ADDOM-005: Obsolete OS on Domain Controllers
- Plataforma
- Active Directory
- Categoría
- AD Domain & Forest Configuration
- Severidad
- Critical
- Pilar de Zero Trust
- Governance (peso 0)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Guerrilla enumerates the domain controllers list via Get-ADDomainController -Filter * (which under the covers queries CN=Domain Controllers,DC=<domain> and resolves the serverReference for each nTDSDSA object under CN=Sites,CN=Configuration). For each DC computer object the check reads the operatingSystem, operatingSystemVersion, operatingSystemServicePack, and lastLogonTimestamp attributes. It also pulls the msDS-Behavior-Version of the domain (CN=NTDS Settings) and the forest functional level from CN=Partitions. operatingSystemVersion is normalized to a build number and compared against the supported-OS table: Windows Server 2003 / R2 (5.2), 2008 (6.0), 2008 R2 (6.1), 2012 (6.2), and 2012 R2 (6.3) all fail. Windows Server 2016 (10.0.14393), 2019 (10.0.17763), 2022 (10.0.20348), and 2025 (10.0.26100) pass, with an additional patch-currency hint generated from the operatingSystemVersion minor build when available. The check also flags Server Core variants only on the OS-currency criterion (Server Core is not itself a finding). A separate cross-check against the Configuration container ensures every DC actually replicates: a stale nTDSDSA object pointing at a decommissioned legacy OS will be reported under ADSTALE rather than ADDOM-005.
Por qué importa
Domain controllers are Tier 0 by definition. They host the Kerberos KDC, the NTDS.dit database that contains every password hash in the domain, the krbtgt account used to sign all TGTs, and the replication subsystem that propagates LAPS passwords, GMSA secrets, and trust keys. A single remote code execution primitive on any DC yields the krbtgt hash (golden ticket), the DPAPI backup key, the AD CS private key when colocated, and the ability to write any object in the directory. End-of-life Windows Server releases accumulate an unbounded backlog of unpatched vulnerabilities: ZeroLogon (CVE-2020-1472) was patched in August 2020 but Windows Server 2008 and 2008 R2 reached end of extended support in January 2020 and received only ESU patches, which most environments do not subscribe to; PrintNightmare on the spooler service ships enabled on legacy DCs by default; SMBv1 remained on by default through Windows Server 2012 R2 and is the vehicle for EternalBlue. Additionally, modern hardening features (LSA Protection on by default, Credential Guard, hardware-enforced stack protection, mandatory SMB signing, Strong Certificate Binding Enforcement, the Local KDC, and the post-November-2022 Kerberos PAC signature) are unavailable or partially implemented on pre-2016 builds. Auditors who follow CIS, PCI DSS 4.0, HIPAA, and the DoD STIG explicitly fail any in-scope server running an unsupported OS; for a domain controller the finding is non-negotiable.
Ruta de ataque
Step 1: Discovery. The attacker, holding any authenticated foothold, runs nltest /dclist:<domain> or queries _ldap._tcp.dc._msdcs.<domain> to enumerate every DC. For each DC the attacker pulls the operating system banner via SMB negotiation, RPC (rpcclient -U "" -N srvinfo), or LDAP search of operatingSystem on the computer object. Tools such as crackmapexec smb <dc> and netexec smb <dc> print the OS string in the banner line without authentication. Step 2: Vulnerability mapping. The attacker matches the banner to known unpatched issues. A Windows Server 2008 R2 DC will be tested for MS17-010 (EternalBlue) with crackmapexec smb <dc> -M ms17-010. A 2012 R2 DC may still be vulnerable to ZeroLogon if the August 2020 cumulative is missing; the attacker runs zerologon_tester.py or Impacket secretsdump.py with the netlogon vector. Step 3: Exploitation. For ZeroLogon: set the DC machine account password to empty using the Netlogon AuthenticateEx primitive, then dump the NTDS.dit via secretsdump.py -no-pass -just-dc <domain>/DC$@<dc>. For EternalBlue on 2008 R2 / 2012 with SMBv1 enabled: deliver shellcode and obtain SYSTEM on the DC. For PrintNightmare on any DC that has the Print Spooler service running and is missing the July 2021 OOB patch: exploit CVE-2021-34527 with PrintNightmare PoCs to load a DLL as SYSTEM. Step 4: Forest compromise. With SYSTEM on a DC the attacker pulls the krbtgt hash, forges a golden ticket, and persists across password resets. They extract the DPAPI domain backup key for offline decryption of LAPS and user secrets. They dump the AD CS CA private key if the CA role is colocated with the DC (a common misconfiguration on small environments). They can also restore the krbtgt password from a backup to undo defensive rotations. Step 5: Lateral movement and persistence. The golden ticket grants access to every domain-joined host. The attacker installs an SSP, a malicious DSRM password, or a DSReplicaSync hook to maintain access even after the legacy DC is finally retired.
Cómo lo evalúa Guerrilla
Guerrilla performs an LDAP search rooted at the domain naming context with filter (&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192)) which matches all SERVER_TRUST_ACCOUNT entries (every DC). For each result it reads operatingSystem, operatingSystemVersion, operatingSystemServicePack, and dNSHostName. operatingSystemVersion (which holds strings like "6.3 (9600)" for 2012 R2 or "10.0 (17763)" for 2019) is parsed into major.minor and build. The build is compared against the minimum supported build table (14393 for 2016, 17763 for 2019, 20348 for 2022, 26100 for 2025). The check raises a finding when the major version is below 10, or when the major version is 10 and the build is below 14393. Each DC carries a sub-classification field (eol, eol-esu-only, supported, current) that drives the severity weighting. The check also pulls msDS-Behavior-Version on the CN=Partitions object to report the domain and forest functional levels alongside the OS list; an FFL below 2016 is reported as a hardening dependency because Credential Guard remote attestation and Authentication Policy Silos require it. Finally, the check joins the result set against ADDOM-001 (last replication time) and ADSTALE-001 to flag DCs that are both obsolete and inactive, since those are commonly forgotten and most easily exploited.
Valor recomendado
All domain controllers running Windows Server 2019 or later with current patches
Remediación
Plan migration of DCs running obsolete OS versions. Build new DCs on Windows Server 2022, transfer FSMO roles if needed, replicate, then demote and decommission old DCs. Prioritize this remediation as legacy DCs are actively targeted
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SI-2, CM-6, SA-22
- CIS Benchmark
- 18.3.1
- ANSSI
- R8
- CIS AD Benchmark
- 1.2.2
- MITRE ATT&CK
- T1210, T1078.002