Red Team Notes 2.0
Search…
Red Team Techniques
Active Directory
Red Team Infrastructure
DCSync
The concept of DCSync is that it impersonates a Domain Controller to request all the hashes of the users in the domain. Yes. This means as long as you have permissions, you do not need to run any commands on the Domain Controller the need to compromise the DC is not necessary as this one is usually quite difficult
For this to work, it is important to have proper permissions to pull hashes from a Domain Controller. Generally limited to the Domain Admins, Enterprise Admins, Domain Controller Groups, and anyone with the Replicating Changes permissions set to Allow (i.e. Replicating Changes All/Replicating Directory Changes), DCSync will allow your user to perform this attack with the use of mimikatz.
What's the risk?
Well if a user can impersonate a Domain Controller and request for all the domain user's passwords, that is enough risk.
Attack
We can enumerate a user with these permission with powerview by using the Get-ObjectACL CMDLET
Get-ObjectAcl -Identity "dc=dominioncyber,dc=local" -ResolveGUIDs | ? {$_.SecurityIdentifier -match "S-1-5-21-1827981533-2463545078-1305764163-1120"}
Above, when locating these 2 objects DCSync is allowed for the user. This is as simple as running DCSync <username> on Covenant and grabbing the hashes for the krbtgt user.
It also has a sample on what command is being executed when utilizing mimikatz
And we can do this for any user of our choosing in the entire Domain
Jwick
Understanding this technique and exploiting is valuable as this can provide persistence with the highest privileges on the Domain and can be also used to initiate other techniques such as Golden/Silver Tickets.
Last modified 1yr ago
Copy link