Domain Cached Credentials Hash

What is Domain Cached Credentials?

Domain Cached Credentials (DCC) is a cryptographic hash format introduced in Microsoft’s Kerberos authentication framework to mitigate the risk of offline password cracking by reducing the storage requirements of hashed credentials on domain controllers. Originating as an optimization for large-scale enterprise environments, DCC leverages a two-part structure: a **salted hash** (SHA-1 by default) of the user’s password concatenated with a domain-specific salt, followed by a **domain hash** (SHA-1 of the user’s SID and domain name). The primary use-case is to enable efficient credential caching for roaming users while minimizing the attack surface—only the DCC hash (not the plaintext password) is stored on the client, and the domain controller retains the domain hash for validation. This design allows for faster authentication during offline scenarios (e.g., VPN reconnects) without exposing the full password hash to intermediate systems.

The DCC format is vulnerable to cracking due to its reliance on **SHA-1**, a cryptographic hash function now considered insecure for password storage due to its susceptibility to collision attacks and preimage resistance weaknesses. The absence of a **per-user salt** in the initial DCCv1 variant (later iterations added partial salting) enables **rainbow table attacks**, as identical passwords across users produce identical hashes. Additionally, the **SHA-1’s computational efficiency** makes it highly amenable to GPU-accelerated cracking via tools like Hashcat, with modern hardware achieving cracking speeds of **millions of hashes per second**. The lack of **key stretching** (e.g., PBKDF2 or bcrypt) exacerbates the risk, as brute-force attacks can exploit parallelized hardware to recover passwords in minutes for weak inputs. Finally, the **fixed-length output** (160 bits) increases collision probability, though this is less critical than the core cryptographic weaknesses.

Identifying Domain Cached Credentials Hashes

Identifying a hash blindly is often difficult because multiple algorithms can output strings of the exact same length. For example, a standard 32-character hexadecimal string could be MD5, NTLM, MD4, or LM. To definitively identify Domain Cached Credentials, security researchers analyze the hash against a strict regular expression (regex) signature (shown above) to find structural matches.

How to Crack Domain Cached Credentials

If you need to recover the plaintext password for a Domain Cached Credentials hash during a penetration test or forensics investigation, you must supply the correct module ID to your cracking software. Use the exact commands provided at the top of this page to target the hash successfully.