DCSync: How to Dump Every Password Hash in the Domain Without Touching the DC

#You Don't Need Admin on the Domain Controller. You Just Need Replication Rights.#link

DCSync abuses the Directory Replication Service Remote Protocol (DRSR). Domain Controllers use this protocol to replicate the AD database between themselves. If your account has the DS-Replication-Get-Changes and DS-Replication-Get-Changes-All extended rights, you can impersonate a DC and request replication of any object's password hash. The real DC can't tell the difference.

You never log into the Domain Controller. You never write a file to its disk. You never create a service or execute a binary on it. You simply ask it nicely over the network to replicate the NTDS data to you. And it does. Because that's what replication permissions mean.

How do you verify an account has DCSync rights?

All three replication rights present on the adunn account. This is your green light. Any one of these alone isn't sufficient. You need both Get-Changes AND Get-Changes-All to perform a full DCSync. The Filtered-Set variant is a bonus that allows requesting specific object types.

Executing DCSync from Linux with secretsdump.py

What about accounts with reversible encryption?

One account, proxyagent, has Store passwords using reversible encryption enabled. The password isn't stored in actual cleartext. It's RC4 encrypted with a key stored in the registry (the Syskey). secretsdump.py decrypts it during the DCSync operation. Rare finding, but when it exists, it's free credentials.

Domain compromised. Every hash dumped. krbtgt in hand for Golden Tickets. Administrator hash for pass-the-hash to any system. This is the end state of most AD attack chains. But getting here required chaining multiple techniques. The next module covers lateral movement options when you have credentials but not quite DCSync rights yet.