Hekatomb

Hekatomb is a Python script designed for advanced post-exploitation in Active Directory environments. It requires Domain Admin rights to extract credentials comprehensively from all domain computers. The tool targets DPAPI blobs stored by users, which contain sensitive data like passwords saved in Windows Credential Manager.

Use cases include red team engagements where attackers have domain admin access and need to harvest credentials at scale without manually targeting individual machines. It streamlines the process of identifying and decrypting secrets across the entire domain, aiding in lateral movement and privilege escalation.

The script outputs decrypted credentials, with options for CSV export or MD5 hashes instead of plaintext for safer handling. Its ASCII art tagline emphasizes that even Domain Admin rights alone are insufficient—Hekatomb enables hacking 'them all'.

Hekatomb authenticates to the target domain controller via SMB (optionally SMBv2) using provided credentials, NTLM hashes, or Domain backup keys. It queries LDAP for all domain computers and users, resolves hostnames via specified DNS if needed. For each computer, it extracts users' DPAPI blobs over SMB/RPC, then uses the domain controller's private key (backup keys or RPC-extracted) to decrypt them, revealing credentials from Windows Credential Manager. Debug modes provide verbose logging of LDAP, SMB, and decryption processes.