2

If I understand correctly, meterpreter's hashdump dumps the content of the SAM file. Domain users should be in the AD database on domain controllers, which I understand is NTDS.dit .

On my test network, if I run hashdump on a domain joined workstation I don't get any domain users as expected.

However on my domain controller, running hashdump appears to also dump my domain users.

Why would people bother fetching NTDS.dit and using extraction tools like esedbexport + dsusers when they can just hashdump?

I fear I'm missing something. Could someone explain more clearly if hashdump on a DC does indeed dump all domain accounts and hashes, and what the difference is between that and extracting them from NTDS.dit?

Improve this question

2 Answers 2

Reset to default
2

smart_hashdump will query a Domain Controller's lsass to dump hashes, but the regular hashdump will only get what is available in the SAM database for users (usually IT admins) that log into the domain-controller server directly (whether on-console, via RDP, or some other remote mechanism).

domain_hashdump uses the NTDS.dit file to extract all Domain Users, including historical ones. See -- https://www.rapid7.com/db/modules/post/windows/gather/credentials/domain_hashdump -- for more information

Improve this answer
2
  • 1
    Thanks. Could I just ask for clarification on the difference between what smart_hashdump gets from lsass, and the contents of NTDS.dit? Will smart_hashdump and domain_hashdump both give me all users/hashes?
    – Juicy
    Mar 18, 2017 at 19:00
  • No, only domain_hashdump gives you all hashes for all Domain Users including archived. It's possible that smart_hashdump will, but I doubt it and would not rely on it. They would have to be utilized to be in-memory like that.
    – atdre
    Mar 18, 2017 at 19:43
0

No you are correct, simply running hashdump whilst logged onto a domain controller via psexec (set target to 1 (powershell) will dump the domain user accounts from the NTDS. I have tested this in real time, creating accounts in AD but not logging onto the DC as them (standard user via users and computers mmc) and re-running hashdump picks them up.

Improve this answer
2
  • 1
    I'm not sure this adds more to what the accepted answer says. Did you intend to say something different or are you confirming what was said?
    – schroeder ♦
    Jan 8, 2018 at 8:47
  • This does feel more like a comment than an answer.
    – Tobi Nary
    Jan 8, 2018 at 9:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .