Skip to content
›_Secrets Dump

Posts tagged: #active-directory

← Back to all posts
secretsdump DCSync: dumping domain hashes with -just-dc
How secretsdump's -just-dc uses the DRSUAPI replication protocol to pull every domain hash from a DC without touching disk — the required rights, the flags, and what it outputs.
secretsdumpimpacketdcsyncactive-directory
NTDS.dit explained: how domain hashes are stored and dumped
A domain controller keeps every account hash in one ESE database. See how the datatable, the Password Encryption Key (PEK) and each cipher layer fit — and how a hash is unwrapped offline.
windowsactive-directoryntdsese