Initial public release of ADSyncDump.
Features
- Extract local AD sync account credentials (MSOL_* user with DCSync/Directory Replication rights)
- Extract Azure AD sync account credentials (Global Admin equivalent for Azure tenant takeover)
- In-memory decryption via ADSync service token impersonation, no PowerShell/child process
- Optional AMSI bypass (disabled by default)
- Auto-detect LocalDB instances, supports all AD Connect versions (v1/v2/v3)
- Auto-locate service process via Service Control Manager
- Structured execution logging
- C# 5 compatible, compiles with system csc.exe, no external dependencies
- Works with C2 execute-assembly (Sliver, Cobalt Strike, etc.)
Assets
- ADSyncDump.exe: x64 compiled binary for Windows