I am working with an extremely large NTDS.DIT file. It is about 20gb.

Originally, I was attempting to dump all of the hashes from the NTDS.DIT file. I tried using meterpreter domain hash dump, smart hash dump, and just simply hash dump on the domain controller. Each time, I received errors from Meterpreter.

Once I ran into this, I used the shadow copy trick and got a copy of the NTDS.DIT file, and began to extract all of the hashes (using libesedb and NTDSextract). However, it has been almost a week, and even though libexedbexport is still running, I am hoping I can get some information quicker than 3 weeks (currently on pace for 3 weeks).

So my next step is trying to extract individual records based on username. I've done some googling, but I haven't been able to find any method of extracting just one or several hashes more quickly.

Is this possible? Is there an application that I can use to do this? Any help would be appreciated.

  • Have you tried Windows Password Recovery Tool to extract the hashes? I would be curious as to the results.
    – shift_tab
    Sep 23, 2015 at 15:36

2 Answers 2


Here is one method, and the bonus is that it is all done remotely -- https://www.dsinternals.com/en/retrieving-active-directory-passwords-remotely/

The author also shows how to dump the whole thing, but of course this isn't recommended. You could also copy the dit file locally, split(1) it, and then exfiltrate the files piece by piece.

  • If this works it is great. I will try it tomorrow!
    – davidb
    Sep 23, 2015 at 16:27
  • I think this would work. The hard part about this is that I dont have PS5 installed anywhere, and I cant get this to run on PS4 or lower. I'll keep toying with it and see if I can get it working.
    – Sugitime
    Sep 23, 2015 at 17:51

Look here: http://www.harmj0y.net/blog/redteaming/the-case-of-a-stubborn-ntds-dit/

article & comments


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .