Domain Password Audit Tool (DPAT)

This is a python script that will generate password use statistics from password hashes dumped from a domain controller and a password crack file such as hashcat.potfile generated from the Hashcat tool during password cracking. The report is an HTML report with clickable links.

A full video tutorial and demo can be viewed here: http://www.blackhillsinfosec.com/?p=5527.

You can run the python script as follows.

dpat.py -n customer.ntds -c hashcat.potfile -g /home/tester/groups -p 8

The three required parameters are the hashes extracted from the domain controller -n, the list of cracked passwords -c generated by tools like Hashcat or JohnTheRipper, and the minimum password length specified in the domain password policy -p.

Note that the group lists directory (-g) is optional. Try this out on the example files provided in the sample_data folder of this project. The sample data was built from census data for common first and last names and passwords from the well known rockyou list.

Your customer.ntds file should be in this format:

domain\username:RID:lmhash:nthash:::

You can get this file by first dumping the password hashes from your domain controller by executing the following command in an administrative command prompt on a domain controller. Just make sure you have enough disk space to store the output in c:\temp. The amount of space needed will be slightly larger than the size of the ntds.dit file that is currently on the disk, as this performs a backup of that file and some registry settings.

ntdsutil "ac in ntds" "ifm" "cr fu c:\temp" q q

The ntdsutil command will create the two files, Active Directory\ntds.dit and registry\SYSTEM, that are needed. You can then turn this output into the format expected by DPAT using secretsdump.py. Secretsdump comes pre-installed on Kali Linux or can be easily installed on Windows using these instructions.

secretsdump.py -system registry/SYSTEM -ntds "Active Directory/ntds.dit" LOCAL -outputfile customer

If you would like to report on password history, include the -history flag as shown below. Note: Jan/2020 Josh Wright reported that the history hashes are not exported correctly on ntds.dit files from Win2K16 TP4 and later. See this issue.

secretsdump.py -system registry/SYSTEM -ntds "Active Directory/ntds.dit" LOCAL -outputfile customer -history

Note: Try using impacket-secretsdump instead of secretsdump.py on Kali Linux if secrectsdump.py can't be found.

The command above will create a file called "customer.ntds" which you will use with this tool (DPAT) as well as for password cracking. You can now proceed with your password cracking efforts to create a crack file in this format (which is the default output of the Hashcat tool):

nthash:password

Or for LM Hashes:

lmhashLeftOrRight:leftOrRightHalfPasswordUpcased

The DPAT tool also supports output from John the Ripper (same format as hashcat.potfile but prepended with $NT$ or $LM$)

The optional "-g" option is followed by a list of any number of files containing lists of users who are in the given group such as "Enterprise Admins" or "Domain Admins". The file can be in the format output by the PowerView PowerShell script as shown in the example below:

Get-NetGroupMember -Recurse -GroupName "Domain Admins" > "Domain Admins.txt"

or to read a group from another domain use something like the following (note that name of the other domain and the domain controller can be obtained with Get-NetForestDomain)

Get-NetGroupMember -Recurse -GroupName "Enterprise Admins" -Domain "some.domain.com" -DomainController "DC01.some.domain.com" > "Enterprise Admins.txt"

Alternatively, the group files can simply be a list of users, one per line, in the following format:

domain\username

Here is a small PowerShell script to create "Schema Admins.txt"

$GroupName = "Schema Admins"
$UPNS = Get-ADGroupMember -Identity $GroupName -Recursive | % {Get-ADUser $_.samaccountname|select userprincipalname -ExpandProperty userprincipalname}
$UPNS = $UPNS| Sort-Object | Get-Unique
$output = @()
foreach ($UPN in $UPNS) {
    $user, $domain = $UPN -split '@'
    $fqdn = $domain + '\' + $user
    $output += $fqdn
    }
$file = $GroupName + ".txt"
$output | Out-File  -filepath $file

The Domain Password Audit Tool also has the handy feature to finish cracking the LM hashes for any hashes where the NT hash was not cracked. This asssumes that you have used Hashcat to brute force all 7 character passwords with the following command:

./hashcat.bin -m 3000 -a 3 customer.ntds -1 ?a ?1?1?1?1?1?1?1 --increment

Or to crack LM hashes with John the Ripper instead:

john --format=LM customer.ntds

To see all available DPAT options use the '-h' or '--help' option

usage: dpat.py [-h] -n NTDSFILE -c CRACKFILE [-o OUTPUTFILE] [-d REPORTDIRECTORY] [-w] [-s] [-g GROUPSDIRECTORY] [-m] [-k] [-kz KERBFILE]
               [--ch-encoding CH_ENCODING] [-dbg] -p MINPASSLEN

This script will perform a domain password audit based on an extracted NTDS file and password cracking output such as Hashcat.

options:
  -h, --help            show this help message and exit
  -n, --ntdsfile NTDSFILE
                        NTDS file name (output from SecretsDump.py)
  -c, --crackfile CRACKFILE
                        Password Cracking output in the default form output by Hashcat, such as hashcat.potfile
  -o, --outputfile OUTPUTFILE
                        The name of the HTML report output file, defaults to _DomainPasswordAuditReport.html
  -d, --reportdirectory REPORTDIRECTORY
                        Folder containing the output HTML files, defaults to DPAT Report
  -w, --writedb         Write the SQLite database info to disk for offline inspection instead of just in memory. Filename will be
                        "pass_audit.db"
  -s, --sanitize        Sanitize the report by partially redacting passwords and hashes. Prepends the report directory with "Sanitized - "
  -g, --groupsdirectory GROUPSDIRECTORY
                        The path to the directory containing files that contain lists of usernames in particular groups. The group names will
                        be taken from the first line in each file. The username list must be in the same format as found in the NTDS file
                        such as some.ad.domain.com\username
  -m, --machineaccts    Include machine accounts when calculating statistics
  -k, --krbtgt          Include the krbtgt account
  -kz, --kerbfile KERBFILE
                        File that contains NTDS lines for Kerberoastable accounts (from the cypherhound script)
  --ch-encoding CH_ENCODING
                        Encoding to open cypherhound files with (default cp1252)
  -dbg, --debug         Enable debug output (for development purposes)
  -p, --minpasslen MINPASSLEN
                        Minimum password length defined in the domain password policy. Any cracked password shorter than this is reported.

CypherHound Integration (Add Extra Statistics)

You can plug files into DPAT generated by CypherHound in order to provide more statistics to DPAT reports. Currently, the extra statistics are:

• Group cracking statistics for every group in a given domain
• Cracked kerberoastable accounts

If you would like to utilize it for providing these extra statistics you will need to utilize the scripts here:

• parse-memberships.py. Pass the output directory to DPAT with the -g flag.
• parse-kerberoastable.py. Pass the output file to DPAT with the -kz flag.

They are simple scripts with usage linked above and using them should be straightforward.

Author Credits

• Carrie Roberts
• Dylan Evans

Originally Sponsored by: