Feature/trust-keys (TDO secrets dump) by Goultarde · Pull Request #1321 · Pennyw0rth/NetExec

Goultarde · 2026-07-18T18:29:20Z

Description

Exposes impacket secretsdump's trust key extraction (fortra/impacket#2207) through NetExec's smb --ntds.

Adds two new flags:

--trust-keys: in addition to the usual NTDS account secrets, dumps Trusted Domain Object (TDO) secrets and derives, for each trust direction (Incoming/Outgoing), the inter-realm Kerberos keys (AES256, AES128) and the RC4 (NT) hash, for both the current and the previous trust password.
--just-trust-keys: same extraction, but dumps ONLY the trust keys and skips account enumeration entirely (faster, quieter, no NTDS account secrets).

Also fixes two pre-existing bugs in smb.py's NTDS output handling that surfaced while wiring this in:

The status-stripping logic in add_hash() blindly dropped the last space-separated word of every secret line (meant to strip the trailing "Enabled"/"Disabled" on account lines), which truncated trust key lines since their direction label ((Incoming, previous)) also contains spaces. Now only strips the last word when it's actually a status.
--enabled silently dropped all trust key lines entirely, since they have no account "Enabled"/"Disabled" status to match against. Trust keys are now always shown with --enabled, except previous-password trust keys (trust equivalent of history), which are excluded like disabled/history entries are.

Dependency: requires impacket built from a commit that includes fortra/impacket#2207 (already the case since NetExec pulls impacket from git+https://github.com/fortra/impacket HEAD in pyproject.toml; poetry.lock needs to be refreshed to a commit at or after the merge).

This change was implemented with the assistance of Claude Code (Sonnet 5): it wrote the flag wiring, the fixes to add_hash(). I reviewed and directed each change.

Type of change

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
Deprecation of feature or functionality
This change requires a documentation update
This requires a third party update (such as Impacket, Dploot, lsassy, etc)
This PR was created with the assistance of AI (Claude Code, Sonnet 5: implementation wiring and bug fixes, feature design and testing done by me, see Description)

Setup guide for the review

Tested against a Windows Server 2022 (build 20348) Domain Controller in a domain (serval.int) with multiple trusts (incoming, outgoing, bidirectional, and a one-way external trust). Authenticated with -k (Kerberos).

Bug fix (status-stripping / --enabled): run --ntds --trust-keys (or --just-trust-keys) against a DC with at least one trust configured; without the fix, trust key lines show truncated (e.g. dev.serval.int (Incoming, with the hash missing) and disappear entirely when --enabled is added.
New feature: requires DS-Replication-Get-Changes rights (Domain Admin or equivalent) on the target DC, same privileges as any DCSync/--ntds dump. No additional GPO or registry changes needed. Both the online DRSUAPI path and --ntds vss were exercised.

Commands used:

netexec smb $DC_IP -u $USER -p $PASSWORD -k --ntds --trust-keys
netexec smb $DC_IP -u $USER -p $PASSWORD -k --ntds --just-trust-keys
netexec smb $DC_IP -u $USER -p $PASSWORD -k --ntds --trust-keys --enabled

Screenshots (if appropriate):

netexec smb $DC_IP -u $USER -p $PASSWORD -k --ntds --trust-keys

netexec smb $DC_IP -u $USER -p $PASSWORD -k --ntds --just-trust-keys

netexec smb $DC_IP -u $USER -p $PASSWORD -k --ntds --just-trust-keys --enabled

Checklist:

I have ran Ruff against my changes (poetry: poetry run ruff check ., use --fix to automatically fix what it can)
I have added or updated the tests/e2e_commands.txt file if necessary (new modules or features are required to be added to the e2e tests)
If reliant on changes of third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
I have linked relevant sources that describes the added technique (blog posts, documentation, etc)
I have performed a self-review of my own code (not an AI review)
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)

Expose impacket secretsdump's trust key extraction (fortra/impacket#2207) through NetExec's --ntds: dumps Trusted Domain Object secrets and derives inter-realm Kerberos (AES256, AES128) and RC4 keys for each trust direction. Also fixes the account-line status stripping in add_hash(), which blindly dropped the last space-separated word of every secret line (meant to strip the trailing "Enabled"/"Disabled" on account lines) and was truncating the trust key lines, which contain spaces but no status suffix.

