Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add ObjectGUID option to secretsdump.py #1892

Open
chadministratorwastaken opened this issue Feb 5, 2025 · 0 comments
Open

Add ObjectGUID option to secretsdump.py #1892

chadministratorwastaken opened this issue Feb 5, 2025 · 0 comments

Comments

@chadministratorwastaken
Copy link

Please consider adding an option to print the Object GUID for AD account objects when running secretsdump.py.

My scenario is offline (i.e., LOCAL) password and hash analysis using ntds.dit and registry hives. Hash dumps in pwdump format do not include unique identifiers for account objects. When multiple domains are contained in the dump "duplicate" objects can occur. For example, the local administrator, guest, and krbtgt accounts for a domain are not printed in domain\user format and always have the same RID. This makes them indiscernible from one domain to another. This is also an issue when machine accounts have the same name across domains, though less frequently. Object GUIDs would positively identify AD objects and serve as a sort of primary key.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant