smb dcsync command

What it does

Performs DCSYNC attack, extracts all hashes and kerberos keys from the domain controller using DRSUAPI

Remarks

None

Requirements

• A working SMB connection URL with a user that has getchanges/getchangesall right to the domain, pointing to the DC

Subcommands

None

Switches

• url: SMB connection URL. Please consult the Connection URL section
• --username : Optional, the username of the user to get the secrets of. If empty then all users will be targeted
• -o or --outfile : Writes the secrets to the specified file

Examples

• pypykatz smb dcsync 'smb2+ntlm-password://TEST\Administrator:[email protected]': Performs DCSYNC