% FOX AD(1) Version 5 | Fox Documentation
fox — The Forensic Examiner's Swiss Army Knife
| fox ad [flags ...] NTDS SYSTEM
Extract NTLM password hashes and records from Active Directory offline databases. Hashes will be shown in secretsdump manner, if records are not specified.
-u, --users
: Show all user records.
-g, --groups
: Show all group records.
-c, --computers
: Show all computer records.
-j, --json
: Show records as JSON objects.
-l, --jsonl
: Show records as JSON lines.
-w, --wordlist
: Lookup hashes using the built-in wordlist. NT and LM hashes will be replaced in place.
-h, --history
: Extract also the users hash history. Lookup of these hashes is also possible.
--lm-only
: Extract only the LM hashes (Hashcat mode 3000). Output will always be plaintext.
--nt-only
: Extract only the NT hashes (Hashcat mode 1000). Output will always be plaintext.
The Active Directory offline database file followed by the Windows system registry hive. To refer to paths inside archives, use the archive!file notation.
FOX_AD_WORDLIST
: Build the rainbow tables based on the given file. The file MUST be a plain text file in either ASCII or UTF-8 encoding. The wordlist MUST contain a single word per line, followed by a linebreak. See <_https://github.com/danielmiessler/SecLists/tree/master/Passwords/Common-Credentials_> for different wordlists. Only available in this mode.
$ fox ad -hw NTDS.dit SYSTEM
: Show NTLM hashes.
$ fox ad -uj NTDS.dit SYSTEM
: Show user records.
Please submit any issues with fox to the project's bug tracker: <_https://foxforensics.eu/issues_>
Please visit the project's homepage at: <https://foxforensics.eu>
fox(1), impacket-secretsdump(1)