Active Directory Dumper

Source: #_shellntel Cybersecurity Blog

Author: Dylan Reuter

URL: https://blog.shellntel.com/p/active-directory-dumper

https://blog.shellntel.com/p/active-directory-dumper

ONE SENTENCE SUMMARY:

ActiveDirectoryDumper consolidates Active Directory password and domain data collection into JSON and pwdump outputs for streamlined auditing and hash analysis.

MAIN POINTS:

  1. Auditors previously used multiple tools generating many files requiring Excel imports.
  2. Hash Master 1000 was created to address shortcomings in legacy password analysis workflows.
  3. Active Directory Dumper (ADD) serves as an all-in-one AD domain information gathering tool.
  4. Collected scope includes password policy, lockout policy, users, groups, trusts, and computers.
  5. C#/.NET implementation simplifies deployment and improves end-user experience.
  6. Integrated Windows authentication eliminates entering credentials on the command line.
  7. Automatic discovery removes the need to specify domain name or domain controller.
  8. Execution does not require running on a Domain Controller, only sufficient privileges.
  9. Output mirrors ldapdomaindump-style data but consolidated into a single JSON file.
  10. Extracts current and historical password hashes, exporting to a pwdump file for cracking.

TAKEAWAYS:

  1. Consolidating AD data into one JSON reduces tool sprawl and manual post-processing.
  2. Native authentication and auto-discovery lower operator errors and configuration overhead.
  3. Including NTLM hashes per account enables direct linkage between objects and hash results.
  4. Historical hash extraction expands audit visibility beyond current credential state.
  5. Pairing ADD with Hash Master 1000 significantly improves password assessment depth and efficiency.