name: impacket-secretsdump
category: ad
description: Extract secrets from SAM, SECURITY, NTDS.dit, and perform DCSync attacks.
keywords:
  - active directory
  - secrets
  - sam
  - ntds
  - dcsync
  - hash
  - credential

parameters:
  target:
    type: string
    required: true
    description: "[domain/]username[:password]@target"

  hashes:
    type: string
    flag: "-hashes"
    description: "NTLM hashes (LM:NT)"

  no_pass:
    type: boolean
    flag: "-no-pass"
    description: Don't ask for password

  kerberos:
    type: boolean
    flag: "-k"
    description: Use Kerberos authentication

  aesKey:
    type: string
    flag: "-aesKey"
    description: AES key for Kerberos

  dc_ip:
    type: string
    flag: "-dc-ip"
    description: Domain controller IP

  target_ip:
    type: string
    flag: "-target-ip"
    description: Target IP (if different from hostname)

  just_dc:
    type: boolean
    flag: "-just-dc"
    description: Only DRSUAPI (DCSync)

  just_dc_user:
    type: string
    flag: "-just-dc-user"
    description: DCSync specific user

  just_dc_ntlm:
    type: boolean
    flag: "-just-dc-ntlm"
    description: Only NTLM hashes from DC

  pwd_last_set:
    type: boolean
    flag: "-pwd-last-set"
    description: Show pwdLastSet attribute

  user_status:
    type: boolean
    flag: "-user-status"
    description: Show user status

  history:
    type: boolean
    flag: "-history"
    description: Dump password history

  ntds:
    type: string
    flag: "-ntds"
    description: Path to NTDS.dit file

  system:
    type: string
    flag: "-system"
    description: Path to SYSTEM hive

  security:
    type: string
    flag: "-security"
    description: Path to SECURITY hive

  sam:
    type: string
    flag: "-sam"
    description: Path to SAM hive

  outputfile:
    type: string
    flag: "-outputfile"
    description: Output file base name

requires_root: false
timeout: 600

examples:
  - "impacket-secretsdump domain/admin:password@dc.domain.local"
  - "impacket-secretsdump -hashes :NTHASH domain/admin@dc"
  - "impacket-secretsdump -just-dc-user krbtgt domain/admin:pass@dc"
  - "impacket-secretsdump -ntds ntds.dit -system SYSTEM -outputfile dump LOCAL"
  - "impacket-secretsdump -just-dc-ntlm domain/admin:pass@dc"

notes: |
  Attack methods:
  1. Remote SAM/LSA dump (admin access)
  2. DCSync via DRSUAPI (replication rights)
  3. Offline NTDS.dit parsing

  Requirements:
  - Local admin for SAM/LSA dump
  - Replicating Directory Changes for DCSync

  Output formats:
  - username:rid:lmhash:nthash
  - Kerberos keys if available

  DCSync specific users:
  - krbtgt: Golden ticket creation
  - Administrator: Domain admin hash
  - Any user: Their specific hash

  Offline parsing:
  1. Copy NTDS.dit and SYSTEM
  2. Use -ntds and -system flags
  3. Parse locally