secretsdump

Impacket's secretsdump.py extracts Windows account credential material without installing an agent on a remote target. It can collect local SAM hashes and SECURITY-hive LSA secrets or cached credentials, obtain NTDS account data through DRSUAPI or VSS-based remote collection, and parse supplied local hive or NTDS files. Directory-replication permissions are required for DCSync; remote hive and snapshot operations have separate target privilege and connectivity requirements.