Impacket secretsdump.py
Back to the category index / Back to the command index
Overview
Section titled “Overview”Extracts SAM, LSA, and NTDS hashes, Kerberos keys, and other secrets from local hive or NTDS files or from a remote host.
| Item | Details |
|---|---|
| Implementation | examples/secretsdump.py |
| Category | Secrets / DPAPI / registry / file analysis |
| Size | 567 lines |
| Distribution | Installed as a script through scripts=examples/*.py in setup.py |
CLI and input
Section titled “CLI and input”Run python examples/secretsdump.py -h for the current option definitions.
| Argument | Description |
|---|---|
target | [[domain/]username[:password]@] |
-ts | Add a timestamp to each log message |
-debug | Enable debug output |
-system | SYSTEM hive to parse; requires a binary REGF hive because a .reg text file lacks boot-key metadata |
-bootkey | Boot key for the SYSTEM hive |
-security | SECURITY hive to parse |
-sam | SAM hive to parse |
-ntds | NTDS.DIT file to parse |
-resumefile | Resume file for an NTDS.DIT dump via DRSUAPI; also updated with session state |
-skip-sam | Do not parse the SAM hive on the remote system |
-skip-security | Do not parse the SECURITY hive on the remote system |
-outputfile | Base output filename; extensions are added for SAM, secrets, cached credentials, and NTDS |
-use-vss | Use the NTDSUTIL VSS method instead of the default DRSUAPI method |
-rodcNo | RODC krbtgt account number (Kerb-Key-List approach only) |
-rodcKey | Read-only domain controller AES key (Kerb-Key-List approach only) |
-use-keylist | Use the Kerb-Key-List method instead of the default DRSUAPI method |
-exec-method | Remote execution method when using -use-vss (choices: smbexec, wmiexec, mmcexec; default: smbexec) |
-use-remoteSSWMI | Create a remote shadow snapshot through WMI, download SAM, SYSTEM, and SECURITY, then parse them locally |
-use-remoteSSWMI-NTDS | Also dump NTDS.DIT with the remote WMI shadow snapshot method on a DC; requires -use-remoteSSWMI |
-remoteSSWMI-remote-volume | Remote volume to snapshot for SAM, SYSTEM, and SECURITY (default: C:) |
-remoteSSWMI-local-path | Local download path for SAM, SYSTEM, and SECURITY from the shadow snapshot (default: current directory) |
-just-dc-user | Extract NTDS.DIT data only for the specified user (DRSUAPI only); implies -just-dc |
-ldapfilter | Extract NTDS.DIT data only for users matching an LDAP filter (DRSUAPI only); implies -just-dc |
-just-dc | Extract only NTDS.DIT data (NTLM hashes and Kerberos keys) |
-just-dc-ntlm | Extract only NTDS.DIT NTLM hashes |
-trust-keys | Dump trusted domain object (TDO) secrets and derive inter-realm Kerberos keys (AES and RC4) for each trust direction |
-just-trust-keys | Like -trust-keys, but dump only trust keys and skip all account secrets |
-skip-user | Skip NTDS.DIT data for the specified user; accepts a comma-separated list or a text file with one user per line |
-pwd-last-set | Show each NTDS.DIT account’s pwdLastSet attribute (not written by -outputfile) |
-user-status | Show whether a user is disabled |
-history | Dump password history (NTDS and SAM hashes) and LSA secret OldVal values |
-hashes | NTLM hashes in LMHASH:NTHASH format |
-no-pass | Do not prompt for a password (useful with -k) |
-k | Use Kerberos authentication. Look for matching credentials in the ccache file named by KRB5CCNAME; if none are valid, use those specified on the command line |
-aesKey | AES key for Kerberos authentication (128 or 256 bits) |
-keytab | Read SPN keys from a keytab file |
-dc-ip | Domain controller IP address; if omitted, use the domain name (FQDN) from the target parameter |
-target-ip | Target machine IP address; if omitted, use the target value. Useful when a NetBIOS target name cannot be resolved |
-ldaps / -use-ldaps | Use LDAPS instead of LDAP for directory queries |
Related technology: boot keys, PEKs, and the separation of acquisition paths and decoders in DPAPI / SAM / LSA / NTDS.
