DC Shadow
They told me I could be anything I wanted ... So I became a domain controller
Theory
The idea behind this persistence technique is to have an attacker-controlled machine act as a domain controller (shadow DC) to push changes onto the domain by forcing other domain controllers to replicate.
There are two requirements for a machine to act as a domain controller:
Be registered as a DC in the domain: this is done by
modifying the computer's SPN (
ServicePrincipalName) toGC/$HOSTNAME.$DOMAIN/$DOMAINadding an entry like
CN=$HOSTNAME,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=$DOMAINwith the following attribute values:objectClass: serverdNSHostName: $HOSTNAME.$DOMAINserverReference: CN=$HOSTNAME,CN=Computers,DC=$DOMAIN
Be able to request and/or respond to specific RPC calls:
DRSBind,DRSUnbind,DRSCrackNames,DRSAddEntry,DRSReplicaAdd,DRSReplicaDel,DRSGetNCChanges.
Below is the attack workflow (step 1 & 2 can be switched if need be):
Register the workstation that will act as the shadow DC
add the required entry in
CN=Configurationmodify the workstation's SPN
Prepare the changes to be pushed onto the domain (with calls to
DRSAddEntry)Push the changes by forcing another legitimate DC to replicate from the workstation with a
DRSReplicaAddcall, which automatically makes aDRSGetNCChangescall from the legitimate DC to the shadow DC.Unregister the workstation so it is not longer considered to be a DC (by a
DRSReplicaDelcall and by reverting changes made toCN=Configurationand the workstation's SPN).
CN=Configuration
It is important to note that this technique can be used as a "meta" one, in the sense that it permits to use other persistence techniques, such as SID History , Delegation to KRBTGT and even DACL abuse.
For instance, a DC Shadow attack can be conducted to register a controlled workstation as a domain controller, and then use that to push changes to the domain that would expose it to DACL abuse.
Practice
July 27th 2023 : There is currently no way to exploit this technique purely from a distant UNIX-like machine, as it requires some tools that have yet to be made.
DC Shadow can be performed by using Mimikatz. It works in every 64-bits Windows Server version up to 2022 (included). Everything happens on the workstation that will act as the shadow DC.
Two Mimikatz shells are required:
one with domain admin privileges (called the trigger shell from now on)
one as
NT-AUTHORITY\SYSTEM(called the RPC shell from now on)
Preparing shells
Preparing changes to push
Pushing changes
See the lsadump::dcshadow at The Hacker Tools for more info.
Talk
Resources
Last updated
Was this helpful?