Domain Cached Credentials 2 Hash

What is Domain Cached Credentials 2?

Domain Cached Credentials 2 (DCC2) is a cryptographic hash format introduced as part of Microsoft’s Active Directory authentication protocol to improve performance and interoperability in Kerberos-based environments. Originating from the need to reduce the computational overhead of traditional password hashing (such as LM or NTLM), DCC2 was designed as a lightweight alternative that leverages the Domain Password Hash (DPH) combined with a salted MD4 hash of the user’s password. The format consists of two primary components: the first 16 bytes represent the plaintext Domain Password Hash (DPH), while the subsequent 16 bytes contain the MD4 hash of the password concatenated with a fixed salt (typically the user’s username or a derived value). This structure enables faster authentication verification by allowing clients to bypass full Kerberos handshake steps when the domain controller already possesses cached credentials, making it ideal for scenarios like roaming user profiles or offline authentication scenarios.

DCC2 is highly vulnerable to cracking due to its reliance on unsalted or weakly salted MD4 hashes, which are susceptible to brute-force and rainbow table attacks. The absence of a per-user salt in the second component allows attackers to precompute hashes for common passwords, significantly reducing the time complexity of offline cracking. Additionally, MD4’s inherent weaknesses—such as collision vulnerabilities and poor avalanche effects—make it prone to cryptanalytic attacks, particularly when combined with GPU-accelerated tools like Hashcat or John the Ripper. The fixed salt (or minimal entropy) further exacerbates this, as identical hashes for repeated passwords enable batch decryption. Finally, the inclusion of the plaintext DPH in the first 16 bytes introduces a bypass vector: if an attacker obtains a DCC2 hash, they can directly extract the DPH for offline Kerberos replay attacks, circumventing the need to crack the MD4 component entirely.

Identifying Domain Cached Credentials 2 Hashes

Identifying a hash blindly is often difficult because multiple algorithms can output strings of the exact same length. For example, a standard 32-character hexadecimal string could be MD5, NTLM, MD4, or LM. To definitively identify Domain Cached Credentials 2, security researchers analyze the hash against a strict regular expression (regex) signature (shown above) to find structural matches.

How to Crack Domain Cached Credentials 2

If you need to recover the plaintext password for a Domain Cached Credentials 2 hash during a penetration test or forensics investigation, you must supply the correct module ID to your cracking software. Use the exact commands provided at the top of this page to target the hash successfully.