Skip to main content
Pulling credential material straight out of Active Directory’s database, rather than from any single host. Two routes get there: abusing AD’s own replication protocol to ask a Domain Controller for the data directly (DCSync), or pulling the raw NTDS.dit database file off a DC and parsing it offline. Both end with the same thing, every domain account’s password hash, including krbtgt.

DCSync

Impersonate a Domain Controller over the Directory Replication Service protocol and ask another DC to just hand over the hashes. No file access, no disk I/O on the DC at all.

NTDS.dit Extraction

Pull the actual database file off a DC’s disk (live via a shadow copy, or from a backup/clone) and parse the hashes out of it offline.

​
DCSync

Domain Controllers normally replicate directory data between each other using the Directory Replication Service Remote Protocol (MS-DRSR). DCSync abuses this directly: any principal holding the DS-Replication-Get-Changes and DS-Replication-Get-Changes-All extended rights on the domain object can ask a DC for that data too, the DC has no way to tell the request apart from a legitimate replication partner. Domain Admins, Enterprise Admins, and DCs themselves hold these rights by default, so does anything granted the combined DCSync right via ACL abuse.
No agent or admin session on the DC itself is ever touched, this makes DCSync one of the quietest ways to get the krbtgt hash needed for a Golden Ticket.

​
NTDS.dit Extraction

NTDS.dit holds the same data DCSync retrieves, but as a locked database file on the DC’s disk, it can’t just be copied while the system is running. SeBackupPrivilege covers the diskshadow method of getting the file off a live DC, it’s just as often obtained from a DC backup or a cloned/virtualized DC’s disk (see Hyper-V Administrators) instead. Once the NTDS.dit file (plus the SYSTEM hive, needed to decrypt it) is in hand run:
lsadump::lsa /patch is a related but different Mimikatz technique, it dumps every domain hash live, directly on a DC, rather than parsing an offline NTDS.dit copy. No file extraction step at all.