{"id":1785,"date":"2015-09-25T16:17:49","date_gmt":"2015-09-25T20:17:49","guid":{"rendered":"https:\/\/adsecurity.org\/?p=1785"},"modified":"2017-12-30T13:22:58","modified_gmt":"2017-12-30T18:22:58","slug":"sneaky-active-directory-persistence-11b-dsrm-persistence-v2","status":"publish","type":"post","link":"https:\/\/adsecurity.org\/?p=1785","title":{"rendered":"Sneaky Active Directory Persistence #13: DSRM Persistence v2"},"content":{"rendered":"

The content in this post describes a method by which an attacker could persist administrative access to Active Directory after having Domain Admin level rights for 5 minutes.<\/p>\n

I presented on this AD persistence method at DerbyCon (2015).<\/a>
\nI also presented<\/a> and posted on DSRM as a persistence method<\/a> previously.<\/p>\n

Complete list of Sneaky Active Directory Persistence Tricks posts <\/a><\/p>\n

Special thanks to Benjamin Delpy<\/a> since the research highlighted on this page wouldn’t have been possible without his valuable input.<\/em><\/span><\/p>\n

 <\/p>\n

The Directory Restore Mode Account<\/strong><\/p>\n

Every Domain Controller has an internal \u201cBreak glass\u201d local administrator account to DC called the Directory Services Restore Mode (DSRM) account. The DSRM password is set when a new DC is promoted and the password is rarely changed.<\/p>\n

The DSRM account name is “Administrator” and is the Domain Controller\u2019s local admin account.
\nWe can confirm this with Mimikatz by dumping the local SAM credentials on a Domain Controller.<\/p>\n

Mimikatz “token::elevate” “lsadump::sam” exit<\/i><\/p>\n

\"SneakyPersistence-DSRM-v2-Dump-DSRM-Local-DCAdministrator-Account\"<\/a><\/p>\n

Using DSRM Credentials (standard methods)<\/b><\/p>\n

Once you know the DSRM account password (local Administrator account on the DC), there are a few tricks to how it can be used.<\/p>\n

Logging on to a DC with the DSRM account:<\/p>\n

    \n
  1. Restart in Directory Services Restore Mode (bcdedit \/set safeboot dsrepair<\/i>)<\/li>\n
  2. Access DSRM without rebooting (Windows Server 2008 and newer)\n
      \n
    1. Set the registry key DsrmAdminLogonBehavior to 1<\/li>\n
    2. Stop the Active Directory service<\/li>\n
    3. Logon using DSRM credentials on the console.<\/li>\n<\/ol>\n<\/li>\n
    4. Access DSRM without rebooting (Windows Server 2008 and newer)\n
        \n
      1. Set the registry key DsrmAdminLogonBehavior to 2<\/li>\n
      2. Logon using DSRM credentials on the console.<\/li>\n<\/ol>\n<\/li>\n
      3. Remote Desktop Client when connecting to the “Console” which is “mstsc \/console” prior to Windows Server 2008 and “mstsc \/admin” with Windows Server 2008 and newer. Tested on Windows Server 2008 R2. Windows Server 2012R2 seems to refuse DSRM logon via RDP console.<\/li>\n<\/ol>\n

        The DSRM Account is a local admin account, so let’s see what else is possible…<\/p>\n

        <\/p>\n

        Advanced Method for Using DSRM Credentials (Windows 2012 R2)<\/b><\/p>\n

        What’s really interesting about this account is that since it’s a valid local administrator account, it can be used to authenticate over the network to the DC (ensure the\u00a0DsrmAdminLogonBehavior regkey is set to 2) . Furthermore, the attacker doesn’t need to know the actual password, all that’s required is the password hash. This means that once an attacker has the password hash for the DSRM account, it can be “passed” to the DC for valid admin access to the DC across the network using Pass-the-Hash. This was tested successfully in limited lab testing on a Windows Server 2008 R2 & 2012 R2 Domain Controllers.<\/p>\n

        Mimikatz “privilege::debug” “sekurlsa::pth \/domain:ADSDC03 \/user:Administrator \/ntlm:7c08d63a2f48f045971bc2236ed3f3ac” exit
        \n<\/i><\/p>\n

