I am working with an extremely large NTDS.DIT file. It is about 20gb.

Originally, I was attempting to dump all of the hashes from the NTDS.DIT file. I tried using meterpreter domain hash dump, smart hash dump, and just simply hash dump on the domain controller. Each time, I received errors from Meterpreter.

Once I ran into this, I used the shadow copy trick and got a copy of the NTDS.DIT file, and began to extract all of the hashes (using libesedb and NTDSextract). However, it has been almost a week, and even though libexedbexport is still running, I am hoping I can get some information quicker than 3 weeks (currently on pace for 3 weeks).

So my next step is trying to extract individual records based on username. I've done some googling, but I haven't been able to find any method of extracting just one or several hashes more quickly.

Is this possible? Is there an application that I can use to do this? Any help would be appreciated.

  • Have you tried Windows Password Recovery Tool to extract the hashes? I would be curious as to the results. – shift_tab Sep 23 '15 at 15:36

Here is one method, and the bonus is that it is all done remotely -- https://www.dsinternals.com/en/retrieving-active-directory-passwords-remotely/

The author also shows how to dump the whole thing, but of course this isn't recommended. You could also copy the dit file locally, split(1) it, and then exfiltrate the files piece by piece.

  • If this works it is great. I will try it tomorrow! – davidb Sep 23 '15 at 16:27
  • I think this would work. The hard part about this is that I dont have PS5 installed anywhere, and I cant get this to run on PS4 or lower. I'll keep toying with it and see if I can get it working. – Sugitime Sep 23 '15 at 17:51

Look here: http://www.harmj0y.net/blog/redteaming/the-case-of-a-stubborn-ntds-dit/

article & comments


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.