PE-SEC
secretsdump
Impacket script for remotely dumping SAM, LSA secrets, and NTDS.dit hashes.
OVERVIEW
secretsdump.py, part of the Impacket suite, remotely extracts credential material from a Windows host or domain controller once you already hold valid credentials or a hash: local SAM and cached domain secrets over SMB, or full NTDS.dit hashes from a DC using either a VSS-based dump or the DRSUAPI replication protocol (the same mechanism behind DCSync).
Because it talks to the target purely over standard Windows protocols and needs no agent or binary dropped on disk, it's often the preferred way to harvest hashes after an initial foothold, and it works equally well authenticating with a password, an NTLM hash, or a Kerberos ticket.
USE CASES
Practical use cases
- 01
Dumping local SAM and cached secrets from a host reachable over SMB.
- 02
Extracting the full NTDS.dit hash database from a domain controller via DRSUAPI.
- 03
Authenticating with a captured NTLM hash instead of a plaintext password (pass-the-hash).
- 04
Feeding recovered hashes into cracking or pass-the-hash tooling for further lateral movement.
QUICK START
With valid domain or local credentials (or a hash) already in hand, to extract password hashes from a host or domain controller without touching disk.
- Confirm the credentials or hash in hand are in scope for this level of access.
- Install Impacket (pip install impacket) if it isn't already available.
- Run secretsdump against the target, authenticating with password, hash, or Kerberos ticket.
- Review the SAM/LSA/NTDS output and keep only what's needed for the finding.
secretsdump.py DOMAIN/user:[email protected]BEFORE YOU RUN IT
What to check before running it
NTDS.dit extraction via DRSUAPI generates the same replication traffic as DCSync, which is a well-monitored indicator on hardened domains.
The recovered hashes are equivalent to plaintext credentials for most purposes — treat the output file as highly sensitive and dispose of it per the engagement's rules.
VSS-based dumps against a live DC can be resource-intensive; confirm the timing is acceptable before running it in a production environment.