Like --trust-keys but skips account enumeration entirely (implied --just-dc behavior in impacket), emitting only the trust keys. Useful when only the inter-realm keys are needed, for a faster and quieter dump.

--just-trust-keys reused the regular NTDS dump summary ("NTDS hashes", "added to the database", grep-disabled hint), which is meaningless when only trust keys are dumped (no accounts are enumerated). Show a summary specific to that mode instead.

Trust key lines never contain "Enabled"/"Disabled" (they have no account status), so the --enabled filter silently dropped them entirely. Detect trust key lines and always show them regardless of --enabled.

NeffIsBack

Hi and thanks for the PR!

Does rc4_hmac refer to the nt hash? Maybe we should align it with the original ntds output, also in respect to dumping the kerberos keys only when --kerberos-keys is specified.

NeffIsBack · 2026-07-19T18:14:11Z

            printUserStatus=True,
+            trustKeys=self.args.trust_keys,
+            justTrustKeys=self.args.just_trust_keys,
+            domainFQDN=self.domain,


That must be self.targetDomain

Goultarde · 2026-07-26T15:22:26Z

Hi, wdym by "Maybe we should align it with the original ntds output"? Do you mean deleting the rc4_hmac label? (cause I hardcoded it on the impacket side too)

For --kerberos-keys: you're right, I forgot to gate the AES derivation behind justNTLM in impacket, it always dumped RC4+AES256+AES128 for trust keys regardless of -just-dc-ntlm. I'm opening a PR for that on impacket now, will link it here once it's up.

For now, i'm changing self.domain into self.targetDomain.

Goultarde · 2026-08-19T15:12:10Z

Merged into Impacket.

It looks fine now:

However, I think we should use --history instead of --enabled. But this would require another Impacket PR :/

mpgn · 2026-08-30T21:39:00Z

Noob question but why not dump the trusted key by default with --ntds ?

by why not juste --ntds and it also dump the trusted key ? if the guy only want trusted is use --just-trusted-keys ?

Goultarde · 2026-08-30T23:03:40Z

Hi! That’s a fair question.
To me, it felt natural to keep -just-dc and -trust-keys separate in Impacket, since they work differently and produce different output.
However, I don’t think merging them under --ntds would be unreasonable either.
I’m just not sure which approach is best.

Noob question but why not dump the trusted key by default with --ntds ?

by why not juste --ntds and it also dump the trusted key ? if the guy only want trusted is use --just-trusted-keys ?

mpgn · 2026-08-31T09:24:54Z

Hi! That’s a fair question. To me, it felt natural to keep -just-dc and -trust-keys separate in Impacket, since they work differently and produce different output. However, I don’t think merging them under --ntds would be unreasonable either. I’m just not sure which approach is best.

Noob question but why not dump the trusted key by default with --ntds ?
by why not juste --ntds and it also dump the trusted key ? if the guy only want trusted is use --just-trusted-keys ?

yeah but for exemple "-just-dc" doesn't exist in nxc, the logic is not the same as impacket-secretdump who dump sam, lsa, ntds and can target remote or local, server or dc, in our case we know "--ntds" will target a DC and the privilege to dump is already granted and dump the trust key doesn't cost if you are already dumping the ntds.

I would keep --just-trust-keys but --trust-key is one more option you need to remember which doesn't bring much.

