| description |
|---|
ATT&CK ID: T1003.006
Permissions Required: Administrator | DCSync rights
Description
Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API) to simulate the replication process from a remote domain controller using a technique called DCSync.
A DCSync attack is where an adversary impersonates a Domain Controller (DC) and requests replication changes from a specific DC. The DC in turn returns replication data to the adversary, which includes account hashes.
By default the following groups have permissions to perform this action:
- Administrators
- Domain Admins
- Enterprise Admins
- Domain Controllers
However, in an incorrectly configured environment it may be possible to hunt down users who have the required individual permissions without being in any of the aforementioned groups. These individual permissions are:
- Replicating Directory Changes
- Replicating Directory Changes All
- Replicating Directory Changes In Filtered Set
Impacket's secretsdumpy.py can be used to dump all domain hashes, providing the hash or password is known for an account with permission to perform replication.
sudo python2 secretsdump.py <Domain>/<User>:<Password>@<IP>
sudo python2 secretsdump.py security/Moe:'Password123!'@10.10.10.10.png)
{% content-ref url="dcsync-attack.md" %} dcsync-attack.md {% endcontent-ref %}