secretsdump.py
Dumps hashes (SAM/LSA/NTDS), DCSync included (impacket).
An Impacket tool to dump Windows/AD credentials: local SAM+SYSTEM hashes, LSA secrets and, against a DC with the right rights, the whole NTDS.dit via DCSync (including the krbtgt hash). It is the endgame of almost every Active Directory box.
Family Credential dumping & theft
Flags -just-dc -just-dc-user -hashes
Concepts DCSync, NTDS.dit Dump, SAM & LSA Secrets Dump, Pass-the-Hash, RBCD (Resource-Based Constrained Delegation), SeBackupPrivilege
Cheatsheet Post-exploitation & lateral
Installation
# All of Impacket's *.py tools ship in the same package:
pipx install impacket
# invoke them as impacket-<tool> or <Tool>.py depending on the packagingUseful commands
Appears in
Some machines where its use is documented; not an exhaustive list.
- AdministratorHackTheBox
- ForestHackTheBox
- SaunaHackTheBox