NTDS secrets

We will cover NTDS secrets extraction as this attack applies only to domain controllers. The ntds.dit file is a database that stores Active Directory data, including hashes. This file is in %systemroot\NTDS\ntds.dit and %systemroot\System32\ntds.dit. It is constantly in use, so it can’t be copied directly as any other file. There are different ways that ntds.dit data can be dumped[31]:

• ntdsutil.exe – Active Directory maintenance tool
• VSSAdmin – volume shadow copy
• vshadow
• DiskShadow
• esentutl.exe
• NinjaCopy from PowerSploit
• Copy-VSS from Nishang
• windows/gather/credentials/domain_hashdump from Metasploit

For our example, on a domain controller, we will run ntdsutil.exe, which will save the ntds.dit file and SYSTEM registry hive, which we can then move to our machine and extract hashes using secretsdump:

ntdsutil "activate instance ntds" "ifm" "create full C:\Windows\Temp\NTDS"...