OS Credential Dumping: NTDS

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in %SystemRoot%\NTDS\Ntds.dit of a domain controller.[1]

In addition to looking NTDS files on active Domain Controllers, attackers may search for backups that contain the same or similar information.[2]

The following tools and techniques can be used to enumerate the NTDS file and the contents of the entire Active Directory hashes.

  • Volume Shadow Copy
  • secretsdump.py
  • Using the in-built Windows tool, ntdsutil.exe
  • Invoke-NinjaCopy
ID: T1003.003
Sub-technique of:  T1003
Tactic: Credential Access
Platforms: Windows
System Requirements: Access to Domain Controller or backup
Permissions Required: Administrator
Data Sources: PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Contributors: Ed Williams, Trustwave, SpiderLabs
Version: 1.0
Created: 11 February 2020
Last Modified: 24 March 2020

Procedure Examples

Name Description
Chimera

Chimera has gathered the SYSTEM registry and ntds.dit files from target systems.[3]

CrackMapExec

CrackMapExec can dump hashed passwords associated with Active Directory using Windows' Directory Replication Services API (DRSUAPI), or Volume Shadow Copy.[4]

Dragonfly 2.0

Dragonfly 2.0 dropped and executed SecretsDump to dump password hashes. They also obtained ntds.dit from domain controllers. [5][6][7]

esentutl

esentutl can use Volume Shadow Copy to copy locked files such as ntds.dit.[8][9]

FIN6

FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.[10][11]

Impacket

SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information from NTDS.dit.[12]

Koadic

Koadic can gather hashed passwords by gathering domain controller hashes from NTDS.[13]

Mitigations

Mitigation Description
Encrypt Sensitive Information

Ensure Domain Controller backups are properly secured.[2]

Password Policies

Ensure that local administrator accounts have complex, unique passwords across all systems on the network.

Privileged Account Management

Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.

User Training

Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.

Detection

Monitor processes and command-line arguments for program execution that may be indicative of credential dumping, especially attempts to access or copy the NTDS.dit.

References