search

Domain Controllers Synchronization Attack

circle-info

This attack requires to have compromised a high privilege user as descbrided in Theory

hashtag
Theory

In production environments, domains typically rely on more than one domain controller to provide redundancy. The Directory Replication Service (DRS) Remote Protocol1arrow-up-right uses replication2arrow-up-right to synchronize these redundant domain controllers. A domain controller may request an update for a specific object, like an account, using the IDL_DRSGetNCChanges3arrow-up-right API.

The DC receiving the update request doesn't check if the request comes from a known DC.

The goal of this attack is to send a road request update to obtain the passwords of all the users.

To do this, our user must have the following privileges =>Replicating Directory Changes, Replicating Directory Changes All, and Replicating Directory Changes in Filtered Set

Members of the Domain Admins, Enterprise Admins, or the Administrators group at the domain level have those rights and privileges.

hashtag
Attack from domain-joined Windows

We launch mimikatz and run the attack and get the hash of the Administrator for example:

mimikatz # lsadump::dcsync /user:corp\Administrator
...
Credentials:
  Hash NTLM: 2892d26cdf84d7a70e2eb3b9f05c425e
...

No that we have the hash we can crack it.

hashtag
Attack from Kali

We want the hash of dave:

We use the IP of the domain controller

We get it!

it's 08d7a47a6f9f66b97b1bae4178747494

PreviousSilver Ticket ForgeryNext4 - Lateral Movement

Last updated