NTDS
Sub-technique of T1003 OS Credential Dumping ↗
Copying the Active Directory database (ntds.dit) to extract every hash in the domain.
How it shows up on Hack The Box
On a DC with SeBackupPrivilege, diskshadow creates a shadow copy and robocopy /b copies ntds.dit; with the SYSTEM hive, secretsdump opens it offline.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Guides
- Windows credential dumping: SAM, LSA, LSASS, DPAPI and NTDS.dit 4 min read Where Windows keeps credentials and how to get them: SAM and SYSTEM, LSA secrets, LSASS with lsassy or pypykatz, DPAPI, and NTDS.dit with SeBackup.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Impacket › More examples
Domain hashes from a copy of ntds.dit
impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCALNo command matches.