Advanced Infrastructure Penetration Testing

Dumping Active Directory domain credentials from an NTDS.dit file

Another dumping technique that threatens Active Directory environments is dumping credentials from an NTDS.dit file (Active Directory data is stored in the NTDS.dit). The Active Directory credentials can be extracted using a Python script called secretdump.py. It is built into the Kali Linux environment, or you can download it from this link ;https://github.com/CoreSecurity/impacket:

#git clone https://github.com/CoreSecurity/impacket

You can find the script in the examples folder, in addition to many other useful scripts:

To retrieve the data, type:

secretdump.py -system /opt/system.hive ...