Conversation
zblurx
changed the title
|
Note: Notice a bug when chaining SAM and LSA dump, DCOM session gets disconnected. Maybe it's related to the fact the every time we need a namespace, we instanciate a new one instead of reuse existing one. Maybe some refacto needed here |
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Update: It was the case. The refacto fixed it. Now NTDS dump is working, and we can chain SAM LSA and NTDS: 
|
|
Added an option to reuse existing ShadowCopy |
|
Hi @zblurx, how about the download speed? it's fast or not? BTW, the download file method is awesome, looks really OPSEC, and another thing is the powershell namespace only works on system >= 2012, win7/08 won't |
Hey, in my lab the ntds.dit file is 16 Mo and it takes approximately 8 seconds to get the file. I have not tested but I guess for big NTDS (like 10K+ users) it can take some time.
Yes, I have not found a workaround for that... |
Can U test this patch? |
Use tradition event subscription to do that XD, if powershell namespace not existed, then fallback to event subscription. https://github.com/XiaoliChan/wmiexec-Pro/blob/main/lib/modules/hashdump.py#L98 |
Tested, it does not change anything. I guess the changes I have made in impacket are similar |
Great, great |
Signed-off-by: zblurx <68540460+zblurx@users.noreply.github.com>
NeffIsBack
left a comment
NeffIsBack
left a comment
There was a problem hiding this comment.
The only problem at the moment seems to be a download limit of somewhere between 50MB and 100MB. Therefore, my 700MB NTDS.dit file couldn't be downloaded and the ntds dump broke.
Rest looks good.
Signed-off-by: zblurx <68540460+zblurx@users.noreply.github.com>
|
Hello, Thanks all for the work, I'm a big fan of the "remoteSSwmi" method and can't wait to use it with netexec. The download method seems really funny but indeed quite slow. Is it worth it to create a SMB module to have it or do you find it redundant ? |
SMB have |
Indeed but it is using command execution on the host + vssadmin right ? I mean creating shadow copy using wmi and retrieving the file with SMB only to avoid any command execution. |
No, u can read the source code from impacket, it’s already update by this PR fortra/impacket#1719 The VSS in NetExec is doing same thing as remoteSS stuff, basically remote call win32_shadowcopy |
I'm aware of this PR yes, I use it a lot with secretsdump it's surprisingly good opsec for an impacket script :) But it seems that nxc smb --ntds vss uses -use-vss instead of --use-remoteSS (I have the last commit for both nxc and impacket). |
Wait... you are right; I just messed it up, sorry, current didn't add the
For this, if we can do it all over WMI, then why do we need to use SMB (to create another connection; this would be really noisy) |
No problem!
Ok, then do you think this could be a good feature as a SMB module ? If so I will maybe make a PR. |
Sure, please add For For |
|
Why are we using vss instead of remoteSS in the first place if vss does command execution? |
Yes, just check imapcket source code, vss did |
I believe it's only remains of the past. Should I make a PR ? I believe it would correspond to #1360. |
Yeah but why are we using |
No, @snowpeacock is talking about the |
Hmm okay, what's the advantage over this PR tho? Having everything natively in wmi was the reason we closed #1370 as duplicate. |
NeffIsBack
left a comment
NeffIsBack
left a comment
There was a problem hiding this comment.
Code looks good so far (one small thing/comment that could be improved). Afterwards we should also integrate wmi in dpapi dumping.
|
|
||
| wql = f"SELECT FileSize FROM CIM_DataFile WHERE Name = '{escaped_path}'" | ||
| self.wmi_query(wql=wql, namespace="//./root/cimv2", callback_func=callback_func) | ||
| # If file is bigger than 70MB, print a warning |
There was a problem hiding this comment.
Can you add a comment about why we limit it to 70MB? The thing with the default transfer limit and how you can check it, just that we know in the future why we did what we did
5 participants
Description
Add a full WMI SAM and LSA dump without command execution. There is a required change in Impacket for this to work, but nothing fancy.
I'm also going to implement NTDS dump this way
PR in Impacket : fortra/impacket#2268
For now I pushed the Impacket changes into PennyW0rth fork
Type of change
Insert an "x" inside the brackets for relevant items (do not delete options)
Setup guide for the review
Any Windows system
Screenshots (if appropriate):
Checklist:
Insert an "x" inside the brackets for completed and relevant items (do not delete options)
poetry run ruff check ., use--fixto automatically fix what it can)tests/e2e_commands.txtfile if necessary (new modules or features are required to be added to the e2e tests)