NTDS

Executes Mimikatz's lsadump::dcsync on the target system. Parses the NTDS file to replicate Secretsdump output. No files are created on disk on the target system.

Output for each system is stored in $pwd\PME\NTDS\

Supported Methods

  • MSSQL

  • SMB

  • SessionHunter (WMI)

  • WMI

  • WinRM

Optional Parameters

Usage

# Standard execution
PsMapExec -Username [User] -Password [Pass] -targets [DC] -Module NTDS -Method [Method] -ShowOutput

Parsing

If -NoParse is not specified, PsMapExec will parse the results from the NTDS output and present them in a digestable and usable format.

Last updated