conducting-domain-persistence-with-dcsync

Perform DCSync attacks to extract Active Directory credential hashes and forge Golden Tickets.

954|172|Updated Mar 13, 2026

Search Tags:#red-team #mimikatz #Active-Directory #golden-ticket #credential-dumping #Kerberos #DCSync

Ready to run

npx skills add https://github.com/xalgord/xalgorix --skill conducting-domain-persistence-with-dcsync

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: conducting-domain-persistence-with-dcsync
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/red-teaming/conducting-domain-persistence-with-dcsync
Command: npx skills add https://github.com/xalgord/xalgorix --skill conducting-domain-persistence-with-dcsync

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

During authorized red team engagements, testers need a repeatable method to abuse Active Directory replication rights, dump domain credentials including the KRBTGT hash, and establish durable domain persistence without guessing at commands or missing critical steps.

Core Features & Use Cases

DCSync Rights Enumeration: Identify principals holding DS-Replication-Get-Changes and Get-Changes-All rights using PowerView, BloodHound Cypher queries, and Impacket.
Credential Extraction: Execute DCSync with Mimikatz or Impacket secretsdump.py to dump KRBTGT, Domain Admin, and service account hashes, including AES256 keys.
Golden Ticket Forging & Persistence: Create Golden Tickets with Mimikatz or ticketer.py and grant DCSync rights to controlled accounts for long-term access.
Use Case: A red team operator with Domain Admin credentials uses secretsdump.py -just-dc-user krbtgt to extract the KRBTGT hash, then forges a Golden Ticket to maintain access after the initial entry point is closed.

Quick Start

Ask the AI to walk you through performing a DCSync attack against a lab domain controller using Impacket secretsdump.py and then forging a Golden Ticket from the extracted KRBTGT hash.

Frequently Asked Questions about conducting-domain-persistence-with-dcsync

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform a DCSync attack with Impacket?▼

Run secretsdump.py domain.local/admin:'Password123'@10.10.10.1 to dump all domain credentials, or add -just-dc-user krbtgt to extract only the KRBTGT hash. Kerberos authentication is supported with -k -no-pass and a valid ccache ticket.

What permissions are required for a DCSync attack?▼

The account needs both DS-Replication-Get-Changes and DS-Replication-Get-Changes-All extended rights on the domain object. Domain Admins, Enterprise Admins, and Domain Controllers hold these by default; verify grants with BloodHound's DCSync edge or PowerView ACL enumeration.

Mimikatz vs secretsdump.py for DCSync, which should I use?▼

Mimikatz lsadump::dcsync runs on Windows hosts and integrates with Golden Ticket creation via kerberos::golden. Impacket secretsdump.py runs remotely from Linux without touching the target disk, making it preferable for network-side operations.

Why does DCSync fail against some domain controllers?▼

DCSync fails against Read-Only Domain Controllers because they do not replicate secrets outbound. It also fails when the account lacks one of the two required replication rights, so target a writable DC and confirm both Get-Changes rights before concluding the attack is blocked.

How do defenders detect DCSync attacks?▼

Detection relies on Event 4662 with replication GUIDs on Domain Controllers, DrsGetNCChanges RPC calls from non-DC IP addresses, and replication traffic volume spikes. Golden Ticket usage surfaces as Event 4624 anomalies with impossible SIDs or non-existent users.

Is DCSync legal to use in penetration testing?▼

DCSync is legal only during authorized security assessments with written permission from the system owner. Using it against systems you do not own or lack authorization to test violates computer fraud laws; the skill includes a legal notice restricting it to authorized testing and education.