ADPRIV-023: Evaluación de exposición de la cuenta krbtgt
- Plataforma
- Active Directory
- Categoría
- AD Privileged Account Security
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
La configuración de la cuenta krbtgt debe evaluarse en busca de indicadores de exposición, incluidos los tipos de cifrado admitidos, la configuración de delegación y los SPN. Cualquier configuración incorrecta aumenta el riesgo de Golden Ticket y otros ataques basados en Kerberos
Por qué importa
The krbtgt hash is the single most valuable secret in an Active Directory forest. With it, an attacker generates a Golden Ticket: a self-signed TGT with arbitrary group membership (typically Domain Admins, Enterprise Admins, Schema Admins, plus SID History for cross-domain reach), an arbitrary lifetime up to ten years, and arbitrary user identity including non-existent accounts. The forged TGT is mathematically valid because it carries the correct PAC signatures generated with the genuine krbtgt key. Domain controllers will accept it for the lifetime of the key, which means until the krbtgt password is reset twice. If msDS-SupportedEncryptionTypes still permits RC4, any historic extraction of the krbtgt hash (from an old DC backup, an unrotated DSRM snapshot, an NTDS.dit copy, an exposed VM disk, or a prior breach) remains weaponizable forever, because RC4 keys are derived directly from the NT hash and do not change unless the password changes. Delegation on krbtgt is anomalous and indicates either a misconfiguration that hands TGT issuance authority to other principals or a deliberate persistence implant. Extra SPNs on krbtgt expose the account to Kerberoasting (TGS-REQ for any principal with an SPN), and although the auto-generated krbtgt password is 128 characters of random data, the presence of an unexpected SPN is itself a strong tampering signal. A single missed reset cycle after a confirmed DC compromise leaves a usable golden-ticket path open indefinitely; this is the canonical failure mode behind nearly every "we thought we evicted them" incident response postmortem.
Ruta de ataque
Step 1: Domain controller compromise. The attacker reaches SYSTEM on any domain controller via an unpatched CVE (PrintNightmare, Zerologon, NoPac, ProxyShell pivoting to a DC), a stolen Domain Admin credential, a backup file with NTDS.dit, or an SCCM / Veeam relay path. The bar for this step is lower than commonly assumed because NTDS.dit copies live on backup tapes, in cloud snapshots, and in DR runbooks across many environments. Step 2: Hash extraction. The attacker pulls the krbtgt NT hash via DCSync (mimikatz lsadump::dcsync /user:krbtgt, Impacket secretsdump.py -just-dc-user krbtgt CONTOSO/admin@dc01), via direct NTDS.dit parse (ntdsutil, secretsdump.py -ntds NTDS.dit -system SYSTEM LOCAL), or via a Volume Shadow Copy snapshot of the SYSTEM hive plus ntds.dit. The attack maps to MITRE T1003.006 (OS Credential Dumping: DCSync). Step 3: Forgery. The attacker creates a Golden Ticket: mimikatz kerberos::golden /user:Administrator /domain:contoso.local /sid:S-1-5-21-... /krbtgt:<NTHash> /id:500 /groups:512,513,518,519,520 /ptt, or Impacket ticketer.py -nthash <hash> -domain-sid <sid> -domain contoso.local Administrator. The ticket is injected into the current logon session and presented to any DC as a normal TGT. The KDC does not contact any other system to validate it because the PAC signatures verify with the genuine krbtgt key the KDC itself holds. Step 4: Persistence and lateral movement. The attacker uses the forged TGT to perform any action allowed by the embedded group membership: DCSync of every account hash, creation of new Domain Admins, modification of Group Policy, AdminSDHolder ACL implants, DSRM admin sync, certificate template manipulation, and direct RDP / WinRM / SMB to any system. Because the TGT is signed by krbtgt, it bypasses MFA, account lockout, password expiry, and the entire interactive logon pipeline. Step 5: Long-tail. The forged ticket lifetime is attacker-chosen. The default mimikatz lifetime is ten years. Even after the responder rotates Domain Admin passwords, reimages DCs, and rebuilds workstations, the golden ticket remains valid until krbtgt is reset twice. Many organizations reset krbtgt once and consider it resolved, leaving the history slot open and the prior hash usable for the next replication cycle. Step 6: Adjacent abuse. If msDS-SupportedEncryptionTypes on krbtgt permits RC4, even hashes extracted years earlier remain valid. If delegation flags are set on krbtgt (rare but observed in tampered environments), the attacker can configure constrained or resource-based delegation paths that issue TGTs to arbitrary services without ever needing the hash again. Extra SPNs on krbtgt are abused as Kerberoasting targets and as PAC injection markers.
