What is DCSync and what does it do?
DCSync is a feature in mimikatz that allows an attacker to simulate a domain controller's replication behavior and request password hashes for all domain users from a legitimate domain controller using the DRS (Directory Replication Service) protocol. It is commonly used to harvest credential material for lateral movement or privilege escalation in Active Directory environments.
---
**Related reading:**
- Domain Penetration - DCSync — original article
- An interesting way of bypassing Windows Attachment Manager
- Penetration Techniques - Exploitation of Nine Windows Privileges
- Penetration Techniques - Pass the Hash with Remote Desktop (Restricted Admin Mode)
---
**Related reading:**
- Domain Penetration - DCSync — original article
- An interesting way of bypassing Windows Attachment Manager
- Penetration Techniques - Exploitation of Nine Windows Privileges
- Penetration Techniques - Pass the Hash with Remote Desktop (Restricted Admin Mode)
DCSyncmimikatzDRS protocoldomain controllerpassword hash
Source:Domain Penetration - DCSync