What is DCSync and what protocol does it use to replicate user credentials?

DCSync is a technique in mimikatz that uses the Directory Replication Service (DRS) protocol to replicate user credentials from a domain controller. It calls IDL_DRSGetNCChanges to export password hashes of all domain users, enabling attackers to escalate privileges or move laterally. --- **Related reading:** - [Domain Penetration - DCSync](/news/domain-penetration-dcsync) — original article - [Webmin<=1.920-Unauthenticated_RCE(CVE-2019-15107) Exploitation Test](/news/webmin-1-920-unauthenticated-rce-cve-2019-15107-exploitation-test) - [Use powershell to find a writable windows service](/news/use-powershell-to-find-a-writable-windows-service) - [Windows Shellcode Study Notes - Extraction and Testing of Shellcode](/news/windows-shellcode-study-notes-extraction-and-testing-of-shellcode)