DCSync
DCSync uses the domain controller’s API to emulate the replication process from a remote domain controller. DCSync, in a nutshell, performs a DsGetNCChanges operation from a domain controller via an RPC request to the Directory Replication Service API (DRSUAPI). This attack requires extended privileges, DS-Replication-Get-Changes and DS-Replication-Get-Changes-All, which are assigned by default only to the “Domain Controllers”, “Domain Admins”, “Administrators”, and “Enterprise Admins” groups in the domain.
If we were able to compromise the user with extended privileges, we could run secretsdump to obtain all hashes in the domain:
/usr/bin/impacket-secretsdump -outputfile 'something' 'essos'/'daenerys.targaryen':'BurnThemAll!'@'192.168.56.12'
The output produced by the preceding command is shown in the following screenshot:
Figure...
