AdminSDHolder
Last updated
Was this helpful?
Last updated
Was this helpful?
AdminSdHolder protects domain objects against permission changes. "AdminSdHolder" either refers to a domain object, a "worker code" or an operation depending on the context.
The operation consists in the PDC (Principal Domain Controller) Emulator restoring pre-set permissions for high-privilege users every 60 minutes. Understanding what DACLs/ACEs are and how to abuse them is a requirement to the understanding of this persistence technique (see Access Controls abuse).
The operation is conducted by a "worker code" called SDProp (Security Descriptor propagator).
SDProp propagates AdminSdHolder's Security Descriptor (which contains the DACL) to every protected object every 60 minutes if their SD is different.
The AdminSdHolder object is located at CN=AdminSdHolder,CN=SYSTEM,DC=DOMAIN,DC=LOCAL. For instance, the default AdminSdHolder object's DACL contains the following.
Authenticated Users: Read
SYSTEM: Full Control
Administrators: Modify
Domain Admins: ReadAndExecute
Enterprise Admins: ReadAndExecute
The default protected objects are the following.
member users (possibly nested) of the following groups: Account Operators, Administrators, Backup Operators, Domain Admins, Domain Controllers, Enterprise Admins, Print Operators, Read-only Domain Controllers, Replicator, Schema Admins, Server Operators
the following users: Administrator, krbtgt
Once sufficient privileges are obtained, attackers can abuse AdminSdHolder to get persistence on the domain by modifying the AdminSdHolder object's DACL.
Let's say an attacker adds the following ACE to AdminSdHolder's DACL: attackercontrolleduser: Full Control.
At the next run of SDProp, attackercontrolleduser will have a GenericAll privilege over all protected objects (Domain Admins, Account Operators, and so on).
AdminSdHolder's DACL can then be inspected with the same utility.
From UNIX-like systems, this can be done with 's dacledit.py (Python).
July 25th 2023, the is still pending.
This can be done in PowerShell with Add-DomainObjectAcl from 's module.
