skills.rest
blacklanternsecurity
blacklanternsecurityOFFICIAL
Explore all skills by this author →
WebsiteGitHub

credential-dumping

Automate credential extraction from Active Directory via DCSync, NTDS.dit, and SAM.

253|37|Updated Feb 22, 2026
Search Tags:#dcsync#active directory#credential dumping#ntds.dit#laps#gmsa
One-click install
npx skills add https://github.com/blacklanternsecurity/red-run --skill credential-dumping
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: credential-dumping
Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/ad/credential-dumping
Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill credential-dumping

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires secretsdump.py, mimikatz, netexec, bloodyAD, gMSADumper, sqlcmd, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the extraction of sensitive credentials from Active Directory and related systems, crucial for understanding an organization's security posture and identifying potential attack paths.

Core Features & Use Cases

  • Comprehensive Credential Extraction: Supports DCSync, NTDS.dit, SAM hive dumps, Azure AD Connect credentials, LAPS passwords, gMSA passwords, and DSRM credentials.
  • Secure Workflow: Prioritizes Kerberos-first authentication for remote operations to minimize detection.
  • Use Case: A penetration tester needs to obtain domain hashes to move laterally within a compromised network. This Skill can extract the krbtgt hash via DCSync or retrieve local administrator passwords from LAPS-managed systems.

Quick Start

Use the credential-dumping skill to extract all domain hashes via DCSync from the domain controller at DC.DOMAIN.LOCAL.

Frequently Asked Questions about credential-dumping

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract Active Directory credentials using DCSync?▼

To extract Active Directory credentials via DCSync, this Skill automates replication requests to a domain controller, pulling domain hashes like krbtgt using Kerberos-first authentication and Impacket's secretsdump.py.

What is the best way to dump NTDS.dit and SAM hive passwords?▼

Dumping NTDS.dit and SAM hive passwords is handled by automating extraction techniques across various access levels, retrieving local administrator and domain credential hashes using tools like mimikatz and netexec.

Can I retrieve LAPS and gMSA passwords from Active Directory?▼

Yes, you can retrieve LAPS and gMSA passwords from Active Directory using integrated tools like bloodyAD and gMSADumper to extract local administrator and managed service account credentials.

Does this Skill support extracting Azure AD Connect credentials?▼

Yes, extracting Azure AD Connect credentials is supported natively, utilizing sqlcmd alongside secretsdump.py to pull synchronized credentials from the local database for offline analysis.

Do I need Kerberos authentication for remote credential dumping?▼

Kerberos authentication is prioritized for remote credential dumping to minimize detection, ensuring secure extraction operations across DCSync, LAPS, and DSRM credential retrieval workflows.

What dependencies are required to dump domain hashes with mimikatz and netexec?▼

Dumping domain hashes requires Impacket, mimikatz, netexec, bloodyAD, gMSADumper, and sqlcmd to fully support DCSync, NTDS.dit extraction, and Azure AD Connect credential retrieval.

Related Skills

Explore More Software Engineering Skills→
utsavthakurutsavthakur

active-directory-kerberos-attacks

Execute multi-step Kerberos attacks against Active Directory authentication.

Community
Advanced
ArianHobson333ArianHobson333
7

credential-access

Extract credentials via LSASS dumping, SAM/SECURITY hives, and DPAPI decryption.

Community
Advanced
hypnguyen1209hypnguyen1209
338

active-directory-attack

Enumerate Active Directory components and map attack paths with BloodHound.

Community
Advanced
AeonDaveAeonDave
15

mimikatz

Extract Windows credentials and Kerberos tickets from LSASS memory.

Community
Advanced