target (DESKTOP-J6FIUBI) from a Kali Linux box (Python 3.13), with a local admin account (Pwn3d!).

What is needed to reproduce:

• Target: Windows host with admin credentials (the method requires local admin, same as the other dump methods)
• Open ports: 445 (SMB, for the hive download) and 135/DCOM (WMI, for the shadow snapshot creation)
• On the target, remote UAC filtering must be disabled for non-builtin admin accounts: LocalAccountTokenFilterPolicy = 1 under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System (this is a common requirement for remote admin tools, not specific to this change)
• No additional software on the attacker side; the required impacket code path is already in the pinned revision

Commands used:

netexec smb <target> -u <admin> -p <password> --sam sswmi
netexec smb <target> -u <admin> -p <password> --lsa sswmi
netexec smb <target> -u <admin> -p <password> --sam sswmi --lsa sswmi   # shares one snapshot
netexec smb <target> -u <admin> -p <password> --ntds sswmi              # DC only, not yet tested

Screenshots (if appropriate):

Example output from the live test:

SMB 192.168.1.110 445 DESKTOP-J6FIUBI [+] DESKTOP-J6FIUBI\caesar1:caesar (Pwn3d!)
SMB 192.168.1.110 445 DESKTOP-J6FIUBI [*] Creating remote Shadow Snapshot on C:\ via WMI and downloading hives
SMB 192.168.1.110 445 DESKTOP-J6FIUBI [+] Shadow Snapshot downloaded to /tmp/nxcdata/tmp/nxc_sswmi_fo_ptm4j
SMB 192.168.1.110 445 DESKTOP-J6FIUBI [*] Dumping SAM hashes
SMB 192.168.1.110 445 DESKTOP-J6FIUBI Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
SMB 192.168.1.110 445 DESKTOP-J6FIUBI caesar1:1004:aad3b435b51404eeaad3b435b51404ee:dc8814c441f4f7dbeb057c897f3a2fb3:::
SMB 192.168.1.110 445 DESKTOP-J6FIUBI [+] Added 6 SAM hashes to the database

Checklist:

Insert an "x" inside the brackets for completed and relevant items (do not delete options)

• I have ran Ruff against my changes (poetry: poetry run ruff check ., use --fix to automatically fix what it can)
• I have added or updated the tests/e2e_commands.txt file if necessary (new modules or features are required to be added to the e2e tests)
• If reliant on changes of third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
• I have linked relevant sources that describes the added technique (blog posts, documentation, etc)
• I have performed a self-review of my own code (not an AI review)
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)

[github-actions]

It looks like the PR template may not have been filled out. The following sections appear to be missing:

• Description

• Type of change

• Setup guide for the review

• Checklist

Please edit your PR description to include them. The template helps reviewers understand and test your changes. Thanks!

[NeffIsBack]

Thanks for the PR.

However, @zblurx has figured out why retrieving the files via wmi was bugged. Since this now works perfectly fine we have an shadow copy dump method natively in wmi and from what I can tell this is therefore duplicate to #1379