live smb dcsync command

What it does

Performs DCSYNC attack, extracts all hashes and kerberos keys from the domain controller using DRSUAPI

Remarks

None

Requirements

• User context which has getchanges/getchangesall rights.

Subcommands

None

Switches

• host: IP or hostname of the domain controller
• --username : Optional, the username of the user to get the secrets of. If empty then all users will be targeted
• -o or --outfile : Writes the secrets to the specified file

Examples

• pypykatz live smb dcsync win2019ad.test.corp: Performs DCSYNC