[WMI] Add SAM, LSA and NTDS dump

[zblurx]

Description

Add a full WMI SAM and LSA dump without command execution. There is a required change in Impacket for this to work, but nothing fancy.

I'm also going to implement NTDS dump this way

PR in Impacket : fortra/impacket#2268
For now I pushed the Impacket changes into PennyW0rth fork

Type of change

Insert an "x" inside the brackets for relevant items (do not delete options)

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Deprecation of feature or functionality
• This change requires a documentation update
• This requires a third party update (such as Impacket, Dploot, lsassy, etc)
• This PR was created with the assistance of AI (list what type of assistance, tool(s)/model(s) in the description)

Setup guide for the review

Any Windows system

Screenshots (if appropriate):

Checklist:

Insert an "x" inside the brackets for completed and relevant items (do not delete options)

• I have ran Ruff against my changes (poetry: poetry run ruff check ., use --fix to automatically fix what it can)
• I have added or updated the tests/e2e_commands.txt file if necessary (new modules or features are required to be added to the e2e tests)
• If reliant on changes of third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
• I have linked relevant sources that describes the added technique (blog posts, documentation, etc)
• I have performed a self-review of my own code (not an AI review)
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)

[zblurx]

Note: Notice a bug when chaining SAM and LSA dump, DCOM session gets disconnected. Maybe it's related to the fact the every time we need a namespace, we instanciate a new one instead of reuse existing one. Maybe some refacto needed here

[zblurx]

Note: Notice a bug when chaining SAM and LSA dump, DCOM session gets disconnected. Maybe it's related to the fact the every time we need a namespace, we instanciate a new one instead of reuse existing one. Maybe some refacto needed here

Update: It was the case. The refacto fixed it. Now NTDS dump is working, and we can chain SAM LSA and NTDS:

[zblurx]

Added an option to reuse existing ShadowCopy

[XiaoliChan]

Hi @zblurx, how about the download speed? it's fast or not?

BTW, the download file method is awesome, looks really OPSEC, and another thing is the powershell namespace only works on system >= 2012, win7/08 won't

[zblurx]

Hi @zblurx, how about the download speed? it's fast or not?

BTW, the download file method is awesome, looks really OPSEC

Hey, in my lab the ntds.dit file is 16 Mo and it takes approximately 8 seconds to get the file. I have not tested but I guess for big NTDS (like 10K+ users) it can take some time.

and another thing is the powershell namespace only works on system >= 2012, win7/08 won't

Yes, I have not found a workaround for that...

[XiaoliChan]

Hey, in my lab the ntds.dit file is 16 Mo and it takes approximately 8 seconds to get the file. I have not tested but I guess for big NTDS (like 10K+ users) it can take some time.

Can U test this patch?
https://github.com/0xthirteen/WMI_Proc_Dump/blob/main/wmi-proc-dump.py#L26

[XiaoliChan]

Yes, I have not found a workaround for that...

Use tradition event subscription to do that XD, if powershell namespace not existed, then fallback to event subscription.

https://github.com/XiaoliChan/wmiexec-Pro/blob/main/lib/modules/hashdump.py#L98

[zblurx]

Hey, in my lab the ntds.dit file is 16 Mo and it takes approximately 8 seconds to get the file. I have not tested but I guess for big NTDS (like 10K+ users) it can take some time.

Can U test this patch? https://github.com/0xthirteen/WMI_Proc_Dump/blob/main/wmi-proc-dump.py#L26

Tested, it does not change anything. I guess the changes I have made in impacket are similar

[XiaoliChan]

Tested, it does not change anything. I guess the changes I have made in impacket are similar

Great, great