New answers tagged active-directory
Look here: http://www.harmj0y.net/blog/redteaming/the-case-of-a-stubborn-ntds-dit/ article & comments gl
It depends of the honeypot you are using. If you are using a low or medium interaction honeypot that only emulates some services, than the chances are very low that the attacker can break out of the honeypot (except if he finds a bug in the honeypot itself). If you are using full interaction honeypots, like a real Windows machine, that the chances are high ...
Here is one method, and the bonus is that it is all done remotely -- https://www.dsinternals.com/en/retrieving-active-directory-passwords-remotely/ The author also shows how to dump the whole thing, but of course this isn't recommended. You could also copy the dit file locally, split(1) it, and then exfiltrate the files piece by piece.
I'm using OSSEC to monitor my servers which works relativly well. The big upside is that it can be used for windows aswell as for linux und unix based systems. Also you are able to provide your own rules to filter for which could be used to track administrative activity that is documented in the logfiles.
You need to get the NTDS.DIT binary file out of %SystemRoot%\ntds. You can use ntdsutil to create a snapshot of the AD database so that you can copy NTDS.DIT. Then you can use something like the Windows Password Recovery tool to extract the hashes. https://technet.microsoft.com/en-us/library/cc753343.aspx ...
Top 50 recent answers are included