If I understand correctly, meterpreter
's hashdump
dumps the content of the SAM file. Domain users should be in the AD database on domain controllers, which I understand is NTDS.dit .
On my test network, if I run hashdump
on a domain joined workstation I don't get any domain users as expected.
However on my domain controller, running hashdump
appears to also dump my domain users.
Why would people bother fetching NTDS.dit and using extraction tools like esedbexport
+ dsusers
when they can just hashdump
?
I fear I'm missing something. Could someone explain more clearly if hashdump
on a DC does indeed dump all domain accounts and hashes, and what the difference is between that and extracting them from NTDS.dit?