hekatomb
Extract and decrypt all credentials from all domain computers
uncategorizedRed Team
TooluncategorizedredLinuxKali LinuxPlatforms: Linux · Last verified September 6, 2026
Hekatomb is a Python script that connects to an LDAP directory to retrieve all computers and users’ information. From there, it will download all DPAPI blobs of all users from all computers and use Domain backup keys to decrypt them.
Only use this tool against systems you own or are explicitly authorized to test — see the disclaimer.
Getting started
Install on Kali Linux with `sudo apt install hekatomb`. See the official Kali tool page and upstream homepage linked above for full usage and configuration details.
