Add a DiskShadow module to automate NTDS.dit dumping via DiskShadow over WinRM #1366

When we have Backup Operators privileges on a domain controller, NetExec’s backup_operator module can retrieve hashes from the local SAM. However, retrieving domain account hashes requires access to both NTDS.dit and the SYSTEM hive.

Because NTDS.dit is locked while the domain controller is running, obtaining these files through DiskShadow currently requires several manual steps (https://github.com/k4sth4/SeBackupPrivilege). I've built a WinRM module that automates this process remotely.

(Optional): Suggest A Solution

I have built an ntds_shadow module that confirms SeBackupPrivilege, creates a DiskShadow snapshot, downloads NTDS.dit and the SYSTEM hive, and removes the remote artifacts and shadow copy afterward.

Hash extraction is out of scope, but the module prints the exact secretsdump command needed to process the downloaded files which is better imo.

The implementation includes tests and has been manually validated across multiple labs. Claude assisted with parts of the development, but I reviewed and tested the code myself.

--