6. The “True” Nature of Administrative Access
▪ Controversial statement: membership in a system’s
local administrators group isn’t what ultimately
▪ What actually matters is what local/domain groups
have access to specific remote resources (RPC,
remote reg, WMI, SQL, etc.) based on the host
service’s security descriptors
12. From Owners to DACLs to ACEs
▪ An object’s Owner completely controls an object
▪ An object’s Discretionary Access Control List
(DACL) is collection of Access Control Entries
▫ ACEs – Allow/Deny rules of who can do what to an object
14. Authorization Checks
▪ Individual services perform authorization checks
when objects are accessed
▪ Services compare the requestor’s user/group SIDs
to the DACL and grant/deny access
▪ Local “Administrators” is a group many services
grant access to by default (but it could be denied)
16. Why Care?
▪ It’s often difficult to determine whether a specific security
descriptor misconfiguration was set maliciously or configured
▫ Existing misconfigurations: privesc/lateral movement opportunities
▫ Malicious misconfiguration changes: persistence!
▪ These changes often have a minimal forensic footprint
▪ Many teams are not aware of these misconfigurations, much
less how to identify, abuse, or remediate them
20. Persistent vs Runtime Security Descriptors
▪ Where do objects get their security descriptor?
▫ Persistent - Security descriptor loaded from registry, file, etc.
▫ Runtime - Security descriptor is in memory
▪ Our approach for enumeration:
▫ Locally as an unprivileged user
▫ Locally as a privileged user
▫ Remotely as an unprivileged user
▫ Remotely as a privileged user
21. Example: Remote Registry
▪ Imagine this scenario: remotely dumping an
endpoint’s machine account hash as an “unprivileged”
user (i.e. not in local admins)!
▪ Backdoor Process
▫ Remotely backdoor the winreg key with an attacker-
controlled user/group (this key == remote registry access)
▫ Add malicious ACEs to a few specific registry hives/keys so
we can read LSA secrets remotely
22. Example: Remote Registry
▪ (Remote) Backdoor Execution
▫ As the backdoor (domain or local) user, connect to the
remote registry service on the backdoored system
▫ Open up specific reg keys linked to LSA and extract their
▫ Combine these class values and compute the BootKey
▫ Use the BootKey to decrypt the LSA key
▫ Use the LSA key to decrypt the machine account hash!
▫ EVERYONE GETS A SILVER TICKET!!
24. Active Directory ACL Advantages
▪ A big advantage: by default the DACLs for nearly
every AD object can be enumerated by any
authenticated user in the domain through LDAP!
▪ Other advantages of AD ACLs:
▫ Changes also have a minimal forensic footprint
▫ Changes often survive OS and domain functional level
upgrades, i.e. “misconfiguration debt”
▫ Anti-audit measures can be taken!
26. Generic Rights We Care About
GenericAll Allows ALL generic rights to the specified object
GenericWrite Allows for the modification of (almost) all
properties on a specified object
WriteDacl Grants the ability to modify the DACL in the
object security descriptor
WriteOwner Grants the ability to take ownership of the object
27. Object-specific Rights We Care About (abbreviated)
Users User-Force-Change-Password or write to
Groups Write to the member property
Computers None outside of LAPS :(
GPOs Modification of GPC-File-Sys-Path
Domains WriteDacl to add DCSync rights
28. Example: Abusing Exchange
▪ Exchange Server introduces several schema changes,
new nested security groups, and MANY control
relationships to Active Directory, making it a perfect
spot to blend in amongst the noise!
▪ Pre Exchange Server 2007 SP1, this included the
WriteDACL privilege against the domain object itself
with Exchange Trusted Subsystem as the principal
30. ▪ Prior to joining active directory, the host is in ultimate
control of who can access its resources
▪ After a machine is joined to AD, a few things happen:
▫ The machine is no longer solely in charge of authentication
▫ A portion of key material for the host is stored in another
location (machine account hash in ntds.dit)
▫ Default domain group SIDs are added to local groups
▫ Management is no longer solely left to the host (i.e. GPOs :)
“Risks” Of Joining Active Directory
31. Active Directory: Before and After
Security Principals Local users/groups
Authentication NTLM (SAM)
+ Domain users/groups
+ Default domain groups
added to local groups
32. Active Directory: Before and After
33. Security Implications
▪ Host-based security descriptors are the missing
link when thinking about domain attack graphs!
▪ There ARE existing “misconfigurations” in the security
descriptors in some host-based services!
▫ More to come on this in a bit ;)
▪ Host-based security descriptor modifications can be
chained with AD misconfigurations/modifications
▪ “Fills the gap” left by the lack of an AD ACL computer primitive
34. tl;dr Security Implications of Joining Active Directory
▪ When you join a system to Active Directory, you’re
introducing additional nodes into the access graph
that may affect the security of other systems
▪ You’re also implicitly trusting the security of a
large number of other nodes in the graph as well
▫ You’re almost certainly exposing your system’s services
to more access than you realize!
