2

If I understand correctly, meterpreter's hashdump dumps the content of the SAM file. Domain users should be in the AD database on domain controllers, which I understand is NTDS.dit .

On my test network, if I run hashdump on a domain joined workstation I don't get any domain users as expected.

However on my domain controller, running hashdump appears to also dump my domain users.

Why would people bother fetching NTDS.dit and using extraction tools like esedbexport + dsusers when they can just hashdump?

I fear I'm missing something. Could someone explain more clearly if hashdump on a DC does indeed dump all domain accounts and hashes, and what the difference is between that and extracting them from NTDS.dit?

2

smart_hashdump will query a Domain Controller's lsass to dump hashes, but the regular hashdump will only get what is available in the SAM database for users (usually IT admins) that log into the domain-controller server directly (whether on-console, via RDP, or some other remote mechanism).

domain_hashdump uses the NTDS.dit file to extract all Domain Users, including historical ones. See -- https://www.rapid7.com/db/modules/post/windows/gather/credentials/domain_hashdump -- for more information

  • 1
    Thanks. Could I just ask for clarification on the difference between what smart_hashdump gets from lsass, and the contents of NTDS.dit? Will smart_hashdump and domain_hashdump both give me all users/hashes? – Juicy Mar 18 '17 at 19:00
  • No, only domain_hashdump gives you all hashes for all Domain Users including archived. It's possible that smart_hashdump will, but I doubt it and would not rely on it. They would have to be utilized to be in-memory like that. – atdre Mar 18 '17 at 19:43
0

No you are correct, simply running hashdump whilst logged onto a domain controller via psexec (set target to 1 (powershell) will dump the domain user accounts from the NTDS. I have tested this in real time, creating accounts in AD but not logging onto the DC as them (standard user via users and computers mmc) and re-running hashdump picks them up.

  • 1
    I'm not sure this adds more to what the accepted answer says. Did you intend to say something different or are you confirming what was said? – schroeder Jan 8 '18 at 8:47
  • This does feel more like a comment than an answer. – Tobi Nary Jan 8 '18 at 9:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.