NTDS
https://attack.mitre.org/techniques/T1003/003/
ATT&CK ID: T1003.003
Permissions Required: Administrator | SYSTEM
Description
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in %SystemRoot%\NTDS\Ntds.dit
of a domain controller.
In addition to looking for NTDS files on active Domain Controllers, adversaries may search for backups that contain the same or similar information.
Techniques
Invoke-DCsync (PentestFactory)
URL: https://github.com/pentestfactory/Invoke-DCSync
Invoke-DCsync pulls Mimikatz,PowerView and ADRecon from Github into memory and then performs DCSync.
Invoke-DCSync (S3cur3Th1sSh1t)
Metasploit
secretsdump.py
can then be used to pull hashes from the ntds.dit
database using the SYSTEM hive file (ref: secretsdump.py further down).
Mimikatz
ntdsutil.exe (Native)
With access to the Domain Controller its possible to run the ntdsutil.exe
native binary to dump SAM, SYSTEM and ntds.dit ready for exfiltration.
Viewing the contents of c:\Exfiltration
we see the files.
Secretsdump we can be used against these files for extraction as shown in the secretsdump.py
section below.
Secretsdump.py
PsMapExec
Volume Shadow Copy
The NTDS.dit and SYSTEM files can be exfiltrated off the system and used with a tool such as secretsdump.py
for hash extraction.
Last updated