TLDR: Python script to automate the extraction of hashes from ntds.dit and system files. Available here : https://bitbucket.org/grimhacker/esedbxtract.
During an internal Penetration Test, once I’ve gained Domain Administrator access the fun doesn’t stop. In order to test the strength of user account passwords I need to retrieve the password hashes.
My preferred method is to use Volume Shadow Copy to extract a copy of the NTDS.dit and SYSTEM files, since this is an administrative task carried out with Windows utilities it does not normal cause alerts or require the Antivirus to be disabled – as is the case with some of the other options.
Once I have these files on my Kali box I use esedbexport from libesedb to export the data and link tables, these tables are used with the SYSTEM file by ntdshashes.py (available here by LaNMaSteR53 based on ntdsusers.py from ntdsxtract) to get the hashes.
This method can take a long time if the Active Directory is very large, but at this point during the assessment I’m not usually in a rush, it is less intensive on the domain controller, and it doesn’t panic the IT staff of the organisation with alerts.
There are a few reasons why I wrote a script to automate the extraction of the hashes from the NTDS.dit and SYSTEM files.
First and foremost, it’s a multi step process that doesn’t actually require any brain power – just for the output of one tool to be fed into another in the correct way. Writing a script to do this means that time isn’t wasted waiting for me to come back to it between each step. And of course it is another success for my continuing mission to replace myself with a small script…
Second ntdshashes.py didn’t work with the the latest version of ntdsxtract when I last rebuilt my machine (because a ntdsxtract added a new required working directory parameter). I patched the script (and raised an Issue on the repository) but decided it wouldn’t take much work to rewrite it as a class and include it in a larger tool.
Finally I hadn’t played with calling external programs as a subprocess in python before and this seemed like a reasonable excuse.
The result is esedbxtraxt.py available on BitBucket: https://bitbucket.org/grimhacker/esedbxtract.
Dependencies are stated in the README.
Normal usage will result in the password hashes being written to ‘hashes.pwdump’:
python esedbxtract.py -n /path/to/NTDS.dit -s /path/to/SYSTEM
Use ‘–help’ or see the README for further options.
As always, if you have any questions, comments or suggestions please feel free to get in touch.