Cómo lo evalúa Guerrilla
Guerrilla executes an LDAP search against the default naming context with filter (&(objectClass=user)(|(sAMAccountName=krbtgt)(sAMAccountName=krbtgt_*))) and the attribute set [sAMAccountName, distinguishedName, objectSid, userAccountControl, msDS-SupportedEncryptionTypes, msDS-KeyVersionNumber, servicePrincipalName, pwdLastSet, lastLogonTimestamp, memberOf, msDS-AllowedToDelegateTo, msDS-AllowedToActOnBehalfOfOtherIdentity, nTSecurityDescriptor, whenChanged, description]. msDS-SupportedEncryptionTypes is decoded against the SupportedEncryptionTypes bit table (0x1 DES_CBC_CRC, 0x2 DES_CBC_MD5, 0x4 RC4_HMAC_MD5, 0x8 AES128_CTS_HMAC_SHA1_96, 0x10 AES256_CTS_HMAC_SHA1_96, 0x20 FAST, 0x40 CompoundIdentity, 0x80 ClaimsSupported, 0x200 ResourceSIDCompression) and any value that omits both AES bits or that includes either DES bit or the RC4 bit is flagged. userAccountControl is decoded bit-wise and the TRUSTED_FOR_DELEGATION (0x80000) and TRUSTED_TO_AUTH_FOR_DELEGATION (0x1000000) bits are tested. servicePrincipalName is diff-checked against the expected baseline (kadmin/changepw on the primary krbtgt; per-RODC kadmin/changepw and the RODC TGT SPN on each krbtgt_<number>); any addition is surfaced. pwdLastSet is converted from Windows FileTime to days, with thresholds at 180 and 365 days, and msDS-KeyVersionNumber is captured to correlate against suspected DCSync events. The check also reads the nTSecurityDescriptor to confirm that only Domain Controllers and the built-in privileged groups hold any write or replication-extended rights on the object, which detects ACL implants. For runtime detection Guerrilla emits paired recommendations to alert on Event ID 4769 where Service Name = krbtgt and Ticket Encryption Type = 0x17 (RC4 golden ticket marker), Event ID 4624 logons that reference a TGT older than the configured Maximum Lifetime for User Ticket (default 10 hours), and Event ID 4662 with Properties containing the DS-Replication-Get-Changes-All GUID (1131f6ad-9c07-11d1-f79f-00c04fc2dcd2) sourced from any non-DC principal.
Valor recomendado
Cuenta krbtgt configurada únicamente con cifrado AES256, sin delegación y sin SPN adicionales más allá del kadmin/changepw predeterminado
Remediación
Revise las propiedades de la cuenta krbtgt, incluidos msDS-SupportedEncryptionTypes, la configuración de delegación y los SPN. Asegúrese de que AES256 sea el tipo de cifrado principal. Verifique que no haya indicadores de delegación establecidos. Compruebe la existencia de SPN inesperados que pudieran indicar compromiso o configuración incorrecta
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SC-12, SC-13
- ANSSI
- R39
- CIS AD Benchmark
- 4.8.2
- MITRE ATT&CK
- T1558.001, T1550.003