        \"SneakyPersistence-DSRM-v2-Dump-DSRM-Local-DCAdministrator-Account-PTH-Connect-DriveC\"<\/a><\/p>\n

        Gaining access to a Domain Controller’s file system is nice, but we can do better!<\/p>\n

         <\/p>\n

        DSRM PTH to DCSync!
        \n<\/b><\/p>\n

        Since it is possible to pass-the-hash for the DSRM account, why not leverage this access to pull password data for any domain account using Mimikatz DCSync. We can target the specific Domain Controller and by using the DC’s short name, we force NTLM authentication.
        \nMimikatz “lsadump::dcsync \/domain:lab.adsecurity.org \/dc:adsdc03 \/user:krbtgt<\/em><\/p>\n

        \"SneakyPersistence-DSRM-v2-Dump-DSRM-Local-DCAdministrator-Account-PTH-DCSync-For-KRBTGT\"<\/a><\/p>\n

         <\/p>\n

        Conclusion<\/b><\/p>\n

        If an attacker can gain knowledge of the DSRM account password on a Domain Controller running Windows Server 2008 R2 or 2012 R2 (with the\u00a0DsrmAdminLogonBehavior regkey set to 2), the DSRM account can be used to authenticate across the network via pass-the-hash to the DC (forcing NTLM authentication). This enables an attacker to retain Domain Controller admin rights when all domain user and computer passwords are changed.<\/p>\n

        The DSRM account now provides a useful attack method to pull domain credentials, despite the fact it’s a “local” administrator account.<\/p>\n

        Many thanks to Benjamin Delpy (author of Mimikatz) for his help in figuring this out!<\/p>\n

         <\/p>\n

        Mitigation<\/b><\/p>\n

        The only true mitigation for this issue is to ensure the DSRM account passwords are unique for every Domain Controller and are changed regularly (at least as often as other account passwords). Also, ensure the DsrmAdminLogonBehavior regkey is *not* set to 2 – this registry key doesn’t exist by default. Setting this regkey to 1 forces the admin to stop the Directory Services service for DSRM logon to work.<\/p>\n

        The Registry Key HKLM\\System\\CurrentControlSet\\Control\\Lsa\\DsrmAdminLogonBehavior<\/em> should not exist or be set to 1.<\/p>\n

         <\/p>\n

         <\/p>\n

         <\/p>\n","protected":false},"excerpt":{"rendered":"

        The content in this post describes a method by which an attacker could persist administrative access to Active Directory after having Domain Admin level rights for 5 minutes. I presented on this AD persistence method at DerbyCon (2015). I also presented and posted on DSRM as a persistence method previously. Complete list of Sneaky Active … <\/p>\n

        Continue reading<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[565,11,234,2],"tags":[598,133,590,624,623,653,626,207,628,625,44,73,627,596,622,54],"class_list":["post-1785","post","type-post","status-publish","format-standard","hentry","category-activedirectorysecurity","category-microsoft-security","category-security-conference-presentationvideo","category-technical-reference","tag-dcsync","tag-derbycon","tag-dsrm","tag-dsrmpassthehash","tag-dsrmpersistence","tag-dsrmptg","tag-lsadump","tag-mimikatz","tag-mstsc","tag-pass-the-hash","tag-passthehash","tag-pth","tag-sam","tag-sneakyadpersistence","tag-sneakypersistence","tag-windowsserver2012r2","item-wrap"],"_links":{"self":[{"href":"https:\/\/adsecurity.org\/index.php?rest_route=\/wp\/v2\/posts\/1785","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/adsecurity.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/adsecurity.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/adsecurity.org\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/adsecurity.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1785"}],"version-history":[{"count":15,"href":"https:\/\/adsecurity.org\/index.php?rest_route=\/wp\/v2\/posts\/1785\/revisions"}],"predecessor-version":[{"id":3902,"href":"https:\/\/adsecurity.org\/index.php?rest_route=\/wp\/v2\/posts\/1785\/revisions\/3902"}],"wp:attachment":[{"href":"https:\/\/adsecurity.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1785"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/adsecurity.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1785"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/adsecurity.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1785"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}