ADPRIV-028: Usuarios con derechos de DCSync
- Plataforma
- Active Directory
- Categoría
- AD Privileged Account Security
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
DCSync permite la replicación de datos de contraseñas desde Active Directory, incluidos todos los hashes de usuario. Las cuentas con los derechos 'Replicating Directory Changes All' y 'Replicating Directory Changes' pueden extraer todos los hashes de contraseña del dominio sin tocar un controlador de dominio. Solo las cuentas de equipo de los controladores de dominio y la cuenta de administrador predeterminada deben tener estos derechos
Por qué importa
DCSync is the canonical credential-extraction primitive in Active Directory. A principal with DS-Replication-Get-Changes plus DS-Replication-Get-Changes-All can call DRSGetNCChanges against any writable domain controller and receive the full secret attributes (unicodePwd, ntPwdHistory, supplementalCredentials, lmPwdHistory) for every account in the domain. This includes the krbtgt account, which is the seed for Golden Tickets. Once the krbtgt hash is exfiltrated the attacker can forge TGTs for any user, including non-existent SIDs, and that capability persists until krbtgt is rotated twice with a wait period in between. Because DCSync uses the standard replication RPC, it does not generate logon events on the DC, does not require code execution on the DC, and can be performed from any host that can reach TCP 135 / dynamic RPC on a DC. The blast radius of a single unauthorized DCSync grant is therefore equivalent to full domain compromise, with persistence that survives password resets of every account except krbtgt itself.
Ruta de ataque
1. Reconnaissance: the attacker enumerates the domain head ACL with BloodHound (SharpHound -CollectionMethod ACL,DCOnly) or PowerView (Get-DomainObjectAcl -SearchBase (Get-ADDomain).DistinguishedName -ResolveGUIDs | Where-Object { $_.ObjectAceType -match "Replication-Get-Changes" }). BloodHound renders the result as GetChanges and GetChangesAll edges. 2. Edge identification: BloodHound highlights a path from a compromised principal (a service account, a help-desk group, or a misconfigured application identity) to the domain object via the two replication edges. 3. Capability acquisition: if the attacker controls a principal that already holds both rights, no further work is needed. If they hold WriteDacl on the domain object (see ADACL-001) they add the two ACEs to a controlled account, typically with the extended-right GUIDs and an Allow Allow pair. 4. Exploitation: the attacker runs DCSync. Common tooling includes mimikatz (lsadump::dcsync /domain:corp.contoso.com /user:krbtgt), impacket-secretsdump (secretsdump.py -just-dc CORP/user@dc01), SharpKatz, or DSInternals (Get-ADReplAccount). The DC responds with the requested secrets over the standard replication RPC. 5. Forgery: with the krbtgt NT hash the attacker forges a Golden Ticket (mimikatz kerberos::golden, Rubeus golden) granting arbitrary group membership including Enterprise Admins, and presents it for service tickets to any resource in the forest. 6. Persistence: the attacker may also dump every user hash for offline cracking, every machine account hash to enable Silver Tickets, and every gMSA blob (msDS-ManagedPassword) to compromise managed service identities. The replication ACE itself is rarely removed by the attacker because the operation is logged as legitimate replication.
Cómo lo evalúa Guerrilla
Guerrilla binds to a writable DC, retrieves the domain object with Get-ADObject -Identity (Get-ADDomain).DistinguishedName -Properties nTSecurityDescriptor, and iterates the DACL. Each ACE is filtered to AccessControlType = Allow, ActiveDirectoryRights includes ExtendedRight, and ObjectType matches one of the three replication GUIDs. Trustees are translated from SID via System.Security.Principal.SecurityIdentifier.Translate so that orphaned SIDs and cross-domain principals are reported as raw SIDs rather than silently dropped. For each non-baseline trustee that is a group, the check expands membership recursively with Get-ADGroupMember -Recursive so the effective DCSync population is visible. Inherited ACEs are reported separately from explicit ACEs because inherited ACEs usually indicate a problem higher in the tree that needs to be fixed at its source. The LDAP query path avoids dependency on the AD: PSDrive so the check works against any reachable DC even when RSAT is not loaded locally.
Valor recomendado
Solo las cuentas de equipo de los controladores de dominio y la cuenta de administrador predeterminada tienen derechos de replicación. Ningún usuario o grupo adicional con permisos de DCSync concedidos
Remediación
Audite la ACL de la raíz del dominio en busca de 'Replicating Directory Changes' y 'Replicating Directory Changes All' mediante (Get-ACL 'AD:\DC=domain,DC=com').Access | Where-Object {$_.ObjectType -match '1131f6a[a-d]'}. Elimine de inmediato cualquier entrada no autorizada. Investigue si las cuentas no autorizadas ya han realizado DCSync
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6(1), AC-3
- CIS Benchmark
- 18.3.1
- ANSSI
- R41
- CIS AD Benchmark
- 4.11.1
- MITRE ATT&CK
- T1003.006