36. Case Study: Exchanging Rights
▪ We saw before that the Exchange Trusted
Subsystem group (which contains Exchange servers)
often has a huge number of rights over the domain
▪ So let’s integrate the remote registry host-based
backdoor on an Exchange box!
▫ No changes to the DC or any AD data
▫ Takes advantage of existing misconfigurations!
39. Ingredient #1: Unconstrained Delegation
▪ If a server is configured for unconstrained
delegation, service ticket requests will include the
requestor’s TGT stuffed into the service ticket
▪ So if you can get a principal to auth to an
unconstrained server you control, you can
extract their TGTs out of memory!
▪ More information: https://adsecurity.org/?p=1667
40. Ingredient #2: Effectively Extracting TGTs
▪ Rubeus is a new C# Kerberos abuse toolkit that
includes various ticket extraction capabilities
▪ The monitor action will monitor 4624 logon events
from the event log and extract any new usable
TGT .kirbis from LSASS using LSA APIs
▫ No read handle to LSASS needed!
41. Ingredient #3: The Printer Bug
▪ Old but enabled-by-default-on-Windows Print
System Remote Protocol (MS-RPRN)
▫ Purpose: “REMOTESERVER, send me a notification when
____” (e.g. when there’s a new print job)
▪ Implication: *Any domain user* can coerce
REMOTESERVER$ to authenticate to any machine
▫ Won’t fix by Microsoft - “ by design” ☺
42. Ingredient #3: The Printer Bug
Domain User/Attacker: Please authenticate to OTHERHOST
▪ Machine account TGT theft via Unconstrained Delegation
▪ NTLM attacks!!!!
▪ NTLM-relay to ______ protocol
▪ Is SERVER$ local admin anywhere? (Relay and login)
▪ LDAP relay anyone…. ☺
▪ NTLMv1 downgrade attacks - XP/2003 anyone?
43. The Dangerous Recipe
1. Compromise a server configured with
2. Beginning monitoring for delegated TGTs
▫ Start Rubeus’ monitor action with /interval:5
3. Coerce a domain controller to authenticate to the
unconstrained server using SpoolSample
4. Load the extracted ticket, DCSync, profit!
▪ Access is more than just “local administrators” !
▪ Host based security descriptors (accidentally misconfigured,
configured by default, or maliciously backdoored) can have
far-reaching implications for the security of other
systems in the domain!
▪ Defense should focus on restricting access to ALL securable
objects (host, AD, Exchange, etc.)
You can find us at @SpecterOps:
▪ @harmj0y , @tifkin_ ,
Credit to @elad_shamir for subsequent
discovery of the printer bug!
47. Appendix: Printer Bug Details
▪ Print System Remote Protocol (MS-RPRN)
▫ All comms are SMB-RPC (TCP 445)
▫ Named Pipe: pipespoolss
▫ RPC UUID: 12345678-1234-ABCD-EF00-0123456789AB
▫ “Discovered” by reading the protocol spec (likely more
RPC servers that do a similar thing)
48. Appendix: Printer Bug Details
▪ Opnum 62 or 65
▪ The RPC server is accessible by all domain users
on Windows >= 8 if the Spooler service is started
(Server & Workstations have it enabled by default)
▫ On Windows < 8 , seems possible if the host has
shared a printer
49. Appendix: Coerced Machine Account Authentication
▪ Printer bug isn’t the only way to do this (we’ve already confirmed from
our own research/other that there’s other vectors)
▪ If NTLMv1 enabled? Do an NTLMv1 downgrade and get the machine’s
▪ NTLM relay
▫ Is a machine account a member of the local Administrators group on any
machine? (Often seen on SCCM and Exchange servers)
▫ NTLM relay to LDAP and grant yourself DCSync rights if LDAP signing not
enforced (see @_dirkjan’s contribution to ntlmrelayx)
▫ Problematic with SMB -> LDAP due to SMB clients setting the signing
bit (thanks @_dirkjan!)
50. Hi Lee,
The team has finished its investigation and determined the issue is by-design.
From the NTLM side of things, this is a relay attack, and there are plenty of mitigations that customers can
use to mitigate this particular attack:
1. Restrict NTLM usage
2. Configure/enable Extended Protection for Authentication for all services that support it.
3. Enable SMB Signing or SMB Encryption
4. Do not grant machine accounts administrative privileges to other machine accounts
51. Additional Guidance
▪ Impersonating domain machine accounts is by design? ¯_(ツ)_/¯
▫ We don’t think it was, but nonetheless, it’s possible
▪ Restricting access to hosts/networks goes a LONG way
▫ Windows does not require inbound network access in order to work
in Active Directory!
▫ FIREWALLS!! Host-based and network
▪ Prevent relaying to LDAP: Set LdapEnforceChannelBinding to 1