ADDOM-005: SO obsoleto en controladores de dominio
- Plataforma
- Active Directory
- Categoría
- AD Domain & Forest Configuration
- Severidad
- Critical
- Pilar de Zero Trust
- Governance (peso 0)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Los controladores de dominio que ejecutan sistemas operativos al final de su vida útil (Windows Server 2012 R2 o anterior) no reciben actualizaciones de seguridad y son vulnerables a exploits conocidos. Estos representan un riesgo crítico de infraestructura, ya que comprometer un DC otorga el control total del dominio
Por qué importa
Domain controllers are Tier 0 by definition. They host the Kerberos KDC, the NTDS.dit database that contains every password hash in the domain, the krbtgt account used to sign all TGTs, and the replication subsystem that propagates LAPS passwords, GMSA secrets, and trust keys. A single remote code execution primitive on any DC yields the krbtgt hash (golden ticket), the DPAPI backup key, the AD CS private key when colocated, and the ability to write any object in the directory. End-of-life Windows Server releases accumulate an unbounded backlog of unpatched vulnerabilities: ZeroLogon (CVE-2020-1472) was patched in August 2020 but Windows Server 2008 and 2008 R2 reached end of extended support in January 2020 and received only ESU patches, which most environments do not subscribe to; PrintNightmare on the spooler service ships enabled on legacy DCs by default; SMBv1 remained on by default through Windows Server 2012 R2 and is the vehicle for EternalBlue. Additionally, modern hardening features (LSA Protection on by default, Credential Guard, hardware-enforced stack protection, mandatory SMB signing, Strong Certificate Binding Enforcement, the Local KDC, and the post-November-2022 Kerberos PAC signature) are unavailable or partially implemented on pre-2016 builds. Auditors who follow CIS, PCI DSS 4.0, HIPAA, and the DoD STIG explicitly fail any in-scope server running an unsupported OS; for a domain controller the finding is non-negotiable.
Ruta de ataque
Step 1: Discovery. The attacker, holding any authenticated foothold, runs nltest /dclist:<domain> or queries _ldap._tcp.dc._msdcs.<domain> to enumerate every DC. For each DC the attacker pulls the operating system banner via SMB negotiation, RPC (rpcclient -U "" -N srvinfo), or LDAP search of operatingSystem on the computer object. Tools such as crackmapexec smb <dc> and netexec smb <dc> print the OS string in the banner line without authentication. Step 2: Vulnerability mapping. The attacker matches the banner to known unpatched issues. A Windows Server 2008 R2 DC will be tested for MS17-010 (EternalBlue) with crackmapexec smb <dc> -M ms17-010. A 2012 R2 DC may still be vulnerable to ZeroLogon if the August 2020 cumulative is missing; the attacker runs zerologon_tester.py or Impacket secretsdump.py with the netlogon vector. Step 3: Exploitation. For ZeroLogon: set the DC machine account password to empty using the Netlogon AuthenticateEx primitive, then dump the NTDS.dit via secretsdump.py -no-pass -just-dc <domain>/DC$@<dc>. For EternalBlue on 2008 R2 / 2012 with SMBv1 enabled: deliver shellcode and obtain SYSTEM on the DC. For PrintNightmare on any DC that has the Print Spooler service running and is missing the July 2021 OOB patch: exploit CVE-2021-34527 with PrintNightmare PoCs to load a DLL as SYSTEM. Step 4: Forest compromise. With SYSTEM on a DC the attacker pulls the krbtgt hash, forges a golden ticket, and persists across password resets. They extract the DPAPI domain backup key for offline decryption of LAPS and user secrets. They dump the AD CS CA private key if the CA role is colocated with the DC (a common misconfiguration on small environments). They can also restore the krbtgt password from a backup to undo defensive rotations. Step 5: Lateral movement and persistence. The golden ticket grants access to every domain-joined host. The attacker installs an SSP, a malicious DSRM password, or a DSReplicaSync hook to maintain access even after the legacy DC is finally retired.
Cómo lo evalúa Guerrilla
Guerrilla performs an LDAP search rooted at the domain naming context with filter (&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192)) which matches all SERVER_TRUST_ACCOUNT entries (every DC). For each result it reads operatingSystem, operatingSystemVersion, operatingSystemServicePack, and dNSHostName. operatingSystemVersion (which holds strings like "6.3 (9600)" for 2012 R2 or "10.0 (17763)" for 2019) is parsed into major.minor and build. The build is compared against the minimum supported build table (14393 for 2016, 17763 for 2019, 20348 for 2022, 26100 for 2025). The check raises a finding when the major version is below 10, or when the major version is 10 and the build is below 14393. Each DC carries a sub-classification field (eol, eol-esu-only, supported, current) that drives the severity weighting. The check also pulls msDS-Behavior-Version on the CN=Partitions object to report the domain and forest functional levels alongside the OS list; an FFL below 2016 is reported as a hardening dependency because Credential Guard remote attestation and Authentication Policy Silos require it. Finally, the check joins the result set against ADDOM-001 (last replication time) and ADSTALE-001 to flag DCs that are both obsolete and inactive, since those are commonly forgotten and most easily exploited.
Valor recomendado
Todos los controladores de dominio ejecutando Windows Server 2019 o posterior con los parches actuales
Remediación
Planifique la migración de los DC que ejecutan versiones de SO obsoletas. Construya nuevos DC en Windows Server 2022, transfiera los roles FSMO si es necesario, replique y luego degrade y retire los DC antiguos. Priorice esta corrección, ya que los DC heredados son objeto de ataque activo
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SI-2, CM-6, SA-22
- CIS Benchmark
- 18.3.1
- ANSSI
- R8
- CIS AD Benchmark
- 1.2.2
- MITRE ATT&CK
- T1210, T1078.002