Detailed processing flow
Section titled “Detailed processing flow”For the LOCAL target, the tool opens the specified hives or database directly. For a remote target, it connects over SMB or LDAP and acquires data through the selected Remote Registry, VSS, DRSUAPI, WMI shadow copy, or Key List path. LocalOperations or RemoteOperations prepares the boot or system keys; SAMHashes, LSASecrets, NTDSHashes, and KeyListSecrets decode and output each record. cleanup() removes service, temporary-file, and resume-state resources.
How it works
Section titled “How it works”secretsdump is an orchestrator that combines several acquisition methods and
decoders. Local mode reads SAM, SYSTEM, SECURITY, and NTDS files directly.
After identifying a remote target over SMB or LDAP, remote mode obtains the
required raw data through Remote Registry, VSS, DRSUAPI replication, WMI shadow
copies, RODC Key List, or another selected path.
SAMHashes and LSASecrets decrypt SAM and LSA data using the boot key.
For NTDS, the boot key decrypts the PEK, which in turn decrypts each account
record’s encrypted hashes and keys with the RID. The DRSUAPI path does not copy
the database file; it normalizes attribute IDs and values from replication
responses into the same logical records. -just-dc* and LDAP filters affect both acquisition and decoder output.
VSS or remote shadow copies and registry saves may create services, snapshots, and temporary files on the target. The resume file holds a cursor for long NTDS operations and must match the target and database when resuming. Allow partial success while recording which sources and decoders succeeded separately.
Hashes, Kerberos keys, trust secrets, and histories have different output schemas.
When -trust-keys and -outputfile are used together, trust keys are saved to
<base>.ntds.trustkeys separately from the usual <base>.ntds.
-history also includes previous trust secrets, and -just-dc-ntlm
also applies to derivation of Kerberos keys from trust keys.
AES keys from a trust secret use two salts when the NetBIOS/flat name is known:
{REALM_FQDN}krbtgt{PARTNER_FQDN} for the on-the-wire inter-realm key, and
{REALM_FQDN}krbtgt{FLAT} labeled (trust account) for the <FLAT>$ login key.
Incoming trusts use the partner’s flat name; outgoing trusts use the local
domain’s flat name. If that flat name cannot be read, the trust-account key is
omitted rather than guessed from the DNS label.
Keep decoder byte processing separate from formatting. cleanup() restores remote
resources even on exception paths. Connect new acquisition methods to the same
raw-record contract rather than embedding them in existing decoders.
Key implementation elements
Section titled “Key implementation elements”| Symbol | Location | Where to trace its responsibility |
|---|---|---|
DumpSecrets | 74 | __init__(), connect(), ldapConnect(), dump(), cleanup() |
Dependencies
Section titled “Dependencies”Within Impacket
Section titled “Within Impacket”| Module | Main names used |
|---|---|
impacket | version |
impacket.examples | logger |
impacket.examples.utils | parse_target |
impacket.smbconnection | SMBConnection |
impacket.ldap.ldap | LDAPConnection, LDAPSessionError |
impacket.examples.secretsdump | KeyListSecrets, LSASecrets, LocalOperations, NTDSHashes, RemoteOperations, SAMHashes |
impacket.krb5.keytab | Keytab |
Output, side effects, and required privileges
Section titled “Output, side effects, and required privileges”- The tool primarily makes queries and authentication attempts. Frequent runs can affect audit logs, account lockouts, and target load.
- Options may create or update local files. Check how existing files are handled and the permissions on output containing secrets.
- Some paths use temporary resources such as remote services, tasks, files, shares, and WMI/RPC resources. Cleaning them up after an abnormal exit is part of the behavior contract.
Failure paths and cleanup
Section titled “Failure paths and cleanup”- On failure, use protocol status codes to determine whether name resolution, connection, authentication, service state, or permissions caused the stop.
- Cleanup-related methods include
cleanup(). Check that new early returns and exception paths reach it too.
When changing the implementation
Section titled “When changing the implementation”The code depends on shared implementation in impacket.examples.secretsdump, SMB, LDAP, DRS/RPC, and Kerberos keytabs. CLI class DumpSecrets handles orchestration across paths and option consistency, so keep new acquisition methods separate from decoders.
Verification
Section titled “Verification”- Syntax:
python -m py_compile examples/secretsdump.py - CLI:
python examples/secretsdump.py -h - Related test:
tests/SMB_RPC/test_secretsdump.py - Related test:
tests/SMB_RPC/test_ldap.py