The following module will extract the domain hashes to a format similar to the output of Metasploit hashdump command. These modules rely on the Invoke-Mimikatz PowerShell script in order to execute Mimikatz commands related to DCSync. Both modules needs to be executed from the perspective of domain administrator and they are using Microsoft replication services.

PowerShell Empire has two modules which can retrieve domain hashes via the DCSync attack. Mimikatz – Dump domain hashes via lsadump Empire The password hashes of the domain users will retrieved. Lsadump::dcsync /domain:pentestlab.local /user:testĪlternatively executing Mimikatz directly in the domain controller password hashes can be dumped via the lsass.exe process. Lsadump::dcsync /domain:pentestlab.local /all /csvīy specifying the domain username with the /user parameter Mimikatz can dump all the account information of this particular user including his password hash. Therefore it is the standard technique for red teams as it is less noisy. This technique eliminates the need to authenticate directly with the domain controller as it can be executed from any system that is part of the domain from the context of domain administrator. Mimikatz has a feature (dcsync) which utilises the Directory Replication Service (DRS) to retrieve the password hashes from the NTDS.DIT file. There are various techniques that can be used to extract this file or the information that is stored inside it however the majority of them are using one of these methods: This file can be found in the following Windows location: The NTDS.DIT file is constantly in use by the operating system and therefore cannot be copied directly to another location for extraction of information. These hashes are stored in a database file in the domain controller (NTDS.DIT) with some additional information like group memberships and users. It is very common during penetration tests where domain administrator access has been achieved to extract the password hashes of all the domain users for offline cracking and analysis.

Hash 7 decrypt