Goultarde · 2026-08-31T09:31:57Z

Seems right to me. I'll change this later. 👍

Signed-off-by: mpgn <5891788+mpgn@users.noreply.github.com>

Set default value for --trust-keys argument to True. Signed-off-by: mpgn <5891788+mpgn@users.noreply.github.com>

mpgn · 2026-08-31T19:50:22Z

Should be good if you want to test it :)

NeffIsBack · 2026-08-31T22:07:48Z

Is it possible to separate it visually from the other output (e.g. adding a .success() log or something)? What about the output file, will it be dumped into the same file?
Might cause issues with parsing if the output has a different structure but it is in the same file

Goultarde added 5 commits July 18, 2026 13:00

Add --just-trust-keys to smb ntds dump

dc7e0e4

Like --trust-keys but skips account enumeration entirely (implied --just-dc behavior in impacket), emitting only the trust keys. Useful when only the inter-realm keys are needed, for a faster and quieter dump.

Fix trust-keys dump summary messages

d96e92d

--just-trust-keys reused the regular NTDS dump summary ("NTDS hashes", "added to the database", grep-disabled hint), which is meaningless when only trust keys are dumped (no accounts are enumerated). Show a summary specific to that mode instead.

Fix trust key lines disappearing with --enabled

9860c5f

Trust key lines never contain "Enabled"/"Disabled" (they have no account status), so the --enabled filter silently dropped them entirely. Detect trust key lines and always show them regardless of --enabled.

Add e2e tests and update --enabled help text for trust keys

77f6ab4

Goultarde requested review from Marshall-Hallenbeck, NeffIsBack, mpgn and zblurx as code owners July 18, 2026 18:29

Goultarde mentioned this pull request Jul 18, 2026

Add/ tdo_dump module #1274

Closed

14 tasks

NeffIsBack requested changes Jul 19, 2026

View reviewed changes

NeffIsBack added the enhancement New feature or request label Jul 19, 2026

Goultarde mentioned this pull request Jul 26, 2026

secretsdump: respect -just-dc-ntlm for trust key Kerberos derivation fortra/impacket#2238

Merged

Use self.targetDomain for trust key salt derivation

59778f5

mpgn added 2 commits August 31, 2026 21:45

simplify the logic and fix regression

9e94f58

Signed-off-by: mpgn <5891788+mpgn@users.noreply.github.com>

Add default value to --trust-keys argument

978270a

Set default value for --trust-keys argument to True. Signed-off-by: mpgn <5891788+mpgn@users.noreply.github.com>

Navigation Menu

Uh oh!

Feature/trust-keys (TDO secrets dump) - #1321

Feature/trust-keys (TDO secrets dump)#1321
Goultarde wants to merge 8 commits into
Pennyw0rth:mainfrom
Goultarde:feature/trust-keys

Goultarde commented Jul 18, 2026

Uh oh!

NeffIsBack left a comment

Uh oh!

NeffIsBack Jul 19, 2026

Uh oh!

Goultarde commented Jul 26, 2026 •

edited

Loading

Uh oh!

Goultarde commented Aug 19, 2026

Uh oh!

mpgn commented Aug 30, 2026 •

edited

Loading

Uh oh!

Goultarde commented Aug 30, 2026

Uh oh!

mpgn commented Aug 31, 2026 •

edited

Loading

Uh oh!

Goultarde commented Aug 31, 2026

Uh oh!

mpgn commented Aug 31, 2026

Uh oh!

NeffIsBack commented Aug 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Goultarde commented Jul 18, 2026

Description

Type of change

Setup guide for the review

Screenshots (if appropriate):

Checklist:

Uh oh!

NeffIsBack left a comment

Choose a reason for hiding this comment

Uh oh!

NeffIsBack Jul 19, 2026

Choose a reason for hiding this comment

Uh oh!

Goultarde commented Jul 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Goultarde commented Aug 19, 2026

Uh oh!

mpgn commented Aug 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Goultarde commented Aug 30, 2026

Uh oh!

mpgn commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Goultarde commented Aug 31, 2026

Uh oh!

mpgn commented Aug 31, 2026

Uh oh!

NeffIsBack commented Aug 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Goultarde commented Jul 26, 2026 •

edited

Loading

mpgn commented Aug 30, 2026 •

edited

Loading

mpgn commented Aug 31, 2026 •

edited

Loading