NTDS

What is

NTDS.dit is the main database used by Active Directory Domain Services to store directory information on a Domain Controller.

The database is normally located at:

C:\Windows\NTDS\NTDS.dit

It contains information related to objects in the Active Directory database, including:

• User information.
• Group information.
• Computer accounts.
• Security descriptors.
• Group memberships.
• Password-derived authentication material.
• Other Active Directory directory data.

One of the most security-sensitive pieces of information stored in the database is the password hash material associated with domain accounts.

Because NTDS.dit is maintained by the Domain Controller, obtaining its contents or the equivalent secrets remotely requires highly privileged access.

Requirements

To extract domain credential material remotely, the attacker generally needs:

• Administrative privileges on the Domain Controller, typically Domain Admin or equivalent privileges.
• Network connectivity to the Domain Controller.
• Valid credentials for the privileged account.
• Access to the required Windows services and remote management interfaces.
• A tool capable of extracting Active Directory secrets, such as Impacket’s secretsdump.

The exact privileges required depend on the extraction method being used.

How to

Summary

The basic workflow is:

Detailed

1. Obtain privileged domain access

The first requirement is a sufficiently privileged account in the Active Directory environment.

A Domain Admin account is a common example, although other accounts or delegated privileges may also provide the permissions required for the extraction method being used.

The important distinction is that having access to a normal domain user account is not enough to extract the domain’s credential database.

The attacker must have sufficient privileges on the Domain Controller to access the Active Directory secrets.

2. Run secretsdump

Impacket provides secretsdump, which can remotely extract secrets from Windows systems.

For an Active Directory Domain Controller, the -just-dc-ntlm option can be used when the objective is specifically to extract NTLM password hashes from the domain.

impacket-secretsdump <DOMAIN>/<USER>:<PASSWORD>@<DC_IP> -just-dc-ntlm

The important parameters are:

• <DOMAIN> specifies the Active Directory domain.
• <USER> specifies the privileged domain account.
• <PASSWORD> specifies the account password.
• <DC_IP> specifies the IP address of the Domain Controller.
• -just-dc-ntlm limits the extraction to NTLM password hashes from the Domain Controller.

secretsdump performs the required remote operations and extracts the relevant Active Directory credential material without requiring the attacker to manually copy the NTDS.dit file.

3. Review the extracted hashes

After a successful execution, secretsdump returns the NTLM hashes associated with domain accounts.

The output follows the familiar Windows password-hash format, containing information such as the account name, RID, LM hash field, and NTLM hash.

For example, an entry may look like:

Administrator:500:<LM_HASH>:<NTLM_HASH>:::

The NTLM hash can then be used for offline password analysis or other authentication-related techniques, depending on the permissions and security controls present in the environment.

The extraction can therefore provide visibility into a large number of domain accounts at once, rather than only the account used to authenticate to the Domain Controller.

Understanding the attack

The important concept is that the Domain Controller is the authoritative source for the Active Directory database.

A simplified representation is:

Privileged Domain Account
          |
          | Authentication
          v
    Domain Controller
          |
          | Access to AD secrets
          v
      secretsdump
          |
          v
 Domain credential material
          |
          v
   NTLM password hashes

The attacker does not need to obtain a copy of NTDS.dit and open the database manually.

Instead, secretsdump performs the remote extraction of the relevant secrets from the Domain Controller.

The resulting NTLM hashes represent the password-derived authentication material stored for domain accounts.

This is particularly significant because compromising a Domain Controller with sufficient privileges can expose credential material for many users simultaneously.

Common problems

Access is denied

Verify that the account being used has sufficient privileges on the Domain Controller.

A standard domain user generally cannot perform the required extraction.

Also verify that the account is not subject to restrictions that prevent the required remote operations.

secretsdump cannot connect to the Domain Controller

Check:

• The Domain Controller IP address.
• Network connectivity.
• SMB accessibility.
• The supplied credentials.
• Windows firewall rules.
• Whether the required remote services are available.

The expected hashes are not present

Make sure that the correct extraction option is being used.

-just-dc-ntlm specifically requests NTLM password hashes. Other secretsdump options can retrieve different types of authentication material.

The amount of information available can also depend on the Windows version and the configuration of the Domain Controller.

Defensive considerations

Protecting Domain Controllers and privileged accounts is critical because access to the Domain Controller can expose authentication material for the entire Active Directory environment.

Important defensive measures include:

• Apply the principle of least privilege.
• Minimize the number of accounts with Domain Admin or equivalent privileges.
• Protect privileged administrative credentials.
• Use dedicated administrative workstations.
• Prevent privileged accounts from unnecessarily authenticating to ordinary workstations.
• Monitor administrative access to Domain Controllers.
• Monitor unusual remote access to Domain Controllers.
• Use endpoint security controls capable of detecting credential-dumping behaviour.
• Reduce NTLM usage where possible.
• Implement appropriate protections for privileged accounts.

A successful NTDS extraction should be treated as a major security event because the resulting credential material can potentially affect a large portion of the Active Directory environment.

Notes

NTDS.dit should not be treated simply as a file containing plaintext passwords.

It is an Active Directory database containing a wide range of directory information, including sensitive password-derived authentication material.

Also, secretsdump does not necessarily transfer the entire NTDS.dit database to the attacker. In the example above, it extracts the relevant NTLM credential material remotely.