SharpDCSync Demonstrates Active Directory DCSync Without Mimikatz
· 15:41 · Watch on YouTube ↗
Summary
A lab demonstration shows SharpDCSync retrieving Active Directory user hashes through DCSync, including execution via Mythic. The presenter reports no Defender alert in the test and notes that the attack requires replication-capable permissions.
Key points
- DCSync can retrieve domain user password hashes when run with an account that has the necessary directory replication rights.
- SharpDCSync uses C#/.NET rather than loading Mimikatz; the presenter says this makes it easier to obfuscate and may reduce detection.
- In the presenter’s lab, the unmodified binary produced no Defender alert during the on-disk test; this is a demonstration result, not a general detection assessment.
- The tool failed when run as a regular user and succeeded when run with a domain administrator account.
- The video demonstrates running the assembly through Mythic and describes a Haunt agent with a built-in DCSync command and token-manager support.
Article Details
- Topics
- [00:00] DCSync and the directory replication privileges required to retrieve user hashes
- [03:36] SharpDCSync's C#/.NET approach and the presenter's detection claims
- [05:00] Compiling SharpDCSync and its compiler and library requirements
- [07:01] On-disk testing and the presenter's Defender results
- [10:16] Executing the assembly through Mythic and other C2 frameworks
- [12:15] Built-in DCSync functionality, token support, and permission failures